dependabot-bun 0.373.0 → 0.374.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: abb5e1f25ecdd33bf6c28c71fccea4f1c01d7bb23b3ca5798f241293467b0ba1
-  data.tar.gz: afc63c38afe65774a9086da08373e23839f95fa79257bdd8ec2520dda465171a
+  metadata.gz: 8262719a72e3213f41fe3f1d26d7efb11a622ff03b9f08539216daf9fdf935e2
+  data.tar.gz: a1bafb40bc94437c6b53de4f1796342d731e65bdf03040f1893f110581d61eda
 SHA512:
-  metadata.gz: 5dde7a9d279a88805fb33defbae40ff0c07558e439f2e43573dbc5c9754622d8f27efdf548086b574152d307481f7b61f846a27c4fd320910f9425a11c9d2f2e
-  data.tar.gz: d935d57e7bcdf7cc3d68051aef61512604657ea0e7d71b9485e0d5b21a80910d0c122c14a3e1d927f145f72bb701ef20693fc7de26d1289d7cd4061ce5e16555
+  metadata.gz: bacf85e5f892f22a607f1602c2a60427cf54a0c552d18d34ca97f2130060ee1a968e2312e2dfac6b1be64e61e66db84ea26bf9f266b8049a2213c26f01742a19
+  data.tar.gz: 74752e2ff6f5c595924a2f980fa0177dbaabaa4c99478ac505a221df144f8c137bdc895216a827d4eccf2b196d3bdb26d31207e0cad6540ef24f75338b62b2de

data/lib/dependabot/bun/dependency_grapher.rb

@@ -0,0 +1,101 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/dependency_graphers"
+require "dependabot/dependency_graphers/base"
+require "dependabot/bun/file_parser"
+require "dependabot/bun/file_parser/bun_lock"
+require "dependabot/bun/bun_package_manager"
+
+module Dependabot
+  module Bun
+    class DependencyGrapher < Dependabot::DependencyGraphers::Base
+      extend T::Sig
+
+      sig { override.returns(Dependabot::DependencyFile) }
+      def relevant_dependency_file
+        lockfile || package_json
+      end
+
+      sig { override.void }
+      def prepare!
+        if lockfile.nil?
+          Dependabot.logger.warn("No bun.lock found; dependency graph will be incomplete.")
+          errored_fetching_subdependencies!
+        end
+        super
+      end
+
+      private
+
+      sig { override.params(dependency: Dependabot::Dependency).returns(T::Array[String]) }
+      def fetch_subdependencies(dependency)
+        package_relationships.fetch(dependency.name, [])
+      end
+
+      sig { override.params(_dependency: Dependabot::Dependency).returns(String) }
+      def purl_pkg_for(_dependency)
+        "npm"
+      end
+
+      sig { override.params(dependency: Dependabot::Dependency).returns(String) }
+      def purl_name_for(dependency)
+        dependency.name.sub(/^@/, "%40")
+      end
+
+      sig { returns(Dependabot::DependencyFile) }
+      def package_json
+        return T.must(@package_json) if defined?(@package_json)
+
+        T.must(
+          @package_json = T.let(
+            T.must(dependency_files.find { |f| f.name.end_with?("package.json") }),
+            T.nilable(Dependabot::DependencyFile)
+          )
+        )
+      end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def lockfile
+        return @lockfile if defined?(@lockfile)
+
+        @lockfile = T.let(
+          dependency_files.find { |f| f.name.end_with?(BunPackageManager::LOCKFILE_NAME) },
+          T.nilable(Dependabot::DependencyFile)
+        )
+      end
+
+      sig { returns(T::Hash[String, T::Array[String]]) }
+      def package_relationships
+        @package_relationships ||= T.let(
+          fetch_package_relationships,
+          T.nilable(T::Hash[String, T::Array[String]])
+        )
+      end
+
+      sig { returns(T::Hash[String, T::Array[String]]) }
+      def fetch_package_relationships
+        return {} unless lockfile
+
+        parsed_lockfile = FileParser::BunLock.new(T.must(lockfile)).parsed
+        packages = parsed_lockfile.fetch("packages", nil)
+        return {} unless packages.is_a?(Hash)
+
+        # bun.lock entries are arrays: ["{name}@{version}", registry, {details}, integrity]
+        packages.each_with_object({}) do |(_key, entry), rels|
+          next unless entry.is_a?(Array) && entry.first.is_a?(String)
+
+          parent_name = T.must(T.cast(entry.first, String).split(/(?<=\w)\@/).first)
+          children = entry.dig(2, "dependencies")&.keys
+          next unless children&.any?
+
+          rels[parent_name] = children
+        end
+      end
+    end
+  end
+end
+
+Dependabot::DependencyGraphers.register("bun", Dependabot::Bun::DependencyGrapher)

data/lib/dependabot/bun.rb

@@ -3,6 +3,7 @@
 
 # These all need to be required so the various classes can be registered in a
 # lookup table of package manager names to concrete classes.
+require "dependabot/bun/dependency_grapher"
 require "dependabot/bun/file_fetcher"
 require "dependabot/bun/file_parser"
 require "dependabot/bun/update_checker"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.373.0
+  version: 0.374.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.373.0
+        version: 0.374.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.373.0
+        version: 0.374.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -308,6 +308,7 @@ files:
 - lib/dependabot/bun/bun_package_manager.rb
 - lib/dependabot/bun/constraint_helper.rb
 - lib/dependabot/bun/dependency_files_filterer.rb
+- lib/dependabot/bun/dependency_grapher.rb
 - lib/dependabot/bun/file_fetcher.rb
 - lib/dependabot/bun/file_fetcher/path_dependency_builder.rb
 - lib/dependabot/bun/file_parser.rb
@@ -347,7 +348,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.373.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.374.0
 rdoc_options: []
 require_paths:
 - lib