dependabot-bun 0.381.0 → 0.382.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c54b6f5779dd69e7bf57b6d84c31cb0423036cc6c9d4ec91b3533c1bbfee20bc
-  data.tar.gz: 3f342ce13012ef46e9217e3820ae68b4897ad6d216effc5f81c7a7e259d534d4
+  metadata.gz: 7d5fede6dbe516bce6f4872b3594e7b563060a41e5c3339b976074157e5d9a2c
+  data.tar.gz: 7f23ed14942549352db6a020e42fcc5e080d69225bdbb99b5e0406a4587c6049
 SHA512:
-  metadata.gz: 631d537ea8a25dcf0bc80552838d164fa567aa94f3f9ddfcc1090cc09a7152f85f6f8f70b0b9b77fda89c99a1cece272ef2de0ea0bb4d5be5f777eb775b40bd7
-  data.tar.gz: a746e9199c513c37616937412a6c857708b04be39dfa6434a34fafdf666180d8ff174a277f7d7b34fa3d34669543fcf776f22e8c4a9e645d3a4be0030d4e98a9
+  metadata.gz: dabbe51b19f87e3db4f6bdc678d414e19f50d137285269e76be2aa594fe6bb4f53250814eee0ed1369deada39f2a05a9fe3a3b25329e6c3a1a51234a2847ad83
+  data.tar.gz: 7ad8d0cd4a368b556a9ddfc4e52fb61a7fc5c0d26a5c42fc1458989c4f4f93b406d91f0589bd83ae6c925507a2f406aa7b58ddeddc2882fec0de2e42e9518874

data/helpers/lib/pnpm/lockfile-parser.js

@@ -72,7 +72,7 @@ function nameVerDevFromPkgSnapshot(depPath, pkgSnapshot, projectSnapshots) {
   return {
     name: name,
     version: version,
-    resolved: pkgSnapshot.resolution.tarball,
+    resolved: pkgSnapshot.resolution?.tarball,
     dev: pkgSnapshot.dev,
     specifiers: specifiers,
     aliased: aliased

data/helpers/test/pnpm/fixtures/parser/lockfile_v9/pnpm-lock.yaml

@@ -0,0 +1,23 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    devDependencies:
+      etag:
+        specifier: ^1.0.0
+        version: 1.8.1
+
+packages:
+
+  etag@1.8.1:
+    resolution: {integrity: sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==}
+    engines: {node: '>= 0.6'}
+
+snapshots:
+
+  etag@1.8.1: {}

data/helpers/test/pnpm/lockfile-parser.test.js

@@ -59,4 +59,21 @@ describe("generates an updated pnpm lock for the original file", () => {
         expect(result.length).toEqual(9);
     })
 
+    // pnpm v9+ lockfiles don't have resolution.tarball for npm packages
+    it("that uses lockfileVersion 9.0 format without resolution.tarball", async () =>{
+        copyDependencies("lockfile_v9", tempDir);
+        const result = await parseLockfile(tempDir);
+
+        expect(result).toEqual([
+            {
+                name: 'etag',
+                version: '1.8.1',
+                resolved: undefined,
+                dev: undefined,
+                specifiers: [ '^1.0.0' ],
+                aliased: false
+            }
+        ]);
+    })
+
 })

data/lib/dependabot/bun/registry_parser.rb

@@ -6,6 +6,8 @@ require "sorbet-runtime"
 module Dependabot
   module Bun
     class RegistryParser
+      # NOTE: npm_and_yarn has an equivalent implementation in
+      # npm_and_yarn/registry_parser.rb. Keep both in sync.
       extend T::Sig
 
       sig { params(resolved_url: String, credentials: T::Array[Dependabot::Credential]).void }
@@ -60,34 +62,68 @@ module Dependabot
       sig { returns(T::Array[Dependabot::Credential]) }
       attr_reader :credentials
 
-      # rubocop:disable Metrics/PerceivedComplexity
       sig { returns(T.nilable(String)) }
       def url_for_relevant_cred
-        resolved_url_host = URI(resolved_url).host
+        resolved_uri = URI(resolved_url)
 
         credential_matching_url =
           credentials
           .select { |cred| cred["type"] == "npm_registry" && cred["registry"] }
           .sort_by { |cred| cred.fetch("registry").length }
-          .find do |details|
-            next true if resolved_url_host == details["registry"]
-
-            uri = if details["registry"]&.include?("://")
-                    URI(details.fetch("registry"))
-                  else
-                    URI("https://#{details['registry']}")
-                  end
-            resolved_url_host == uri.host && resolved_url.include?(details.fetch("registry"))
-          end
+          .find { |details| credential_matches?(details, resolved_uri: resolved_uri) }
 
         return unless credential_matching_url
 
-        # Trim the resolved URL so that it ends at the same point as the
-        # credential registry
         reg = credential_matching_url.fetch("registry")
-        resolved_url.gsub(/#{Regexp.quote(reg)}.*/, "") + reg
+        # When the credential registry already includes an explicit scheme, return
+        # it directly — the gsub pattern would not match and would produce a
+        # malformed string if it ran.
+        return reg if reg.include?("://")
+
+        build_registry_url(registry: reg, resolved_uri: resolved_uri)
+      end
+
+      sig { params(registry: String, resolved_uri: URI::Generic).returns(String) }
+      def build_registry_url(registry:, resolved_uri:)
+        credential_uri = URI("https://#{registry}")
+        normalized_path = credential_uri.path.to_s.chomp("/")
+
+        "#{resolved_uri.scheme}://#{resolved_uri.authority}#{normalized_path}"
+      end
+
+      # Enforce npm registry credential boundaries by matching on host, optional
+      # explicit scheme, and full path segments so sibling paths on the same host
+      # cannot inherit credentials configured for a different registry scope.
+      sig { params(details: Dependabot::Credential, resolved_uri: URI::Generic).returns(T::Boolean) }
+      def credential_matches?(details, resolved_uri:)
+        resolved_url_host = resolved_uri.host
+        return true if resolved_url_host == details["registry"]
+
+        registry_has_scheme = details["registry"]&.include?("://")
+        uri = if registry_has_scheme
+                URI(details.fetch("registry"))
+              else
+                URI("https://#{details['registry']}")
+              end
+        return false unless resolved_url_host == uri.host
+        # When the credential includes an explicit scheme, require scheme
+        # equality so we do not attribute a URL to credentials configured for
+        # a different transport protocol.
+        return false if registry_has_scheme && resolved_uri.scheme != uri.scheme
+
+        # Use path-segment-aware matching to prevent credentials configured
+        # for one path-scoped registry from being applied to sibling paths
+        # on the same host (e.g., /victim-npm should not match /victim-npm-evil).
+        credential_path_match?(uri: uri, resolved_url_path: resolved_uri.path.to_s)
+      end
+
+      sig { params(uri: URI::Generic, resolved_url_path: String).returns(T::Boolean) }
+      def credential_path_match?(uri:, resolved_url_path:)
+        registry_path = uri.path.to_s.chomp("/")
+        registry_path.empty? ||
+          resolved_url_path.start_with?("#{registry_path}/") ||
+          resolved_url_path == registry_path
       end
-      # rubocop:enable Metrics/PerceivedComplexity
     end
   end
 end

data/lib/dependabot/bun/update_checker.rb

@@ -51,7 +51,7 @@ module Dependabot
       )
         @latest_version = T.let(nil, T.nilable(T.any(String, Gem::Version)))
         @latest_resolvable_version = T.let(nil, T.nilable(T.any(String, Dependabot::Version)))
-        @updated_requirements = T.let(nil, T.nilable(T::Array[T::Hash[Symbol, T.untyped]]))
+        @updated_requirements = T.let(nil, T.nilable(T::Array[Dependabot::DependencyRequirement]))
         @vulnerability_audit = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
         @vulnerable_versions = T.let(nil, T.nilable(T::Array[T.any(String, Gem::Version)]))
 
@@ -161,7 +161,7 @@ module Dependabot
         T.unsafe(version_resolver.latest_resolvable_previous_version(updated_version))
       end
 
-      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
         resolvable_version =
           if preferred_resolvable_version.is_a?(version_class)
@@ -176,12 +176,14 @@ module Dependabot
           end
 
         @updated_requirements ||=
-          RequirementsUpdater.new(
-            requirements: dependency.requirements,
-            updated_source: updated_source,
-            latest_resolvable_version: resolvable_version,
-            update_strategy: T.must(requirements_update_strategy)
-          ).updated_requirements
+          wrap_requirements(
+            RequirementsUpdater.new(
+              requirements: dependency.requirements,
+              updated_source: updated_source,
+              latest_resolvable_version: resolvable_version,
+              update_strategy: T.must(requirements_update_strategy)
+            ).updated_requirements
+          )
       end
 
       sig { returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.381.0
+  version: 0.382.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.382.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.382.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -282,6 +282,7 @@ files:
 - helpers/test/npm6/helpers.js
 - helpers/test/npm6/updater.test.js
 - helpers/test/pnpm/fixtures/parser/empty_version/pnpm-lock.yaml
+- helpers/test/pnpm/fixtures/parser/lockfile_v9/pnpm-lock.yaml
 - helpers/test/pnpm/fixtures/parser/no_lockfile_change/pnpm-lock.yaml
 - helpers/test/pnpm/fixtures/parser/only_dev_dependencies/pnpm-lock.yaml
 - helpers/test/pnpm/fixtures/parser/peer_disambiguation/pnpm-lock.yaml
@@ -349,7 +350,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.381.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0
 rdoc_options: []
 require_paths:
 - lib