dependabot-bun 0.401.0 → 0.402.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6911ce58a858da72deaee55412e7a9f6f434181fb6eaafafc81a64b0e22fe31a
-  data.tar.gz: 5e63b632ac51775a4283fb4ca4166cd9276a12c13585bac4c411648b9901c667
+  metadata.gz: e4c9217ef3c6884ac153b6bb6e516709f0440e6d70a2c25e4f795aaf443adb47
+  data.tar.gz: 25430e72661535db6c374dee825b3dcac942f37e98853e47750061f326253602
 SHA512:
-  metadata.gz: 3c11b9f089126fe325f9ee718521def2ff8ad105a49ba883116a76f423bd07de38930c33e63487b41842babe2375b44efad8943b26adb83c224c885f6ee499c9
-  data.tar.gz: bf9388f37be2732c47a40fe19b7d1613644c92747dafff37cf51e595ab3b496a6542b09de507fd2f3c14ec4e4dc46ce171a64936f872e14898b56caa81d6645d
+  metadata.gz: 97eda92117fac8f2ebeb5883f865cff280b089d8430127b0dbb4da826f2ff24ddf11949181b45ca9f320a23ed3b8f8b4fbf5d2660946a5255f646b115dad5b76
+  data.tar.gz: 9b729c7238e1f784a09500789c26c4eec54c8afe891619600312345a7902cb15feb3ae0230e56744435876b963e4dc054f06eec94974353ef4d696f7642887c8

data/lib/dependabot/bun/file_updater/bun_lockfile_updater.rb

@@ -6,6 +6,7 @@ require "sorbet-runtime"
 require "dependabot/bun/helpers"
 require "dependabot/bun/package/registry_finder"
 require "dependabot/bun/registry_parser"
+require "dependabot/package/npm_package_json"
 require "dependabot/shared_helpers"
 
 module Dependabot
@@ -69,6 +70,24 @@ module Dependabot
           T::Hash[Regexp, Dependabot::DependabotError]
         )
 
+        # A registry rejected the request for a package or its tarball. bun prints
+        # `error: failed to download <name>@<version>: <status> <reason>` with the tarball URL on the next line, or
+        # `error: GET <url> - <status>` when the request for the package metadata fails.
+        DOWNLOAD_FAILED =
+          %r{error: failed to download (?<spec>\S+): (?<status>\d{3})[^\n]*(?:\n[[:space:]]*(?<url>https?://\S+))?}
+        REQUEST_FAILED = %r{error: GET (?<url>https?://\S+) - (?<status>\d{3})\b}
+        ACCESS_DENIED_STATUSES = %w(401 403).freeze
+        NOT_FOUND_STATUS = "404"
+
+        # A workspace that bun.lock or package.json refers to is not part of the checkout
+        WORKSPACE_NOT_ON_DISK =
+          /
+            error:\s(?:the\sroot\spackage|workspace\s"[^"]+")\s
+            depends\son\sworkspace\s"(?<name>[^"]+)"\s\((?<path>[^)]*)\),\s
+            which\sis\slisted\sin\sbun\.lock\sbut\snot\son\sdisk
+          /x
+        WORKSPACE_NOT_FOUND = /error: Workspace not found "(?<path>[^"]+)"/
+
         sig { params(bun_lock: Dependabot::DependencyFile).returns(String) }
         def run_bun_update(bun_lock:)
           SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
@@ -88,14 +107,83 @@ module Dependabot
 
         sig { void }
         def run_bun_updater
-          dependency_updates = dependencies.map do |d|
-            "#{d.name}@#{d.version}"
-          end.join(" ")
+          dependency_updates_by_target.each do |workspace_name, deps|
+            dependency_updates = deps.map { |d| "#{d.name}@#{d.version}" }
 
-          Helpers.run_bun_command(
-            "install #{dependency_updates} --save-text-lockfile --ignore-scripts",
-            fingerprint: "install <dependency_updates> --save-text-lockfile --ignore-scripts"
-          )
+            command = T.let(["install", *dependency_updates], T::Array[String])
+            command += ["--filter", workspace_name] if workspace_name
+            command += ["--save-text-lockfile", "--ignore-scripts"]
+
+            Helpers.run_bun_command(
+              command,
+              fingerprint: "install <dependency_updates> --save-text-lockfile --ignore-scripts"
+            )
+          end
+        end
+
+        # Maps each install target (nil for the repo root, or a workspace
+        # path) to the dependencies that need installing there. A dependency
+        # declared in multiple manifests must be installed in each one, since
+        # Bun merges same-name declarations into a single Dependency.
+        sig { returns(T::Hash[T.nilable(String), T::Array[Dependabot::Dependency]]) }
+        def dependency_updates_by_target
+          dependencies
+            .flat_map { |dependency| install_targets_for(dependency).map { |target| [target, dependency] } }
+            .group_by { |target, _dependency| target }
+            .transform_values { |pairs| pairs.map { |_target, dependency| dependency } }
+        end
+
+        # Returns every install target (nil for the repo root, or a workspace
+        # path) that declares +dependency+. Falls back to an unfiltered root
+        # install if it isn't declared anywhere (e.g. a sub-dependency).
+        sig { params(dependency: Dependabot::Dependency).returns(T::Array[T.nilable(String)]) }
+        def install_targets_for(dependency)
+          root = root_package_json
+
+          workspace_targets = package_files.filter_map do |file|
+            next if file == root
+            next unless package_json_declares?(file, dependency)
+
+            workspace_filter(file)
+          end.uniq
+
+          declared_at_root = !root || package_json_declares?(root, dependency)
+          return workspace_targets if !declared_at_root && workspace_targets.any?
+
+          [nil, *workspace_targets]
+        end
+
+        # Path-based --filter target for the workspace at +file+ (e.g.
+        # "./packages/app"). Bun's --filter also accepts a package's declared
+        # "name", but names can contain glob metacharacters that would match
+        # unrelated workspaces, so a path is used instead.
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
+        def workspace_filter(file)
+          unless Dependabot::Package::NpmPackageJson.from_file(file).name
+            raise Dependabot::DependencyFileNotParseable.new(
+              file.path,
+              "#{file.name} must declare a \"name\" to be targeted for a workspace-scoped update"
+            )
+          end
+
+          "./#{File.dirname(file.name)}"
+        end
+
+        sig do
+          params(package_json_file: Dependabot::DependencyFile, dependency: Dependabot::Dependency)
+            .returns(T::Boolean)
+        end
+        def package_json_declares?(package_json_file, dependency)
+          declared = T.let(false, T::Boolean)
+          Dependabot::Package::NpmPackageJson.from_file(package_json_file).each_dependency do |name, _req, _type|
+            declared ||= name == dependency.name
+          end
+          declared
+        end
+
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
+        def root_package_json
+          package_files.find { |f| f.name == "package.json" }
         end
 
         sig { void }
@@ -116,10 +204,13 @@ module Dependabot
             ).parse
         end
 
-        sig { params(error: Dependabot::DependabotError, _bun_lock: Dependabot::DependencyFile).returns(T.noreturn) }
-        def handle_bun_lock_updater_error(error, _bun_lock)
+        sig { params(error: Dependabot::DependabotError, bun_lock: Dependabot::DependencyFile).returns(T.noreturn) }
+        def handle_bun_lock_updater_error(error, bun_lock)
           error_message = error.message
 
+          raise_registry_error(error_message)
+          raise_workspace_error(error_message, bun_lock)
+
           ERR_PATTERNS.each do |pattern, error_class|
             raise error_class, error_message if error_message.match?(pattern)
           end
@@ -127,6 +218,65 @@ module Dependabot
           raise error
         end
 
+        # Reports the first registry failure bun printed that the repository has to resolve: access that was denied,
+        # or a tarball the registry does not have. A failure with any other status is skipped, so it cannot hide a
+        # later one that can be classified, and is left to the generic handling when there is none.
+        sig { params(error_message: String).void }
+        def raise_registry_error(error_message)
+          registry_failures(error_message).each do |failure|
+            status = failure[:status]
+            url = failure[:url]
+
+            if ACCESS_DENIED_STATUSES.include?(status) && url
+              raise Dependabot::PrivateSourceAuthenticationFailure, registry_origin(url)
+            end
+
+            next unless status == NOT_FOUND_STATUS && failure.names.include?("spec")
+
+            raise Dependabot::DependencyNotFound, package_name_from(T.must(failure[:spec]))
+          end
+        end
+
+        # Every registry failure in the output, in the order bun printed them
+        sig { params(error_message: String).returns(T::Array[MatchData]) }
+        def registry_failures(error_message)
+          [DOWNLOAD_FAILED, REQUEST_FAILED]
+            .flat_map { |pattern| error_message.to_enum(:scan, pattern).map { T.must(Regexp.last_match) } }
+            .sort_by { |match| match.begin(0) }
+        end
+
+        sig { params(error_message: String, bun_lock: Dependabot::DependencyFile).void }
+        def raise_workspace_error(error_message, bun_lock)
+          if (match = error_message.match(WORKSPACE_NOT_ON_DISK))
+            raise Dependabot::DependencyFileNotResolvable,
+                  "#{bun_lock.path} lists the workspace \"#{match[:name]}\" (#{match[:path]}), " \
+                  "but it is not part of the repository. Every workspace in the lockfile must be present."
+          end
+
+          return unless (match = error_message.match(WORKSPACE_NOT_FOUND))
+
+          raise Dependabot::DependencyFileNotResolvable,
+                "package.json lists the workspace \"#{match[:path]}\", but it does not exist in the repository."
+        end
+
+        # The scheme, host and any non-default port of the URL, so the error names the registry and not a single
+        # tarball. A registry on another port is a different endpoint.
+        sig { params(url: String).returns(String) }
+        def registry_origin(url)
+          uri = URI.parse(url)
+          default_port = T.cast(uri.default_port, T.nilable(Integer))
+          port = ":#{uri.port}" if uri.port && uri.port != default_port
+          "#{uri.scheme}://#{uri.host}#{port}"
+        rescue URI::InvalidURIError
+          url
+        end
+
+        # "@scope/name@1.2.3" and "name@1.2.3" both end in the version
+        sig { params(spec: String).returns(String) }
+        def package_name_from(spec)
+          spec.sub(/@[^@]*\z/, "")
+        end
+
         sig { void }
         def write_final_package_json_files
           package_files.each do |file|

data/lib/dependabot/bun/helpers.rb

@@ -63,21 +63,23 @@ module Dependabot
         nil
       end
 
-      sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
+      sig { params(command: T.any(String, T::Array[String]), fingerprint: T.nilable(String)).returns(String) }
       def self.run_bun_command(command, fingerprint: nil)
-        full_command = "bun #{command}"
+        full_command = command.is_a?(Array) ? ["bun", *command] : "bun #{command}"
+        display_command = full_command.is_a?(Array) ? full_command.join(" ") : full_command
+        fingerprint_command = command.is_a?(Array) ? command.join(" ") : command
 
-        Dependabot.logger.info("Running bun command: #{full_command}")
+        Dependabot.logger.info("Running bun command: #{display_command}")
 
         result = Dependabot::SharedHelpers.run_shell_command(
           full_command,
-          fingerprint: "bun #{fingerprint || command}"
+          fingerprint: "bun #{fingerprint || fingerprint_command}"
         )
 
-        Dependabot.logger.info("Command executed successfully: #{full_command}")
+        Dependabot.logger.info("Command executed successfully: #{display_command}")
         result
       rescue StandardError => e
-        Dependabot.logger.error("Error running bun command: #{full_command}, Error: #{e.message}")
+        Dependabot.logger.error("Error running bun command: #{display_command}, Error: #{e.message}")
         raise
       end
 

data/lib/dependabot/bun/metadata_finder.rb

@@ -178,21 +178,25 @@ module Dependabot
       def latest_version_listing
         return @latest_version_listing unless @latest_version_listing.nil?
 
+        @latest_version_listing = T.let({}, T.nilable(T::Hash[String, T.untyped]))
+
         response = Dependabot::RegistryClient.get(
           url: "#{dependency_url}/latest",
           headers: registry_auth_headers
         )
-        return @latest_version_listing = {} if response.status >= 500
+        return T.must(@latest_version_listing) if response.status >= 500
 
         begin
-          @latest_version_listing = JSON.parse(response.body)
+          # A registry can answer a missing package with a bare JSON string such as "Not Found"
+          parsed = JSON.parse(response.body)
+          @latest_version_listing = parsed if parsed.is_a?(Hash)
         rescue JSON::ParserError
           raise unless non_standard_registry?
-
-          @latest_version_listing = {}
         end
+
+        T.must(@latest_version_listing)
       rescue JSON::ParserError, Excon::Error::Timeout
-        @latest_version_listing = T.let({}, T.nilable(T::Hash[String, T.untyped]))
+        T.must(@latest_version_listing)
       end
 
       sig { returns(T::Array[[String, T::Hash[String, T.untyped]]]) }
@@ -209,18 +213,21 @@ module Dependabot
       def npm_listing
         return @npm_listing unless @npm_listing.nil?
 
+        @npm_listing = T.let({}, T.nilable(T::Hash[String, T.untyped]))
+
         response = Dependabot::RegistryClient.get(url: dependency_url, headers: registry_auth_headers)
-        return @npm_listing = {} if response.status >= 500
+        return T.must(@npm_listing) if response.status >= 500
 
         begin
-          @npm_listing = JSON.parse(response.body)
+          parsed = JSON.parse(response.body)
+          @npm_listing = parsed if parsed.is_a?(Hash)
         rescue JSON::ParserError
           raise unless non_standard_registry?
-
-          @npm_listing = {}
         end
+
+        T.must(@npm_listing)
       rescue Excon::Error::Timeout
-        @npm_listing = T.let({}, T.nilable(T::Hash[String, T.untyped]))
+        T.must(@npm_listing)
       end
 
       sig { returns(String) }

data/lib/dependabot/bun/package/registry_finder.rb

@@ -20,7 +20,7 @@ module Dependabot
           https://registry.yarnpkg.com
           http://registry.yarnpkg.com
         ).freeze
-        NPM_AUTH_TOKEN_REGEX = %r{//(?<registry>.*)/:_authToken=(?<token>.*)$}
+        NPM_AUTH_TOKEN_REGEX = %r{^[ \t]*//(?<registry>.*)/:_authToken=(?<token>.*)$}
         NPM_GLOBAL_REGISTRY_REGEX = /^registry\s*=\s*['"]?(?<registry>.*?)['"]?$/
         YARN_GLOBAL_REGISTRY_REGEX = /^(?:--)?registry\s+((['"](?<registry>.*)['"])|(?<registry>.*))/
         NPM_SCOPED_REGISTRY_REGEX = /^(?<scope>@[^:]+)\s*:registry\s*=\s*['"]?(?<registry>.*?)['"]?$/

data/lib/dependabot/bun/update_checker/version_resolver.rb

@@ -6,6 +6,7 @@ require "sorbet-runtime"
 require "dependabot/errors"
 require "dependabot/git_commit_checker"
 require "dependabot/logger"
+require "dependabot/package/npm_package_json"
 require "dependabot/package/npm_registry_package"
 require "dependabot/bun/dependency_files_filterer"
 require "dependabot/bun/file_parser"
@@ -615,13 +616,119 @@ module Dependabot
         def run_bun_checker(path:, version:)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
-              Helpers.run_bun_command(
-                "update #{dependency.name}@#{version} --save-text-lockfile --ignore-scripts",
-                fingerprint: "update <dependency_name>@<version> --save-text-lockfile --ignore-scripts"
-              )
+              workspace_filters(path).flat_map { |filter| run_bun_update(filter: filter, version: version) }
             end
           end
+        end
+
+        sig do
+          params(
+            filter: T.nilable(String),
+            version: T.nilable(T.any(String, Gem::Version))
+          ).returns(T::Array[PeerDependencyConflict])
+        end
+        def run_bun_update(filter:, version:)
+          command = T.let(["update", "#{dependency.name}@#{version}"], T::Array[String])
+          command += ["--filter", filter] if filter
+          command += ["--save-text-lockfile", "--ignore-scripts"]
+
+          Helpers.run_bun_command(
+            command,
+            fingerprint: "update <dependency_name>@<version> --save-text-lockfile --ignore-scripts"
+          )
           []
+        rescue SharedHelpers::HelperSubprocessFailed => e
+          handle_peer_dependency_errors(e.message)
+        end
+
+        # Returns every workspace filter (nil for the +path+ we've already
+        # chdir'd into, or a workspace path relative to it) for manifests in
+        # the project rooted at +path+ that declare +dependency+. Manifests
+        # are matched by scanning their actual dependency fields (as
+        # BunLockfileUpdater does), rather than dependency.requirements,
+        # since Bun always records catalog entries against the root
+        # package.json even when a nested workspace is the only consumer
+        # (via "catalog:"). Falls back to an unfiltered check at +path+ if
+        # it isn't declared anywhere in this project (e.g. a
+        # sub-dependency).
+        sig { params(path: String).returns(T::Array[T.nilable(String)]) }
+        def workspace_filters(path)
+          manifests = package_jsons_in_project(path)
+          root_file = manifests.find { |file| File.dirname(file.name) == path }
+
+          workspace_filters = manifests.filter_map do |file|
+            next if file == root_file
+            next unless package_json_declares?(file)
+
+            workspace_filter(file, path: path)
+          end.uniq
+
+          declared_at_root = root_file && package_json_declares?(root_file)
+          return workspace_filters if !declared_at_root && workspace_filters.any?
+
+          [nil, *workspace_filters]
+        end
+
+        # Every package.json belonging to the same Bun project as +path+:
+        # its own manifest, plus any workspace members governed by the same
+        # lockfile. Manifests under a *nested* project with its own
+        # lockfile are excluded, so that sibling nested projects (each
+        # checked separately, chdir'd into their own path) don't leak their
+        # declarations into each other's filters.
+        sig { params(path: String).returns(T::Array[Dependabot::DependencyFile]) }
+        def package_jsons_in_project(path)
+          project_lockfile_dir = lockfile_dir_for(path)
+
+          dependency_files.select do |file|
+            next false unless file.name.end_with?("package.json")
+
+            dir = File.dirname(file.name)
+            next false unless path == "." || dir == path || dir.start_with?("#{path}/")
+
+            lockfile_dir_for(dir) == project_lockfile_dir
+          end
+        end
+
+        # The directory of the bun.lock that governs +dir+: the lockfile
+        # whose own directory is the longest ancestor match, since a nested
+        # lockfile takes precedence over the root one for its own subtree.
+        sig { params(dir: String).returns(T.nilable(String)) }
+        def lockfile_dir_for(dir)
+          lockfile_dirs = dependency_files_builder.bun_locks.map { |lockfile| File.dirname(lockfile.name) }
+          lockfile_dirs.select { |lockfile_dir| lockfile_governs_dir?(lockfile_dir, dir) }.max_by(&:length)
+        end
+
+        sig { params(lockfile_dir: String, dir: String).returns(T::Boolean) }
+        def lockfile_governs_dir?(lockfile_dir, dir)
+          lockfile_dir == "." || dir == lockfile_dir || dir.start_with?("#{lockfile_dir}/")
+        end
+
+        sig { params(package_json_file: Dependabot::DependencyFile).returns(T::Boolean) }
+        def package_json_declares?(package_json_file)
+          declared = T.let(false, T::Boolean)
+          Dependabot::Package::NpmPackageJson.from_file(package_json_file).each_dependency do |name, _req, _type|
+            declared ||= name == dependency.name
+          end
+          declared
+        end
+
+        # Path-based --filter target, relative to +path+, for the workspace
+        # at +file+ (e.g. "./packages/app"). Bun's --filter also accepts a
+        # package's declared "name", but names can contain glob
+        # metacharacters that would match unrelated workspaces, so a path is
+        # used instead.
+        sig { params(file: Dependabot::DependencyFile, path: String).returns(String) }
+        def workspace_filter(file, path:)
+          unless Dependabot::Package::NpmPackageJson.from_file(file).name
+            raise Dependabot::DependencyFileNotParseable.new(
+              file.path,
+              "#{file.name} must declare a \"name\" to be targeted for a workspace-scoped check"
+            )
+          end
+
+          workspace_dir = File.dirname(file.name)
+          workspace_dir = workspace_dir.delete_prefix("#{path}/") unless path == "."
+          "./#{workspace_dir}"
         end
 
         sig do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.401.0
+  version: 0.402.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.401.0
+        version: 0.402.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.401.0
+        version: 0.402.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -356,7 +356,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.401.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.402.0
 rdoc_options: []
 require_paths:
 - lib