dependabot-bun 0.381.0 → 0.383.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c54b6f5779dd69e7bf57b6d84c31cb0423036cc6c9d4ec91b3533c1bbfee20bc
-  data.tar.gz: 3f342ce13012ef46e9217e3820ae68b4897ad6d216effc5f81c7a7e259d534d4
+  metadata.gz: a134971ae7d59b607f29131dd5154cfe58103aee0e00119ce6c110d5375f40af
+  data.tar.gz: 222bf7c881b859998596d439158d23ae057c473739f9429e72341c2b07b64d2e
 SHA512:
-  metadata.gz: 631d537ea8a25dcf0bc80552838d164fa567aa94f3f9ddfcc1090cc09a7152f85f6f8f70b0b9b77fda89c99a1cece272ef2de0ea0bb4d5be5f777eb775b40bd7
-  data.tar.gz: a746e9199c513c37616937412a6c857708b04be39dfa6434a34fafdf666180d8ff174a277f7d7b34fa3d34669543fcf776f22e8c4a9e645d3a4be0030d4e98a9
+  metadata.gz: '06584381c0b42dad6050cbbe91d79e90ca6964becb15b9c1c8c5abc9229c5486cc96184e10fbdc632fa9fb85536e748dc26f568c43368159d18ee4c558347c10'
+  data.tar.gz: 7b9bdd03f58a4e0aa3a655b8adf704abafe3401ddfb033b8ecb161c049715cbac8083447ac7900d5b75510011ea2381dfa88e90b152bd720e463fd5dff5c7cbf

data/helpers/lib/pnpm/lockfile-parser.js

@@ -72,7 +72,7 @@ function nameVerDevFromPkgSnapshot(depPath, pkgSnapshot, projectSnapshots) {
   return {
     name: name,
     version: version,
-    resolved: pkgSnapshot.resolution.tarball,
+    resolved: pkgSnapshot.resolution?.tarball,
     dev: pkgSnapshot.dev,
     specifiers: specifiers,
     aliased: aliased

data/helpers/test/pnpm/fixtures/parser/lockfile_v9/pnpm-lock.yaml

@@ -0,0 +1,23 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    devDependencies:
+      etag:
+        specifier: ^1.0.0
+        version: 1.8.1
+
+packages:
+
+  etag@1.8.1:
+    resolution: {integrity: sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==}
+    engines: {node: '>= 0.6'}
+
+snapshots:
+
+  etag@1.8.1: {}

data/helpers/test/pnpm/lockfile-parser.test.js

@@ -59,4 +59,21 @@ describe("generates an updated pnpm lock for the original file", () => {
         expect(result.length).toEqual(9);
     })
 
+    // pnpm v9+ lockfiles don't have resolution.tarball for npm packages
+    it("that uses lockfileVersion 9.0 format without resolution.tarball", async () =>{
+        copyDependencies("lockfile_v9", tempDir);
+        const result = await parseLockfile(tempDir);
+
+        expect(result).toEqual([
+            {
+                name: 'etag',
+                version: '1.8.1',
+                resolved: undefined,
+                dev: undefined,
+                specifiers: [ '^1.0.0' ],
+                aliased: false
+            }
+        ]);
+    })
+
 })

data/lib/dependabot/bun/registry_parser.rb

@@ -6,6 +6,8 @@ require "sorbet-runtime"
 module Dependabot
   module Bun
     class RegistryParser
+      # NOTE: npm_and_yarn has an equivalent implementation in
+      # npm_and_yarn/registry_parser.rb. Keep both in sync.
       extend T::Sig
 
       sig { params(resolved_url: String, credentials: T::Array[Dependabot::Credential]).void }
@@ -60,34 +62,68 @@ module Dependabot
       sig { returns(T::Array[Dependabot::Credential]) }
       attr_reader :credentials
 
-      # rubocop:disable Metrics/PerceivedComplexity
       sig { returns(T.nilable(String)) }
       def url_for_relevant_cred
-        resolved_url_host = URI(resolved_url).host
+        resolved_uri = URI(resolved_url)
 
         credential_matching_url =
           credentials
           .select { |cred| cred["type"] == "npm_registry" && cred["registry"] }
           .sort_by { |cred| cred.fetch("registry").length }
-          .find do |details|
-            next true if resolved_url_host == details["registry"]
-
-            uri = if details["registry"]&.include?("://")
-                    URI(details.fetch("registry"))
-                  else
-                    URI("https://#{details['registry']}")
-                  end
-            resolved_url_host == uri.host && resolved_url.include?(details.fetch("registry"))
-          end
+          .find { |details| credential_matches?(details, resolved_uri: resolved_uri) }
 
         return unless credential_matching_url
 
-        # Trim the resolved URL so that it ends at the same point as the
-        # credential registry
         reg = credential_matching_url.fetch("registry")
-        resolved_url.gsub(/#{Regexp.quote(reg)}.*/, "") + reg
+        # When the credential registry already includes an explicit scheme, return
+        # it directly — the gsub pattern would not match and would produce a
+        # malformed string if it ran.
+        return reg if reg.include?("://")
+
+        build_registry_url(registry: reg, resolved_uri: resolved_uri)
+      end
+
+      sig { params(registry: String, resolved_uri: URI::Generic).returns(String) }
+      def build_registry_url(registry:, resolved_uri:)
+        credential_uri = URI("https://#{registry}")
+        normalized_path = credential_uri.path.to_s.chomp("/")
+
+        "#{resolved_uri.scheme}://#{resolved_uri.authority}#{normalized_path}"
+      end
+
+      # Enforce npm registry credential boundaries by matching on host, optional
+      # explicit scheme, and full path segments so sibling paths on the same host
+      # cannot inherit credentials configured for a different registry scope.
+      sig { params(details: Dependabot::Credential, resolved_uri: URI::Generic).returns(T::Boolean) }
+      def credential_matches?(details, resolved_uri:)
+        resolved_url_host = resolved_uri.host
+        return true if resolved_url_host == details["registry"]
+
+        registry_has_scheme = details["registry"]&.include?("://")
+        uri = if registry_has_scheme
+                URI(details.fetch("registry"))
+              else
+                URI("https://#{details['registry']}")
+              end
+        return false unless resolved_url_host == uri.host
+        # When the credential includes an explicit scheme, require scheme
+        # equality so we do not attribute a URL to credentials configured for
+        # a different transport protocol.
+        return false if registry_has_scheme && resolved_uri.scheme != uri.scheme
+
+        # Use path-segment-aware matching to prevent credentials configured
+        # for one path-scoped registry from being applied to sibling paths
+        # on the same host (e.g., /victim-npm should not match /victim-npm-evil).
+        credential_path_match?(uri: uri, resolved_url_path: resolved_uri.path.to_s)
+      end
+
+      sig { params(uri: URI::Generic, resolved_url_path: String).returns(T::Boolean) }
+      def credential_path_match?(uri:, resolved_url_path:)
+        registry_path = uri.path.to_s.chomp("/")
+        registry_path.empty? ||
+          resolved_url_path.start_with?("#{registry_path}/") ||
+          resolved_url_path == registry_path
       end
-      # rubocop:enable Metrics/PerceivedComplexity
     end
   end
 end

data/lib/dependabot/bun/update_checker/requirements_updater.rb

@@ -11,6 +11,7 @@ require "sorbet-runtime"
 require "dependabot/bun/requirement"
 require "dependabot/bun/update_checker"
 require "dependabot/bun/version"
+require "dependabot/dependency_requirement"
 require "dependabot/requirements_update_strategy"
 
 module Dependabot
@@ -33,7 +34,7 @@ module Dependabot
 
         sig do
           params(
-            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            requirements: T::Array[Dependabot::DependencyRequirement],
             updated_source: T.nilable(T::Hash[Symbol, T.untyped]),
             update_strategy: Dependabot::RequirementsUpdateStrategy,
             latest_resolvable_version: T.nilable(T.any(String, Gem::Version))
@@ -46,7 +47,10 @@ module Dependabot
           update_strategy:,
           latest_resolvable_version:
         )
-          @requirements = requirements
+          @requirements = T.let(
+            requirements.map { |req| Dependabot::DependencyRequirement.create(req) },
+            T::Array[Dependabot::DependencyRequirement]
+          )
           @updated_source = updated_source
           @update_strategy = update_strategy
 
@@ -60,12 +64,12 @@ module Dependabot
           )
         end
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         def updated_requirements
           return requirements if update_strategy.lockfile_only?
 
           requirements.map do |req|
-            req = req.merge(source: updated_source)
+            req = Dependabot::DependencyRequirement.create(req.merge(source: updated_source))
             next req unless latest_resolvable_version
             next initial_req_after_source_change(req) unless req[:requirement]
             next req if req[:requirement].match?(/^([A-Za-uw-z]|v[^\d])/)
@@ -82,7 +86,7 @@ module Dependabot
 
         private
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
         sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
@@ -109,15 +113,15 @@ module Dependabot
           original_source&.fetch(:type) == "git"
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def initial_req_after_source_change(req)
           return req unless updating_from_git_to_npm?
           return req unless req[:requirement].nil?
 
-          req.merge(requirement: "^#{latest_resolvable_version}")
+          Dependabot::DependencyRequirement.create(req.merge(requirement: "^#{latest_resolvable_version}"))
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_version_requirement(req)
           current_requirement = req[:requirement]
 
@@ -126,14 +130,14 @@ module Dependabot
             return req if ruby_req&.satisfied_by?(latest_resolvable_version)
 
             updated_req = update_range_requirement(current_requirement)
-            return req.merge(requirement: updated_req)
+            return Dependabot::DependencyRequirement.create(req.merge(requirement: updated_req))
           end
 
           reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
-          req.merge(requirement: update_version_string(reqs.first))
+          Dependabot::DependencyRequirement.create(req.merge(requirement: update_version_string(reqs.first)))
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_version_requirement_if_needed(req)
           current_requirement = req[:requirement]
           version = latest_resolvable_version
@@ -145,7 +149,7 @@ module Dependabot
           update_version_requirement(req)
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def widen_requirement(req)
           current_requirement = req[:requirement]
           version = latest_resolvable_version
@@ -165,7 +169,7 @@ module Dependabot
               current_requirement
             end
 
-          req.merge(requirement: updated_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: updated_requirement))
         end
 
         sig { params(requirement_string: String).returns(T::Array[Bun::Requirement]) }

data/lib/dependabot/bun/update_checker.rb

@@ -51,7 +51,7 @@ module Dependabot
       )
         @latest_version = T.let(nil, T.nilable(T.any(String, Gem::Version)))
         @latest_resolvable_version = T.let(nil, T.nilable(T.any(String, Dependabot::Version)))
-        @updated_requirements = T.let(nil, T.nilable(T::Array[T::Hash[Symbol, T.untyped]]))
+        @updated_requirements = T.let(nil, T.nilable(T::Array[Dependabot::DependencyRequirement]))
         @vulnerability_audit = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
         @vulnerable_versions = T.let(nil, T.nilable(T::Array[T.any(String, Gem::Version)]))
 
@@ -161,7 +161,7 @@ module Dependabot
         T.unsafe(version_resolver.latest_resolvable_previous_version(updated_version))
       end
 
-      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
         resolvable_version =
           if preferred_resolvable_version.is_a?(version_class)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.381.0
+  version: 0.383.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.383.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.383.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -282,6 +282,7 @@ files:
 - helpers/test/npm6/helpers.js
 - helpers/test/npm6/updater.test.js
 - helpers/test/pnpm/fixtures/parser/empty_version/pnpm-lock.yaml
+- helpers/test/pnpm/fixtures/parser/lockfile_v9/pnpm-lock.yaml
 - helpers/test/pnpm/fixtures/parser/no_lockfile_change/pnpm-lock.yaml
 - helpers/test/pnpm/fixtures/parser/only_dev_dependencies/pnpm-lock.yaml
 - helpers/test/pnpm/fixtures/parser/peer_disambiguation/pnpm-lock.yaml
@@ -349,7 +350,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.381.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
 rdoc_options: []
 require_paths:
 - lib