dependabot-bun 0.393.0 → 0.395.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 923b839c39e732c6fb6811cf6c9d1d7ec632278e3ea3e53a869091ebbf4ebf3f
-  data.tar.gz: 39e1cf8df33890c3eb795c37ca76d05a13407a0147cbd30c61cd89d192983aed
+  metadata.gz: '0648b7baf73e363870c4861430535dc9f35abf4152baa7d8c7005a8c24a0db17'
+  data.tar.gz: 4fc09e11fbebaf9dd3ca41200fc727b6b01e5bfff5533922bd6965cd3e83c6aa
 SHA512:
-  metadata.gz: 4954f66e622be9eee7f56ab6ce81d65a8874b3308140b63d2c98bf2a0316eead317e296cb71e173b810170047995f9fc9fe9230b543fdbcf1939c2990399a207
-  data.tar.gz: 8f4ed98c474f44bd4f385ea10f54506294776b9b4a6ba2f72150d07c544b9eef60cdd3bddbe5a2ec93ebcf76eaa58281244bb5cebe4c5356d8d213e13225452a
+  metadata.gz: 254c7ce06535deeef02648b0620e3f199a538e934bd1ce24cbd8c454cfe33fb8dcfb1efe8f14ead0d6d208e85505235e3706c9e1da06a925bdd1022e3dc1da1e
+  data.tar.gz: 5ff486306f46d916352f1daa4d0a7288861e84b2dba0b27b614a0beaf07345f78852b2f3c4a6bcce41aa257b60b1cb96aa62e6d735026be411b44596b25bedde

data/helpers/package-lock.json

@@ -14521,9 +14521,10 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.1.2",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-      "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
+      "license": "MIT",
       "dependencies": {
         "cssesc": "^3.0.0",
         "util-deprecate": "^1.0.2"
@@ -27148,9 +27149,9 @@
       }
     },
     "postcss-selector-parser": {
-      "version": "6.1.2",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-      "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
       "requires": {
         "cssesc": "^3.0.0",
         "util-deprecate": "^1.0.2"

data/lib/dependabot/bun/constraint_helper.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/bun/file_fetcher.rb

@@ -116,7 +116,7 @@ module Dependabot
       def package_manager_helper
         @package_manager_helper ||= T.let(
           PackageManagerHelper.new(
-            parsed_package_json,
+            Dependabot::Package::NpmPackageManagerConfig.from_package_json(parsed_package_json),
             lockfiles,
             registry_config_files,
             credentials

data/lib/dependabot/bun/file_parser.rb

@@ -98,7 +98,7 @@ module Dependabot
       def package_manager_helper
         @package_manager_helper ||= T.let(
           PackageManagerHelper.new(
-            parsed_package_json,
+            Dependabot::Package::NpmPackageManagerConfig.from_package_json(parsed_package_json),
             lockfiles,
             registry_config_files,
             credentials

data/lib/dependabot/bun/package/package_details_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "json"
@@ -6,6 +6,7 @@ require "excon"
 require "time"
 require "dependabot/package/package_release"
 require "dependabot/package/package_details"
+require "dependabot/package/npm_registry_package"
 require "dependabot/bun/package/registry_finder"
 
 module Dependabot
@@ -21,17 +22,8 @@ module Dependabot
         API_AUTHORIZATION_VALUE_BASIC_PREFIX = "Basic"
         API_RESPONSE_STATUS_SUCCESS_PREFIX = "2"
 
-        RELEASE_TIME_KEY = "time"
-        RELEASE_VERSIONS_KEY = "versions"
-        RELEASE_DIST_TAGS_KEY = "dist-tags"
         RELEASE_DIST_TAGS_LATEST_KEY = "latest"
-        RELEASE_ENGINES_KEY = "engines"
         RELEASE_LANGUAGE_KEY = "node"
-        RELEASE_DEPRECATION_KEY = "deprecated"
-        RELEASE_REPOSITORY_KEY = "repository"
-        RELEASE_PACKAGE_TYPE_KEY = "type"
-        RELEASE_PACKAGE_TYPE_GIT = "git"
-        RELEASE_PACKAGE_TYPE_NPM = "npm"
 
         REGISTRY_FILE_NPMRC = ".npmrc"
         REGISTRY_FILE_YARNRC = ".yarnrc"
@@ -53,7 +45,7 @@ module Dependabot
           @dependency_files = dependency_files
           @credentials = credentials
 
-          @npm_details = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+          @npm_details = T.let(nil, T.nilable(Dependabot::Package::NpmRegistryPackage))
           @dist_tags = T.let(nil, T.nilable(T::Hash[String, String]))
           @registry_finder = T.let(nil, T.nilable(Package::RegistryFinder))
           @version_endpoint_working = T.let(nil, T.nilable(T::Boolean))
@@ -84,7 +76,7 @@ module Dependabot
           !dist_tags.nil?
         end
 
-        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+        sig { returns(T.nilable(Dependabot::Package::NpmRegistryPackage)) }
         def npm_details
           @npm_details ||= fetch_npm_details
         end
@@ -158,32 +150,26 @@ module Dependabot
 
         sig do
           params(
-            npm_data: T::Hash[String, T.untyped]
+            npm_data: Dependabot::Package::NpmRegistryPackage
           ).returns(T::Array[Dependabot::Package::PackageRelease])
         end
         def parse_versions(npm_data)
-          time_data = fetch_value_from_hash(npm_data, RELEASE_TIME_KEY) || {}
-          versions_data = fetch_value_from_hash(npm_data, RELEASE_VERSIONS_KEY) || {}
+          latest_version = npm_data.dist_tags&.[](RELEASE_DIST_TAGS_LATEST_KEY)
 
-          dist_tags = fetch_value_from_hash(npm_data, RELEASE_DIST_TAGS_KEY)
-          latest_version = fetch_value_from_hash(dist_tags, RELEASE_DIST_TAGS_LATEST_KEY)
-
-          versions_data.filter_map do |version, details|
-            next unless Dependabot::Bun::Version.correct?(version)
-
-            package_type = infer_package_type(details)
+          npm_data.releases.values.filter_map do |release|
+            next unless Dependabot::Bun::Version.correct?(release.version)
 
             Dependabot::Package::PackageRelease.new(
-              version: Version.new(version),
-              released_at: time_data[version] ? Time.parse(time_data[version]) : nil,
+              version: Version.new(release.version),
+              released_at: release.released_at,
               yanked: false,
               yanked_reason: nil,
               downloads: nil,
-              latest: latest_version.to_s == version,
-              url: package_version_url(version),
-              package_type: package_type,
-              language: package_language(details),
-              details: details
+              latest: latest_version == release.version,
+              url: package_version_url(release.version),
+              package_type: release.package_type,
+              language: package_language(release.node_requirement),
+              details: release.details
             )
           end.sort_by(&:version).reverse
         end
@@ -193,39 +179,31 @@ module Dependabot
           "#{dependency_registry}/#{@dependency.name}/v/#{version}"
         end
 
-        sig do
-          params(version_details: T::Hash[String, T.untyped])
-            .returns(T.nilable(Dependabot::Package::PackageLanguage))
-        end
-        def package_language(version_details)
-          # Fetch the engines hash from the version details
-          engines = version_details.is_a?(Hash) ? version_details[RELEASE_ENGINES_KEY] : nil
-          # Check if engines is a hash and fetch the node requirement
-          node_requirement = engines.is_a?(Hash) ? engines.fetch(RELEASE_LANGUAGE_KEY, nil) : nil
-
+        sig { params(node_requirement: T.nilable(String)).returns(T.nilable(Dependabot::Package::PackageLanguage)) }
+        def package_language(node_requirement)
           return nil unless node_requirement
 
-          if node_requirement
-            Dependabot::Package::PackageLanguage.new(
-              name: RELEASE_LANGUAGE_KEY,
-              version: nil,
-              requirement: Requirement.new(node_requirement)
-            )
-          end
+          Dependabot::Package::PackageLanguage.new(
+            name: RELEASE_LANGUAGE_KEY,
+            version: nil,
+            requirement: Requirement.new(node_requirement)
+          )
         rescue Gem::Requirement::BadRequirementError
           nil
         end
 
         sig { returns(T.nilable(T::Hash[String, String])) }
         def dist_tags
-          @dist_tags ||= fetch_value_from_hash(npm_details, RELEASE_DIST_TAGS_KEY)
+          @dist_tags ||= npm_details&.dist_tags
         end
 
-        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+        sig { returns(T.nilable(Dependabot::Package::NpmRegistryPackage)) }
         def fetch_npm_details
           npm_response = fetch_npm_response
           check_npm_response(npm_response) if npm_response
-          JSON.parse(npm_response.body)
+          Dependabot::Package::NpmRegistryPackage.from_json(npm_response.body) do |version|
+            Dependabot::Bun::Version.correct?(version)
+          end
         rescue JSON::ParserError, Excon::Error::Timeout, Excon::Error::Socket, RegistryError => e
           if git_dependency?
             nil
@@ -250,10 +228,10 @@ module Dependabot
           # If a private registry returns a 500 error, check authentication
           return response unless response.status == 500
 
-          auth = fetch_value_from_hash(registry_auth_headers, API_AUTHORIZATION_KEY)
+          auth = registry_auth_headers[API_AUTHORIZATION_KEY]
           return response unless auth
 
-          return response unless auth&.start_with?(API_AUTHORIZATION_VALUE_BASIC_PREFIX)
+          return response unless auth.start_with?(API_AUTHORIZATION_VALUE_BASIC_PREFIX)
 
           decoded_token = Base64.decode64(auth.gsub("#{API_AUTHORIZATION_VALUE_BASIC_PREFIX} ", "")).strip
 
@@ -275,29 +253,6 @@ module Dependabot
           raise DependencyFileNotResolvable, e.message
         end
 
-        sig do
-          params(
-            details: T::Hash[String, T.untyped],
-            git_dependency: T::Boolean
-          )
-            .returns(String)
-        end
-        def infer_package_type(details, git_dependency: false)
-          return RELEASE_PACKAGE_TYPE_GIT if git_dependency
-
-          repository = fetch_value_from_hash(details, RELEASE_REPOSITORY_KEY)
-
-          case repository
-          when String
-            return repository.start_with?("git+") ? RELEASE_PACKAGE_TYPE_GIT : RELEASE_PACKAGE_TYPE_NPM
-          when Hash
-            type = fetch_value_from_hash(repository, RELEASE_PACKAGE_TYPE_KEY)
-            return RELEASE_PACKAGE_TYPE_GIT if type == RELEASE_PACKAGE_TYPE_GIT
-          end
-
-          RELEASE_PACKAGE_TYPE_NPM
-        end
-
         sig { params(npm_response: Excon::Response).void }
         def check_npm_response(npm_response)
           return if git_dependency?
@@ -332,7 +287,7 @@ module Dependabot
           raise RegistryError.new(status, msg)
         end
 
-        sig { params(error: StandardError).void }
+        sig { params(error: StandardError).returns(T.noreturn) }
         def raise_npm_details_error(error)
           raise if dependency_registry == GLOBAL_REGISTRY
           raise unless error.is_a?(Excon::Error::Timeout) || error.is_a?(Excon::Error::Socket)
@@ -372,8 +327,7 @@ module Dependabot
 
         sig { params(npm_response: Excon::Response).returns(T::Boolean) }
         def response_invalid_json?(npm_response)
-          result = JSON.parse(npm_response.body)
-          result.is_a?(Hash) || result.is_a?(Array)
+          T.cast(JSON.parse(npm_response.body), Object)
           false
         rescue JSON::ParserError, TypeError
           true
@@ -423,15 +377,6 @@ module Dependabot
             credentials: credentials
           ).git_dependency?
         end
-
-        # This function safely retrieves a value for a given key from a Hash.
-        # If the hash is valid and the key exists, it will return the value, otherwise nil.
-        sig { params(hash: T.untyped, key: T.untyped).returns(T.untyped) }
-        def fetch_value_from_hash(hash, key)
-          return nil unless hash.is_a?(Hash) # Return nil if the hash is not a Hash
-
-          hash.fetch(key, nil) # Fetch the value for the given key, defaulting to nil if not found
-        end
       end
     end
   end

data/lib/dependabot/bun/package_manager.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"
@@ -9,6 +9,7 @@ require "dependabot/bun/registry_helper"
 require "dependabot/bun/bun_package_manager"
 require "dependabot/bun/language"
 require "dependabot/bun/constraint_helper"
+require "dependabot/package/npm_package_manager_config"
 
 module Dependabot
   module Bun
@@ -59,22 +60,21 @@ module Dependabot
 
       sig do
         params(
-          package_json: T.nilable(T::Hash[String, T.untyped]),
+          config: Dependabot::Package::NpmPackageManagerConfig,
           lockfiles: T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)],
           registry_config_files: T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)],
           credentials: T.nilable(T::Array[Dependabot::Credential])
         ).void
       end
-      def initialize(package_json, lockfiles, registry_config_files, credentials)
-        @package_json = package_json
+      def initialize(config, lockfiles, registry_config_files, credentials)
         @lockfiles = lockfiles
         @registry_helper = T.let(
           RegistryHelper.new(registry_config_files, credentials),
           Dependabot::Bun::RegistryHelper
         )
 
-        @manifest_package_manager = T.let(package_json&.fetch(MANIFEST_PACKAGE_MANAGER_KEY, nil), T.nilable(String))
-        @engines = T.let(package_json&.fetch(MANIFEST_ENGINES_KEY, nil), T.nilable(T::Hash[String, T.untyped]))
+        @manifest_package_manager = T.let(config.package_manager, T.nilable(String))
+        @engines = T.let(config.engines, T.nilable(T::Hash[String, String]))
 
         @installed_versions = T.let({}, T::Hash[String, String])
         @registries = T.let({}, T::Hash[String, String])
@@ -105,9 +105,9 @@ module Dependabot
       def find_engine_constraints_as_requirement(name)
         Dependabot.logger.info("Processing engine constraints for #{name}")
 
-        return nil unless @engines.is_a?(Hash) && @engines[name]
+        return nil unless @engines
 
-        raw_constraint = @engines[name].to_s.strip
+        raw_constraint = @engines.fetch(name, "").strip
         return nil if raw_constraint.empty?
 
         constraints = ConstraintHelper.extract_ruby_constraints(raw_constraint)
@@ -227,25 +227,25 @@ module Dependabot
         match["version"]
       end
 
-      sig { params(name: String).returns(T.nilable(T.any(Integer, String))) }
+      sig { params(name: String).returns(T.nilable(Integer)) }
       def guessed_version(name)
         lockfile = @lockfiles[name.to_sym]
         return unless lockfile
 
-        version = Helpers.send(:"#{name}_version_numeric", lockfile)
+        version = Helpers.bun_version_numeric(lockfile)
 
         Dependabot.logger.info("Guessed version info \"#{name}\" : \"#{version}\"")
 
         version
       end
 
-      sig { params(name: T.untyped).returns(T.nilable(String)) }
+      sig { params(name: String).returns(T.nilable(String)) }
       def check_engine_version(name)
-        return if @package_json.nil?
+        return unless @engines
 
         version_selector = VersionSelector.new
 
-        engine_versions = version_selector.setup(@package_json, name, BunPackageManager::SUPPORTED_VERSIONS)
+        engine_versions = version_selector.setup(@engines, name, BunPackageManager::SUPPORTED_VERSIONS)
 
         return if engine_versions.empty?
 

data/lib/dependabot/bun/update_checker/version_resolver.rb

@@ -18,7 +18,7 @@ require "dependabot/bun/update_checker"
 require "dependabot/bun/version"
 require "dependabot/shared_helpers"
 
-# rubocop:disable Metrics/ClassLength
+# rubocop:disable-next Metrics/ClassLength
 module Dependabot
   module Bun
     class UpdateChecker
@@ -749,4 +749,3 @@ module Dependabot
     end
   end
 end
-# rubocop:enable Metrics/ClassLength

data/lib/dependabot/bun/version_selector.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"
@@ -10,29 +10,27 @@ module Dependabot
       extend T::Sig
       extend T::Helpers
 
-      # Sets up engine versions from the given manifest JSON.
+      # Sets up the requested engine version from the manifest engines.
       #
-      # @param manifest_json [Hash] The manifest JSON containing version information.
+      # @param engine_versions [Hash] The manifest engine constraints.
       # @param name [String] The engine name to match.
       # @return [Hash] A hash with selected versions, if found.
       sig do
         params(
-          manifest_json: T::Hash[String, T.untyped],
+          engine_versions: T.nilable(T::Hash[String, String]),
           name: String,
           dependabot_versions: T.nilable(T::Array[Dependabot::Version])
         )
-          .returns(T::Hash[Symbol, T.untyped])
+          .returns(T::Hash[String, T.nilable(String)])
       end
-      def setup(manifest_json, name, dependabot_versions = nil)
-        engine_versions = manifest_json["engines"]
-
+      def setup(engine_versions, name, dependabot_versions = nil)
         # Return an empty hash if no engine versions are specified
         return {} if engine_versions.nil?
 
-        versions = {}
+        versions = T.let({}, T::Hash[String, T.nilable(String)])
 
         engine_versions.each do |engine, value|
-          next unless engine.to_s == name
+          next unless engine == name
 
           versions[name] = ConstraintHelper.find_highest_version_from_constraint_expression(
             value, dependabot_versions

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.393.0
+  version: 0.395.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -169,28 +169,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -354,7 +354,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
 rdoc_options: []
 require_paths:
 - lib