dependabot-bun 0.296.2 → 0.297.0

data/lib/dependabot/bun/language.rb

@@ -0,0 +1,45 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/bun/package_manager"
+
+module Dependabot
+  module Bun
+    class Language < Ecosystem::VersionManager
+      extend T::Sig
+      NAME = "node"
+
+      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig do
+        params(
+          detected_version: T.nilable(String),
+          raw_version: T.nilable(String),
+          requirement: T.nilable(Dependabot::Bun::Requirement)
+        ).void
+      end
+      def initialize(detected_version: nil, raw_version: nil, requirement: nil)
+        super(
+          name: NAME,
+          detected_version: detected_version ? Version.new(detected_version) : nil,
+          version: raw_version ? Version.new(raw_version) : nil,
+          deprecated_versions: DEPRECATED_VERSIONS,
+          supported_versions: SUPPORTED_VERSIONS,
+          requirement: requirement
+        )
+      end
+
+      sig { override.returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { override.returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+  end
+end

data/lib/dependabot/bun/metadata_finder.rb

@@ -0,0 +1,214 @@
+# typed: true
+# frozen_string_literal: true
+
+require "excon"
+require "time"
+
+require "dependabot/metadata_finders"
+require "dependabot/metadata_finders/base"
+require "dependabot/registry_client"
+require "dependabot/bun/update_checker/registry_finder"
+require "dependabot/bun/version"
+
+module Dependabot
+  module Bun
+    class MetadataFinder < Dependabot::MetadataFinders::Base
+      def homepage_url
+        # Attempt to use version_listing first, as fetching the entire listing
+        # array can be slow (if it's large)
+        return latest_version_listing["homepage"] if latest_version_listing["homepage"]
+
+        listing = all_version_listings.find { |_, l| l["homepage"] }
+        listing&.last&.fetch("homepage", nil) || super
+      end
+
+      def maintainer_changes
+        return unless npm_releaser
+        return unless npm_listing.dig("time", dependency.version)
+        return if previous_releasers.include?(npm_releaser)
+
+        "This version was pushed to npm by " \
+          "[#{npm_releaser}](https://www.npmjs.com/~#{npm_releaser}), a new " \
+          "releaser for #{dependency.name} since your current version."
+      end
+
+      private
+
+      def look_up_source
+        return find_source_from_registry if new_source.nil?
+
+        source_type = new_source[:type] || new_source.fetch("type")
+
+        case source_type
+        when "git" then find_source_from_git_url
+        when "registry" then find_source_from_registry
+        else raise "Unexpected source type: #{source_type}"
+        end
+      end
+
+      def npm_releaser
+        all_version_listings
+          .find { |v, _| v == dependency.version }
+          &.last&.fetch("_npmUser", nil)&.fetch("name", nil)
+      end
+
+      def previous_releasers
+        times = npm_listing.fetch("time")
+
+        cutoff =
+          if dependency.previous_version && times[dependency.previous_version]
+            Time.parse(times[dependency.previous_version])
+          elsif times[dependency.version]
+            Time.parse(times[dependency.version]) - 1
+          end
+        return unless cutoff
+
+        all_version_listings
+          .reject { |v, _| Time.parse(times[v]) > cutoff }
+          .filter_map { |_, d| d.fetch("_npmUser", nil)&.fetch("name", nil) }
+      end
+
+      def find_source_from_registry
+        # Attempt to use version_listing first, as fetching the entire listing
+        # array can be slow (if it's large)
+        potential_sources =
+          [
+            get_source(latest_version_listing["repository"]),
+            get_source(latest_version_listing["homepage"]),
+            get_source(latest_version_listing["bugs"])
+          ].compact
+
+        return potential_sources.first if potential_sources.any?
+
+        potential_sources =
+          all_version_listings.flat_map do |_, listing|
+            [
+              get_source(listing["repository"]),
+              get_source(listing["homepage"]),
+              get_source(listing["bugs"])
+            ]
+          end.compact
+
+        potential_sources.first
+      end
+
+      def new_source
+        sources = dependency.requirements
+                            .map { |r| r.fetch(:source) }.uniq.compact
+                            .sort_by { |source| UpdateChecker::RegistryFinder.central_registry?(source[:url]) ? 1 : 0 }
+
+        sources.first
+      end
+
+      def get_source(details)
+        potential_url = get_url(details)
+        return unless potential_url
+
+        potential_source = Source.from_url(potential_url)
+        return unless potential_source
+
+        potential_source.directory = get_directory(details)
+        potential_source
+      end
+
+      def get_url(details)
+        url =
+          case details
+          when String then details
+          when Hash then details.fetch("url", nil)
+          end
+        return url unless url&.match?(%r{^[\w.-]+/[\w.-]+$})
+
+        "https://github.com/" + url
+      end
+
+      def get_directory(details)
+        # Only return a directory if it is explicitly specified
+        return unless details.is_a?(Hash)
+
+        details.fetch("directory", nil)
+      end
+
+      def find_source_from_git_url
+        url = new_source[:url] || new_source.fetch("url")
+        Source.from_url(url)
+      end
+
+      def latest_version_listing
+        return @latest_version_listing if defined?(@latest_version_listing)
+
+        response = Dependabot::RegistryClient.get(url: "#{dependency_url}/latest", headers: registry_auth_headers)
+        return @latest_version_listing = JSON.parse(response.body) if response.status == 200
+
+        @latest_version_listing = {}
+      rescue JSON::ParserError, Excon::Error::Timeout
+        @latest_version_listing = {}
+      end
+
+      def all_version_listings
+        return [] if npm_listing["versions"].nil?
+
+        npm_listing["versions"]
+          .reject { |_, details| details["deprecated"] }
+          .sort_by { |version, _| Bun::Version.new(version) }
+          .reverse
+      end
+
+      def npm_listing
+        return @npm_listing unless @npm_listing.nil?
+
+        response = Dependabot::RegistryClient.get(url: dependency_url, headers: registry_auth_headers)
+        return @npm_listing = {} if response.status >= 500
+
+        begin
+          @npm_listing = JSON.parse(response.body)
+        rescue JSON::ParserError
+          raise unless non_standard_registry?
+
+          @npm_listing = {}
+        end
+      rescue Excon::Error::Timeout
+        @npm_listing = {}
+      end
+
+      def dependency_url
+        registry_url =
+          if new_source.nil? then "https://registry.npmjs.org"
+          else
+            new_source.fetch(:url)
+          end
+
+        # NPM registries expect slashes to be escaped
+        escaped_dependency_name = dependency.name.gsub("/", "%2F")
+        "#{registry_url}/#{escaped_dependency_name}"
+      end
+
+      def registry_auth_headers
+        return {} unless auth_token
+
+        { "Authorization" => "Bearer #{auth_token}" }
+      end
+
+      def dependency_registry
+        if new_source.nil? then "registry.npmjs.org"
+        else
+          new_source.fetch(:url).gsub("https://", "").gsub("http://", "")
+        end
+      end
+
+      def auth_token
+        credentials
+          .select { |cred| cred["type"] == "npm_registry" }
+          .find { |cred| cred["registry"] == dependency_registry }
+          &.fetch("token", nil)
+      end
+
+      def non_standard_registry?
+        dependency_registry != "registry.npmjs.org"
+      end
+    end
+  end
+end
+
+Dependabot::MetadataFinders
+  .register("bun", Dependabot::Bun::MetadataFinder)

data/lib/dependabot/bun/native_helpers.rb

@@ -0,0 +1,19 @@
+# typed: true
+# frozen_string_literal: true
+
+module Dependabot
+  module Bun
+    module NativeHelpers
+      def self.helper_path
+        "node #{File.join(native_helpers_root, 'run.js')}"
+      end
+
+      def self.native_helpers_root
+        helpers_root = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
+        return File.join(helpers_root, "bun") unless helpers_root.nil?
+
+        File.join(__dir__, "../../../helpers")
+      end
+    end
+  end
+end

data/lib/dependabot/bun/package_manager.rb

@@ -0,0 +1,280 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "dependabot/shared_helpers"
+require "dependabot/ecosystem"
+require "dependabot/bun/requirement"
+require "dependabot/bun/version_selector"
+require "dependabot/bun/registry_helper"
+require "dependabot/bun/bun_package_manager"
+require "dependabot/bun/language"
+require "dependabot/bun/constraint_helper"
+
+module Dependabot
+  module Bun
+    ECOSYSTEM = "bun"
+    MANIFEST_FILENAME = "package.json"
+    LERNA_JSON_FILENAME = "lerna.json"
+    PACKAGE_MANAGER_VERSION_REGEX = /
+      ^                        # Start of string
+      (?<major>\d+)            # Major version (required, numeric)
+      \.                       # Separator between major and minor versions
+      (?<minor>\d+)            # Minor version (required, numeric)
+      \.                       # Separator between minor and patch versions
+      (?<patch>\d+)            # Patch version (required, numeric)
+      (                        # Start pre-release section
+        -(?<pre_release>[a-zA-Z0-9.]+) # Pre-release label (optional, alphanumeric or dot-separated)
+      )?
+      (                        # Start build metadata section
+        \+(?<build>[a-zA-Z0-9.]+) # Build metadata (optional, alphanumeric or dot-separated)
+      )?
+      $                        # End of string
+    /x # Extended mode for readability
+
+    VALID_REQUIREMENT_CONSTRAINT = /
+      ^                        # Start of string
+      (?<operator>=|>|>=|<|<=|~>|\\^) # Allowed operators
+      \s*                      # Optional whitespace
+      (?<major>\d+)            # Major version (required)
+      (\.(?<minor>\d+))?       # Minor version (optional)
+      (\.(?<patch>\d+))?       # Patch version (optional)
+      (                        # Start pre-release section
+        -(?<pre_release>[a-zA-Z0-9.]+) # Pre-release label (optional)
+      )?
+      (                        # Start build metadata section
+        \+(?<build>[a-zA-Z0-9.]+) # Build metadata (optional)
+      )?
+      $                        # End of string
+    /x # Extended mode for readability
+
+    MANIFEST_PACKAGE_MANAGER_KEY = "packageManager"
+    MANIFEST_ENGINES_KEY = "engines"
+
+    # Error malformed version number string
+    ERROR_MALFORMED_VERSION_NUMBER = "Malformed version number"
+
+    class PackageManagerHelper
+      extend T::Sig
+      extend T::Helpers
+
+      sig do
+        params(
+          package_json: T.nilable(T::Hash[String, T.untyped]),
+          lockfiles: T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)],
+          registry_config_files: T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)],
+          credentials: T.nilable(T::Array[Dependabot::Credential])
+        ).void
+      end
+      def initialize(package_json, lockfiles, registry_config_files, credentials)
+        @package_json = package_json
+        @lockfiles = lockfiles
+        @registry_helper = T.let(
+          RegistryHelper.new(registry_config_files, credentials),
+          Dependabot::Bun::RegistryHelper
+        )
+
+        @manifest_package_manager = T.let(package_json&.fetch(MANIFEST_PACKAGE_MANAGER_KEY, nil), T.nilable(String))
+        @engines = T.let(package_json&.fetch(MANIFEST_ENGINES_KEY, nil), T.nilable(T::Hash[String, T.untyped]))
+
+        @installed_versions = T.let({}, T::Hash[String, String])
+        @registries = T.let({}, T::Hash[String, String])
+
+        @language = T.let(nil, T.nilable(Ecosystem::VersionManager))
+        @language_requirement = T.let(nil, T.nilable(Requirement))
+      end
+
+      sig { returns(Ecosystem::VersionManager) }
+      def package_manager
+        package_manager_by_name(ECOSYSTEM)
+      end
+
+      sig { returns(Ecosystem::VersionManager) }
+      def language
+        @language ||= Language.new(
+          raw_version: Helpers.node_version,
+          requirement: language_requirement
+        )
+      end
+
+      sig { returns(T.nilable(Requirement)) }
+      def language_requirement
+        @language_requirement ||= find_engine_constraints_as_requirement(Language::NAME)
+      end
+
+      # rubocop:disable Metrics/PerceivedComplexity
+      # rubocop:disable Metrics/AbcSize
+      sig { params(name: String).returns(T.nilable(Requirement)) }
+      def find_engine_constraints_as_requirement(name)
+        Dependabot.logger.info("Processing engine constraints for #{name}")
+
+        return nil unless @engines.is_a?(Hash) && @engines[name]
+
+        raw_constraint = @engines[name].to_s.strip
+        return nil if raw_constraint.empty?
+
+        if Dependabot::Experiments.enabled?(:enable_engine_version_detection)
+          constraints = ConstraintHelper.extract_ruby_constraints(raw_constraint)
+          # When constraints are invalid we return constraints array nil
+          if constraints.nil?
+            Dependabot.logger.warn(
+              "Unrecognized constraint format for #{name}: #{raw_constraint}"
+            )
+          end
+        else
+          raw_constraints = raw_constraint.split
+          constraints = raw_constraints.map do |constraint|
+            case constraint
+            when /^\d+$/
+              ">=#{constraint}.0.0 <#{constraint.to_i + 1}.0.0"
+            when /^\d+\.\d+$/
+              ">=#{constraint} <#{constraint.split('.').first.to_i + 1}.0.0"
+            when /^\d+\.\d+\.\d+$/
+              "=#{constraint}"
+            else
+              Dependabot.logger.warn("Unrecognized constraint format for #{name}: #{constraint}")
+              constraint
+            end
+          end
+
+        end
+
+        if constraints && !constraints.empty?
+          Dependabot.logger.info("Parsed constraints for #{name}: #{constraints.join(', ')}")
+          Requirement.new(constraints)
+        end
+      rescue StandardError => e
+        Dependabot.logger.error("Error processing constraints for #{name}: #{e.message}")
+        nil
+      end
+      # rubocop:enable Metrics/AbcSize
+      # rubocop:enable Metrics/PerceivedComplexity
+
+      # rubocop:disable Metrics/CyclomaticComplexity
+      # rubocop:disable Metrics/PerceivedComplexity
+      sig { params(name: String).returns(T.nilable(T.any(Integer, String))) }
+      def setup(name)
+        # we prioritize version mentioned in "packageManager" instead of "engines"
+        # i.e. if { engines : "pnpm" : "6" } and { packageManager: "pnpm@6.0.2" },
+        # we go for the specificity mentioned in packageManager (6.0.2)
+
+        unless @manifest_package_manager&.start_with?("#{name}@") ||
+               (@manifest_package_manager&.==name.to_s) ||
+               @manifest_package_manager.nil?
+          return
+        end
+
+        return package_manager.version.to_s if package_manager.deprecated? || package_manager.unsupported?
+
+        if @engines && @manifest_package_manager.nil?
+          # if "packageManager" doesn't exists in manifest file,
+          # we check if we can extract "engines" information
+          version = check_engine_version(name)
+
+        elsif @manifest_package_manager&.==name.to_s
+          # if "packageManager" is found but no version is specified (i.e. pnpm@1.2.3),
+          # we check if we can get "engines" info to override default version
+          version = check_engine_version(name) if @engines
+
+        elsif @manifest_package_manager&.start_with?("#{name}@")
+          # if "packageManager" info has version specification i.e. yarn@3.3.1
+          # we go with the version in "packageManager"
+          Dependabot.logger.info(
+            "Found \"#{MANIFEST_PACKAGE_MANAGER_KEY}\" : \"#{@manifest_package_manager}\". " \
+            "Skipped checking \"#{MANIFEST_ENGINES_KEY}\"."
+          )
+        end
+
+        version ||= requested_version(name)
+        version ||= guessed_version(name)
+
+        version
+      end
+      # rubocop:enable Metrics/CyclomaticComplexity
+      # rubocop:enable Metrics/PerceivedComplexity
+      sig { params(name: String).returns(T.nilable(String)) }
+      def detect_version(name)
+        # Prioritize version mentioned in "packageManager" instead of "engines"
+        if @manifest_package_manager&.start_with?("#{name}@")
+          detected_version = @manifest_package_manager.split("@").last.to_s
+        end
+
+        # If "packageManager" has no version specified, check if we can extract "engines" information
+        detected_version ||= check_engine_version(name) if detected_version.to_s.empty?
+
+        # If neither "packageManager" nor "engines" have versions, infer version from lockfileVersion
+        detected_version ||= guessed_version(name) if detected_version.to_s.empty?
+
+        # Strip and validate version format
+        detected_version_string = detected_version.to_s.strip
+
+        # Ensure detected_version is neither "0" nor invalid format
+        return if detected_version_string == "0" || !detected_version_string.match?(ConstraintHelper::VERSION_REGEX)
+
+        detected_version_string
+      end
+
+      sig { params(name: String).returns(Ecosystem::VersionManager) }
+      def package_manager_by_name(name)
+        detected_version = detect_version(name)
+
+        # if we have a detected version, we check if it is deprecated or unsupported
+        if detected_version
+          package_manager = BunPackageManager.new(
+            detected_version: detected_version.to_s
+          )
+          return package_manager if package_manager.deprecated? || package_manager.unsupported?
+        end
+
+        BunPackageManager.new(
+          detected_version: detected_version,
+          raw_version: installed_version
+        )
+      end
+
+      sig { returns(T.nilable(String)) }
+      def installed_version
+        Helpers.bun_version
+      end
+
+      private
+
+      sig { params(name: String).returns(T.nilable(String)) }
+      def requested_version(name)
+        return unless @manifest_package_manager
+
+        match = @manifest_package_manager.match(/^#{name}@(?<version>\d+.\d+.\d+)/)
+        return unless match
+
+        Dependabot.logger.info("Requested version #{match['version']}")
+        match["version"]
+      end
+
+      sig { params(name: String).returns(T.nilable(T.any(Integer, String))) }
+      def guessed_version(name)
+        lockfile = @lockfiles[name.to_sym]
+        return unless lockfile
+
+        version = Helpers.send(:"#{name}_version_numeric", lockfile)
+
+        Dependabot.logger.info("Guessed version info \"#{name}\" : \"#{version}\"")
+
+        version
+      end
+
+      sig { params(name: T.untyped).returns(T.nilable(String)) }
+      def check_engine_version(name)
+        return if @package_json.nil?
+
+        version_selector = VersionSelector.new
+
+        engine_versions = version_selector.setup(@package_json, name, BunPackageManager::SUPPORTED_VERSIONS)
+
+        return if engine_versions.empty?
+
+        version = engine_versions[name]
+        Dependabot.logger.info("Returned (#{MANIFEST_ENGINES_KEY}) info \"#{name}\" : \"#{version}\"")
+        version
+      end
+    end
+  end
+end

data/lib/dependabot/bun/package_name.rb

@@ -0,0 +1,118 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module Bun
+    class PackageName
+      extend T::Sig
+
+      # NPM package naming rules are defined by the following projects:
+      # - https://github.com/npm/npm-user-validate
+      # - https://github.com/npm/validate-npm-package-name
+      PACKAGE_NAME_REGEX = %r{
+        \A                                          # beginning of string
+        (?=.{1,214}\z)                              # enforce length (1 - 214)
+        (@(?<scope>                                 # capture 'scope' if present
+          [a-z0-9\-\_\.\!\~\*\'\(\)]+               # URL-safe characters in scope
+        )\/)?                                       # scope must be followed by slash
+        (?<name>                                    # capture package name
+          (?(<scope>)                               # if scope is present
+            [a-z0-9\-\_\.\!\~\*\'\(\)]+             # scoped names can start with any URL-safe character
+          |                                         # if no scope
+            [a-z0-9\-\!\~\*\'\(\)]                  # non-scoped names cannot start with . or _
+            [a-z0-9\-\_\.\!\~\*\'\(\)]*             # subsequent characters can be any URL-safe character
+          )
+        )
+        \z                                          # end of string
+      }xi # multi-line/case-insensitive
+
+      TYPES_PACKAGE_NAME_REGEX = %r{
+          \A                                          # beginning of string
+          @types\/                                    # starts with @types/
+          ((?<scope>.+)__)?                           # capture scope
+          (?<name>.+)                                 # capture name
+          \z                                          # end of string
+      }xi # multi-line/case-insensitive
+
+      class InvalidPackageName < StandardError; end
+
+      sig { params(string: String).void }
+      def initialize(string)
+        match = PACKAGE_NAME_REGEX.match(string.to_s)
+        raise InvalidPackageName unless match
+
+        @scope = T.let(match[:scope], T.nilable(String))
+        @name = T.let(match[:name], T.nilable(String))
+      end
+
+      sig { returns(String) }
+      def to_s
+        if scoped?
+          "@#{@scope}/#{@name}"
+        else
+          @name.to_s
+        end
+      end
+
+      sig { params(other: PackageName).returns(T::Boolean) }
+      def eql?(other)
+        self.class == other.class && to_s == other.to_s
+      end
+
+      sig { returns(Integer) }
+      def hash
+        to_s.downcase.hash
+      end
+
+      sig { params(other: PackageName).returns(T.nilable(Integer)) }
+      def <=>(other)
+        to_s.casecmp(other.to_s)
+      end
+
+      sig { returns(T.nilable(PackageName)) }
+      def library_name
+        return unless types_package?
+        return @library_name if defined?(@library_name)
+
+        lib_name =
+          begin
+            match = T.must(TYPES_PACKAGE_NAME_REGEX.match(to_s))
+            if match[:scope]
+              self.class.new("@#{match[:scope]}/#{match[:name]}")
+            else
+              self.class.new(match[:name].to_s)
+            end
+          end
+
+        @library_name ||= T.let(lib_name, T.nilable(PackageName))
+      end
+
+      sig { returns(T.nilable(PackageName)) }
+      def types_package_name
+        return if types_package?
+
+        @types_package_name ||= T.let(
+          if scoped?
+            self.class.new("@types/#{@scope}__#{@name}")
+          else
+            self.class.new("@types/#{@name}")
+          end, T.nilable(PackageName)
+        )
+      end
+
+      private
+
+      sig { returns(T::Boolean) }
+      def scoped?
+        !@scope.nil?
+      end
+
+      sig { returns(T.nilable(T::Boolean)) }
+      def types_package?
+        "types".casecmp?(@scope)
+      end
+    end
+  end
+end