dependabot-bun 0.308.0 → 0.309.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: df5c9bc08db27b356fc7ada3f8da5f778523465ae1b926e33daffd1cc1fb554e
-  data.tar.gz: 228693c29a5da30aa9ee4366c041f51dce91b9158142dbef7b8b6121c7a27de5
+  metadata.gz: a896e9586e6aa0db1c681ea1eaaff0bbb2d785de7791d19077ba4216ad95de4c
+  data.tar.gz: 159ebc8a0f44dbffd0e3907d7f7992b35110eac1cbd7b6a7487e1cbaee08db0b
 SHA512:
-  metadata.gz: e0c36f0b0c93f72b3cf6fbc1e7bf5a0ad7ad669927dfb45c1b3453cd84209ed8871d10704c9443d5ba448c6938096bef96feb9070a28a78a71cb6ffac50b763f
-  data.tar.gz: b3cb11cd5ad915dc5c833fe02d4eb96dfe84ba7a9a16c152eb5958f7d9c4fa9c4443232d3145e110a2aae981f15926159026f25a8b3e66a9779aa0260762454f
+  metadata.gz: dc35d9e0f988774f61a4f60c01a68322287085cf3a85a3e2c38de3a55422a7e40aa17c9a4b403527f9b04b7532319c4891964e032de2b9f5e0e00fd9bf579c92
+  data.tar.gz: c36e41684ec0f8b08ab338e7191ba44253b6dbc56060e5d5aeb4a3a14814cbab974bf50dad7f52165c7525259171cef9ef8ce81871c3f2244840a6a8eb7985ae

data/lib/dependabot/bun/update_checker/latest_version_finder.rb

@@ -77,7 +77,7 @@ module Dependabot
         def latest_version_with_no_unlock(language_version: nil)
           with_custom_registry_rescue do
             return unless valid_npm_details?
-            return version_from_dist_tags if specified_dist_tag_requirement?
+            return version_from_dist_tags&.version if specified_dist_tag_requirement?
 
             super
           end
@@ -100,8 +100,8 @@ module Dependabot
           with_custom_registry_rescue do
             return unless valid_npm_details?
 
-            tag_version = version_from_dist_tags
-            return tag_version if tag_version
+            tag_release = version_from_dist_tags
+            return tag_release.version if tag_release
 
             return if specified_dist_tag_requirement?
 
@@ -117,16 +117,20 @@ module Dependabot
         def fetch_latest_version_with_no_unlock(language_version: nil)
           with_custom_registry_rescue do
             return unless valid_npm_details?
-            return version_from_dist_tags if specified_dist_tag_requirement?
+            return version_from_dist_tags&.version if specified_dist_tag_requirement?
 
             super
           end
         end
 
-        sig { override.params(versions: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
-        def apply_post_fetch_latest_versions_filter(versions)
-          original_count = versions.count
-          filtered_versions = lazy_filter_yanked_versions_by_min_max(versions, check_max: true)
+        sig do
+          override
+            .params(releases: T::Array[Dependabot::Package::PackageRelease])
+            .returns(T::Array[Dependabot::Package::PackageRelease])
+        end
+        def apply_post_fetch_latest_versions_filter(releases)
+          original_count = releases.count
+          filtered_versions = lazy_filter_yanked_versions_by_min_max(releases, check_max: true)
 
           # Log the filter if any versions were removed
           if original_count > filtered_versions.count
@@ -141,26 +145,30 @@ module Dependabot
 
         sig do
           params(
-            versions: T::Array[Dependabot::Version],
+            releases: T::Array[Dependabot::Package::PackageRelease],
             check_max: T::Boolean
-          ).returns(T::Array[Dependabot::Version])
+          ).returns(T::Array[Dependabot::Package::PackageRelease])
         end
-        def lazy_filter_yanked_versions_by_min_max(versions, check_max: true)
+        def lazy_filter_yanked_versions_by_min_max(releases, check_max: true)
           # Sort the versions based on the check_max flag (max -> descending, min -> ascending)
-          sorted_versions = check_max ? versions.sort.reverse : versions.sort
+          sorted_releases = if check_max
+                              releases.sort_by(&:version).reverse
+                            else
+                              releases.sort_by(&:version)
+                            end
 
           filtered_versions = []
 
           not_yanked = T.let(false, T::Boolean)
 
           # Iterate through the sorted versions lazily, filtering out yanked versions
-          sorted_versions.each do |version|
-            next if !not_yanked && yanked_version?(version)
+          sorted_releases.each do |release|
+            next if !not_yanked && yanked_version?(release.version)
 
             not_yanked = true
 
             # Once we find a valid (non-yanked) version, add it to the filtered list
-            filtered_versions << version
+            filtered_versions << release
             break
           end
 
@@ -172,7 +180,7 @@ module Dependabot
             .params(language_version: T.nilable(T.any(String, Dependabot::Version)))
             .returns(T.nilable(Dependabot::Version))
         end
-        def fetch_lowest_security_fix_version(language_version:) # rubocop:disable Lint/UnusedMethodArgument
+        def fetch_lowest_security_fix_version(language_version: nil) # rubocop:disable Lint/UnusedMethodArgument
           with_custom_registry_rescue do
             return unless valid_npm_details?
 
@@ -180,7 +188,7 @@ module Dependabot
               if specified_dist_tag_requirement?
                 [version_from_dist_tags].compact
               else
-                possible_versions(filter_ignored: false)
+                possible_releases(filter_ignored: false)
               end
 
             secure_versions =
@@ -196,22 +204,22 @@ module Dependabot
             secure_versions = lazy_filter_yanked_versions_by_min_max(secure_versions, check_max: false)
 
             # Return the lowest non-yanked version
-            secure_versions.max
+            secure_versions.max_by(&:version)&.version
           end
         end
 
         sig do
-          params(versions_array: T::Array[Dependabot::Version])
-            .returns(T::Array[Dependabot::Version])
+          params(releases: T::Array[Dependabot::Package::PackageRelease])
+            .returns(T::Array[Dependabot::Package::PackageRelease])
         end
-        def filter_prerelease_versions(versions_array)
-          filtered = versions_array.reject do |v|
-            v.prerelease? && !related_to_current_pre?(v)
+        def filter_prerelease_versions(releases)
+          filtered = releases.reject do |release|
+            release.version.prerelease? && !related_to_current_pre?(release.version)
           end
 
-          if versions_array.count > filtered.count
+          if releases.count > filtered.count
             Dependabot.logger.info(
-              "Filtered out #{versions_array.count - filtered.count} unrelated pre-release versions"
+              "Filtered out #{releases.count - filtered.count} unrelated pre-release versions"
             )
           end
 
@@ -317,7 +325,7 @@ module Dependabot
           !!package_details&.releases&.any?
         end
 
-        sig { returns(T.nilable(Dependabot::Version)) }
+        sig { returns(T.nilable(Dependabot::Package::PackageRelease)) }
         def version_from_dist_tags # rubocop:disable Metrics/PerceivedComplexity
           dist_tags = package_details&.dist_tags
           return nil unless dist_tags
@@ -332,14 +340,14 @@ module Dependabot
 
           if dist_tag_req
             release = find_dist_tag_release(dist_tag_req, releases)
-            return release.version if release && !release.yanked?
+            return release if release && !release.yanked?
           end
 
           latest_release = find_dist_tag_release("latest", releases)
 
           return nil unless latest_release
 
-          return latest_release.version if wants_latest_dist_tag?(latest_release.version) && !latest_release.yanked?
+          return latest_release if wants_latest_dist_tag?(latest_release.version) && !latest_release.yanked?
 
           nil
         end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.308.0
+  version: 0.309.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-04-12 00:00:00.000000000 Z
+date: 2025-04-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.308.0
+        version: 0.309.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.308.0
+        version: 0.309.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -347,7 +347,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.308.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.309.0
 rdoc_options: []
 require_paths:
 - lib