dependabot-bun 0.296.0 → 0.296.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/helpers/.eslintrc +11 -0
- data/helpers/README.md +29 -0
- data/helpers/build +26 -0
- data/helpers/jest.config.js +5 -0
- data/helpers/lib/npm/conflicting-dependency-parser.js +78 -0
- data/helpers/lib/npm/index.js +9 -0
- data/helpers/lib/npm/vulnerability-auditor.js +291 -0
- data/helpers/lib/npm6/helpers.js +25 -0
- data/helpers/lib/npm6/index.js +9 -0
- data/helpers/lib/npm6/peer-dependency-checker.js +111 -0
- data/helpers/lib/npm6/remove-dependencies-from-lockfile.js +22 -0
- data/helpers/lib/npm6/subdependency-updater.js +78 -0
- data/helpers/lib/npm6/updater.js +199 -0
- data/helpers/lib/pnpm/index.js +5 -0
- data/helpers/lib/pnpm/lockfile-parser.js +82 -0
- data/helpers/lib/yarn/conflicting-dependency-parser.js +176 -0
- data/helpers/lib/yarn/fix-duplicates.js +80 -0
- data/helpers/lib/yarn/helpers.js +54 -0
- data/helpers/lib/yarn/index.js +14 -0
- data/helpers/lib/yarn/lockfile-parser.js +21 -0
- data/helpers/lib/yarn/peer-dependency-checker.js +132 -0
- data/helpers/lib/yarn/replace-lockfile-declaration.js +57 -0
- data/helpers/lib/yarn/subdependency-updater.js +83 -0
- data/helpers/lib/yarn/updater.js +209 -0
- data/helpers/package-lock.json +28519 -0
- data/helpers/package.json +29 -0
- data/helpers/patches/npm++pacote+9.5.12.patch +14 -0
- data/helpers/run.js +30 -0
- data/helpers/test/npm6/conflicting-dependency-parser.test.js +66 -0
- data/helpers/test/npm6/fixtures/conflicting-dependency-parser/deeply-nested/package-lock.json +591 -0
- data/helpers/test/npm6/fixtures/conflicting-dependency-parser/deeply-nested/package.json +14 -0
- data/helpers/test/npm6/fixtures/conflicting-dependency-parser/nested/package-lock.json +188 -0
- data/helpers/test/npm6/fixtures/conflicting-dependency-parser/nested/package.json +14 -0
- data/helpers/test/npm6/fixtures/conflicting-dependency-parser/simple/package-lock.json +27 -0
- data/helpers/test/npm6/fixtures/conflicting-dependency-parser/simple/package.json +14 -0
- data/helpers/test/npm6/fixtures/updater/original/package-lock.json +16 -0
- data/helpers/test/npm6/fixtures/updater/original/package.json +9 -0
- data/helpers/test/npm6/fixtures/updater/updated/package-lock.json +16 -0
- data/helpers/test/npm6/helpers.js +21 -0
- data/helpers/test/npm6/updater.test.js +30 -0
- data/helpers/test/pnpm/fixtures/parser/empty_version/pnpm-lock.yaml +72 -0
- data/helpers/test/pnpm/fixtures/parser/no_lockfile_change/pnpm-lock.yaml +2744 -0
- data/helpers/test/pnpm/fixtures/parser/only_dev_dependencies/pnpm-lock.yaml +16 -0
- data/helpers/test/pnpm/fixtures/parser/peer_disambiguation/pnpm-lock.yaml +855 -0
- data/helpers/test/pnpm/lockfile-parser.test.js +62 -0
- data/helpers/test/yarn/conflicting-dependency-parser.test.js +83 -0
- data/helpers/test/yarn/fixtures/conflicting-dependency-parser/deeply-nested/package.json +14 -0
- data/helpers/test/yarn/fixtures/conflicting-dependency-parser/deeply-nested/yarn.lock +496 -0
- data/helpers/test/yarn/fixtures/conflicting-dependency-parser/dev-dependencies/package.json +14 -0
- data/helpers/test/yarn/fixtures/conflicting-dependency-parser/dev-dependencies/yarn.lock +21 -0
- data/helpers/test/yarn/fixtures/conflicting-dependency-parser/nested/package.json +14 -0
- data/helpers/test/yarn/fixtures/conflicting-dependency-parser/nested/yarn.lock +183 -0
- data/helpers/test/yarn/fixtures/conflicting-dependency-parser/simple/package.json +14 -0
- data/helpers/test/yarn/fixtures/conflicting-dependency-parser/simple/yarn.lock +21 -0
- data/helpers/test/yarn/fixtures/updater/illegal_character/package.json +8 -0
- data/helpers/test/yarn/fixtures/updater/illegal_character/yarn.lock +14 -0
- data/helpers/test/yarn/fixtures/updater/original/package.json +6 -0
- data/helpers/test/yarn/fixtures/updater/original/yarn.lock +11 -0
- data/helpers/test/yarn/fixtures/updater/updated/yarn.lock +12 -0
- data/helpers/test/yarn/fixtures/updater/with-version-comments/package.json +5 -0
- data/helpers/test/yarn/fixtures/updater/with-version-comments/yarn.lock +13 -0
- data/helpers/test/yarn/helpers.js +18 -0
- data/helpers/test/yarn/updater.test.js +117 -0
- data/lib/dependabot/bun/bun_package_manager.rb +47 -0
- data/lib/dependabot/bun/constraint_helper.rb +359 -0
- data/lib/dependabot/bun/dependency_files_filterer.rb +157 -0
- data/lib/dependabot/bun/file_fetcher/path_dependency_builder.rb +184 -0
- data/lib/dependabot/bun/file_fetcher.rb +343 -38
- data/lib/dependabot/bun/file_parser/bun_lock.rb +3 -11
- data/lib/dependabot/bun/file_parser/lockfile_parser.rb +105 -0
- data/lib/dependabot/bun/file_parser.rb +477 -0
- data/lib/dependabot/bun/file_updater/bun_lockfile_updater.rb +144 -0
- data/lib/dependabot/bun/file_updater/npmrc_builder.rb +256 -0
- data/lib/dependabot/bun/file_updater/package_json_preparer.rb +88 -0
- data/lib/dependabot/bun/file_updater/package_json_updater.rb +378 -0
- data/lib/dependabot/bun/file_updater.rb +203 -0
- data/lib/dependabot/bun/helpers.rb +41 -27
- data/lib/dependabot/bun/language.rb +2 -2
- data/lib/dependabot/bun/metadata_finder.rb +214 -0
- data/lib/dependabot/bun/native_helpers.rb +19 -0
- data/lib/dependabot/bun/package_manager.rb +261 -27
- data/lib/dependabot/bun/package_name.rb +118 -0
- data/lib/dependabot/bun/pnpm_package_manager.rb +55 -0
- data/lib/dependabot/bun/registry_helper.rb +188 -0
- data/lib/dependabot/bun/registry_parser.rb +93 -0
- data/lib/dependabot/bun/requirement.rb +134 -2
- data/lib/dependabot/bun/sub_dependency_files_filterer.rb +82 -0
- data/lib/dependabot/bun/update_checker/conflicting_dependency_resolver.rb +59 -0
- data/lib/dependabot/bun/update_checker/dependency_files_builder.rb +79 -0
- data/lib/dependabot/bun/update_checker/latest_version_finder.rb +448 -0
- data/lib/dependabot/bun/update_checker/library_detector.rb +76 -0
- data/lib/dependabot/bun/update_checker/registry_finder.rb +279 -0
- data/lib/dependabot/bun/update_checker/requirements_updater.rb +206 -0
- data/lib/dependabot/bun/update_checker/subdependency_version_resolver.rb +154 -0
- data/lib/dependabot/bun/update_checker/version_resolver.rb +583 -0
- data/lib/dependabot/bun/update_checker/vulnerability_auditor.rb +164 -0
- data/lib/dependabot/bun/update_checker.rb +455 -0
- data/lib/dependabot/bun/version.rb +128 -2
- data/lib/dependabot/bun/version_selector.rb +61 -0
- data/lib/dependabot/bun.rb +338 -26
- metadata +101 -27
- data/lib/dependabot/javascript/file_fetcher_helper.rb +0 -245
- data/lib/dependabot/javascript/requirement.rb +0 -141
- data/lib/dependabot/javascript/version.rb +0 -135
- data/lib/dependabot/javascript.rb +0 -8
@@ -1,135 +0,0 @@
|
|
1
|
-
# typed: strict
|
2
|
-
# frozen_string_literal: true
|
3
|
-
|
4
|
-
require "dependabot/version"
|
5
|
-
require "dependabot/utils"
|
6
|
-
require "sorbet-runtime"
|
7
|
-
|
8
|
-
# JavaScript pre-release versions use 1.0.1-rc1 syntax, which Gem::Version
|
9
|
-
# converts into 1.0.1.pre.rc1. We override the `to_s` method to stop that
|
10
|
-
# alteration.
|
11
|
-
#
|
12
|
-
# See https://semver.org/ for details of node's version syntax.
|
13
|
-
|
14
|
-
module Dependabot
|
15
|
-
module Javascript
|
16
|
-
class Version < Dependabot::Version
|
17
|
-
extend T::Sig
|
18
|
-
|
19
|
-
sig { returns(T.nilable(String)) }
|
20
|
-
attr_reader :build_info
|
21
|
-
|
22
|
-
# These are possible npm versioning tags that can be used in place of a version.
|
23
|
-
# See https://docs.npmjs.com/cli/v10/commands/npm-dist-tag#purpose for more details.
|
24
|
-
VERSION_TAGS = T.let([
|
25
|
-
"alpha", # Alpha version, early testing phase
|
26
|
-
"beta", # Beta version, more stable than alpha
|
27
|
-
"canary", # Canary version, often used for cutting-edge builds
|
28
|
-
"dev", # Development version, ongoing development
|
29
|
-
"experimental", # Experimental version, unstable and new features
|
30
|
-
"latest", # Latest stable version, used by npm to identify the current version of a package
|
31
|
-
"legacy", # Legacy version, older version maintained for compatibility
|
32
|
-
"next", # Next version, used by some projects to identify the upcoming version
|
33
|
-
"nightly", # Nightly build, daily builds often including latest changes
|
34
|
-
"rc", # Release candidate, potential final version
|
35
|
-
"release", # General release version
|
36
|
-
"stable" # Stable version, thoroughly tested and stable
|
37
|
-
].freeze.map(&:freeze), T::Array[String])
|
38
|
-
|
39
|
-
VERSION_PATTERN = T.let(Gem::Version::VERSION_PATTERN + '(\+[0-9a-zA-Z\-.]+)?', String)
|
40
|
-
ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
|
41
|
-
|
42
|
-
sig { override.params(version: VersionParameter).returns(T::Boolean) }
|
43
|
-
def self.correct?(version)
|
44
|
-
version = version.gsub(/^v/, "") if version.is_a?(String)
|
45
|
-
|
46
|
-
return false if version.nil?
|
47
|
-
|
48
|
-
version.to_s.match?(ANCHORED_VERSION_PATTERN)
|
49
|
-
end
|
50
|
-
|
51
|
-
sig { params(version: VersionParameter).returns(VersionParameter) }
|
52
|
-
def self.semver_for(version)
|
53
|
-
# The next two lines are to guard against improperly formatted
|
54
|
-
# versions in a lockfile, such as an empty string or additional
|
55
|
-
# characters. NPM/yarn fixes these when running an update, so we can
|
56
|
-
# safely ignore these versions.
|
57
|
-
return if version == ""
|
58
|
-
return unless correct?(version)
|
59
|
-
|
60
|
-
version
|
61
|
-
end
|
62
|
-
|
63
|
-
sig { override.params(version: VersionParameter).void }
|
64
|
-
def initialize(version)
|
65
|
-
version = clean_version(version)
|
66
|
-
|
67
|
-
@version_string = T.let(version.to_s, String)
|
68
|
-
|
69
|
-
@build_info = T.let(nil, T.nilable(String))
|
70
|
-
|
71
|
-
version, @build_info = version.to_s.split("+") if version.to_s.include?("+")
|
72
|
-
|
73
|
-
super(T.must(version))
|
74
|
-
end
|
75
|
-
|
76
|
-
sig { params(version: VersionParameter).returns(VersionParameter) }
|
77
|
-
def clean_version(version)
|
78
|
-
# Check if version is a string before attempting to match
|
79
|
-
if version.is_a?(String)
|
80
|
-
# Matches @ followed by x.y.z (digits separated by dots)
|
81
|
-
if (match = version.match(/@(\d+\.\d+\.\d+)/))
|
82
|
-
version = match[1] # Just "4.5.3"
|
83
|
-
|
84
|
-
# Extract version in case the output contains Corepack verbose data
|
85
|
-
elsif version.include?("Corepack")
|
86
|
-
version = T.must(T.must(version.tr("\n", " ").match(/(\d+\.\d+\.\d+)/))[-1])
|
87
|
-
end
|
88
|
-
version = version&.gsub(/^v/, "")
|
89
|
-
end
|
90
|
-
|
91
|
-
version
|
92
|
-
end
|
93
|
-
|
94
|
-
sig { override.params(version: VersionParameter).returns(Dependabot::Javascript::Version) }
|
95
|
-
def self.new(version)
|
96
|
-
T.cast(super, Dependabot::Javascript::Version)
|
97
|
-
end
|
98
|
-
|
99
|
-
sig { returns(Integer) }
|
100
|
-
def major
|
101
|
-
@major ||= T.let(segments[0].to_i, T.nilable(Integer))
|
102
|
-
end
|
103
|
-
|
104
|
-
sig { returns(Integer) }
|
105
|
-
def minor
|
106
|
-
@minor ||= T.let(segments[1].to_i, T.nilable(Integer))
|
107
|
-
end
|
108
|
-
|
109
|
-
sig { returns(Integer) }
|
110
|
-
def patch
|
111
|
-
@patch ||= T.let(segments[2].to_i, T.nilable(Integer))
|
112
|
-
end
|
113
|
-
|
114
|
-
sig { params(other: Dependabot::Javascript::Version).returns(T::Boolean) }
|
115
|
-
def backwards_compatible_with?(other)
|
116
|
-
case major
|
117
|
-
when 0
|
118
|
-
self == other
|
119
|
-
else
|
120
|
-
major == other.major && minor >= other.minor
|
121
|
-
end
|
122
|
-
end
|
123
|
-
|
124
|
-
sig { override.returns(String) }
|
125
|
-
def to_s
|
126
|
-
@version_string
|
127
|
-
end
|
128
|
-
|
129
|
-
sig { override.returns(String) }
|
130
|
-
def inspect
|
131
|
-
"#<#{self.class} #{@version_string}>"
|
132
|
-
end
|
133
|
-
end
|
134
|
-
end
|
135
|
-
end
|