dependabot-bun 0.296.0 → 0.296.3

Sign up to get free protection for your applications and to get access to all the features.
Files changed (106) hide show
  1. checksums.yaml +4 -4
  2. data/helpers/.eslintrc +11 -0
  3. data/helpers/README.md +29 -0
  4. data/helpers/build +26 -0
  5. data/helpers/jest.config.js +5 -0
  6. data/helpers/lib/npm/conflicting-dependency-parser.js +78 -0
  7. data/helpers/lib/npm/index.js +9 -0
  8. data/helpers/lib/npm/vulnerability-auditor.js +291 -0
  9. data/helpers/lib/npm6/helpers.js +25 -0
  10. data/helpers/lib/npm6/index.js +9 -0
  11. data/helpers/lib/npm6/peer-dependency-checker.js +111 -0
  12. data/helpers/lib/npm6/remove-dependencies-from-lockfile.js +22 -0
  13. data/helpers/lib/npm6/subdependency-updater.js +78 -0
  14. data/helpers/lib/npm6/updater.js +199 -0
  15. data/helpers/lib/pnpm/index.js +5 -0
  16. data/helpers/lib/pnpm/lockfile-parser.js +82 -0
  17. data/helpers/lib/yarn/conflicting-dependency-parser.js +176 -0
  18. data/helpers/lib/yarn/fix-duplicates.js +80 -0
  19. data/helpers/lib/yarn/helpers.js +54 -0
  20. data/helpers/lib/yarn/index.js +14 -0
  21. data/helpers/lib/yarn/lockfile-parser.js +21 -0
  22. data/helpers/lib/yarn/peer-dependency-checker.js +132 -0
  23. data/helpers/lib/yarn/replace-lockfile-declaration.js +57 -0
  24. data/helpers/lib/yarn/subdependency-updater.js +83 -0
  25. data/helpers/lib/yarn/updater.js +209 -0
  26. data/helpers/package-lock.json +28519 -0
  27. data/helpers/package.json +29 -0
  28. data/helpers/patches/npm++pacote+9.5.12.patch +14 -0
  29. data/helpers/run.js +30 -0
  30. data/helpers/test/npm6/conflicting-dependency-parser.test.js +66 -0
  31. data/helpers/test/npm6/fixtures/conflicting-dependency-parser/deeply-nested/package-lock.json +591 -0
  32. data/helpers/test/npm6/fixtures/conflicting-dependency-parser/deeply-nested/package.json +14 -0
  33. data/helpers/test/npm6/fixtures/conflicting-dependency-parser/nested/package-lock.json +188 -0
  34. data/helpers/test/npm6/fixtures/conflicting-dependency-parser/nested/package.json +14 -0
  35. data/helpers/test/npm6/fixtures/conflicting-dependency-parser/simple/package-lock.json +27 -0
  36. data/helpers/test/npm6/fixtures/conflicting-dependency-parser/simple/package.json +14 -0
  37. data/helpers/test/npm6/fixtures/updater/original/package-lock.json +16 -0
  38. data/helpers/test/npm6/fixtures/updater/original/package.json +9 -0
  39. data/helpers/test/npm6/fixtures/updater/updated/package-lock.json +16 -0
  40. data/helpers/test/npm6/helpers.js +21 -0
  41. data/helpers/test/npm6/updater.test.js +30 -0
  42. data/helpers/test/pnpm/fixtures/parser/empty_version/pnpm-lock.yaml +72 -0
  43. data/helpers/test/pnpm/fixtures/parser/no_lockfile_change/pnpm-lock.yaml +2744 -0
  44. data/helpers/test/pnpm/fixtures/parser/only_dev_dependencies/pnpm-lock.yaml +16 -0
  45. data/helpers/test/pnpm/fixtures/parser/peer_disambiguation/pnpm-lock.yaml +855 -0
  46. data/helpers/test/pnpm/lockfile-parser.test.js +62 -0
  47. data/helpers/test/yarn/conflicting-dependency-parser.test.js +83 -0
  48. data/helpers/test/yarn/fixtures/conflicting-dependency-parser/deeply-nested/package.json +14 -0
  49. data/helpers/test/yarn/fixtures/conflicting-dependency-parser/deeply-nested/yarn.lock +496 -0
  50. data/helpers/test/yarn/fixtures/conflicting-dependency-parser/dev-dependencies/package.json +14 -0
  51. data/helpers/test/yarn/fixtures/conflicting-dependency-parser/dev-dependencies/yarn.lock +21 -0
  52. data/helpers/test/yarn/fixtures/conflicting-dependency-parser/nested/package.json +14 -0
  53. data/helpers/test/yarn/fixtures/conflicting-dependency-parser/nested/yarn.lock +183 -0
  54. data/helpers/test/yarn/fixtures/conflicting-dependency-parser/simple/package.json +14 -0
  55. data/helpers/test/yarn/fixtures/conflicting-dependency-parser/simple/yarn.lock +21 -0
  56. data/helpers/test/yarn/fixtures/updater/illegal_character/package.json +8 -0
  57. data/helpers/test/yarn/fixtures/updater/illegal_character/yarn.lock +14 -0
  58. data/helpers/test/yarn/fixtures/updater/original/package.json +6 -0
  59. data/helpers/test/yarn/fixtures/updater/original/yarn.lock +11 -0
  60. data/helpers/test/yarn/fixtures/updater/updated/yarn.lock +12 -0
  61. data/helpers/test/yarn/fixtures/updater/with-version-comments/package.json +5 -0
  62. data/helpers/test/yarn/fixtures/updater/with-version-comments/yarn.lock +13 -0
  63. data/helpers/test/yarn/helpers.js +18 -0
  64. data/helpers/test/yarn/updater.test.js +117 -0
  65. data/lib/dependabot/bun/bun_package_manager.rb +47 -0
  66. data/lib/dependabot/bun/constraint_helper.rb +359 -0
  67. data/lib/dependabot/bun/dependency_files_filterer.rb +157 -0
  68. data/lib/dependabot/bun/file_fetcher/path_dependency_builder.rb +184 -0
  69. data/lib/dependabot/bun/file_fetcher.rb +343 -38
  70. data/lib/dependabot/bun/file_parser/bun_lock.rb +3 -11
  71. data/lib/dependabot/bun/file_parser/lockfile_parser.rb +105 -0
  72. data/lib/dependabot/bun/file_parser.rb +477 -0
  73. data/lib/dependabot/bun/file_updater/bun_lockfile_updater.rb +144 -0
  74. data/lib/dependabot/bun/file_updater/npmrc_builder.rb +256 -0
  75. data/lib/dependabot/bun/file_updater/package_json_preparer.rb +88 -0
  76. data/lib/dependabot/bun/file_updater/package_json_updater.rb +378 -0
  77. data/lib/dependabot/bun/file_updater.rb +203 -0
  78. data/lib/dependabot/bun/helpers.rb +41 -27
  79. data/lib/dependabot/bun/language.rb +2 -2
  80. data/lib/dependabot/bun/metadata_finder.rb +214 -0
  81. data/lib/dependabot/bun/native_helpers.rb +19 -0
  82. data/lib/dependabot/bun/package_manager.rb +261 -27
  83. data/lib/dependabot/bun/package_name.rb +118 -0
  84. data/lib/dependabot/bun/pnpm_package_manager.rb +55 -0
  85. data/lib/dependabot/bun/registry_helper.rb +188 -0
  86. data/lib/dependabot/bun/registry_parser.rb +93 -0
  87. data/lib/dependabot/bun/requirement.rb +134 -2
  88. data/lib/dependabot/bun/sub_dependency_files_filterer.rb +82 -0
  89. data/lib/dependabot/bun/update_checker/conflicting_dependency_resolver.rb +59 -0
  90. data/lib/dependabot/bun/update_checker/dependency_files_builder.rb +79 -0
  91. data/lib/dependabot/bun/update_checker/latest_version_finder.rb +448 -0
  92. data/lib/dependabot/bun/update_checker/library_detector.rb +76 -0
  93. data/lib/dependabot/bun/update_checker/registry_finder.rb +279 -0
  94. data/lib/dependabot/bun/update_checker/requirements_updater.rb +206 -0
  95. data/lib/dependabot/bun/update_checker/subdependency_version_resolver.rb +154 -0
  96. data/lib/dependabot/bun/update_checker/version_resolver.rb +583 -0
  97. data/lib/dependabot/bun/update_checker/vulnerability_auditor.rb +164 -0
  98. data/lib/dependabot/bun/update_checker.rb +455 -0
  99. data/lib/dependabot/bun/version.rb +128 -2
  100. data/lib/dependabot/bun/version_selector.rb +61 -0
  101. data/lib/dependabot/bun.rb +338 -26
  102. metadata +101 -27
  103. data/lib/dependabot/javascript/file_fetcher_helper.rb +0 -245
  104. data/lib/dependabot/javascript/requirement.rb +0 -141
  105. data/lib/dependabot/javascript/version.rb +0 -135
  106. data/lib/dependabot/javascript.rb +0 -8
@@ -1,135 +0,0 @@
1
- # typed: strict
2
- # frozen_string_literal: true
3
-
4
- require "dependabot/version"
5
- require "dependabot/utils"
6
- require "sorbet-runtime"
7
-
8
- # JavaScript pre-release versions use 1.0.1-rc1 syntax, which Gem::Version
9
- # converts into 1.0.1.pre.rc1. We override the `to_s` method to stop that
10
- # alteration.
11
- #
12
- # See https://semver.org/ for details of node's version syntax.
13
-
14
- module Dependabot
15
- module Javascript
16
- class Version < Dependabot::Version
17
- extend T::Sig
18
-
19
- sig { returns(T.nilable(String)) }
20
- attr_reader :build_info
21
-
22
- # These are possible npm versioning tags that can be used in place of a version.
23
- # See https://docs.npmjs.com/cli/v10/commands/npm-dist-tag#purpose for more details.
24
- VERSION_TAGS = T.let([
25
- "alpha", # Alpha version, early testing phase
26
- "beta", # Beta version, more stable than alpha
27
- "canary", # Canary version, often used for cutting-edge builds
28
- "dev", # Development version, ongoing development
29
- "experimental", # Experimental version, unstable and new features
30
- "latest", # Latest stable version, used by npm to identify the current version of a package
31
- "legacy", # Legacy version, older version maintained for compatibility
32
- "next", # Next version, used by some projects to identify the upcoming version
33
- "nightly", # Nightly build, daily builds often including latest changes
34
- "rc", # Release candidate, potential final version
35
- "release", # General release version
36
- "stable" # Stable version, thoroughly tested and stable
37
- ].freeze.map(&:freeze), T::Array[String])
38
-
39
- VERSION_PATTERN = T.let(Gem::Version::VERSION_PATTERN + '(\+[0-9a-zA-Z\-.]+)?', String)
40
- ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
41
-
42
- sig { override.params(version: VersionParameter).returns(T::Boolean) }
43
- def self.correct?(version)
44
- version = version.gsub(/^v/, "") if version.is_a?(String)
45
-
46
- return false if version.nil?
47
-
48
- version.to_s.match?(ANCHORED_VERSION_PATTERN)
49
- end
50
-
51
- sig { params(version: VersionParameter).returns(VersionParameter) }
52
- def self.semver_for(version)
53
- # The next two lines are to guard against improperly formatted
54
- # versions in a lockfile, such as an empty string or additional
55
- # characters. NPM/yarn fixes these when running an update, so we can
56
- # safely ignore these versions.
57
- return if version == ""
58
- return unless correct?(version)
59
-
60
- version
61
- end
62
-
63
- sig { override.params(version: VersionParameter).void }
64
- def initialize(version)
65
- version = clean_version(version)
66
-
67
- @version_string = T.let(version.to_s, String)
68
-
69
- @build_info = T.let(nil, T.nilable(String))
70
-
71
- version, @build_info = version.to_s.split("+") if version.to_s.include?("+")
72
-
73
- super(T.must(version))
74
- end
75
-
76
- sig { params(version: VersionParameter).returns(VersionParameter) }
77
- def clean_version(version)
78
- # Check if version is a string before attempting to match
79
- if version.is_a?(String)
80
- # Matches @ followed by x.y.z (digits separated by dots)
81
- if (match = version.match(/@(\d+\.\d+\.\d+)/))
82
- version = match[1] # Just "4.5.3"
83
-
84
- # Extract version in case the output contains Corepack verbose data
85
- elsif version.include?("Corepack")
86
- version = T.must(T.must(version.tr("\n", " ").match(/(\d+\.\d+\.\d+)/))[-1])
87
- end
88
- version = version&.gsub(/^v/, "")
89
- end
90
-
91
- version
92
- end
93
-
94
- sig { override.params(version: VersionParameter).returns(Dependabot::Javascript::Version) }
95
- def self.new(version)
96
- T.cast(super, Dependabot::Javascript::Version)
97
- end
98
-
99
- sig { returns(Integer) }
100
- def major
101
- @major ||= T.let(segments[0].to_i, T.nilable(Integer))
102
- end
103
-
104
- sig { returns(Integer) }
105
- def minor
106
- @minor ||= T.let(segments[1].to_i, T.nilable(Integer))
107
- end
108
-
109
- sig { returns(Integer) }
110
- def patch
111
- @patch ||= T.let(segments[2].to_i, T.nilable(Integer))
112
- end
113
-
114
- sig { params(other: Dependabot::Javascript::Version).returns(T::Boolean) }
115
- def backwards_compatible_with?(other)
116
- case major
117
- when 0
118
- self == other
119
- else
120
- major == other.major && minor >= other.minor
121
- end
122
- end
123
-
124
- sig { override.returns(String) }
125
- def to_s
126
- @version_string
127
- end
128
-
129
- sig { override.returns(String) }
130
- def inspect
131
- "#<#{self.class} #{@version_string}>"
132
- end
133
- end
134
- end
135
- end
@@ -1,8 +0,0 @@
1
- # typed: strong
2
- # frozen_string_literal: true
3
-
4
- module Dependabot
5
- module Javascript
6
- MANIFEST_FILENAME = "package.json"
7
- end
8
- end