dependabot-bun 0.326.1 → 0.327.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: abcafb920033a648dda107d341c86eb2dccd59b0a016b9681c490f77401ecb3a
-  data.tar.gz: '099f0b198629c66aab0aa0f92d568ff91a1a4d43536bacd1ed94aeb20ea29b0c'
+  metadata.gz: 01c5fe0976efe49daa9cd4b1bb5f0312f406d6b1f3a15b26958f007449695942
+  data.tar.gz: 4a6e833c389ebe66f3ee65db7a23469ccc6477b705ffc08974fe29e43f3a6b02
 SHA512:
-  metadata.gz: 3ca795eef3dbdfb25c66724e7bc1524c0513238603242cd836326ef12546e8aa7429de3b66c44a956c60c89c7814f76ccd39465bb03085208511aeeade1c674e
-  data.tar.gz: 132f155d09a212683dbd5069c850be1e86bcb5119939f7f001409292e9d61a0955194ad4024dfbad8899f8da4315fbc817f669c77a63a04be723a46aebfc1e07
+  metadata.gz: 2ae287d01812499998379f701a0a0a7d9b0b7ca85c009b7edac4bb7d7e1e404aa276adf671debcc09f0174911316d6389c9c4ab893b3757eefd18afb1802edf0
+  data.tar.gz: a5f6c406a4efe7af69fd65bc4269f03ce64012bf49b6152ff3ce53477beeff060e2118b57ea8b46fcdb88490e01a7eacf04f58f417bcdd9d24b1c6ad912a9771

data/lib/dependabot/bun/metadata_finder.rb

@@ -22,8 +22,8 @@ module Dependabot
         # array can be slow (if it's large)
         return latest_version_listing["homepage"] if latest_version_listing["homepage"]
 
-        listing = all_version_listings.find { |l| l["homepage"] }
-        listing&.fetch("homepage", nil) || super
+        listing = all_version_listings.find { |_, l| l["homepage"] }
+        listing&.last&.fetch("homepage", nil) || super
       end
 
       sig { override.returns(T.nilable(String)) }
@@ -55,8 +55,8 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       def npm_releaser
         all_version_listings
-          .find { |v| v["version"] == dependency.version }
-          &.dig("_npmUser", "name")
+          .find { |v, _| v == dependency.version }
+          &.last&.dig("_npmUser", "name")
       end
 
       sig { returns(T.nilable(T::Array[String])) }
@@ -73,7 +73,7 @@ module Dependabot
 
         all_version_listings
           .reject { |v, _| Time.parse(times[v]) > cutoff }
-          .filter_map { |d| d.fetch("_npmUser", nil)&.fetch("name", nil) }
+          .filter_map { |_, d| d.fetch("_npmUser", nil)&.fetch("name", nil) }
       end
 
       sig { returns(T.nilable(Source)) }
@@ -90,7 +90,7 @@ module Dependabot
         return potential_sources.first if potential_sources.any?
 
         potential_sources =
-          all_version_listings.flat_map do |listing|
+          all_version_listings.flat_map do |_, listing|
             [
               get_source(listing["repository"]),
               get_source(listing["homepage"]),
@@ -110,7 +110,7 @@ module Dependabot
         sources.first
       end
 
-      sig { params(details: T.any(String, T::Hash[String, String])).returns(T.nilable(Source)) }
+      sig { params(details: T.nilable(T.any(String, T::Hash[String, String]))).returns(T.nilable(Source)) }
       def get_source(details)
         potential_url = get_url(details)
         return unless potential_url
@@ -144,7 +144,7 @@ module Dependabot
         "https://github.com/" + url
       end
 
-      sig { params(details: T.any(String, T::Hash[String, String])).returns(T.nilable(String)) }
+      sig { params(details: T.nilable(T.any(String, T::Hash[String, String]))).returns(T.nilable(String)) }
       def get_directory(details)
         # Only return a directory if it is explicitly specified
         return unless details.is_a?(Hash)
@@ -177,7 +177,7 @@ module Dependabot
         @latest_version_listing = T.let({}, T.nilable(T::Hash[String, T.untyped]))
       end
 
-      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+      sig { returns(T::Array[[String, T::Hash[String, T.untyped]]]) }
       def all_version_listings
         return [] if npm_listing["versions"].nil?
 
@@ -208,16 +208,37 @@ module Dependabot
       sig { returns(String) }
       def dependency_url
         registry_url =
-          if new_source.nil? then "https://registry.npmjs.org"
+          if new_source.nil?
+            configured_registry_from_credentials || "https://registry.npmjs.org"
           else
             new_source&.fetch(:url)
           end
 
+        # Remove trailing slashes and escape spaces for proper URL formatting
+        registry_url = URI::DEFAULT_PARSER.escape(registry_url)&.gsub(%r{/+$}, "")
+
         # NPM registries expect slashes to be escaped
         escaped_dependency_name = dependency.name.gsub("/", "%2F")
         "#{registry_url}/#{escaped_dependency_name}"
       end
 
+      sig { returns(T.nilable(String)) }
+      def configured_registry_from_credentials
+        # Look for a credential that replaces the base registry (global registry replacement)
+        replaces_base_cred = credentials.find { |cred| cred["type"] == "npm_registry" && cred.replaces_base? }
+        return normalize_registry_url(replaces_base_cred["registry"]) if replaces_base_cred
+
+        nil
+      end
+
+      sig { params(registry: T.nilable(String)).returns(T.nilable(String)) }
+      def normalize_registry_url(registry)
+        return nil unless registry
+        return registry if registry.start_with?("http")
+
+        "https://#{registry}"
+      end
+
       sig { returns(T::Hash[String, String]) }
       def registry_auth_headers
         return {} unless auth_token

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.326.1
+  version: 0.327.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.326.1
+        version: 0.327.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.326.1
+        version: 0.327.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -347,7 +347,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.326.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.327.0
 rdoc_options: []
 require_paths:
 - lib