dependabot-bun 0.397.0 → 0.399.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b2b3b0451e9df5a0b011f86aa2350c9dfc0e8144ced6556d1425d4a081af8f3
-  data.tar.gz: 17a5e6489722676fb3b8939e8f3ce6eddb8f8a3e5afb0738edc7d11cdaab3a16
+  metadata.gz: d59bf33354551f9161677330979c54091111a200a40fca829414ef1a248dee2e
+  data.tar.gz: 9242abc5d378aa15d36df47f5e2e6affdc746488b1fa9f7dee8b37a1cdd67c25
 SHA512:
-  metadata.gz: 0e2b0630b65dd996e8099e5d3600fe082fd6f589d2588960ed94df6ded3c180fba7b32b242e3ba07b85fab5f86c581fa25a7238c62d5191e989e6b6bc72de05f
-  data.tar.gz: 33400c832cc9a40a7ca79dde6354eab961e3515194d245e93d7fd2e5909c7b13853f6e3cfc28bb2ff6d76af674eb832b5e43d782f792105f8561cfd43a99bb42
+  metadata.gz: 6c53fd5237fb74ca862b33716177c4a151f8eafcd44471d174c93a003bd511669536198d03513bc61316e880d288d2c5eb00c769fe5633f4cadd21df8e5438cb
+  data.tar.gz: c9fb0790b0f0945e034fa514a7c02344bfd58ee7f410e4e90cf3d4c3186320556883edae4fc76ca0b4ea321e24879360256ebf7c89e91c80861f9ed7f36610b8

data/helpers/package-lock.json

@@ -889,38 +889,41 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.6",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.6.tgz",
-      "integrity": "sha512-YuI2ZHQL78Q5HbhDiBA1X4LmYdXCKCMQIfw0pw7piHJwyREFebJUvrQN4cMssyES6x+vfUbx1CIpaQUKYdQZOw==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
+      "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
-        "@humanwhocodes/retry": "^0.3.0"
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
+        "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
-    "node_modules/@humanfs/node/node_modules/@humanwhocodes/retry": {
-      "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.3.1.tgz",
-      "integrity": "sha512-JBxkERygn7Bv/GbN5Rv8Ul6LVknS+5Bp6RgDC/O8gEBU/yeH5Ui5C/OlWrTb6qct7LjjfT6Re2NxB0ln0yYybA==",
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
       "dev": true,
+      "license": "Apache-2.0",
       "engines": {
-        "node": ">=18.18"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
+        "node": ">=18.18.0"
       }
     },
     "node_modules/@humanwhocodes/module-importer": {
@@ -6018,9 +6021,10 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
+      "version": "10.7.2",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
+      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
+      "license": "MIT",
       "engines": {
         "node": ">= 12"
       }
@@ -17047,29 +17051,31 @@
       }
     },
     "@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
-      "dev": true
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
+      "dev": true,
+      "requires": {
+        "@humanfs/types": "^0.15.0"
+      }
     },
     "@humanfs/node": {
-      "version": "0.16.6",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.6.tgz",
-      "integrity": "sha512-YuI2ZHQL78Q5HbhDiBA1X4LmYdXCKCMQIfw0pw7piHJwyREFebJUvrQN4cMssyES6x+vfUbx1CIpaQUKYdQZOw==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "requires": {
-        "@humanfs/core": "^0.19.1",
-        "@humanwhocodes/retry": "^0.3.0"
-      },
-      "dependencies": {
-        "@humanwhocodes/retry": {
-          "version": "0.3.1",
-          "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.3.1.tgz",
-          "integrity": "sha512-JBxkERygn7Bv/GbN5Rv8Ul6LVknS+5Bp6RgDC/O8gEBU/yeH5Ui5C/OlWrTb6qct7LjjfT6Re2NxB0ln0yYybA==",
-          "dev": true
-        }
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
+        "@humanwhocodes/retry": "^0.4.0"
       }
     },
+    "@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true
+    },
     "@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
@@ -20860,9 +20866,9 @@
       }
     },
     "ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ=="
+      "version": "10.7.2",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
+      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w=="
     },
     "is-arguments": {
       "version": "1.1.0",

data/lib/dependabot/bun/constraint_helper.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/bun/requirement"
 
 module Dependabot
   module Bun
@@ -179,11 +180,35 @@ module Dependabot
       def self.find_highest_version_from_constraint_expression(constraint_expression, dependabot_versions = nil)
         parsed_constraints = parse_constraints(constraint_expression, dependabot_versions)
 
-        return nil unless parsed_constraints
+        return nil if parsed_constraints.nil? || parsed_constraints.empty?
+
+        parsed_versions = parsed_constraints.filter_map { |parsed| parsed[:version] }
+        parsed_versions = parsed_versions.map { |version| Version.new(version) }
+        candidates = T.let(parsed_versions + (dependabot_versions || []), T::Array[Dependabot::Version])
 
-        parsed_constraints
-          .filter_map { |parsed| parsed[:version] } # Extract all versions
-          .max_by { |version| Version.new(version) }
+        return candidates.max&.to_s if unconstrained_expression?(constraint_expression)
+
+        matching_versions_for(constraint_expression, candidates).max&.to_s
+      end
+
+      sig do
+        params(
+          constraint_expression: T.nilable(String),
+          candidates: T::Array[Dependabot::Version]
+        ).returns(T::Array[Dependabot::Version])
+      end
+      def self.matching_versions_for(constraint_expression, candidates)
+        requirements = Requirement.requirements_array(constraint_expression)
+        candidates.select do |version|
+          requirements.any? { |requirement| requirement.satisfied_by?(version) }
+        end
+      end
+
+      sig { params(constraint_expression: T.nilable(String)).returns(T::Boolean) }
+      def self.unconstrained_expression?(constraint_expression)
+        constraint_expression.to_s.split("||").map(&:strip).any? do |group|
+          SEMVER_CONSTANTS.include?(group)
+        end
       end
 
       # Parse all constraints (split by logical OR `||`) and convert to Ruby-compatible constraints.

data/lib/dependabot/bun/requirement.rb

@@ -12,7 +12,7 @@ module Dependabot
     class Requirement < Dependabot::Requirement
       extend T::Sig
 
-      AND_SEPARATOR = /(?<=[a-zA-Z0-9*])\s+(?:&+\s+)?(?!\s*[|-])/
+      AND_SEPARATOR = /(?<=[a-zA-Z0-9*])\s++(?:&++\s++)?(?!\s*+[,|-])/
       OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|+/
 
       # Override the version pattern to allow a 'v' prefix

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.397.0
+  version: 0.399.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -355,7 +355,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.397.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
 rdoc_options: []
 require_paths:
 - lib