dependabot-bun 0.398.0 → 0.399.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ab75a705da7df78c2196ab5b502fc5a9292b0a202482604b18cd9b7871ca64b5
-  data.tar.gz: e7d596c1782e717d6ab703aa2d32b925c8d4dd6b052e4a11221084cd35bac4a9
+  metadata.gz: d59bf33354551f9161677330979c54091111a200a40fca829414ef1a248dee2e
+  data.tar.gz: 9242abc5d378aa15d36df47f5e2e6affdc746488b1fa9f7dee8b37a1cdd67c25
 SHA512:
-  metadata.gz: 6e9a38ebe8c6e15fac9767f5f99a5b92f6ed6def0eb5abce44a29ae4acac62326c309e8535767e5342a06fe686bb1c6925117ab8e8b943879bf1f2b93ac56e1d
-  data.tar.gz: 282b66e218629492f198b6083835fda5a2fc0035b794c4b66e4019b2223ace16469a05786f591008531949f4485a361a37db90ec503e895984e72b3e112b685f
+  metadata.gz: 6c53fd5237fb74ca862b33716177c4a151f8eafcd44471d174c93a003bd511669536198d03513bc61316e880d288d2c5eb00c769fe5633f4cadd21df8e5438cb
+  data.tar.gz: c9fb0790b0f0945e034fa514a7c02344bfd58ee7f410e4e90cf3d4c3186320556883edae4fc76ca0b4ea321e24879360256ebf7c89e91c80861f9ed7f36610b8

data/helpers/package-lock.json

@@ -6021,9 +6021,10 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
+      "version": "10.7.2",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
+      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
+      "license": "MIT",
       "engines": {
         "node": ">= 12"
       }
@@ -20865,9 +20866,9 @@
       }
     },
     "ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ=="
+      "version": "10.7.2",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
+      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w=="
     },
     "is-arguments": {
       "version": "1.1.0",

data/lib/dependabot/bun/constraint_helper.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/bun/requirement"
 
 module Dependabot
   module Bun
@@ -179,11 +180,35 @@ module Dependabot
       def self.find_highest_version_from_constraint_expression(constraint_expression, dependabot_versions = nil)
         parsed_constraints = parse_constraints(constraint_expression, dependabot_versions)
 
-        return nil unless parsed_constraints
+        return nil if parsed_constraints.nil? || parsed_constraints.empty?
+
+        parsed_versions = parsed_constraints.filter_map { |parsed| parsed[:version] }
+        parsed_versions = parsed_versions.map { |version| Version.new(version) }
+        candidates = T.let(parsed_versions + (dependabot_versions || []), T::Array[Dependabot::Version])
 
-        parsed_constraints
-          .filter_map { |parsed| parsed[:version] } # Extract all versions
-          .max_by { |version| Version.new(version) }
+        return candidates.max&.to_s if unconstrained_expression?(constraint_expression)
+
+        matching_versions_for(constraint_expression, candidates).max&.to_s
+      end
+
+      sig do
+        params(
+          constraint_expression: T.nilable(String),
+          candidates: T::Array[Dependabot::Version]
+        ).returns(T::Array[Dependabot::Version])
+      end
+      def self.matching_versions_for(constraint_expression, candidates)
+        requirements = Requirement.requirements_array(constraint_expression)
+        candidates.select do |version|
+          requirements.any? { |requirement| requirement.satisfied_by?(version) }
+        end
+      end
+
+      sig { params(constraint_expression: T.nilable(String)).returns(T::Boolean) }
+      def self.unconstrained_expression?(constraint_expression)
+        constraint_expression.to_s.split("||").map(&:strip).any? do |group|
+          SEMVER_CONSTANTS.include?(group)
+        end
       end
 
       # Parse all constraints (split by logical OR `||`) and convert to Ruby-compatible constraints.

data/lib/dependabot/bun/requirement.rb

@@ -12,7 +12,7 @@ module Dependabot
     class Requirement < Dependabot::Requirement
       extend T::Sig
 
-      AND_SEPARATOR = /(?<=[a-zA-Z0-9*])\s+(?:&+\s+)?(?!\s*[|-])/
+      AND_SEPARATOR = /(?<=[a-zA-Z0-9*])\s++(?:&++\s++)?(?!\s*+[,|-])/
       OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|+/
 
       # Override the version pattern to allow a 'v' prefix

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.398.0
+  version: 0.399.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.399.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.399.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -355,7 +355,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.398.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
 rdoc_options: []
 require_paths:
 - lib