dependabot-bun 0.394.0 → 0.396.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 58c6e65516abb330782b80eb404d962d2f275f52d283c50849004b0bfd1156e6
-  data.tar.gz: a6ccf3ca258033e75af17af705d6df2daa2ac2c61593b1fbb3756a1ec7721ff2
+  metadata.gz: 8d8c5792f04904252b5cafdfc832e3ffd55327fed710c2192bf9d10c8201ef21
+  data.tar.gz: 18f707c30fc183e89236ed35019a5c7cbb6a8bbeea8be17f0c291544bb881a7a
 SHA512:
-  metadata.gz: 5f7e979b6ea89101fd6257465ae92c00a42a448404ee790fd010cf1be5c60dcaea094933b4a10c77cab94b9560ffaf8528859a6a019a2c5fe4620b5471a590c9
-  data.tar.gz: 43d0c921178052889623bc74cf29e13a46f4d4d631f4f6ae2ce55f2536d170494ea2ba9c13a0b2d3c8533d5e6c3cd905adf445690fbb365b2acc4b539f223f7c
+  metadata.gz: a100f03e67e2dde0fe734fa91c66137508583cbfb38f1006e5c86afce7b511ac383819c04be14b3b0bfb9946fef72c2bc7222e7c066cb7bca7767206c8d4d82e
+  data.tar.gz: 0a67133acfc05a31241115d8a35be5f978d6a63dd6b01b19ca1509cdd0eadb213e3783b0f0bf348d12f1f151bd04558631d1713f20e9f28ad9ffa06c426bda24

data/helpers/package-lock.json

@@ -14521,9 +14521,10 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.1.2",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-      "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
+      "license": "MIT",
       "dependencies": {
         "cssesc": "^3.0.0",
         "util-deprecate": "^1.0.2"
@@ -27148,9 +27149,9 @@
       }
     },
     "postcss-selector-parser": {
-      "version": "6.1.2",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-      "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
       "requires": {
         "cssesc": "^3.0.0",
         "util-deprecate": "^1.0.2"

data/lib/dependabot/bun/constraint_helper.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/bun/dependency_files_filterer.rb

@@ -1,7 +1,8 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/utils"
+require "dependabot/package/npm_package_json"
 require "dependabot/bun/file_parser/lockfile_parser"
 require "sorbet-runtime"
 
@@ -87,7 +88,7 @@ module Dependabot
       def workspaces_lockfile?(lockfile)
         return false unless ["yarn.lock", "package-lock.json", "pnpm-lock.yaml", "bun.lock"].include?(lockfile.name)
 
-        return false unless parsed_root_package_json["workspaces"] || dependency_files.any? do |file|
+        return false unless root_package_json_document.workspaces? || dependency_files.any? do |file|
           file.name.end_with?("pnpm-workspace.yaml") && File.dirname(file.name) == File.dirname(lockfile.name)
         end
 
@@ -114,14 +115,14 @@ module Dependabot
         )
       end
 
-      sig { returns(T::Hash[String, T.untyped]) }
-      def parsed_root_package_json
-        @parsed_root_package_json ||= T.let(
+      sig { returns(Dependabot::Package::NpmPackageJson) }
+      def root_package_json_document
+        @root_package_json_document ||= T.let(
           begin
             package = T.must(dependency_files.find { |f| f.name == "package.json" })
-            JSON.parse(T.must(package.content))
+            Dependabot::Package::NpmPackageJson.from_file(package)
           end,
-          T.nilable(T::Hash[String, T.untyped])
+          T.nilable(Dependabot::Package::NpmPackageJson)
         )
       end
 

data/lib/dependabot/bun/dependency_grapher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -110,17 +110,15 @@ module Dependabot
       def fetch_package_relationships
         return {} unless lockfile
 
-        parsed_lockfile = FileParser::BunLock.new(T.must(lockfile)).parsed
-        packages = parsed_lockfile.fetch("packages", nil)
-        return {} unless packages.is_a?(Hash)
+        packages = FileParser::BunLock.new(T.must(lockfile)).records
+        return {} unless packages
 
-        # bun.lock entries are arrays: ["{name}@{version}", registry, {details}, integrity]
-        packages.each_with_object({}) do |(_key, entry), rels|
-          next unless entry.is_a?(Array) && entry.first.is_a?(String)
+        packages.each_with_object({}) do |(_key, record), rels|
+          next unless record.graph_compatible?
 
-          parent_name = T.must(T.cast(entry.first, String).split(/(?<=\w)\@/).first)
-          children = entry.dig(2, "dependencies")&.keys
-          next unless children&.any?
+          parent_name = record.name
+          children = record.dependency_names
+          next if children.empty?
 
           rels[parent_name] = children
         end

data/lib/dependabot/bun/file_fetcher.rb

@@ -116,7 +116,7 @@ module Dependabot
       def package_manager_helper
         @package_manager_helper ||= T.let(
           PackageManagerHelper.new(
-            parsed_package_json,
+            Dependabot::Package::NpmPackageManagerConfig.from_package_json(parsed_package_json),
             lockfiles,
             registry_config_files,
             credentials

data/lib/dependabot/bun/file_parser/bun_lock/record.rb

@@ -0,0 +1,101 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/bun/file_parser/bun_lock"
+require "dependabot/package/npm_lockfile_details"
+
+module Dependabot
+  module Bun
+    class FileParser < Dependabot::FileParsers::Base
+      class BunLock
+        class Record
+          extend T::Sig
+
+          sig { params(data: Object, path: String, context: String).void }
+          def initialize(data, path:, context:)
+            @data = data
+            @path = path
+            @context = context
+            @entry = T.let(nil, T.nilable(T::Array[Object]))
+          end
+
+          sig { returns(T::Boolean) }
+          def graph_compatible?
+            data = @data
+            data.is_a?(Array) && T.cast(data.first, Object).is_a?(String)
+          end
+
+          sig { returns(String) }
+          def name
+            name = resolution_label.split(/(?<=\w)\@/).first
+            invalid!("#{@context}[0] must contain a package name") unless name
+
+            name
+          end
+
+          sig { returns(T.nilable(String)) }
+          def version
+            Version.semver_for(package_resolution)&.to_s
+          end
+
+          sig { returns(Dependabot::Package::NpmLockfileDetails) }
+          def lookup_details
+            semver = version
+            Dependabot::Package::NpmLockfileDetails.new(
+              version: semver,
+              resolution: semver ? nil : package_resolution
+            )
+          end
+
+          sig { returns(T::Array[String]) }
+          def dependency_names
+            details = entry[2]
+            return [] if details.nil?
+
+            invalid!("#{@context} details must be an object") unless details.is_a?(Hash)
+            dependencies = T.cast(details["dependencies"], Object)
+            return [] if dependencies.nil?
+
+            invalid!("#{@context}.dependencies must be an object") unless dependencies.is_a?(Hash)
+            dependencies.keys.map do |raw_name|
+              child = T.cast(raw_name, Object)
+              invalid!("#{@context}.dependencies keys must be strings") unless child.is_a?(String)
+
+              child
+            end
+          end
+
+          private
+
+          sig { returns(T::Array[Object]) }
+          def entry
+            return @entry if @entry
+
+            data = @data
+            invalid!("#{@context} must be an array") unless data.is_a?(Array)
+            @entry = data.map { |value| T.cast(value, Object) }
+          end
+
+          sig { returns(String) }
+          def resolution_label
+            label = entry.first
+            invalid!("#{@context}[0] must be a string") unless label.is_a?(String)
+
+            label
+          end
+
+          sig { returns(T.nilable(String)) }
+          def package_resolution
+            resolution_label.split(/(?<=\w)\@/)[1]
+          end
+
+          sig { params(message: String).returns(T.noreturn) }
+          def invalid!(message)
+            raise DependencyFileNotParseable.new(@path, "Invalid bun.lock file: #{message}")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bun/file_parser/bun_lock.rb

@@ -1,8 +1,9 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "yaml"
 require "dependabot/errors"
+require "dependabot/bun/file_parser"
 require "dependabot/bun/bun_package_manager"
 require "dependabot/bun/helpers"
 require "sorbet-runtime"
@@ -13,22 +14,19 @@ module Dependabot
       class BunLock
         extend T::Sig
 
+        require_relative "bun_lock/record"
+
         sig { params(dependency_file: DependencyFile).void }
         def initialize(dependency_file)
           @dependency_file = dependency_file
+          @parsed = T.let(nil, T.nilable(T::Hash[Object, Object]))
+          @records = T.let(nil, T.nilable(T::Hash[String, Record]))
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
+        sig { returns(T::Hash[Object, Object]) }
         def parsed
           @parsed ||= begin
-            content = begin
-              # Since bun.lock is a JSONC file, which is a subset of YAML, we can use YAML to parse it
-              YAML.load(T.must(@dependency_file.content))
-            rescue Psych::SyntaxError => e
-              raise_invalid!("malformed JSONC at line #{e.line}, column #{e.column}")
-            end
-            raise_invalid!("expected to be an object") unless content.is_a?(Hash)
-
+            content = parse_document
             version = content["lockfileVersion"]
             raise_invalid!("expected 'lockfileVersion' to be an integer") unless version.is_a?(Integer)
             raise_invalid!("expected 'lockfileVersion' to be >= 0") unless version >= 0
@@ -45,7 +43,23 @@ module Dependabot
               end
             end
 
-            T.let(content, T.untyped)
+            content
+          end
+        end
+        private :parsed
+
+        sig { returns(T.nilable(T::Hash[String, Record])) }
+        def records
+          return @records if @records
+
+          packages = parsed["packages"]
+          return unless packages.is_a?(Hash)
+
+          @records = packages.to_h do |raw_key, value|
+            key = T.cast(raw_key, Object)
+            raise_invalid!("expected package keys to be strings") unless key.is_a?(String)
+
+            [key, Record.new(T.cast(value, Object), path: @dependency_file.path, context: "packages.#{key}")]
           end
         end
 
@@ -56,24 +70,19 @@ module Dependabot
           # bun.lock v0 format:
           # https://github.com/oven-sh/bun/blob/c130df6c589fdf28f9f3c7f23ed9901140bc9349/src/install/bun.lock.zig#L595-L605
 
-          packages = parsed["packages"]
-          raise_invalid!("expected 'packages' to be an object") unless packages.is_a?(Hash)
-
-          packages.each do |key, details|
-            raise_invalid!("expected 'packages.#{key}' to be an array") unless details.is_a?(Array)
+          packages = records
+          raise_invalid!("expected 'packages' to be an object") unless packages
 
-            resolution = details.first
-            raise_invalid!("expected 'packages.#{key}[0]' to be a string") unless resolution.is_a?(String)
-
-            name, version = resolution.split(/(?<=\w)\@/)
+          packages.each_value do |record|
+            name = record.name
             next if name.empty?
 
-            semver = Version.semver_for(version)
+            semver = record.version
             next unless semver
 
             dependency_set << Dependency.new(
               name: name,
-              version: semver.to_s,
+              version: semver,
               package_manager: "bun",
               requirements: []
             )
@@ -83,33 +92,27 @@ module Dependabot
         end
 
         sig do
-          params(dependency_name: String, requirement: T.untyped, _manifest_name: String)
-            .returns(T.nilable(T::Hash[String, T.untyped]))
+          params(dependency_name: String, _requirement: T.nilable(String), _manifest_name: String)
+            .returns(T.nilable(Dependabot::Package::NpmLockfileDetails))
         end
-        def details(dependency_name, requirement, _manifest_name)
-          packages = parsed["packages"]
-          return unless packages.is_a?(Hash)
-
-          candidates =
-            packages
-            .select { |name, _| name == dependency_name }
-            .values
-
-          # If there's only one entry for this dependency, use it, even if
-          # the requirement in the lockfile doesn't match
-          if candidates.one?
-            parse_details(candidates.first)
-          else
-            candidate = candidates.find do |label, _|
-              label.scan(/(?<=\w)\@(?:npm:)?([^\s,]+)/).flatten.include?(requirement)
-            end&.last
-            parse_details(candidate)
-          end
+        def details(dependency_name, _requirement, _manifest_name)
+          records&.[](dependency_name)&.lookup_details
         end
 
         private
 
-        sig { params(message: String).void }
+        sig { returns(T::Hash[Object, Object]) }
+        def parse_document
+          # Since bun.lock is a JSONC file, which is a subset of YAML, we can use YAML to parse it
+          content = T.cast(YAML.load(T.must(@dependency_file.content)), Object)
+          raise_invalid!("expected to be an object") unless content.is_a?(Hash)
+
+          content.to_h { |key, value| [T.cast(key, Object), T.cast(value, Object)] }
+        rescue Psych::SyntaxError => e
+          raise_invalid!("malformed JSONC at line #{e.line}, column #{e.column}")
+        end
+
+        sig { params(message: String).returns(T.noreturn) }
         def raise_invalid!(message)
           raise Dependabot::DependencyFileNotParseable.new(@dependency_file.path, "Invalid bun.lock file: #{message}")
         end
@@ -124,40 +127,6 @@ module Dependabot
                 "The bun version Dependabot runs supports up to " \
                 "#{BunPackageManager::MAX_SUPPORTED_LOCKFILE_VERSION}."
         end
-
-        sig do
-          params(entry: T.nilable(T::Array[T.untyped])).returns(T.nilable(T::Hash[String, T.untyped]))
-        end
-        def parse_details(entry)
-          return unless entry.is_a?(Array)
-
-          # Either:
-          # - "{name}@{version}", registry, details, integrity
-          # - "{name}@{resolution}", details
-          resolution = entry.first
-          return unless resolution.is_a?(String)
-
-          name, version = resolution.split(/(?<=\w)\@/)
-          semver = Version.semver_for(version)
-
-          if semver
-            registry, details, integrity = entry[1..3]
-            {
-              "name" => name,
-              "version" => semver.to_s,
-              "registry" => registry,
-              "details" => details,
-              "integrity" => integrity
-            }
-          else
-            details = entry[1]
-            {
-              "name" => name,
-              "resolution" => version,
-              "details" => details
-            }
-          end
-        end
       end
     end
   end

data/lib/dependabot/bun/file_parser/lockfile_parser.rb

@@ -4,6 +4,7 @@
 require "dependabot/dependency_file"
 require "dependabot/bun/file_parser"
 require "dependabot/bun/helpers"
+require "dependabot/package/npm_lockfile_details"
 require "sorbet-runtime"
 
 module Dependabot
@@ -45,10 +46,10 @@ module Dependabot
 
         sig do
           params(dependency_name: String, requirement: T.nilable(String), manifest_name: String)
-            .returns(T.nilable(T::Hash[String, T.untyped]))
+            .returns(T.nilable(Dependabot::Package::NpmLockfileDetails))
         end
         def lockfile_details(dependency_name:, requirement:, manifest_name:)
-          details = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+          details = T.let(nil, T.nilable(Dependabot::Package::NpmLockfileDetails))
           potential_lockfiles_for_manifest(manifest_name).each do |lockfile|
             details = lockfile_for(lockfile).details(dependency_name, requirement, manifest_name)
 

data/lib/dependabot/bun/file_parser.rb

@@ -5,6 +5,8 @@
 
 require "cgi/escape"
 require "dependabot/dependency"
+require "dependabot/package/npm_lockfile_details"
+require "dependabot/package/npm_package_json"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/shared_helpers"
@@ -98,7 +100,7 @@ module Dependabot
       def package_manager_helper
         @package_manager_helper ||= T.let(
           PackageManagerHelper.new(
-            parsed_package_json,
+            package_json_document.package_manager_config,
             lockfiles,
             registry_config_files,
             credentials
@@ -121,9 +123,9 @@ module Dependabot
         }
       end
 
-      sig { returns(T.untyped) }
-      def parsed_package_json
-        JSON.parse(T.must(package_json.content))
+      sig { returns(Dependabot::Package::NpmPackageJson) }
+      def package_json_document
+        Dependabot::Package::NpmPackageJson.from_file(package_json)
       rescue JSON::ParserError
         raise Dependabot::DependencyFileNotParseable, package_json.path
       end
@@ -162,16 +164,14 @@ module Dependabot
         dependency_set = DependencySet.new
 
         package_files.each do |file|
-          json = JSON.parse(T.must(file.content))
+          manifest = Dependabot::Package::NpmPackageJson.from_file(file)
 
           # TODO: Currently, Dependabot can't handle flat dependency files
           # (and will error at the FileUpdater stage, because the
           # UpdateChecker doesn't take account of flat resolution).
-          next if json["flat"]
-
-          self.class.each_dependency(json) do |name, requirement, type|
-            next unless requirement.is_a?(String)
+          next if manifest.flat?
 
+          manifest.each_dependency do |name, requirement, type|
             # Skip dependencies using Yarn workspace cross-references as requirements
             next if requirement.start_with?("workspace:", "catalog:")
 
@@ -202,7 +202,7 @@ module Dependabot
       end
 
       sig do
-        params(file: DependencyFile, type: T.untyped, name: String, requirement: String)
+        params(file: DependencyFile, type: String, name: String, requirement: String)
           .returns(T.nilable(Dependency))
       end
       def build_dependency(file:, type:, name:, requirement:)
@@ -303,14 +303,14 @@ module Dependabot
       def workspace_package_names
         @workspace_package_names ||= T.let(
           package_files.filter_map do |f|
-            JSON.parse(T.must(f.content))["name"]
+            Dependabot::Package::NpmPackageJson.from_file(f).name
           end,
           T.nilable(T::Array[String])
         )
       end
 
       sig do
-        params(requirement: String, lockfile_details: T.nilable(T::Hash[String, T.untyped]))
+        params(requirement: String, lockfile_details: T.nilable(Dependabot::Package::NpmLockfileDetails))
           .returns(T.nilable(T.any(String, Integer, Gem::Version)))
       end
       def version_for(requirement, lockfile_details)
@@ -332,10 +332,10 @@ module Dependabot
         end
       end
 
-      sig { params(lockfile_details: T.nilable(T::Hash[String, T.untyped])).returns(T.nilable(String)) }
+      sig { params(lockfile_details: T.nilable(Dependabot::Package::NpmLockfileDetails)).returns(T.nilable(String)) }
       def git_revision_for(lockfile_details)
-        version = T.cast(lockfile_details&.fetch("version", nil), T.nilable(String))
-        resolved = T.cast(lockfile_details&.fetch("resolved", nil), T.nilable(String))
+        version = lockfile_details&.version
+        resolved = lockfile_details&.resolved
         [
           version&.split("#")&.last,
           resolved&.split("#")&.last,
@@ -375,11 +375,11 @@ module Dependabot
       end
 
       sig do
-        params(lockfile_details: T.nilable(T::Hash[String, T.untyped]))
+        params(lockfile_details: T.nilable(Dependabot::Package::NpmLockfileDetails))
           .returns(T.nilable(T.any(String, Integer, Gem::Version)))
       end
       def lockfile_version_for(lockfile_details)
-        semver_version_for(lockfile_details&.fetch("version", ""))
+        semver_version_for(lockfile_details&.version)
       end
 
       sig { params(version: T.nilable(String)).returns(T.nilable(T.any(String, Integer, Gem::Version))) }
@@ -398,17 +398,17 @@ module Dependabot
       end
 
       sig do
-        params(name: String, requirement: String, lockfile_details: T.nilable(T::Hash[String, T.untyped]))
+        params(name: String, requirement: String, lockfile_details: T.nilable(Dependabot::Package::NpmLockfileDetails))
           .returns(T.nilable(T::Hash[Symbol, T.untyped]))
       end
       def source_for(name, requirement, lockfile_details)
         return git_source_for(requirement) if git_url?(requirement)
 
-        resolved_url = lockfile_details&.fetch("resolved", nil)
+        resolved_url = lockfile_details&.resolved
 
-        resolution = lockfile_details&.fetch("resolution", nil)
-        package_match = resolution&.match(/__archiveUrl=(?<package_url>.+)/)
-        resolved_url = CGI.unescape(package_match.named_captures.fetch("package_url", "")) if package_match
+        resolution = lockfile_details&.resolution
+        package_url = resolution&.[](/__archiveUrl=(.+)/, 1)
+        resolved_url = CGI.unescape(package_url) if package_url
 
         return unless resolved_url
         return unless resolved_url.start_with?("http")

data/lib/dependabot/bun/package_manager.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"
@@ -9,6 +9,7 @@ require "dependabot/bun/registry_helper"
 require "dependabot/bun/bun_package_manager"
 require "dependabot/bun/language"
 require "dependabot/bun/constraint_helper"
+require "dependabot/package/npm_package_manager_config"
 
 module Dependabot
   module Bun
@@ -59,22 +60,21 @@ module Dependabot
 
       sig do
         params(
-          package_json: T.nilable(T::Hash[String, T.untyped]),
+          config: Dependabot::Package::NpmPackageManagerConfig,
           lockfiles: T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)],
           registry_config_files: T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)],
           credentials: T.nilable(T::Array[Dependabot::Credential])
         ).void
       end
-      def initialize(package_json, lockfiles, registry_config_files, credentials)
-        @package_json = package_json
+      def initialize(config, lockfiles, registry_config_files, credentials)
         @lockfiles = lockfiles
         @registry_helper = T.let(
           RegistryHelper.new(registry_config_files, credentials),
           Dependabot::Bun::RegistryHelper
         )
 
-        @manifest_package_manager = T.let(package_json&.fetch(MANIFEST_PACKAGE_MANAGER_KEY, nil), T.nilable(String))
-        @engines = T.let(package_json&.fetch(MANIFEST_ENGINES_KEY, nil), T.nilable(T::Hash[String, T.untyped]))
+        @manifest_package_manager = T.let(config.package_manager, T.nilable(String))
+        @engines = T.let(config.engines, T.nilable(T::Hash[String, String]))
 
         @installed_versions = T.let({}, T::Hash[String, String])
         @registries = T.let({}, T::Hash[String, String])
@@ -105,9 +105,9 @@ module Dependabot
       def find_engine_constraints_as_requirement(name)
         Dependabot.logger.info("Processing engine constraints for #{name}")
 
-        return nil unless @engines.is_a?(Hash) && @engines[name]
+        return nil unless @engines
 
-        raw_constraint = @engines[name].to_s.strip
+        raw_constraint = @engines.fetch(name, "").strip
         return nil if raw_constraint.empty?
 
         constraints = ConstraintHelper.extract_ruby_constraints(raw_constraint)
@@ -227,25 +227,25 @@ module Dependabot
         match["version"]
       end
 
-      sig { params(name: String).returns(T.nilable(T.any(Integer, String))) }
+      sig { params(name: String).returns(T.nilable(Integer)) }
       def guessed_version(name)
         lockfile = @lockfiles[name.to_sym]
         return unless lockfile
 
-        version = Helpers.send(:"#{name}_version_numeric", lockfile)
+        version = Helpers.bun_version_numeric(lockfile)
 
         Dependabot.logger.info("Guessed version info \"#{name}\" : \"#{version}\"")
 
         version
       end
 
-      sig { params(name: T.untyped).returns(T.nilable(String)) }
+      sig { params(name: String).returns(T.nilable(String)) }
       def check_engine_version(name)
-        return if @package_json.nil?
+        return unless @engines
 
         version_selector = VersionSelector.new
 
-        engine_versions = version_selector.setup(@package_json, name, BunPackageManager::SUPPORTED_VERSIONS)
+        engine_versions = version_selector.setup(@engines, name, BunPackageManager::SUPPORTED_VERSIONS)
 
         return if engine_versions.empty?
 

data/lib/dependabot/bun/update_checker/version_resolver.rb

@@ -18,7 +18,7 @@ require "dependabot/bun/update_checker"
 require "dependabot/bun/version"
 require "dependabot/shared_helpers"
 
-# rubocop:disable Metrics/ClassLength
+# rubocop:disable-next Metrics/ClassLength
 module Dependabot
   module Bun
     class UpdateChecker
@@ -749,4 +749,3 @@ module Dependabot
     end
   end
 end
-# rubocop:enable Metrics/ClassLength

data/lib/dependabot/bun/version_selector.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"
@@ -10,29 +10,27 @@ module Dependabot
       extend T::Sig
       extend T::Helpers
 
-      # Sets up engine versions from the given manifest JSON.
+      # Sets up the requested engine version from the manifest engines.
       #
-      # @param manifest_json [Hash] The manifest JSON containing version information.
+      # @param engine_versions [Hash] The manifest engine constraints.
       # @param name [String] The engine name to match.
       # @return [Hash] A hash with selected versions, if found.
       sig do
         params(
-          manifest_json: T::Hash[String, T.untyped],
+          engine_versions: T.nilable(T::Hash[String, String]),
           name: String,
           dependabot_versions: T.nilable(T::Array[Dependabot::Version])
         )
-          .returns(T::Hash[Symbol, T.untyped])
+          .returns(T::Hash[String, T.nilable(String)])
       end
-      def setup(manifest_json, name, dependabot_versions = nil)
-        engine_versions = manifest_json["engines"]
-
+      def setup(engine_versions, name, dependabot_versions = nil)
         # Return an empty hash if no engine versions are specified
         return {} if engine_versions.nil?
 
-        versions = {}
+        versions = T.let({}, T::Hash[String, T.nilable(String)])
 
         engine_versions.each do |engine, value|
-          next unless engine.to_s == name
+          next unless engine == name
 
           versions[name] = ConstraintHelper.find_highest_version_from_constraint_expression(
             value, dependabot_versions

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.394.0
+  version: 0.396.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.396.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.396.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -178,19 +178,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -319,6 +319,7 @@ files:
 - lib/dependabot/bun/file_fetcher/path_dependency_builder.rb
 - lib/dependabot/bun/file_parser.rb
 - lib/dependabot/bun/file_parser/bun_lock.rb
+- lib/dependabot/bun/file_parser/bun_lock/record.rb
 - lib/dependabot/bun/file_parser/lockfile_parser.rb
 - lib/dependabot/bun/file_updater.rb
 - lib/dependabot/bun/file_updater/bun_lockfile_updater.rb
@@ -354,7 +355,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.396.0
 rdoc_options: []
 require_paths:
 - lib