dependabot-bun 0.400.0 → 0.401.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 695147981009a25e1dfdc5b0bb7f6a312a81e7505b91ae1fcf4fe04565e05116
-  data.tar.gz: 60327771f9e963e76b9f77f32ef8be93e945b52d3b94a0ee51eeaa260d30269a
+  metadata.gz: 6911ce58a858da72deaee55412e7a9f6f434181fb6eaafafc81a64b0e22fe31a
+  data.tar.gz: 5e63b632ac51775a4283fb4ca4166cd9276a12c13585bac4c411648b9901c667
 SHA512:
-  metadata.gz: c21419897e7d901b04ebcfa4f4a09600b69ce29bef225d4884dde567b45c1d09162ef6d8622385d6ba43e358b26782cf182669fe827f5ea5298f3f2480c88a84
-  data.tar.gz: 1fbfcb079150eef24eb36562200565e38cfd65654843258f54eb3d2fd21f4fb8b1cc0f3e64101fa4bf284dec22bb9f3ac456ba9cb946f250d7f12b55ca0981a2
+  metadata.gz: 3c11b9f089126fe325f9ee718521def2ff8ad105a49ba883116a76f423bd07de38930c33e63487b41842babe2375b44efad8943b26adb83c224c885f6ee499c9
+  data.tar.gz: bf9388f37be2732c47a40fe19b7d1613644c92747dafff37cf51e595ab3b496a6542b09de507fd2f3c14ec4e4dc46ce171a64936f872e14898b56caa81d6645d

data/lib/dependabot/bun/file_parser.rb

@@ -30,6 +30,7 @@ module Dependabot
       require_relative "file_parser/lockfile_parser"
 
       DEPENDENCY_TYPES = %w(dependencies devDependencies optionalDependencies).freeze
+      DEFAULT_CATALOG = "default"
       ALIAS_PROTOCOL = "npm:"
       GIT_URL_REGEX = %r{
         (?<git_prefix>^|^git.*?|^github:|^bitbucket:|^gitlab:|github\.com/)
@@ -63,6 +64,7 @@ module Dependabot
         dependency_set = DependencySet.new
         dependency_set += manifest_dependencies
         dependency_set += lockfile_dependencies
+        dependency_set += catalog_dependencies
 
         dependencies = Helpers.dependencies_with_all_versions_metadata(dependency_set)
 
@@ -202,11 +204,34 @@ module Dependabot
         lockfile_parser.parse_set
       end
 
+      sig { returns(Dependabot::FileParsers::Base::DependencySet) }
+      def catalog_dependencies
+        dependency_set = DependencySet.new
+        document = package_json_document
+        catalogs = [[DEFAULT_CATALOG, document.catalog], *document.catalogs.to_a]
+
+        catalogs.each do |catalog_name, entries|
+          entries.each do |name, requirement|
+            # Catalog entries are production dependencies, as pnpm catalogs are in npm_and_yarn.
+            dep = build_dependency(
+              file: package_json,
+              type: "dependencies",
+              name: name,
+              requirement: requirement,
+              catalog: catalog_name
+            )
+            dependency_set << dep if dep
+          end
+        end
+
+        dependency_set
+      end
+
       sig do
-        params(file: DependencyFile, type: String, name: String, requirement: String)
+        params(file: DependencyFile, type: String, name: String, requirement: String, catalog: T.nilable(String))
           .returns(T.nilable(Dependency))
       end
-      def build_dependency(file:, type:, name:, requirement:)
+      def build_dependency(file:, type:, name:, requirement:, catalog: nil)
         lockfile_details = lockfile_parser.lockfile_details(
           dependency_name: name,
           requirement: requirement,
@@ -243,11 +268,17 @@ module Dependabot
             requirement: requirement_for(requirement),
             file: file.name,
             groups: [type],
-            source: source_for(name, requirement, lockfile_details)
+            source: source_for(name, requirement, lockfile_details),
+            **catalog_metadata(catalog)
           }]
         )
       end
 
+      sig { params(catalog: T.nilable(String)).returns(T::Hash[Symbol, T::Hash[Symbol, String]]) }
+      def catalog_metadata(catalog)
+        catalog ? { metadata: { catalog: catalog } } : {}
+      end
+
       sig { override.void }
       def check_required_files
         return if get_original_file(MANIFEST_FILENAME)

data/lib/dependabot/bun/file_updater/json_object_members.rb

@@ -0,0 +1,127 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+require "dependabot/bun/file_updater"
+
+module Dependabot
+  module Bun
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      # Locates object members in JSON source text, so they can be edited in
+      # place without reformatting the document.
+      class JsonObjectMembers
+        extend T::Sig
+
+        # Maps each member of the JSON object opening at `start` whose value is
+        # an object to the range of that value in `content`.
+        sig { params(content: String, start: Integer).returns(T::Hash[String, T::Range[Integer]]) }
+        def self.objects(content, start)
+          new(content, start).objects
+        end
+
+        # Maps each member of the JSON object opening at `start` whose value is
+        # a string to the range of that value, quotes included, in `content`.
+        sig { params(content: String, start: Integer).returns(T::Hash[String, T::Range[Integer]]) }
+        def self.strings(content, start)
+          new(content, start).strings
+        end
+
+        sig { returns(T::Hash[String, T::Range[Integer]]) }
+        attr_reader :objects
+
+        sig { returns(T::Hash[String, T::Range[Integer]]) }
+        attr_reader :strings
+
+        sig { params(content: String, start: Integer).void }
+        def initialize(content, start)
+          @objects = T.let({}, T::Hash[String, T::Range[Integer]])
+          @strings = T.let({}, T::Hash[String, T::Range[Integer]])
+          @depth = T.let(0, Integer)
+          @key = T.let(nil, T.nilable(String))
+          @value_start = T.let(nil, T.nilable(Integer))
+          @string = T.let(nil, T.nilable(String))
+          @last_string = T.let(nil, T.nilable(String))
+          @escaped = T.let(false, T::Boolean)
+          scan(content, start)
+        end
+
+        private
+
+        sig { params(content: String, start: Integer).void }
+        def scan(content, start)
+          T.must(content[start..]).each_char.with_index(start) do |char, index|
+            if @string
+              read_string(@string, char, index)
+            else
+              read_structure(char, index)
+              break if @depth.zero?
+            end
+          end
+        end
+
+        sig { params(string: String, char: String, index: Integer).void }
+        def read_string(string, char, index)
+          if @escaped
+            @escaped = false
+          elsif char == "\\"
+            @escaped = true
+          elsif char == "\""
+            close_string(string, index)
+            return
+          end
+
+          string << char
+        end
+
+        sig { params(char: String, index: Integer).void }
+        def read_structure(char, index)
+          case char
+          when "\"" then open_string(index)
+          when ":" then @key = @last_string if @depth == 1
+          when "," then @key = nil if @depth == 1
+          when "{", "[" then enter(char, index)
+          when "}", "]" then leave(index)
+          end
+        end
+
+        sig { params(index: Integer).void }
+        def open_string(index)
+          @string = +""
+          @value_start = index if @depth == 1 && @key
+        end
+
+        sig { params(string: String, index: Integer).void }
+        def close_string(string, index)
+          value = T.cast(JSON.parse("\"#{string}\""), String)
+          @last_string = value
+          @string = nil
+          record(@strings, index) if @depth == 1
+        end
+
+        sig { params(char: String, index: Integer).void }
+        def enter(char, index)
+          @value_start = index if @depth == 1 && char == "{" && @key
+          @depth += 1
+        end
+
+        sig { params(index: Integer).void }
+        def leave(index)
+          @depth -= 1
+          record(@objects, index) if @depth == 1
+        end
+
+        sig { params(members: T::Hash[String, T::Range[Integer]], index: Integer).void }
+        def record(members, index)
+          key = @key
+          value_start = @value_start
+          return unless key && value_start
+
+          members[key] = value_start..index
+          @value_start = nil
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bun/file_updater/package_json_updater.rb

@@ -3,7 +3,10 @@
 
 require "sorbet-runtime"
 
+require "dependabot/bun/file_parser"
 require "dependabot/bun/file_updater"
+require "dependabot/bun/file_updater/json_object_members"
+require "dependabot/package/npm_package_json"
 
 module Dependabot
   module Bun
@@ -93,7 +96,10 @@ module Dependabot
         def old_requirement(dependency, new_requirement)
           T.must(dependency.previous_requirements)
            .select { |r| r.file == package_json.name }
-           .find { |r| r.groups == new_requirement.groups }
+           .find do |r|
+             r.groups == new_requirement.groups &&
+               r.metadata_string("catalog") == new_requirement.metadata_string("catalog")
+           end
         end
 
         sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::DependencyRequirement]) }
@@ -131,6 +137,17 @@ module Dependabot
             .returns(String)
         end
         def update_package_json_declaration(package_json_content:, new_req:, dependency_name:, old_req:)
+          catalog = new_req.metadata_string("catalog")
+          if catalog
+            return update_catalog_declaration(
+              catalog: catalog,
+              content: package_json_content,
+              dependency_name: dependency_name,
+              old_req: old_req,
+              new_req: new_req
+            )
+          end
+
           original_line = declaration_line(
             dependency_name: dependency_name,
             dependency_req: old_req,
@@ -323,6 +340,72 @@ module Dependabot
           end
         end
 
+        # Bun reads catalogs only from `NpmPackageJson#catalog_container`, so
+        # the entry is looked up and replaced among those catalogs' members.
+        sig do
+          params(
+            catalog: String,
+            content: String,
+            dependency_name: String,
+            old_req: T.nilable(Dependabot::DependencyRequirement),
+            new_req: Dependabot::DependencyRequirement
+          )
+            .returns(String)
+        end
+        def update_catalog_declaration(catalog:, content:, dependency_name:, old_req:, new_req:)
+          value_ranges = catalog_ranges(catalog, content).filter_map do |range|
+            JsonObjectMembers.strings(content, range.begin)[dependency_name]
+          end
+
+          # Replacing from the end keeps the earlier ranges valid.
+          value_ranges.sort_by(&:begin).reverse.each_with_object(content.dup) do |range, updated|
+            value = updated_catalog_value(dependency_name, T.must(updated[range]), old_req, new_req)
+            updated[range] = value if value
+          end
+        end
+
+        # The default catalog is `catalog` together with `catalogs.default`.
+        sig { params(catalog: String, content: String).returns(T::Array[T::Range[Integer]]) }
+        def catalog_ranges(catalog, content)
+          root_start = content.index("{")
+          return [] unless root_start
+
+          fields = JsonObjectMembers.objects(content, root_start)
+          document = Dependabot::Package::NpmPackageJson.new(JSON.parse(content), package_json.path)
+          container = document.catalog_container
+          if container
+            container_range = fields[container]
+            return [] unless container_range
+
+            fields = JsonObjectMembers.objects(content, container_range.begin)
+          end
+
+          catalogs_range = fields["catalogs"]
+          [
+            (fields["catalog"] if catalog == FileParser::DEFAULT_CATALOG),
+            (JsonObjectMembers.objects(content, catalogs_range.begin)[catalog] if catalogs_range)
+          ].compact
+        end
+
+        # The value is matched and rewritten as a normalized declaration, so
+        # its source formatting never affects the match.
+        sig do
+          params(
+            dependency_name: String,
+            value: String,
+            old_req: T.nilable(Dependabot::DependencyRequirement),
+            new_req: Dependabot::DependencyRequirement
+          )
+            .returns(T.nilable(String))
+        end
+        def updated_catalog_value(dependency_name, value, old_req, new_req)
+          prefix = %("#{dependency_name}": )
+          line = prefix + JSON.generate(JSON.parse(value))
+          return if declaration_line(dependency_name: dependency_name, dependency_req: old_req, content: line).empty?
+
+          replacement_declaration_line(original_line: line, old_req: old_req, new_req: new_req).delete_prefix(prefix)
+        end
+
         sig { params(string: String).returns(Integer) }
         def closing_bracket_index(string)
           closes_required = 1

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.400.0
+  version: 0.401.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.401.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.401.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -323,6 +323,7 @@ files:
 - lib/dependabot/bun/file_parser/lockfile_parser.rb
 - lib/dependabot/bun/file_updater.rb
 - lib/dependabot/bun/file_updater/bun_lockfile_updater.rb
+- lib/dependabot/bun/file_updater/json_object_members.rb
 - lib/dependabot/bun/file_updater/npmrc_builder.rb
 - lib/dependabot/bun/file_updater/package_json_preparer.rb
 - lib/dependabot/bun/file_updater/package_json_updater.rb
@@ -355,7 +356,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.401.0
 rdoc_options: []
 require_paths:
 - lib