dependabot-vcpkg 0.391.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f824b87bbbdcbed88c4168756096993636ff08219dacffd3260a4e5bae932156
-  data.tar.gz: 7edab2f942a03e18d4601d7a5a6750b82b4ef934a13de4d59e1bcc3448be1b63
+  metadata.gz: d9adda37faba7a4ba0d78122d2b340d3abe3b66033c4629341f6ad6027aa23fb
+  data.tar.gz: c17e3c6abdb537d697c86d20f9defc2a78384cabcb334f77c7124c09d8f64cb8
 SHA512:
-  metadata.gz: 5ecb1115bc51dc7978a6089ac440e9cec32345d4fb2fd6a5b779df2bbd20c2f5e3a8f242076bcc7dcfad59bcecded26efd77b54cda81f52f4a0765ac64503f42
-  data.tar.gz: 100d4e1033cd53627cde2626964568b4e3961e29e854b3db4d85e4daf7269f6906d441b370aef860c966913030f264b12786e0c0e2f4151e6883907eb693119c
+  metadata.gz: 3a6431124969298347d410137b294da0fe3cfa94061fd6f1aeb625f79ebae6a89ab39d4b2c92ee9d0bcb992c987bee812007b824249d44a668f4e75aa66a0f6a
+  data.tar.gz: 6dae72dd089b071f0a4494c914d82ee47bb3e0656176846dd9bdb5057f7a81fe936e1fc9c4d55f7a1cfb1634f6b6688a42e05342743804d4f1f899047a48a46e

data/lib/dependabot/vcpkg/file_updater.rb

@@ -63,7 +63,7 @@ module Dependabot
         parsed_content = JSON.parse(content)
 
         dependencies
-          .filter_map { |dep| [dep, dep.requirements.find { |r| r[:file] == file.name }] }
+          .filter_map { |dep| [dep, dep.requirements.find { |requirement| requirement.file == file.name }] }
           .select { |_, requirement| requirement }
           .each { |dependency, _| update_dependency_in_content(parsed_content, dependency, file.name) }
 
@@ -80,7 +80,7 @@ module Dependabot
         parsed_content = JSON.parse(content)
 
         dependencies
-          .filter_map { |dep| [dep, dep.requirements.find { |r| r[:file] == file.name }] }
+          .filter_map { |dep| [dep, dep.requirements.find { |requirement| requirement.file == file.name }] }
           .select { |_, requirement| requirement }
           .each { |dependency, _| update_registry_dependency_in_content(parsed_content, dependency, file.name) }
 
@@ -120,11 +120,9 @@ module Dependabot
         params(dependency: Dependabot::Dependency, filename: String).returns(T.nilable(Symbol))
       end
       def remediation_for(dependency, filename)
-        requirement = dependency.requirements.find { |r| r[:file] == filename }
-        metadata = requirement&.dig(:metadata)
-        return nil unless metadata.is_a?(Hash)
-
-        metadata[:security_remediation]
+        dependency.requirements
+                  .find { |requirement| requirement.file == filename }
+                  &.metadata_symbol("security_remediation")
       end
 
       sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency).void }
@@ -185,7 +183,7 @@ module Dependabot
       def build_security_baseline
         commit_sha = dependencies
                      .flat_map(&:requirements)
-                     .filter_map { |requirement| requirement.dig(:metadata, :baseline_commit_sha) }
+                     .filter_map { |requirement| requirement.metadata_string("baseline_commit_sha") }
                      .first
         return nil unless commit_sha.is_a?(String)
 
@@ -245,19 +243,17 @@ module Dependabot
           .returns(T.nilable(T::Hash[String, String]))
       end
       def build_default_registry(dependency, filename)
-        requirement = dependency.requirements.find { |r| r[:file] == filename }
+        requirement = dependency.requirements.find { |candidate| candidate.file == filename }
         return unless requirement
 
-        case requirement[:source]
-        in { ref: String => baseline }
-          {
-            "kind" => "git",
-            "repository" => VCPKG_DEFAULT_REGISTRY_REPOSITORY,
-            "baseline" => baseline
-          }
-        else
-          nil
-        end
+        baseline = requirement.source_string("ref")
+        return unless baseline
+
+        {
+          "kind" => "git",
+          "repository" => VCPKG_DEFAULT_REGISTRY_REPOSITORY,
+          "baseline" => baseline
+        }
       end
 
       sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency, filename: String).void }
@@ -282,16 +278,12 @@ module Dependabot
       end
       def update_baseline_field(target, dependency, filename, field_name)
         # Find the requirement for this specific file
-        requirement = dependency.requirements.find { |r| r[:file] == filename }
+        requirement = dependency.requirements.find { |candidate| candidate.file == filename }
         return unless requirement
 
         # Extract and validate the new baseline
-        case requirement[:source]
-        in { ref: String => new_baseline }
-          target[field_name] = new_baseline
-        else
-          # Skip if source doesn't have the expected structure
-        end
+        new_baseline = requirement.source_string("ref")
+        target[field_name] = new_baseline if new_baseline
       end
 
       sig do
@@ -307,7 +299,7 @@ module Dependabot
           registries.find { |r| r.is_a?(Hash) && r["kind"] == "builtin" }
         else
           # For git registries, find by repository URL
-          repository_url = dependency.requirements.first&.dig(:source, :url)
+          repository_url = dependency.requirements.first&.source_string("url")
           registries.find { |r| r.is_a?(Hash) && r["repository"] == repository_url }
         end
       end

data/lib/dependabot/vcpkg/metadata_finder.rb

@@ -1,8 +1,9 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
+require "dependabot/vcpkg"
 
 module Dependabot
   module Vcpkg
@@ -29,14 +30,8 @@ module Dependabot
       sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
         # Check if this is a Git dependency with a specific source
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
-
-        url =
-          if info.nil?
-            VCPKG_DEFAULT_BASELINE_URL
-          else
-            info[:url] || info.fetch("url", VCPKG_DEFAULT_BASELINE_URL)
-          end
+        requirement = dependency.requirements.find(&:source_hash)
+        url = requirement&.source_string("url") || VCPKG_DEFAULT_BASELINE_URL
         Source.from_url(url)
       end
 

data/lib/dependabot/vcpkg/update_checker/security_fix_resolver.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -253,8 +253,8 @@ module Dependabot
         def declared_constraint_version
           return @declared_constraint_version if @declared_constraint_version
 
-          constraint = dependency.requirements.filter_map { |req| req[:requirement] }.first
-          return nil unless constraint.is_a?(String)
+          constraint = dependency.requirements.filter_map(&:requirement_string).first
+          return nil unless constraint
 
           text = constraint.delete_prefix(">=").strip
           return nil unless Dependabot::Vcpkg::Version.correct?(text)

data/lib/dependabot/vcpkg/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -63,27 +63,33 @@ module Dependabot
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
         fix = security_fix
-        return wrap_requirements(security_updated_requirements(fix)) if fix
+        return security_updated_requirements(fix) if fix
         return dependency.requirements unless latest_version
 
-        wrap_requirements(dependency.requirements.map { |requirement| updated_requirement(requirement) })
+        dependency.requirements.map { |requirement| updated_requirement(requirement) }
       end
 
       private
 
       sig do
-        params(requirement: T::Hash[Symbol, T.anything]).returns(T::Hash[Symbol, T.anything])
+        params(requirement: Dependabot::DependencyRequirement)
+          .returns(Dependabot::DependencyRequirement)
       end
       def updated_requirement(requirement)
-        source = T.cast(requirement[:source], T.nilable(T::Hash[Symbol, T.anything]))
+        source = requirement.source_hash
 
         if source && registry_dependency?
           # For git dependencies (baselines), update the git ref with the commit SHA
-          latest_commit_sha = latest_version_finder.latest_release_info&.details&.dig("commit_sha")
-          requirement.merge(source: source.merge(ref: latest_commit_sha))
-        elsif source.nil? && requirement[:requirement]
+          latest_commit_sha = T.cast(
+            latest_version_finder.latest_release_info&.details&.dig("commit_sha"),
+            T.nilable(String)
+          )
+          requirement.source_string("ref")
+          updated_source = hash_with_value(source, "ref", latest_commit_sha)
+          Dependabot::DependencyRequirement.create(requirement.merge(source: updated_source))
+        elsif source.nil? && requirement.requirement
           # For port dependencies (no source but has requirement), update the version constraint
-          requirement.merge(requirement: ">=#{latest_version}")
+          Dependabot::DependencyRequirement.create(requirement.merge(requirement: ">=#{latest_version}"))
         else
           # Keep the original requirement unchanged for other cases
           requirement
@@ -93,24 +99,49 @@ module Dependabot
       # Describes the manifest edit that fixes the advisory, so the file updater can apply it
       # without repeating the resolution.
       sig do
-        params(fix: SecurityFixResolver::Fix).returns(T::Array[T::Hash[Symbol, T.anything]])
+        params(fix: SecurityFixResolver::Fix)
+          .returns(T::Array[Dependabot::DependencyRequirement])
       end
       def security_updated_requirements(fix)
         dependency.requirements.map do |requirement|
-          metadata = T.cast(requirement[:metadata], T.nilable(T::Hash[Symbol, T.untyped])) || {}
-          updated = requirement.merge(
-            metadata: metadata.merge(
-              security_remediation: fix.kind,
-              security_version: fix.version.to_s,
-              baseline_commit_sha: fix.baseline_commit_sha,
-              baseline_tag: fix.baseline_tag
-            )
+          metadata = T.let(
+            requirement.metadata || {},
+            Dependabot::DependencyRequirement::ObjectHash
           )
+          metadata = hash_with_value(metadata, "security_remediation", fix.kind)
+          metadata = hash_with_value(metadata, "security_version", fix.version.to_s)
+          metadata = hash_with_value(metadata, "baseline_commit_sha", fix.baseline_commit_sha)
+          metadata = hash_with_value(metadata, "baseline_tag", fix.baseline_tag)
+
+          updated = Dependabot::DependencyRequirement.create(requirement.merge(metadata: metadata))
+          next updated unless fix.kind == :version_constraint
 
-          fix.kind == :version_constraint ? updated.merge(requirement: ">=#{fix.version}") : updated
+          Dependabot::DependencyRequirement.create(updated.merge(requirement: ">=#{fix.version}"))
         end
       end
 
+      sig do
+        params(
+          details: Dependabot::DependencyRequirement::ObjectHash,
+          key: String,
+          value: Object
+        ).returns(Dependabot::DependencyRequirement::ObjectHash)
+      end
+      def hash_with_value(details, key, value)
+        updated = details.dup
+        actual_key = if details.key?(key.to_sym)
+                       key.to_sym
+                     elsif details.key?(key)
+                       key
+                     elsif details.empty? || details.keys.any?(Symbol)
+                       key.to_sym
+                     else
+                       key
+                     end
+        updated[actual_key] = value
+        updated
+      end
+
       sig { returns(T.nilable(SecurityFixResolver::Fix)) }
       def security_fix
         return @security_fix if @searched_for_security_fix
@@ -134,13 +165,13 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def registry_dependency?
-        dependency.source_details(allowed_types: ["git"]) in { type: "git" }
+        dependency.source_string("type", allowed_types: ["git"]) == "git"
       end
 
       sig { returns(T::Boolean) }
       def port_dependency?
         # A port dependency has no git source but has a requirement constraint
-        !registry_dependency? && dependency.requirements.any? { |req| req[:requirement] }
+        !registry_dependency? && dependency.requirements.any?(&:requirement)
       end
 
       # A port whose version comes solely from the registry baseline.
@@ -149,7 +180,7 @@ module Dependabot
         return false if registry_dependency?
         return false unless dependency.numeric_version
 
-        dependency.requirements.none? { |requirement| requirement[:requirement] }
+        dependency.requirements.none?(&:requirement)
       end
 
       # `latest_version` may be a version vcpkg cannot order against the current one, which is

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-vcpkg
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.392.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.392.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.392.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -259,7 +259,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
 rdoc_options: []
 require_paths:
 - lib