dependabot-bun 0.296.2 → 0.296.3

data/lib/dependabot/bun/update_checker/registry_finder.rb

@@ -0,0 +1,279 @@
+# typed: true
+# frozen_string_literal: true
+
+require "excon"
+require "dependabot/bun/update_checker"
+require "dependabot/registry_client"
+
+module Dependabot
+  module Bun
+    class UpdateChecker
+      class RegistryFinder
+        CENTRAL_REGISTRIES = %w(
+          https://registry.npmjs.org
+          http://registry.npmjs.org
+        ).freeze
+        NPM_AUTH_TOKEN_REGEX = %r{//(?<registry>.*)/:_authToken=(?<token>.*)$}
+        NPM_GLOBAL_REGISTRY_REGEX = /^registry\s*=\s*['"]?(?<registry>.*?)['"]?$/
+        NPM_SCOPED_REGISTRY_REGEX = /^(?<scope>@[^:]+)\s*:registry\s*=\s*['"]?(?<registry>.*?)['"]?$/
+
+        def initialize(dependency:, credentials:, npmrc_file: nil)
+          @dependency = dependency
+          @credentials = credentials
+          @npmrc_file = npmrc_file
+        end
+
+        def registry
+          @registry ||= locked_registry || configured_registry || first_registry_with_dependency_details
+        end
+
+        def auth_headers
+          auth_header_for(auth_token)
+        end
+
+        def dependency_url
+          "#{registry_url}/#{escaped_dependency_name}"
+        end
+
+        def tarball_url(version)
+          version_without_build_metadata = version.to_s.gsub(/\+.*/, "")
+
+          # Dependency name needs to be unescaped since tarball URLs don't always work with escaped slashes
+          "#{registry_url}/#{dependency.name}/-/#{scopeless_name}-#{version_without_build_metadata}.tgz"
+        end
+
+        def self.central_registry?(registry)
+          CENTRAL_REGISTRIES.any? do |r|
+            r.include?(registry)
+          end
+        end
+
+        def registry_from_rc(dependency_name)
+          explicit_registry_from_rc(dependency_name) || global_registry
+        end
+
+        private
+
+        attr_reader :dependency
+        attr_reader :credentials
+        attr_reader :npmrc_file
+
+        def explicit_registry_from_rc(dependency_name)
+          if dependency_name.start_with?("@") && dependency_name.include?("/")
+            scope = dependency_name.split("/").first
+            scoped_registry(scope) || configured_global_registry
+          else
+            configured_global_registry
+          end
+        end
+
+        def first_registry_with_dependency_details
+          @first_registry_with_dependency_details ||=
+            known_registries.find do |details|
+              url = "#{details['registry'].gsub(%r{/+$}, '')}/#{escaped_dependency_name}"
+              url = "https://#{url}" unless url.start_with?("http")
+              response = Dependabot::RegistryClient.get(
+                url: url,
+                headers: auth_header_for(details["token"])
+              )
+              response.status < 400 && JSON.parse(response.body)
+            rescue Excon::Error::Timeout,
+                   Excon::Error::Socket,
+                   JSON::ParserError
+              nil
+            rescue URI::InvalidURIError => e
+              raise DependencyFileNotResolvable, e.message
+            end&.fetch("registry")
+
+          @first_registry_with_dependency_details ||= global_registry.sub(%r{/+$}, "").sub(%r{^.*?//}, "")
+        end
+
+        def registry_url
+          url =
+            if registry.start_with?("http")
+              registry
+            else
+              protocol =
+                if registry_source_url
+                  registry_source_url.split("://").first
+                else
+                  "https"
+                end
+
+              "#{protocol}://#{registry}"
+            end
+
+          url.gsub(%r{/+$}, "")
+        end
+
+        def auth_header_for(token)
+          return {} unless token
+
+          if token.include?(":")
+            encoded_token = Base64.encode64(token).delete("\n")
+            { "Authorization" => "Basic #{encoded_token}" }
+          elsif Base64.decode64(token).ascii_only? &&
+                Base64.decode64(token).include?(":")
+            { "Authorization" => "Basic #{token.delete("\n")}" }
+          else
+            { "Authorization" => "Bearer #{token}" }
+          end
+        end
+
+        def auth_token
+          known_registries
+            .find { |cred| cred["registry"] == registry }
+            &.fetch("token", nil)
+        end
+
+        def locked_registry
+          return unless registry_source_url
+
+          lockfile_registry =
+            registry_source_url
+            .gsub("https://", "")
+            .gsub("http://", "")
+          detailed_registry =
+            known_registries
+            .find { |h| h["registry"].include?(lockfile_registry) }
+            &.fetch("registry")
+
+          detailed_registry || lockfile_registry
+        end
+
+        def configured_registry
+          configured_registry_url = explicit_registry_from_rc(dependency.name)
+          return unless configured_registry_url
+
+          normalize_configured_registry(configured_registry_url)
+        end
+
+        def known_registries
+          @known_registries ||=
+            begin
+              registries = []
+              registries += credentials
+                            .select { |cred| cred["type"] == "npm_registry" && cred["registry"] }
+                            .tap { |arr| arr.each { |c| c["token"] ||= nil } }
+              registries += npmrc_registries
+
+              unique_registries(registries)
+            end
+        end
+
+        def npmrc_registries
+          return [] unless npmrc_file
+
+          registries = []
+          npmrc_file.content.scan(NPM_AUTH_TOKEN_REGEX) do
+            next if Regexp.last_match&.[](:registry)&.include?("${")
+
+            registry = T.must(Regexp.last_match)[:registry]
+            token = T.must(Regexp.last_match)[:token]&.strip
+
+            registries << {
+              "type" => "npm_registry",
+              "registry" => registry&.gsub(/\s+/, "%20"),
+              "token" => token
+            }
+          end
+
+          registries += npmrc_global_registries
+        end
+
+        def unique_registries(registries)
+          registries.uniq.reject do |registry|
+            next if registry["token"]
+
+            # Reject this entry if an identical one with a token exists
+            registries.any? do |r|
+              r["token"] && r["registry"] == registry["registry"]
+            end
+          end
+        end
+
+        def global_registry
+          return @global_registry if defined? @global_registry
+
+          @global_registry ||= configured_global_registry || "https://registry.npmjs.org"
+        end
+
+        def configured_global_registry
+          return @configured_global_registry if defined? @configured_global_registry
+
+          @configured_global_registry = npmrc_file && npmrc_global_registries.first&.fetch("url")
+          return @configured_global_registry if @configured_global_registry
+
+          replaces_base = credentials.find { |cred| cred["type"] == "npm_registry" && cred.replaces_base? }
+          if replaces_base
+            registry = replaces_base["registry"]
+            registry = "https://#{registry}" unless registry.start_with?("http")
+            return @configured_global_registry = registry
+          end
+
+          @configured_global_registry = nil
+        end
+
+        def npmrc_global_registries
+          global_rc_registries(npmrc_file, syntax: NPM_GLOBAL_REGISTRY_REGEX)
+        end
+
+        def scoped_registry(scope)
+          scoped_rc_registry(npmrc_file, syntax: NPM_SCOPED_REGISTRY_REGEX, scope: scope)
+        end
+
+        def global_rc_registries(file, syntax:)
+          registries = []
+
+          file.content.scan(syntax) do
+            next if Regexp.last_match&.[](:registry)&.include?("${")
+
+            url = T.must(T.must(Regexp.last_match)[:registry]).strip
+            registry = normalize_configured_registry(url)
+            registries << {
+              "type" => "npm_registry",
+              "registry" => registry,
+              "url" => url,
+              "token" => nil
+            }
+          end
+
+          registries
+        end
+
+        def scoped_rc_registry(file, syntax:, scope:)
+          file&.content.to_s.scan(syntax) do
+            next if Regexp.last_match&.[](:registry)&.include?("${") || Regexp.last_match&.[](:scope) != scope
+
+            return T.must(T.must(Regexp.last_match)[:registry]).strip
+          end
+
+          nil
+        end
+
+        # npm registries expect slashes to be escaped
+        def escaped_dependency_name
+          dependency.name.gsub("/", "%2F")
+        end
+
+        def scopeless_name
+          dependency.name.split("/").last
+        end
+
+        def registry_source_url
+          sources = dependency.requirements
+                              .map { |r| r.fetch(:source) }.uniq.compact
+                              .sort_by { |source| self.class.central_registry?(source[:url]) ? 1 : 0 }
+
+          sources.find { |s| s[:type] == "registry" }&.fetch(:url)
+        end
+
+        def normalize_configured_registry(url)
+          url.sub(%r{/+$}, "")
+             .sub(%r{^.*?//}, "")
+             .gsub(/\s+/, "%20")
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bun/update_checker/requirements_updater.rb

@@ -0,0 +1,206 @@
+# typed: true
+# frozen_string_literal: true
+
+################################################################################
+# For more details on npm version constraints, see:                            #
+# https://docs.npmjs.com/misc/semver                                           #
+################################################################################
+
+require "dependabot/bun/requirement"
+require "dependabot/bun/update_checker"
+require "dependabot/bun/version"
+require "dependabot/requirements_update_strategy"
+
+module Dependabot
+  module Bun
+    class UpdateChecker
+      class RequirementsUpdater
+        VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/
+        SEPARATOR = /(?<=[a-zA-Z0-9*])[\s|]+(?![\s|-])/
+        ALLOWED_UPDATE_STRATEGIES = T.let(
+          [
+            RequirementsUpdateStrategy::LockfileOnly,
+            RequirementsUpdateStrategy::WidenRanges,
+            RequirementsUpdateStrategy::BumpVersions,
+            RequirementsUpdateStrategy::BumpVersionsIfNecessary
+          ].freeze,
+          T::Array[Dependabot::RequirementsUpdateStrategy]
+        )
+
+        def initialize(requirements:, updated_source:, update_strategy:,
+                       latest_resolvable_version:)
+          @requirements = requirements
+          @updated_source = updated_source
+          @update_strategy = update_strategy
+
+          check_update_strategy
+
+          return unless latest_resolvable_version
+
+          @latest_resolvable_version =
+            version_class.new(latest_resolvable_version)
+        end
+
+        def updated_requirements
+          return requirements if update_strategy.lockfile_only?
+
+          requirements.map do |req|
+            req = req.merge(source: updated_source)
+            next req unless latest_resolvable_version
+            next initial_req_after_source_change(req) unless req[:requirement]
+            next req if req[:requirement].match?(/^([A-Za-uw-z]|v[^\d])/)
+
+            case update_strategy
+            when RequirementsUpdateStrategy::WidenRanges then widen_requirement(req)
+            when RequirementsUpdateStrategy::BumpVersions then update_version_requirement(req)
+            when RequirementsUpdateStrategy::BumpVersionsIfNecessary
+              update_version_requirement_if_needed(req)
+            else raise "Unexpected update strategy: #{update_strategy}"
+            end
+          end
+        end
+
+        private
+
+        attr_reader :requirements
+        attr_reader :updated_source
+        attr_reader :update_strategy
+        attr_reader :latest_resolvable_version
+
+        def check_update_strategy
+          return if ALLOWED_UPDATE_STRATEGIES.include?(update_strategy)
+
+          raise "Unknown update strategy: #{update_strategy}"
+        end
+
+        def updating_from_git_to_npm?
+          return false unless updated_source.nil?
+
+          original_source = requirements.filter_map { |r| r[:source] }.first
+          original_source&.fetch(:type) == "git"
+        end
+
+        def initial_req_after_source_change(req)
+          return req unless updating_from_git_to_npm?
+          return req unless req[:requirement].nil?
+
+          req.merge(requirement: "^#{latest_resolvable_version}")
+        end
+
+        def update_version_requirement(req)
+          current_requirement = req[:requirement]
+
+          if current_requirement.match?(/(<|-\s)/i)
+            ruby_req = ruby_requirements(current_requirement).first
+            return req if ruby_req.satisfied_by?(latest_resolvable_version)
+
+            updated_req = update_range_requirement(current_requirement)
+            return req.merge(requirement: updated_req)
+          end
+
+          reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
+          req.merge(requirement: update_version_string(reqs.first))
+        end
+
+        def update_version_requirement_if_needed(req)
+          current_requirement = req[:requirement]
+          version = latest_resolvable_version
+          return req if current_requirement.strip == ""
+
+          ruby_reqs = ruby_requirements(current_requirement)
+          return req if ruby_reqs.any? { |r| r.satisfied_by?(version) }
+
+          update_version_requirement(req)
+        end
+
+        def widen_requirement(req)
+          current_requirement = req[:requirement]
+          version = latest_resolvable_version
+          return req if current_requirement.strip == ""
+
+          ruby_reqs = ruby_requirements(current_requirement)
+          return req if ruby_reqs.any? { |r| r.satisfied_by?(version) }
+
+          reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
+
+          updated_requirement =
+            if reqs.any? { |r| r.match?(/(<|-\s)/i) }
+              update_range_requirement(current_requirement)
+            elsif current_requirement.strip.split(SEPARATOR).count == 1
+              update_version_string(current_requirement)
+            else
+              current_requirement
+            end
+
+          req.merge(requirement: updated_requirement)
+        end
+
+        def ruby_requirements(requirement_string)
+          Bun::Requirement
+            .requirements_array(requirement_string)
+        end
+
+        def update_range_requirement(req_string)
+          range_requirements =
+            req_string.split(SEPARATOR).select { |r| r.match?(/<|(\s+-\s+)/) }
+
+          if range_requirements.count == 1
+            range_requirement = range_requirements.first
+            versions = range_requirement.scan(VERSION_REGEX)
+            upper_bound = versions.map { |v| version_class.new(v) }.max
+            new_upper_bound = update_greatest_version(
+              upper_bound,
+              latest_resolvable_version
+            )
+
+            req_string.sub(
+              upper_bound.to_s,
+              new_upper_bound.to_s
+            )
+          else
+            req_string + " || ^#{latest_resolvable_version}"
+          end
+        end
+
+        def update_version_string(req_string)
+          req_string
+            .sub(VERSION_REGEX) do |old_version|
+              if old_version.match?(/\d-/) ||
+                 latest_resolvable_version.to_s.match?(/\d-/)
+                latest_resolvable_version.to_s
+              else
+                old_parts = old_version.split(".")
+                new_parts = latest_resolvable_version.to_s.split(".")
+                                                     .first(old_parts.count)
+                new_parts.map.with_index do |part, i|
+                  old_parts[i].match?(/^x\b/) ? "x" : part
+                end.join(".")
+              end
+            end
+        end
+
+        def update_greatest_version(old_version, version_to_be_permitted)
+          version = version_class.new(old_version)
+          version = version.release if version.prerelease?
+
+          index_to_update =
+            version.segments.map.with_index { |seg, i| seg.zero? ? 0 : i }.max
+
+          version.segments.map.with_index do |_, index|
+            if index < index_to_update
+              version_to_be_permitted.segments[index]
+            elsif index == index_to_update
+              version_to_be_permitted.segments[index] + 1
+            else
+              0
+            end
+          end.join(".")
+        end
+
+        def version_class
+          Bun::Version
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bun/update_checker/subdependency_version_resolver.rb

@@ -0,0 +1,154 @@
+# typed: true
+# frozen_string_literal: true
+
+require "dependabot/dependency"
+require "dependabot/errors"
+require "dependabot/logger"
+require "dependabot/bun/file_parser"
+require "dependabot/bun/helpers"
+require "dependabot/bun/native_helpers"
+require "dependabot/bun/sub_dependency_files_filterer"
+require "dependabot/bun/update_checker"
+require "dependabot/bun/update_checker/dependency_files_builder"
+require "dependabot/bun/version"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module Bun
+    class UpdateChecker
+      class SubdependencyVersionResolver
+        def initialize(dependency:, credentials:, dependency_files:,
+                       ignored_versions:, latest_allowable_version:, repo_contents_path:)
+          @dependency = dependency
+          @credentials = credentials
+          @dependency_files = dependency_files
+          @ignored_versions = ignored_versions
+          @latest_allowable_version = latest_allowable_version
+          @repo_contents_path = repo_contents_path
+        end
+
+        def latest_resolvable_version
+          raise "Not a subdependency!" if dependency.requirements.any?
+          return if bundled_dependency?
+
+          base_dir = dependency_files.first.directory
+          SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
+            dependency_files_builder.write_temporary_dependency_files
+
+            updated_lockfiles = filtered_lockfiles.map do |lockfile|
+              updated_content = update_subdependency_in_lockfile(lockfile)
+              updated_lockfile = lockfile.dup
+              updated_lockfile.content = updated_content
+              updated_lockfile
+            end
+
+            version_from_updated_lockfiles(updated_lockfiles)
+          end
+        rescue SharedHelpers::HelperSubprocessFailed
+          # TODO: Move error handling logic from the FileUpdater to this class
+
+          # Return nil (no update possible) if an unknown error occurred
+          nil
+        end
+
+        private
+
+        attr_reader :dependency
+        attr_reader :credentials
+        attr_reader :dependency_files
+        attr_reader :ignored_versions
+        attr_reader :latest_allowable_version
+        attr_reader :repo_contents_path
+
+        def update_subdependency_in_lockfile(lockfile)
+          lockfile_name = Pathname.new(lockfile.name).basename.to_s
+          path = Pathname.new(lockfile.name).dirname.to_s
+
+          updated_files = (run_bun_updater(path, lockfile_name) if lockfile.name.end_with?("bun.lock"))
+
+          updated_files.fetch(lockfile_name)
+        end
+
+        def version_from_updated_lockfiles(updated_lockfiles)
+          updated_files = dependency_files -
+                          dependency_files_builder.lockfiles +
+                          updated_lockfiles
+
+          updated_version = Bun::FileParser.new(
+            dependency_files: updated_files,
+            source: nil,
+            credentials: credentials
+          ).parse.find { |d| d.name == dependency.name }&.version
+          return unless updated_version
+
+          version_class.new(updated_version)
+        end
+
+        def run_bun_updater(path, lockfile_name)
+          SharedHelpers.with_git_configured(credentials: credentials) do
+            Dir.chdir(path) do
+              Helpers.run_bun_command(
+                "update #{dependency.name} --save-text-lockfile",
+                fingerprint: "update <dependency_name> --save-text-lockfile"
+              )
+              { lockfile_name => File.read(lockfile_name) }
+            end
+          end
+        end
+
+        def version_class
+          dependency.version_class
+        end
+
+        def updated_dependency
+          Dependabot::Dependency.new(
+            name: dependency.name,
+            version: latest_allowable_version,
+            previous_version: dependency.version,
+            requirements: [],
+            package_manager: dependency.package_manager
+          )
+        end
+
+        def filtered_lockfiles
+          @filtered_lockfiles ||=
+            SubDependencyFilesFilterer.new(
+              dependency_files: dependency_files,
+              updated_dependencies: [updated_dependency]
+            ).files_requiring_update
+        end
+
+        def dependency_files_builder
+          @dependency_files_builder ||=
+            DependencyFilesBuilder.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              credentials: credentials
+            )
+        end
+
+        # TODO: We should try and fix this by updating the parent that's not
+        # bundled. For this case: `chokidar > fsevents > node-pre-gyp > tar` we
+        # would need to update `fsevents`
+        #
+        # We shouldn't update bundled sub-dependencies as they have been bundled
+        # into the release at an exact version by a parent using
+        # `bundledDependencies`.
+        #
+        # For example, fsevents < 2 bundles node-pre-gyp meaning all it's
+        # sub-dependencies get bundled into the release tarball at publish time
+        # so you always get the same sub-dependency versions if you re-install a
+        # specific version of fsevents.
+        #
+        # Updating the sub-dependency by deleting the entry works but it gets
+        # removed from the bundled set of dependencies and moved top level
+        # resulting in a bunch of package duplication which is pretty confusing.
+        def bundled_dependency?
+          dependency.subdependency_metadata
+                    &.any? { |h| h.fetch(:npm_bundled, false) } ||
+            false
+        end
+      end
+    end
+  end
+end