dependabot-bun 0.388.0 → 0.389.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d35ccc1aac59905c40beece74c715bc870aa961bf0fc81369451f126c6cdb189
-  data.tar.gz: 5bfcf59f40932759fdb77505742edd15c38137257c5989f64e1b2421e4a6eca6
+  metadata.gz: 22834707df55df4ac0a7ac6780eccb4888052824833bbab428b11e10142871df
+  data.tar.gz: c557dcb417537da0427682aa54ef50f2a4d096707b2eecf3b0a2e727eae95172
 SHA512:
-  metadata.gz: 8846046a149c47be747c816e0b3fd38d58e7e6b33339965067aa5ec2d1135055d1e491da45009daf763b6532076fd73708df78d759bc6cb07c4605565a99e15d
-  data.tar.gz: 4572b2960fbf871d8e758e257bd8ccfafb646440c2ee7a18a52b1735def020f683e5dd8657cba7bbd5e38e7cb78c7ad9af7d87e7ce2c04f1ec27bbd3cdb81dec
+  metadata.gz: 5d1471eeeeb325f22b47c5fa57d6f02890f84b18525e07ab58b83a0b4e95bca08719696765f3e9d9a9d42c2d578f2db2c6b84c547b055d48961f718fa7735c26
+  data.tar.gz: 837703736f6acb5a04b29209746ddfb8481d9d2f8264ba0dd25d2b4fd584b5770bab5b6745828d15dcbd284c60179ae61ee1a8efe9130592a5098372bfff2b69

data/helpers/eslint.config.js

@@ -0,0 +1,28 @@
+const globals = require("globals");
+const js = require("@eslint/js");
+const eslintConfigPrettier = require("eslint-config-prettier/flat");
+
+module.exports = [
+  js.configs.recommended,
+  {
+    languageOptions: {
+      globals: {
+        ...globals.node,
+        ...globals.jest,
+      },
+      ecmaVersion: "latest",
+    },
+  },
+  {
+    rules: {
+      "no-unused-vars": [
+        "error",
+        { argsIgnorePattern: "^_", destructuredArrayIgnorePattern: "^_" },
+      ],
+    },
+  },
+  eslintConfigPrettier,
+  {
+    ignores: ["dist/**", "build/**"],
+  },
+];

data/helpers/lib/yarn/helpers.js

@@ -44,7 +44,11 @@ class LightweightInstall extends Install {
   }
 }
 
-const LOCKFILE_ENTRY_REGEX = /^(.*)@([^@]*?)$/;
+// Matches a yarn lockfile entry key, correctly handling:
+// - scoped packages:           @scope/name@requirement
+// - unscoped packages:         name@requirement
+// - git URLs with credentials: name@https://token@host/path (@ preserved in requirement)
+const LOCKFILE_ENTRY_REGEX = /^(@[^@]+|[^@]+)@(.*)$/;
 
 module.exports = {
   isString,

data/helpers/lib/yarn/replace-lockfile-declaration.js

@@ -1,13 +1,12 @@
 const parse = require("@dependabot/yarn-lib/lib/lockfile/parse").default;
 const stringify = require("@dependabot/yarn-lib/lib/lockfile/stringify")
   .default;
+const { LOCKFILE_ENTRY_REGEX } = require("./helpers");
 
 // Get an array of a dependency's requested version ranges from a lockfile
 function getRequestedVersions(depName, lockfileJson) {
   const requestedVersions = [];
-  // Matching dependency name and version requirements which could be a full url:
-  // dep@version, @private-dep@version, private-dep@https:://token@gh.com...#ref
-  const re = /^(.[^@]*)@(.*?)$/;
+  const re = LOCKFILE_ENTRY_REGEX;
 
   Object.entries(lockfileJson).forEach(([name, _]) => {
     if (name.match(re)) {

data/helpers/package-lock.json

@@ -21,8 +21,10 @@
         "helper": "run.js"
       },
       "devDependencies": {
+        "@eslint/js": "^9.16.0",
         "eslint": "^9.16.0",
         "eslint-config-prettier": "^9.1.0",
+        "globals": "^13.24.0",
         "jest": "^29.7.0",
         "prettier": "^3.4.2"
       }
@@ -820,6 +822,19 @@
         }
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/globals": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
+      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/@eslint/eslintrc/node_modules/js-yaml": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
@@ -5474,12 +5489,16 @@
       }
     },
     "node_modules/globals": {
-      "version": "14.0.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
-      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
+      "version": "13.24.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-13.24.0.tgz",
+      "integrity": "sha512-AhO5QUcj8llrbG09iWhPU2B204J1xnPeL8kQmVorSsy+Sjj1sk8gIyh6cUocGmH4L0UuhAJy+hJMRA4mgA4mFQ==",
       "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "type-fest": "^0.20.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=8"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -15873,6 +15892,19 @@
         "node": ">=4"
       }
     },
+    "node_modules/type-fest": {
+      "version": "0.20.2",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+      "dev": true,
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/unique-filename": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-4.0.0.tgz",
@@ -16939,6 +16971,12 @@
             "ms": "^2.1.3"
           }
         },
+        "globals": {
+          "version": "14.0.0",
+          "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
+          "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
+          "dev": true
+        },
         "js-yaml": {
           "version": "4.1.0",
           "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
@@ -20391,10 +20429,13 @@
       }
     },
     "globals": {
-      "version": "14.0.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
-      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
-      "dev": true
+      "version": "13.24.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-13.24.0.tgz",
+      "integrity": "sha512-AhO5QUcj8llrbG09iWhPU2B204J1xnPeL8kQmVorSsy+Sjj1sk8gIyh6cUocGmH4L0UuhAJy+hJMRA4mgA4mFQ==",
+      "dev": true,
+      "requires": {
+        "type-fest": "^0.20.2"
+      }
     },
     "graceful-fs": {
       "version": "4.2.10",
@@ -28159,6 +28200,12 @@
       "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
       "dev": true
     },
+    "type-fest": {
+      "version": "0.20.2",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+      "dev": true
+    },
     "unique-filename": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-4.0.0.tgz",

data/helpers/package.json

@@ -21,8 +21,10 @@
     "patch-package": "^8.0.0"
   },
   "devDependencies": {
+    "@eslint/js": "^9.16.0",
     "eslint": "^9.16.0",
     "eslint-config-prettier": "^9.1.0",
+    "globals": "^13.24.0",
     "jest": "^29.7.0",
     "prettier": "^3.4.2"
   }

data/helpers/test/yarn/fixtures/updater/scoped-git-source/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "test-project",
+  "version": "1.0.0",
+  "dependencies": {
+    "is-positive": "^3.0.0"
+  }
+}

data/helpers/test/yarn/fixtures/updater/scoped-git-source/yarn.lock

@@ -0,0 +1,8 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"is-positive@^3.0.0", "is-positive@3.0.0":
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/is-positive/-/is-positive-3.0.0.tgz#e1ee21cb67a4b41ea3e9ca23b32e6fb51bef9d26"
+  integrity sha512-3aX3F8v8gzxT1DnLXo8/0fQ9i/aKDqgDZZvFh/hhsb0HkYfNxz5j9xLF8f3T8L/5DgVxWlBGFbHfgHYf3vJXEA==

data/helpers/test/yarn/helpers.test.js

@@ -0,0 +1,40 @@
+const { LOCKFILE_ENTRY_REGEX } = require("../../lib/yarn/helpers");
+
+describe("LOCKFILE_ENTRY_REGEX", () => {
+  it("matches a simple unscoped package", () => {
+    const match = "left-pad@1.0.0".match(LOCKFILE_ENTRY_REGEX);
+    expect(match).not.toBeNull();
+    const [, packageName, requirement] = match;
+    expect(packageName).toBe("left-pad");
+    expect(requirement).toBe("1.0.0");
+  });
+
+  it("matches a scoped package", () => {
+    const match = "@scope/pkg@1.2.3".match(LOCKFILE_ENTRY_REGEX);
+    expect(match).not.toBeNull();
+    const [, packageName, requirement] = match;
+    expect(packageName).toBe("@scope/pkg");
+    expect(requirement).toBe("1.2.3");
+  });
+
+  it("matches an unscoped package with a git URL containing @", () => {
+    const key =
+      "is-number@git+https://username:password@github.com/jonschlinkert/is-number.git";
+    const match = key.match(LOCKFILE_ENTRY_REGEX);
+    expect(match).not.toBeNull();
+    const [, packageName, requirement] = match;
+    expect(packageName).toBe("is-number");
+    expect(requirement).toBe(
+      "git+https://username:password@github.com/jonschlinkert/is-number.git"
+    );
+  });
+
+  it("matches a scoped package with a git URL containing multiple @ characters", () => {
+    const key = "@scope/pkg@git+https://x@github.com/y/z";
+    const match = key.match(LOCKFILE_ENTRY_REGEX);
+    expect(match).not.toBeNull();
+    const [, packageName, requirement] = match;
+    expect(packageName).toBe("@scope/pkg");
+    expect(requirement).toBe("git+https://x@github.com/y/z");
+  });
+});

data/helpers/test/yarn/updater.test.js

@@ -114,4 +114,32 @@ describe("updater", () => {
       expect(error.message).toEqual("package.json: Name contains illegal characters")
     }
   });
+
+  it("correctly updates packages with multiple lockfile entries", async () => {
+    // This test verifies that replaceLockfileDeclaration correctly consolidates
+    // duplicate lockfile entries when updating versions. This ensures the regex
+    // change properly identifies all entries belonging to a dependency.
+    copyDependencies("scoped-git-source", tempDir);
+
+    const result = await updateDependencyFiles(tempDir, [
+      {
+        name: "is-positive",
+        version: "3.1.0",
+        requirements: [
+          {
+            requirement: "^3.0.0",
+            file: "package.json",
+            groups: ["dependencies"],
+          },
+        ],
+      },
+    ]);
+
+    // The updated lock should have the new version
+    expect(result["yarn.lock"]).toContain('version "3.1.0"');
+    // Old version should be gone
+    expect(result["yarn.lock"]).not.toContain('version "3.0.0"');
+    // The caret requirement entry should be preserved
+    expect(result["yarn.lock"]).toContain("is-positive@^3.0.0");
+  });
 });

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.388.0
+  version: 0.389.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.388.0
+        version: 0.389.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.388.0
+        version: 0.389.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -244,6 +244,7 @@ files:
 - helpers/.eslintrc
 - helpers/README.md
 - helpers/build
+- helpers/eslint.config.js
 - helpers/jest.config.js
 - helpers/lib/npm/conflicting-dependency-parser.js
 - helpers/lib/npm/index.js
@@ -300,10 +301,13 @@ files:
 - helpers/test/yarn/fixtures/updater/illegal_character/yarn.lock
 - helpers/test/yarn/fixtures/updater/original/package.json
 - helpers/test/yarn/fixtures/updater/original/yarn.lock
+- helpers/test/yarn/fixtures/updater/scoped-git-source/package.json
+- helpers/test/yarn/fixtures/updater/scoped-git-source/yarn.lock
 - helpers/test/yarn/fixtures/updater/updated/yarn.lock
 - helpers/test/yarn/fixtures/updater/with-version-comments/package.json
 - helpers/test/yarn/fixtures/updater/with-version-comments/yarn.lock
 - helpers/test/yarn/helpers.js
+- helpers/test/yarn/helpers.test.js
 - helpers/test/yarn/updater.test.js
 - lib/dependabot/bun.rb
 - lib/dependabot/bun/bun_package_manager.rb
@@ -350,7 +354,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.388.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.389.0
 rdoc_options: []
 require_paths:
 - lib