dependabot-bun 0.296.0 → 0.296.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aec5d70543afebc798276a80ab116a1375a90395a66815467b48ffc778f1287c
-  data.tar.gz: f44ddcdc48fee485db9e56d97c06040e9bcf597b42b057be8a98ca4eadbc7665
+  metadata.gz: 0eb8192cb230095bd5c5c41ca47242ba70625b32e7e77eda267893b9984dc4ff
+  data.tar.gz: 4036b1f4381b20a6d797f5a7afa0d50d8dc1850acb10293835675132dceedbeb
 SHA512:
-  metadata.gz: ad382c4264db5281a25cd912a5379316e175efef2c4188e89d05699eeffc753d6114fd9046ba7fafe5bf979fd83c7ad5ec7cc2bec3237aa477d42bb19dd3b7c8
-  data.tar.gz: fd61ab1f24b72c1306b2b187728cfc45581740515d7000a6026bde6c5313b3e7bf3e05af3ce0e77a3d0af530e4a09a3f5b26ab518c577ef4fef5176431e44fe3
+  metadata.gz: c2559a11a91f31650bf5dc84a5d418c7280d55bab80b659986df71c9893cb9b494ccb8ec29f5bb1f9a3c154ee0b122919bc29021fc7ad1fb134e4d3c2230428d
+  data.tar.gz: 5433aab5f7fae6978db3f4d85ad18d0e91e37a725d9c2158b0b547247103b626e4fd41993f2be76d832dd2e7b89aeb975dd92bfc29b233e8db9be19a6d5a82c2

data/lib/dependabot/bun.rb

@@ -33,7 +33,17 @@ Dependabot::PullRequestCreator::Labeler
 Dependabot::Dependency.register_production_check("bun", ->(_) { true })
 
 module Dependabot
-  module Bun
-    ECOSYSTEM = "bun"
+  module Javascript
+    module Bun
+      ECOSYSTEM = "bun"
+    end
   end
 end
+
+Dependabot::FileFetchers.register("bun", Dependabot::Javascript::Bun::FileFetcher)
+Dependabot::FileParsers.register("bun", Dependabot::Javascript::Bun::FileParser)
+Dependabot::FileUpdaters.register("bun", Dependabot::Javascript::Bun::FileUpdater)
+Dependabot::UpdateCheckers.register("bun", Dependabot::Javascript::Bun::UpdateChecker)
+Dependabot::MetadataFinders.register("bun", Dependabot::Javascript::Shared::MetadataFinder)
+Dependabot::Utils.register_requirement_class("bun", Dependabot::Javascript::Bun::Requirement)
+Dependabot::Utils.register_version_class("bun", Dependabot::Javascript::Bun::Version)

data/lib/dependabot/javascript/bun/file_fetcher.rb

@@ -0,0 +1,77 @@
+# typed: strong
+# frozen_string_literal: true
+
+module Dependabot
+  module Javascript
+    module Bun
+      class FileFetcher < Shared::FileFetcher
+        extend T::Sig
+        extend T::Helpers
+
+        sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
+        def self.required_files_in?(filenames)
+          filenames.include?("package.json")
+        end
+
+        sig { override.returns(String) }
+        def self.required_files_message
+          "Repo must contain a package.json."
+        end
+
+        sig { override.returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def ecosystem_versions
+          return unknown_ecosystem_versions unless ecosystem_enabled?
+
+          {
+            package_managers: {
+              "bun" => 1
+            }
+          }
+        end
+
+        sig { override.returns(T::Array[DependencyFile]) }
+        def fetch_files
+          fetched_files = T.let([], T::Array[DependencyFile])
+          fetched_files << package_json(self)
+          fetched_files += bun_files if ecosystem_enabled?
+          fetched_files += workspace_package_jsons(self)
+          fetched_files += path_dependencies(self, fetched_files)
+
+          fetched_files.uniq
+        end
+
+        private
+
+        sig { returns(T::Array[DependencyFile]) }
+        def bun_files
+          [bun_lock].compact
+        end
+
+        sig { returns(T.nilable(DependencyFile)) }
+        def bun_lock
+          return @bun_lock if defined?(@bun_lock)
+
+          @bun_lock ||= T.let(fetch_file_if_present(PackageManager::LOCKFILE_NAME), T.nilable(DependencyFile))
+
+          return @bun_lock if @bun_lock || directory == "/"
+
+          @bun_lock = fetch_file_from_parent_directories(self, PackageManager::LOCKFILE_NAME)
+        end
+
+        sig { returns(T::Boolean) }
+        def ecosystem_enabled?
+          allow_beta_ecosystems? && Experiments.enabled?(:enable_bun_ecosystem)
+        end
+
+        sig { returns(T::Hash[Symbol, String]) }
+        def unknown_ecosystem_versions
+          {
+            package_managers: {
+              "unknown" => 0
+            }
+          }
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/javascript/bun/file_parser/bun_lock.rb

@@ -0,0 +1,156 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Dependabot
+  module Javascript
+    module Bun
+      class FileParser
+        class BunLock < Shared::FileParser::Lockfile
+          extend T::Sig
+
+          sig { params(dependency_file: DependencyFile).void }
+          def initialize(dependency_file)
+            super
+            @parsed = T.let(
+              nil,
+              T.nilable(T::Hash[String, T.any(Integer, String, T::Array[String], T::Hash[String, String])])
+            )
+          end
+
+          sig { override.returns(T::Hash[String, T.untyped]) }
+          def parsed
+            @parsed ||= begin
+              content = begin
+                # Since bun.lock is a JSONC file, which is a subset of YAML, we can use YAML to parse it
+                YAML.load(T.must(@dependency_file.content))
+              rescue Psych::SyntaxError => e
+                raise_invalid!("malformed JSONC at line #{e.line}, column #{e.column}")
+              end
+              raise_invalid!("expected to be an object") unless content.is_a?(Hash)
+
+              version = content["lockfileVersion"]
+              raise_invalid!("expected 'lockfileVersion' to be an integer") unless version.is_a?(Integer)
+              raise_invalid!("expected 'lockfileVersion' to be >= 0") unless version >= 0
+
+              content
+            end
+          end
+
+          sig { override.returns(Dependabot::FileParsers::Base::DependencySet) }
+          def dependencies
+            dependency_set = Dependabot::FileParsers::Base::DependencySet.new
+
+            # bun.lock v0 format:
+            # https://github.com/oven-sh/bun/blob/c130df6c589fdf28f9f3c7f23ed9901140bc9349/src/install/bun.lock.zig#L595-L605
+
+            packages = parsed["packages"]
+            raise_invalid!("expected 'packages' to be an object") unless packages.is_a?(Hash)
+
+            packages.each do |key, details|
+              raise_invalid!("expected 'packages.#{key}' to be an array") unless details.is_a?(Array)
+
+              resolution = details.first
+              raise_invalid!("expected 'packages.#{key}[0]' to be a string") unless resolution.is_a?(String)
+
+              name, version = resolution.split(/(?<=\w)\@/)
+              next if name.empty?
+
+              semver = Version.semver_for(version)
+              next unless semver
+
+              dependency_set << Dependency.new(
+                name: name,
+                version: semver.to_s,
+                package_manager: "bun",
+                requirements: []
+              )
+            end
+
+            dependency_set
+          end
+
+          sig do
+            override
+              .params(
+                dependency_name: String,
+                requirement: T.untyped,
+                manifest_name: String
+              )
+              .returns(T.nilable(T::Hash[String, T.untyped]))
+          end
+          def details(dependency_name, requirement, manifest_name) # rubocop:disable Lint/UnusedMethodArgument
+            packages = parsed["packages"]
+            return unless packages.is_a?(Hash)
+
+            candidates =
+              packages
+              .select { |name, _| name == dependency_name }
+              .values
+
+            # If there's only one entry for this dependency, use it, even if
+            # the requirement in the lockfile doesn't match
+            if candidates.one?
+              parse_details(candidates.first)
+            else
+              candidate = candidates.find do |label, _|
+                label.scan(/(?<=\w)\@(?:npm:)?([^\s,]+)/).flatten.include?(requirement)
+              end&.last
+              parse_details(candidate)
+            end
+          end
+
+          private
+
+          sig { params(message: String).void }
+          def raise_invalid!(message)
+            raise Dependabot::DependencyFileNotParseable.new(@dependency_file.path, "Invalid bun.lock file: #{message}")
+          end
+
+          sig do
+            params(entry: T.nilable(T::Array[T.untyped])).returns(T.nilable(T::Hash[String, T.untyped]))
+          end
+          def parse_details(entry)
+            return unless entry.is_a?(Array)
+
+            # Either:
+            # - "{name}@{version}", registry, details, integrity
+            # - "{name}@{resolution}", details
+            resolution = entry.first
+            return unless resolution.is_a?(String)
+
+            name, version = resolution.split(/(?<=\w)\@/)
+            semver = Version.semver_for(version)
+
+            if semver
+              registry, details, integrity = entry[1..3]
+              {
+                "name" => name,
+                "version" => semver.to_s,
+                "registry" => registry,
+                "details" => details,
+                "integrity" => integrity
+              }
+            else
+              details = entry[1]
+              {
+                "name" => name,
+                "resolution" => version,
+                "details" => details
+              }
+            end
+          end
+        end
+
+        sig { override.returns(T::Array[Dependabot::Dependency]) }
+        def parse
+          []
+        end
+
+        private
+
+        sig { override.void }
+        def check_required_files; end
+      end
+    end
+  end
+end

data/lib/dependabot/javascript/bun/file_parser/lockfile_parser.rb

@@ -0,0 +1,55 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Dependabot
+  module Javascript
+    module Bun
+      class FileParser
+        class LockfileParser < Shared::FileParser::LockfileParser
+          extend T::Sig
+
+          DEFAULT_LOCKFILES = %w(bun.lock).freeze
+
+          sig { override.returns(Dependabot::FileParsers::Base::DependencySet) }
+          def parse_set
+            dependency_set = Dependabot::FileParsers::Base::DependencySet.new
+
+            bun_locks.each do |file|
+              dependency_set += lockfile_for(file).dependencies
+            end
+
+            dependency_set
+          end
+
+          sig { override.returns(T::Array[String]) }
+          def default_lockfiles
+            DEFAULT_LOCKFILES
+          end
+
+          private
+
+          sig { override.params(file: DependencyFile).returns(BunLock) }
+          def lockfile_for(file)
+            @lockfiles ||= T.let({}, T.nilable(T::Hash[String, BunLock]))
+            @lockfiles[file.name] ||= case file.name
+                                      when *bun_locks.map(&:name)
+                                        Bun::FileParser::BunLock.new(file)
+                                      else
+                                        raise "Unexpected lockfile: #{file.name}"
+                                      end
+          end
+
+          sig { returns(T::Array[DependencyFile]) }
+          def bun_locks
+            @bun_locks ||= T.let(select_files_by_extension("bun.lock"), T.nilable(T::Array[DependencyFile]))
+          end
+
+          sig { override.returns(T.class_of(Version)) }
+          def version_class
+            Version
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/javascript/bun/file_parser.rb

@@ -0,0 +1,74 @@
+# typed: strong
+# frozen_string_literal: true
+
+# See https://docs.npmjs.com/files/package.json for package.json format docs.
+
+module Dependabot
+  module Javascript
+    module Bun
+      class FileParser < Shared::FileParser
+        extend T::Sig
+
+        sig { override.returns(Ecosystem) }
+        def ecosystem
+          @ecosystem ||= T.let(
+            Ecosystem.new(
+              name: ECOSYSTEM,
+              package_manager: PackageManager.new(detected_version:),
+              language: Shared::Language.new(detected_version:)
+            ),
+            T.nilable(Ecosystem)
+          )
+        end
+
+        private
+
+        sig { returns(T.nilable(String)) }
+        def detected_version
+          Helpers.local_package_manager_version(Bun::PackageManager::NAME)
+        end
+
+        sig { override.returns(T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)]) }
+        def lockfiles
+          {
+            bun: bun_lock
+          }
+        end
+
+        sig { override.returns(LockfileParser) }
+        def lockfile_parser
+          @lockfile_parser ||= T.let(LockfileParser.new(
+                                       dependency_files: dependency_files
+                                     ), T.nilable(LockfileParser))
+        end
+
+        sig { override.returns(T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)]) }
+        def registry_config_files
+          {
+            npmrc: npmrc
+          }
+        end
+
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
+        def bun_lock
+          @bun_lock ||= T.let(dependency_files.find do |f|
+            f.name.end_with?(PackageManager::LOCKFILE_NAME)
+          end, T.nilable(Dependabot::DependencyFile))
+        end
+
+        sig { override.returns(T.class_of(Version)) }
+        def version_class
+          Version
+        end
+
+        sig { override.returns(T.class_of(Requirement)) }
+        def requirement_class
+          Requirement
+        end
+
+        sig { override.void }
+        def check_required_files; end
+      end
+    end
+  end
+end

data/lib/dependabot/javascript/bun/file_updater/lockfile_updater.rb

@@ -0,0 +1,138 @@
+# typed: true
+# frozen_string_literal: true
+
+module Dependabot
+  module Javascript
+    module Bun
+      class FileUpdater
+        class LockfileUpdater
+          def initialize(dependencies:, dependency_files:, repo_contents_path:, credentials:)
+            @dependencies = dependencies
+            @dependency_files = dependency_files
+            @repo_contents_path = repo_contents_path
+            @credentials = credentials
+          end
+
+          def updated_bun_lock_content(bun_lock)
+            @updated_bun_lock_content ||= {}
+            return @updated_bun_lock_content[bun_lock.name] if @updated_bun_lock_content[bun_lock.name]
+
+            new_content = run_bun_update(bun_lock: bun_lock)
+            @updated_bun_lock_content[bun_lock.name] = new_content
+          rescue SharedHelpers::HelperSubprocessFailed => e
+            handle_bun_lock_updater_error(e, bun_lock)
+          end
+
+          private
+
+          attr_reader :dependencies
+          attr_reader :dependency_files
+          attr_reader :repo_contents_path
+          attr_reader :credentials
+
+          ERR_PATTERNS = {
+            /get .* 404/i => Dependabot::DependencyNotFound,
+            /installfailed cloning repository/i => Dependabot::DependencyNotFound,
+            /file:.* failed to resolve/i => Dependabot::DependencyNotFound,
+            /no version matching/i => Dependabot::DependencyFileNotResolvable,
+            /failed to resolve/i => Dependabot::DependencyFileNotResolvable
+          }.freeze
+
+          def run_bun_update(bun_lock:)
+            SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
+              File.write(".npmrc", npmrc_content(bun_lock))
+
+              SharedHelpers.with_git_configured(credentials: credentials) do
+                run_bun_updater
+
+                write_final_package_json_files
+
+                run_bun_install
+
+                File.read(bun_lock.name)
+              end
+            end
+          end
+
+          def run_bun_updater
+            dependency_updates = dependencies.map do |d|
+              "#{d.name}@#{d.version}"
+            end.join(" ")
+
+            Helpers.run_bun_command(
+              "install #{dependency_updates} --save-text-lockfile",
+              fingerprint: "install <dependency_updates> --save-text-lockfile"
+            )
+          end
+
+          def run_bun_install
+            Helpers.run_bun_command(
+              "install --save-text-lockfile"
+            )
+          end
+
+          def lockfile_dependencies(lockfile)
+            @lockfile_dependencies ||= {}
+            @lockfile_dependencies[lockfile.name] ||=
+              FileParser.new(
+                dependency_files: [lockfile, *package_files],
+                source: nil,
+                credentials: credentials
+              ).parse
+          end
+
+          def handle_bun_lock_updater_error(error, _bun_lock)
+            error_message = error.message
+
+            ERR_PATTERNS.each do |pattern, error_class|
+              raise error_class, error_message if error_message.match?(pattern)
+            end
+
+            raise error
+          end
+
+          def write_final_package_json_files
+            package_files.each do |file|
+              path = file.name
+              FileUtils.mkdir_p(Pathname.new(path).dirname)
+              File.write(path, updated_package_json_content(file))
+            end
+          end
+
+          def npmrc_content(bun_lock)
+            Dependabot::Javascript::Shared::FileUpdater::NpmrcBuilder.new(
+              credentials: credentials,
+              dependency_files: dependency_files,
+              dependencies: lockfile_dependencies(bun_lock)
+            ).npmrc_content
+          end
+
+          def updated_package_json_content(file)
+            @updated_package_json_content ||= {}
+            @updated_package_json_content[file.name] ||=
+              Dependabot::Javascript::Shared::FileUpdater::PackageJsonUpdater.new(
+                package_json: file,
+                dependencies: dependencies
+              ).updated_package_json.content
+          end
+
+          def package_files
+            @package_files ||= dependency_files.select { |f| f.name.end_with?("package.json") }
+          end
+
+          def base_dir
+            dependency_files.first.directory
+          end
+
+          def npmrc_file
+            dependency_files.find { |f| f.name == ".npmrc" }
+          end
+
+          def sanitize_message(message)
+            message.gsub(/"|\[|\]|\}|\{/, "")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/javascript/bun/file_updater.rb

@@ -0,0 +1,75 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Dependabot
+  module Javascript
+    module Bun
+      class FileUpdater < Shared::FileUpdater
+        sig { override.returns(T::Array[Regexp]) }
+        def self.updated_files_regex
+          [
+            %r{^(?:.*/)?package\.json$},
+            %r{^(?:.*/)?bun\.lock$} # Matches bun.lock files
+          ]
+        end
+
+        private
+
+        sig { override.returns(T.class_of(FileParser::LockfileParser)) }
+        def lockfile_parser_class
+          FileParser::LockfileParser
+        end
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        def bun_locks
+          @bun_locks ||= T.let(
+            filtered_dependency_files
+            .select { |f| f.name.end_with?("bun.lock") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
+        end
+
+        sig { params(bun_lock: Dependabot::DependencyFile).returns(T::Boolean) }
+        def bun_lock_changed?(bun_lock)
+          bun_lock.content != updated_bun_lock_content(bun_lock)
+        end
+
+        sig { override.returns(T::Array[Dependabot::DependencyFile]) }
+        def updated_lockfiles
+          updated_files = []
+
+          bun_locks.each do |bun_lock|
+            next unless bun_lock_changed?(bun_lock)
+
+            updated_files << updated_file(
+              file: bun_lock,
+              content: updated_bun_lock_content(bun_lock)
+            )
+          end
+
+          updated_files
+        end
+
+        sig { params(bun_lock: Dependabot::DependencyFile).returns(String) }
+        def updated_bun_lock_content(bun_lock)
+          @updated_bun_lock_content ||= T.let({}, T.nilable(T::Hash[String, T.nilable(String)]))
+          @updated_bun_lock_content[bun_lock.name] ||=
+            bun_lockfile_updater.updated_bun_lock_content(bun_lock)
+        end
+
+        sig { returns(Bun::FileUpdater::LockfileUpdater) }
+        def bun_lockfile_updater
+          @bun_lockfile_updater ||= T.let(
+            LockfileUpdater.new(
+              dependencies: dependencies,
+              dependency_files: dependency_files,
+              repo_contents_path: repo_contents_path,
+              credentials: credentials
+            ),
+            T.nilable(Bun::FileUpdater::LockfileUpdater)
+          )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/javascript/bun/helpers.rb

@@ -0,0 +1,72 @@
+# typed: strong
+# frozen_string_literal: true
+
+module Dependabot
+  module Javascript
+    module Bun
+      module Helpers
+        extend T::Sig
+
+        # BUN Version Constants
+        BUN_V1 = 1
+        BUN_DEFAULT_VERSION = BUN_V1
+
+        sig { params(_bun_lock: T.nilable(DependencyFile)).returns(Integer) }
+        def self.bun_version_numeric(_bun_lock)
+          BUN_DEFAULT_VERSION
+        end
+
+        sig { returns(T.nilable(String)) }
+        def self.bun_version
+          run_bun_command("--version", fingerprint: "--version").strip
+        rescue StandardError => e
+          Dependabot.logger.error("Error retrieving Bun version: #{e.message}")
+          nil
+        end
+
+        sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
+        def self.run_bun_command(command, fingerprint: nil)
+          full_command = "bun #{command}"
+
+          Dependabot.logger.info("Running bun command: #{full_command}")
+
+          result = Dependabot::SharedHelpers.run_shell_command(
+            full_command,
+            fingerprint: "bun #{fingerprint || command}"
+          )
+
+          Dependabot.logger.info("Command executed successfully: #{full_command}")
+          result
+        rescue StandardError => e
+          Dependabot.logger.error("Error running bun command: #{full_command}, Error: #{e.message}")
+          raise
+        end
+
+        # Fetch the currently installed version of the package manager directly
+        # from the system
+        sig { params(name: String).returns(String) }
+        def self.local_package_manager_version(name)
+          Dependabot::SharedHelpers.run_shell_command(
+            "#{name} -v",
+            fingerprint: "#{name} -v"
+          ).strip
+        end
+
+        # Run single command on package manager returning stdout/stderr
+        sig do
+          params(
+            name: String,
+            command: String,
+            fingerprint: T.nilable(String)
+          ).returns(String)
+        end
+        def self.package_manager_run_command(name, command, fingerprint: nil)
+          return run_bun_command(command, fingerprint: fingerprint) if name == PackageManager::NAME
+
+          # TODO: remove this method and just use the one in the PackageManager class
+          "noop"
+        end
+      end
+    end
+  end
+end