dependabot-bun 0.400.0 → 0.402.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 695147981009a25e1dfdc5b0bb7f6a312a81e7505b91ae1fcf4fe04565e05116
-  data.tar.gz: 60327771f9e963e76b9f77f32ef8be93e945b52d3b94a0ee51eeaa260d30269a
+  metadata.gz: e4c9217ef3c6884ac153b6bb6e516709f0440e6d70a2c25e4f795aaf443adb47
+  data.tar.gz: 25430e72661535db6c374dee825b3dcac942f37e98853e47750061f326253602
 SHA512:
-  metadata.gz: c21419897e7d901b04ebcfa4f4a09600b69ce29bef225d4884dde567b45c1d09162ef6d8622385d6ba43e358b26782cf182669fe827f5ea5298f3f2480c88a84
-  data.tar.gz: 1fbfcb079150eef24eb36562200565e38cfd65654843258f54eb3d2fd21f4fb8b1cc0f3e64101fa4bf284dec22bb9f3ac456ba9cb946f250d7f12b55ca0981a2
+  metadata.gz: 97eda92117fac8f2ebeb5883f865cff280b089d8430127b0dbb4da826f2ff24ddf11949181b45ca9f320a23ed3b8f8b4fbf5d2660946a5255f646b115dad5b76
+  data.tar.gz: 9b729c7238e1f784a09500789c26c4eec54c8afe891619600312345a7902cb15feb3ae0230e56744435876b963e4dc054f06eec94974353ef4d696f7642887c8

data/lib/dependabot/bun/file_parser.rb

@@ -30,6 +30,7 @@ module Dependabot
       require_relative "file_parser/lockfile_parser"
 
       DEPENDENCY_TYPES = %w(dependencies devDependencies optionalDependencies).freeze
+      DEFAULT_CATALOG = "default"
       ALIAS_PROTOCOL = "npm:"
       GIT_URL_REGEX = %r{
         (?<git_prefix>^|^git.*?|^github:|^bitbucket:|^gitlab:|github\.com/)
@@ -63,6 +64,7 @@ module Dependabot
         dependency_set = DependencySet.new
         dependency_set += manifest_dependencies
         dependency_set += lockfile_dependencies
+        dependency_set += catalog_dependencies
 
         dependencies = Helpers.dependencies_with_all_versions_metadata(dependency_set)
 
@@ -202,11 +204,34 @@ module Dependabot
         lockfile_parser.parse_set
       end
 
+      sig { returns(Dependabot::FileParsers::Base::DependencySet) }
+      def catalog_dependencies
+        dependency_set = DependencySet.new
+        document = package_json_document
+        catalogs = [[DEFAULT_CATALOG, document.catalog], *document.catalogs.to_a]
+
+        catalogs.each do |catalog_name, entries|
+          entries.each do |name, requirement|
+            # Catalog entries are production dependencies, as pnpm catalogs are in npm_and_yarn.
+            dep = build_dependency(
+              file: package_json,
+              type: "dependencies",
+              name: name,
+              requirement: requirement,
+              catalog: catalog_name
+            )
+            dependency_set << dep if dep
+          end
+        end
+
+        dependency_set
+      end
+
       sig do
-        params(file: DependencyFile, type: String, name: String, requirement: String)
+        params(file: DependencyFile, type: String, name: String, requirement: String, catalog: T.nilable(String))
           .returns(T.nilable(Dependency))
       end
-      def build_dependency(file:, type:, name:, requirement:)
+      def build_dependency(file:, type:, name:, requirement:, catalog: nil)
         lockfile_details = lockfile_parser.lockfile_details(
           dependency_name: name,
           requirement: requirement,
@@ -243,11 +268,17 @@ module Dependabot
             requirement: requirement_for(requirement),
             file: file.name,
             groups: [type],
-            source: source_for(name, requirement, lockfile_details)
+            source: source_for(name, requirement, lockfile_details),
+            **catalog_metadata(catalog)
           }]
         )
       end
 
+      sig { params(catalog: T.nilable(String)).returns(T::Hash[Symbol, T::Hash[Symbol, String]]) }
+      def catalog_metadata(catalog)
+        catalog ? { metadata: { catalog: catalog } } : {}
+      end
+
       sig { override.void }
       def check_required_files
         return if get_original_file(MANIFEST_FILENAME)

data/lib/dependabot/bun/file_updater/bun_lockfile_updater.rb

@@ -6,6 +6,7 @@ require "sorbet-runtime"
 require "dependabot/bun/helpers"
 require "dependabot/bun/package/registry_finder"
 require "dependabot/bun/registry_parser"
+require "dependabot/package/npm_package_json"
 require "dependabot/shared_helpers"
 
 module Dependabot
@@ -69,6 +70,24 @@ module Dependabot
           T::Hash[Regexp, Dependabot::DependabotError]
         )
 
+        # A registry rejected the request for a package or its tarball. bun prints
+        # `error: failed to download <name>@<version>: <status> <reason>` with the tarball URL on the next line, or
+        # `error: GET <url> - <status>` when the request for the package metadata fails.
+        DOWNLOAD_FAILED =
+          %r{error: failed to download (?<spec>\S+): (?<status>\d{3})[^\n]*(?:\n[[:space:]]*(?<url>https?://\S+))?}
+        REQUEST_FAILED = %r{error: GET (?<url>https?://\S+) - (?<status>\d{3})\b}
+        ACCESS_DENIED_STATUSES = %w(401 403).freeze
+        NOT_FOUND_STATUS = "404"
+
+        # A workspace that bun.lock or package.json refers to is not part of the checkout
+        WORKSPACE_NOT_ON_DISK =
+          /
+            error:\s(?:the\sroot\spackage|workspace\s"[^"]+")\s
+            depends\son\sworkspace\s"(?<name>[^"]+)"\s\((?<path>[^)]*)\),\s
+            which\sis\slisted\sin\sbun\.lock\sbut\snot\son\sdisk
+          /x
+        WORKSPACE_NOT_FOUND = /error: Workspace not found "(?<path>[^"]+)"/
+
         sig { params(bun_lock: Dependabot::DependencyFile).returns(String) }
         def run_bun_update(bun_lock:)
           SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
@@ -88,14 +107,83 @@ module Dependabot
 
         sig { void }
         def run_bun_updater
-          dependency_updates = dependencies.map do |d|
-            "#{d.name}@#{d.version}"
-          end.join(" ")
+          dependency_updates_by_target.each do |workspace_name, deps|
+            dependency_updates = deps.map { |d| "#{d.name}@#{d.version}" }
 
-          Helpers.run_bun_command(
-            "install #{dependency_updates} --save-text-lockfile --ignore-scripts",
-            fingerprint: "install <dependency_updates> --save-text-lockfile --ignore-scripts"
-          )
+            command = T.let(["install", *dependency_updates], T::Array[String])
+            command += ["--filter", workspace_name] if workspace_name
+            command += ["--save-text-lockfile", "--ignore-scripts"]
+
+            Helpers.run_bun_command(
+              command,
+              fingerprint: "install <dependency_updates> --save-text-lockfile --ignore-scripts"
+            )
+          end
+        end
+
+        # Maps each install target (nil for the repo root, or a workspace
+        # path) to the dependencies that need installing there. A dependency
+        # declared in multiple manifests must be installed in each one, since
+        # Bun merges same-name declarations into a single Dependency.
+        sig { returns(T::Hash[T.nilable(String), T::Array[Dependabot::Dependency]]) }
+        def dependency_updates_by_target
+          dependencies
+            .flat_map { |dependency| install_targets_for(dependency).map { |target| [target, dependency] } }
+            .group_by { |target, _dependency| target }
+            .transform_values { |pairs| pairs.map { |_target, dependency| dependency } }
+        end
+
+        # Returns every install target (nil for the repo root, or a workspace
+        # path) that declares +dependency+. Falls back to an unfiltered root
+        # install if it isn't declared anywhere (e.g. a sub-dependency).
+        sig { params(dependency: Dependabot::Dependency).returns(T::Array[T.nilable(String)]) }
+        def install_targets_for(dependency)
+          root = root_package_json
+
+          workspace_targets = package_files.filter_map do |file|
+            next if file == root
+            next unless package_json_declares?(file, dependency)
+
+            workspace_filter(file)
+          end.uniq
+
+          declared_at_root = !root || package_json_declares?(root, dependency)
+          return workspace_targets if !declared_at_root && workspace_targets.any?
+
+          [nil, *workspace_targets]
+        end
+
+        # Path-based --filter target for the workspace at +file+ (e.g.
+        # "./packages/app"). Bun's --filter also accepts a package's declared
+        # "name", but names can contain glob metacharacters that would match
+        # unrelated workspaces, so a path is used instead.
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
+        def workspace_filter(file)
+          unless Dependabot::Package::NpmPackageJson.from_file(file).name
+            raise Dependabot::DependencyFileNotParseable.new(
+              file.path,
+              "#{file.name} must declare a \"name\" to be targeted for a workspace-scoped update"
+            )
+          end
+
+          "./#{File.dirname(file.name)}"
+        end
+
+        sig do
+          params(package_json_file: Dependabot::DependencyFile, dependency: Dependabot::Dependency)
+            .returns(T::Boolean)
+        end
+        def package_json_declares?(package_json_file, dependency)
+          declared = T.let(false, T::Boolean)
+          Dependabot::Package::NpmPackageJson.from_file(package_json_file).each_dependency do |name, _req, _type|
+            declared ||= name == dependency.name
+          end
+          declared
+        end
+
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
+        def root_package_json
+          package_files.find { |f| f.name == "package.json" }
         end
 
         sig { void }
@@ -116,10 +204,13 @@ module Dependabot
             ).parse
         end
 
-        sig { params(error: Dependabot::DependabotError, _bun_lock: Dependabot::DependencyFile).returns(T.noreturn) }
-        def handle_bun_lock_updater_error(error, _bun_lock)
+        sig { params(error: Dependabot::DependabotError, bun_lock: Dependabot::DependencyFile).returns(T.noreturn) }
+        def handle_bun_lock_updater_error(error, bun_lock)
           error_message = error.message
 
+          raise_registry_error(error_message)
+          raise_workspace_error(error_message, bun_lock)
+
           ERR_PATTERNS.each do |pattern, error_class|
             raise error_class, error_message if error_message.match?(pattern)
           end
@@ -127,6 +218,65 @@ module Dependabot
           raise error
         end
 
+        # Reports the first registry failure bun printed that the repository has to resolve: access that was denied,
+        # or a tarball the registry does not have. A failure with any other status is skipped, so it cannot hide a
+        # later one that can be classified, and is left to the generic handling when there is none.
+        sig { params(error_message: String).void }
+        def raise_registry_error(error_message)
+          registry_failures(error_message).each do |failure|
+            status = failure[:status]
+            url = failure[:url]
+
+            if ACCESS_DENIED_STATUSES.include?(status) && url
+              raise Dependabot::PrivateSourceAuthenticationFailure, registry_origin(url)
+            end
+
+            next unless status == NOT_FOUND_STATUS && failure.names.include?("spec")
+
+            raise Dependabot::DependencyNotFound, package_name_from(T.must(failure[:spec]))
+          end
+        end
+
+        # Every registry failure in the output, in the order bun printed them
+        sig { params(error_message: String).returns(T::Array[MatchData]) }
+        def registry_failures(error_message)
+          [DOWNLOAD_FAILED, REQUEST_FAILED]
+            .flat_map { |pattern| error_message.to_enum(:scan, pattern).map { T.must(Regexp.last_match) } }
+            .sort_by { |match| match.begin(0) }
+        end
+
+        sig { params(error_message: String, bun_lock: Dependabot::DependencyFile).void }
+        def raise_workspace_error(error_message, bun_lock)
+          if (match = error_message.match(WORKSPACE_NOT_ON_DISK))
+            raise Dependabot::DependencyFileNotResolvable,
+                  "#{bun_lock.path} lists the workspace \"#{match[:name]}\" (#{match[:path]}), " \
+                  "but it is not part of the repository. Every workspace in the lockfile must be present."
+          end
+
+          return unless (match = error_message.match(WORKSPACE_NOT_FOUND))
+
+          raise Dependabot::DependencyFileNotResolvable,
+                "package.json lists the workspace \"#{match[:path]}\", but it does not exist in the repository."
+        end
+
+        # The scheme, host and any non-default port of the URL, so the error names the registry and not a single
+        # tarball. A registry on another port is a different endpoint.
+        sig { params(url: String).returns(String) }
+        def registry_origin(url)
+          uri = URI.parse(url)
+          default_port = T.cast(uri.default_port, T.nilable(Integer))
+          port = ":#{uri.port}" if uri.port && uri.port != default_port
+          "#{uri.scheme}://#{uri.host}#{port}"
+        rescue URI::InvalidURIError
+          url
+        end
+
+        # "@scope/name@1.2.3" and "name@1.2.3" both end in the version
+        sig { params(spec: String).returns(String) }
+        def package_name_from(spec)
+          spec.sub(/@[^@]*\z/, "")
+        end
+
         sig { void }
         def write_final_package_json_files
           package_files.each do |file|

data/lib/dependabot/bun/file_updater/json_object_members.rb

@@ -0,0 +1,127 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+require "dependabot/bun/file_updater"
+
+module Dependabot
+  module Bun
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      # Locates object members in JSON source text, so they can be edited in
+      # place without reformatting the document.
+      class JsonObjectMembers
+        extend T::Sig
+
+        # Maps each member of the JSON object opening at `start` whose value is
+        # an object to the range of that value in `content`.
+        sig { params(content: String, start: Integer).returns(T::Hash[String, T::Range[Integer]]) }
+        def self.objects(content, start)
+          new(content, start).objects
+        end
+
+        # Maps each member of the JSON object opening at `start` whose value is
+        # a string to the range of that value, quotes included, in `content`.
+        sig { params(content: String, start: Integer).returns(T::Hash[String, T::Range[Integer]]) }
+        def self.strings(content, start)
+          new(content, start).strings
+        end
+
+        sig { returns(T::Hash[String, T::Range[Integer]]) }
+        attr_reader :objects
+
+        sig { returns(T::Hash[String, T::Range[Integer]]) }
+        attr_reader :strings
+
+        sig { params(content: String, start: Integer).void }
+        def initialize(content, start)
+          @objects = T.let({}, T::Hash[String, T::Range[Integer]])
+          @strings = T.let({}, T::Hash[String, T::Range[Integer]])
+          @depth = T.let(0, Integer)
+          @key = T.let(nil, T.nilable(String))
+          @value_start = T.let(nil, T.nilable(Integer))
+          @string = T.let(nil, T.nilable(String))
+          @last_string = T.let(nil, T.nilable(String))
+          @escaped = T.let(false, T::Boolean)
+          scan(content, start)
+        end
+
+        private
+
+        sig { params(content: String, start: Integer).void }
+        def scan(content, start)
+          T.must(content[start..]).each_char.with_index(start) do |char, index|
+            if @string
+              read_string(@string, char, index)
+            else
+              read_structure(char, index)
+              break if @depth.zero?
+            end
+          end
+        end
+
+        sig { params(string: String, char: String, index: Integer).void }
+        def read_string(string, char, index)
+          if @escaped
+            @escaped = false
+          elsif char == "\\"
+            @escaped = true
+          elsif char == "\""
+            close_string(string, index)
+            return
+          end
+
+          string << char
+        end
+
+        sig { params(char: String, index: Integer).void }
+        def read_structure(char, index)
+          case char
+          when "\"" then open_string(index)
+          when ":" then @key = @last_string if @depth == 1
+          when "," then @key = nil if @depth == 1
+          when "{", "[" then enter(char, index)
+          when "}", "]" then leave(index)
+          end
+        end
+
+        sig { params(index: Integer).void }
+        def open_string(index)
+          @string = +""
+          @value_start = index if @depth == 1 && @key
+        end
+
+        sig { params(string: String, index: Integer).void }
+        def close_string(string, index)
+          value = T.cast(JSON.parse("\"#{string}\""), String)
+          @last_string = value
+          @string = nil
+          record(@strings, index) if @depth == 1
+        end
+
+        sig { params(char: String, index: Integer).void }
+        def enter(char, index)
+          @value_start = index if @depth == 1 && char == "{" && @key
+          @depth += 1
+        end
+
+        sig { params(index: Integer).void }
+        def leave(index)
+          @depth -= 1
+          record(@objects, index) if @depth == 1
+        end
+
+        sig { params(members: T::Hash[String, T::Range[Integer]], index: Integer).void }
+        def record(members, index)
+          key = @key
+          value_start = @value_start
+          return unless key && value_start
+
+          members[key] = value_start..index
+          @value_start = nil
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bun/file_updater/package_json_updater.rb

@@ -3,7 +3,10 @@
 
 require "sorbet-runtime"
 
+require "dependabot/bun/file_parser"
 require "dependabot/bun/file_updater"
+require "dependabot/bun/file_updater/json_object_members"
+require "dependabot/package/npm_package_json"
 
 module Dependabot
   module Bun
@@ -93,7 +96,10 @@ module Dependabot
         def old_requirement(dependency, new_requirement)
           T.must(dependency.previous_requirements)
            .select { |r| r.file == package_json.name }
-           .find { |r| r.groups == new_requirement.groups }
+           .find do |r|
+             r.groups == new_requirement.groups &&
+               r.metadata_string("catalog") == new_requirement.metadata_string("catalog")
+           end
         end
 
         sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::DependencyRequirement]) }
@@ -131,6 +137,17 @@ module Dependabot
             .returns(String)
         end
         def update_package_json_declaration(package_json_content:, new_req:, dependency_name:, old_req:)
+          catalog = new_req.metadata_string("catalog")
+          if catalog
+            return update_catalog_declaration(
+              catalog: catalog,
+              content: package_json_content,
+              dependency_name: dependency_name,
+              old_req: old_req,
+              new_req: new_req
+            )
+          end
+
           original_line = declaration_line(
             dependency_name: dependency_name,
             dependency_req: old_req,
@@ -323,6 +340,72 @@ module Dependabot
           end
         end
 
+        # Bun reads catalogs only from `NpmPackageJson#catalog_container`, so
+        # the entry is looked up and replaced among those catalogs' members.
+        sig do
+          params(
+            catalog: String,
+            content: String,
+            dependency_name: String,
+            old_req: T.nilable(Dependabot::DependencyRequirement),
+            new_req: Dependabot::DependencyRequirement
+          )
+            .returns(String)
+        end
+        def update_catalog_declaration(catalog:, content:, dependency_name:, old_req:, new_req:)
+          value_ranges = catalog_ranges(catalog, content).filter_map do |range|
+            JsonObjectMembers.strings(content, range.begin)[dependency_name]
+          end
+
+          # Replacing from the end keeps the earlier ranges valid.
+          value_ranges.sort_by(&:begin).reverse.each_with_object(content.dup) do |range, updated|
+            value = updated_catalog_value(dependency_name, T.must(updated[range]), old_req, new_req)
+            updated[range] = value if value
+          end
+        end
+
+        # The default catalog is `catalog` together with `catalogs.default`.
+        sig { params(catalog: String, content: String).returns(T::Array[T::Range[Integer]]) }
+        def catalog_ranges(catalog, content)
+          root_start = content.index("{")
+          return [] unless root_start
+
+          fields = JsonObjectMembers.objects(content, root_start)
+          document = Dependabot::Package::NpmPackageJson.new(JSON.parse(content), package_json.path)
+          container = document.catalog_container
+          if container
+            container_range = fields[container]
+            return [] unless container_range
+
+            fields = JsonObjectMembers.objects(content, container_range.begin)
+          end
+
+          catalogs_range = fields["catalogs"]
+          [
+            (fields["catalog"] if catalog == FileParser::DEFAULT_CATALOG),
+            (JsonObjectMembers.objects(content, catalogs_range.begin)[catalog] if catalogs_range)
+          ].compact
+        end
+
+        # The value is matched and rewritten as a normalized declaration, so
+        # its source formatting never affects the match.
+        sig do
+          params(
+            dependency_name: String,
+            value: String,
+            old_req: T.nilable(Dependabot::DependencyRequirement),
+            new_req: Dependabot::DependencyRequirement
+          )
+            .returns(T.nilable(String))
+        end
+        def updated_catalog_value(dependency_name, value, old_req, new_req)
+          prefix = %("#{dependency_name}": )
+          line = prefix + JSON.generate(JSON.parse(value))
+          return if declaration_line(dependency_name: dependency_name, dependency_req: old_req, content: line).empty?
+
+          replacement_declaration_line(original_line: line, old_req: old_req, new_req: new_req).delete_prefix(prefix)
+        end
+
         sig { params(string: String).returns(Integer) }
         def closing_bracket_index(string)
           closes_required = 1

data/lib/dependabot/bun/helpers.rb

@@ -63,21 +63,23 @@ module Dependabot
         nil
       end
 
-      sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
+      sig { params(command: T.any(String, T::Array[String]), fingerprint: T.nilable(String)).returns(String) }
       def self.run_bun_command(command, fingerprint: nil)
-        full_command = "bun #{command}"
+        full_command = command.is_a?(Array) ? ["bun", *command] : "bun #{command}"
+        display_command = full_command.is_a?(Array) ? full_command.join(" ") : full_command
+        fingerprint_command = command.is_a?(Array) ? command.join(" ") : command
 
-        Dependabot.logger.info("Running bun command: #{full_command}")
+        Dependabot.logger.info("Running bun command: #{display_command}")
 
         result = Dependabot::SharedHelpers.run_shell_command(
           full_command,
-          fingerprint: "bun #{fingerprint || command}"
+          fingerprint: "bun #{fingerprint || fingerprint_command}"
         )
 
-        Dependabot.logger.info("Command executed successfully: #{full_command}")
+        Dependabot.logger.info("Command executed successfully: #{display_command}")
         result
       rescue StandardError => e
-        Dependabot.logger.error("Error running bun command: #{full_command}, Error: #{e.message}")
+        Dependabot.logger.error("Error running bun command: #{display_command}, Error: #{e.message}")
         raise
       end
 

data/lib/dependabot/bun/metadata_finder.rb

@@ -178,21 +178,25 @@ module Dependabot
       def latest_version_listing
         return @latest_version_listing unless @latest_version_listing.nil?
 
+        @latest_version_listing = T.let({}, T.nilable(T::Hash[String, T.untyped]))
+
         response = Dependabot::RegistryClient.get(
           url: "#{dependency_url}/latest",
           headers: registry_auth_headers
         )
-        return @latest_version_listing = {} if response.status >= 500
+        return T.must(@latest_version_listing) if response.status >= 500
 
         begin
-          @latest_version_listing = JSON.parse(response.body)
+          # A registry can answer a missing package with a bare JSON string such as "Not Found"
+          parsed = JSON.parse(response.body)
+          @latest_version_listing = parsed if parsed.is_a?(Hash)
         rescue JSON::ParserError
           raise unless non_standard_registry?
-
-          @latest_version_listing = {}
         end
+
+        T.must(@latest_version_listing)
       rescue JSON::ParserError, Excon::Error::Timeout
-        @latest_version_listing = T.let({}, T.nilable(T::Hash[String, T.untyped]))
+        T.must(@latest_version_listing)
       end
 
       sig { returns(T::Array[[String, T::Hash[String, T.untyped]]]) }
@@ -209,18 +213,21 @@ module Dependabot
       def npm_listing
         return @npm_listing unless @npm_listing.nil?
 
+        @npm_listing = T.let({}, T.nilable(T::Hash[String, T.untyped]))
+
         response = Dependabot::RegistryClient.get(url: dependency_url, headers: registry_auth_headers)
-        return @npm_listing = {} if response.status >= 500
+        return T.must(@npm_listing) if response.status >= 500
 
         begin
-          @npm_listing = JSON.parse(response.body)
+          parsed = JSON.parse(response.body)
+          @npm_listing = parsed if parsed.is_a?(Hash)
         rescue JSON::ParserError
           raise unless non_standard_registry?
-
-          @npm_listing = {}
         end
+
+        T.must(@npm_listing)
       rescue Excon::Error::Timeout
-        @npm_listing = T.let({}, T.nilable(T::Hash[String, T.untyped]))
+        T.must(@npm_listing)
       end
 
       sig { returns(String) }

data/lib/dependabot/bun/package/registry_finder.rb

@@ -20,7 +20,7 @@ module Dependabot
           https://registry.yarnpkg.com
           http://registry.yarnpkg.com
         ).freeze
-        NPM_AUTH_TOKEN_REGEX = %r{//(?<registry>.*)/:_authToken=(?<token>.*)$}
+        NPM_AUTH_TOKEN_REGEX = %r{^[ \t]*//(?<registry>.*)/:_authToken=(?<token>.*)$}
         NPM_GLOBAL_REGISTRY_REGEX = /^registry\s*=\s*['"]?(?<registry>.*?)['"]?$/
         YARN_GLOBAL_REGISTRY_REGEX = /^(?:--)?registry\s+((['"](?<registry>.*)['"])|(?<registry>.*))/
         NPM_SCOPED_REGISTRY_REGEX = /^(?<scope>@[^:]+)\s*:registry\s*=\s*['"]?(?<registry>.*?)['"]?$/

data/lib/dependabot/bun/update_checker/version_resolver.rb

@@ -6,6 +6,7 @@ require "sorbet-runtime"
 require "dependabot/errors"
 require "dependabot/git_commit_checker"
 require "dependabot/logger"
+require "dependabot/package/npm_package_json"
 require "dependabot/package/npm_registry_package"
 require "dependabot/bun/dependency_files_filterer"
 require "dependabot/bun/file_parser"
@@ -615,13 +616,119 @@ module Dependabot
         def run_bun_checker(path:, version:)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
-              Helpers.run_bun_command(
-                "update #{dependency.name}@#{version} --save-text-lockfile --ignore-scripts",
-                fingerprint: "update <dependency_name>@<version> --save-text-lockfile --ignore-scripts"
-              )
+              workspace_filters(path).flat_map { |filter| run_bun_update(filter: filter, version: version) }
             end
           end
+        end
+
+        sig do
+          params(
+            filter: T.nilable(String),
+            version: T.nilable(T.any(String, Gem::Version))
+          ).returns(T::Array[PeerDependencyConflict])
+        end
+        def run_bun_update(filter:, version:)
+          command = T.let(["update", "#{dependency.name}@#{version}"], T::Array[String])
+          command += ["--filter", filter] if filter
+          command += ["--save-text-lockfile", "--ignore-scripts"]
+
+          Helpers.run_bun_command(
+            command,
+            fingerprint: "update <dependency_name>@<version> --save-text-lockfile --ignore-scripts"
+          )
           []
+        rescue SharedHelpers::HelperSubprocessFailed => e
+          handle_peer_dependency_errors(e.message)
+        end
+
+        # Returns every workspace filter (nil for the +path+ we've already
+        # chdir'd into, or a workspace path relative to it) for manifests in
+        # the project rooted at +path+ that declare +dependency+. Manifests
+        # are matched by scanning their actual dependency fields (as
+        # BunLockfileUpdater does), rather than dependency.requirements,
+        # since Bun always records catalog entries against the root
+        # package.json even when a nested workspace is the only consumer
+        # (via "catalog:"). Falls back to an unfiltered check at +path+ if
+        # it isn't declared anywhere in this project (e.g. a
+        # sub-dependency).
+        sig { params(path: String).returns(T::Array[T.nilable(String)]) }
+        def workspace_filters(path)
+          manifests = package_jsons_in_project(path)
+          root_file = manifests.find { |file| File.dirname(file.name) == path }
+
+          workspace_filters = manifests.filter_map do |file|
+            next if file == root_file
+            next unless package_json_declares?(file)
+
+            workspace_filter(file, path: path)
+          end.uniq
+
+          declared_at_root = root_file && package_json_declares?(root_file)
+          return workspace_filters if !declared_at_root && workspace_filters.any?
+
+          [nil, *workspace_filters]
+        end
+
+        # Every package.json belonging to the same Bun project as +path+:
+        # its own manifest, plus any workspace members governed by the same
+        # lockfile. Manifests under a *nested* project with its own
+        # lockfile are excluded, so that sibling nested projects (each
+        # checked separately, chdir'd into their own path) don't leak their
+        # declarations into each other's filters.
+        sig { params(path: String).returns(T::Array[Dependabot::DependencyFile]) }
+        def package_jsons_in_project(path)
+          project_lockfile_dir = lockfile_dir_for(path)
+
+          dependency_files.select do |file|
+            next false unless file.name.end_with?("package.json")
+
+            dir = File.dirname(file.name)
+            next false unless path == "." || dir == path || dir.start_with?("#{path}/")
+
+            lockfile_dir_for(dir) == project_lockfile_dir
+          end
+        end
+
+        # The directory of the bun.lock that governs +dir+: the lockfile
+        # whose own directory is the longest ancestor match, since a nested
+        # lockfile takes precedence over the root one for its own subtree.
+        sig { params(dir: String).returns(T.nilable(String)) }
+        def lockfile_dir_for(dir)
+          lockfile_dirs = dependency_files_builder.bun_locks.map { |lockfile| File.dirname(lockfile.name) }
+          lockfile_dirs.select { |lockfile_dir| lockfile_governs_dir?(lockfile_dir, dir) }.max_by(&:length)
+        end
+
+        sig { params(lockfile_dir: String, dir: String).returns(T::Boolean) }
+        def lockfile_governs_dir?(lockfile_dir, dir)
+          lockfile_dir == "." || dir == lockfile_dir || dir.start_with?("#{lockfile_dir}/")
+        end
+
+        sig { params(package_json_file: Dependabot::DependencyFile).returns(T::Boolean) }
+        def package_json_declares?(package_json_file)
+          declared = T.let(false, T::Boolean)
+          Dependabot::Package::NpmPackageJson.from_file(package_json_file).each_dependency do |name, _req, _type|
+            declared ||= name == dependency.name
+          end
+          declared
+        end
+
+        # Path-based --filter target, relative to +path+, for the workspace
+        # at +file+ (e.g. "./packages/app"). Bun's --filter also accepts a
+        # package's declared "name", but names can contain glob
+        # metacharacters that would match unrelated workspaces, so a path is
+        # used instead.
+        sig { params(file: Dependabot::DependencyFile, path: String).returns(String) }
+        def workspace_filter(file, path:)
+          unless Dependabot::Package::NpmPackageJson.from_file(file).name
+            raise Dependabot::DependencyFileNotParseable.new(
+              file.path,
+              "#{file.name} must declare a \"name\" to be targeted for a workspace-scoped check"
+            )
+          end
+
+          workspace_dir = File.dirname(file.name)
+          workspace_dir = workspace_dir.delete_prefix("#{path}/") unless path == "."
+          "./#{workspace_dir}"
         end
 
         sig do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.400.0
+  version: 0.402.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.402.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.402.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -323,6 +323,7 @@ files:
 - lib/dependabot/bun/file_parser/lockfile_parser.rb
 - lib/dependabot/bun/file_updater.rb
 - lib/dependabot/bun/file_updater/bun_lockfile_updater.rb
+- lib/dependabot/bun/file_updater/json_object_members.rb
 - lib/dependabot/bun/file_updater/npmrc_builder.rb
 - lib/dependabot/bun/file_updater/package_json_preparer.rb
 - lib/dependabot/bun/file_updater/package_json_updater.rb
@@ -355,7 +356,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.402.0
 rdoc_options: []
 require_paths:
 - lib