dependabot-bun 0.391.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c780794b3492c9c16abad2a46f2d48797beec9bf74f951945e6d0d22772039d
-  data.tar.gz: 49f31895cd22a23cdd66d8ed57c9ba5b4eb7bb8ad948a71689e98ce2095e98b2
+  metadata.gz: a26cc2bacba80d0257ab7818f69fbe7f5347e71eb1975a1558f5d49c145d0ebd
+  data.tar.gz: e472da36b4791b838a6e543f225f06b872a6f9d4966b76878f73043c99cb9db7
 SHA512:
-  metadata.gz: 4c73c9ef6474b3e9b7ccd94c1568239f60cfb4524f087d414b79e11301bc718d93457524715939095523e4b30cf4a3983b3944befd0de2fb707906092f12c766
-  data.tar.gz: fc887be654050067bbfb8c8b23c8dc0e2667eb8e0a12d5dcb6e21d067941c41b1585f1dad1fa4381f6e41127b4463408184ba6f7d10bf2cf9924ebd27f0ebbd5
+  metadata.gz: 61c9f416d4fd133198b90bf7e6d2f30e00745422dd9eed1e8f23c27b47db97511c999e1983a4c358508e1eba720b2489ef13bf1f44efe96963646b6e53be207b
+  data.tar.gz: 15e81fb3532a1bd2126d1a5d01e33ceab4b37e9b872802dd59248b10ac6d0555782d5b6006bd9e44295272da7f9114967e68b9635b4d72454e38058467de621b

data/lib/dependabot/bun/bun_package_manager.rb

@@ -13,6 +13,11 @@ module Dependabot
       # In Bun 1.1.39, the lockfile format was changed from a binary bun.lockb to a text-based bun.lock.
       # https://bun.sh/blog/bun-lock-text-lockfile
       MIN_SUPPORTED_VERSION = Version.new("1.1.39")
+
+      # The highest bun.lock `lockfileVersion` the bun binary bundled in `bun/Dockerfile` can parse.
+      # Bun 1.4 raised the default to 2 (https://github.com/oven-sh/bun/pull/31539), which the bundled
+      # bun rejects at parse time. Bump this in lockstep with `ARG BUN_VERSION` in `bun/Dockerfile`.
+      MAX_SUPPORTED_LOCKFILE_VERSION = 1
       SUPPORTED_VERSIONS = T.let([MIN_SUPPORTED_VERSION].freeze, T::Array[Dependabot::Version])
       DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
 

data/lib/dependabot/bun/file_parser/bun_lock.rb

@@ -3,6 +3,7 @@
 
 require "yaml"
 require "dependabot/errors"
+require "dependabot/bun/bun_package_manager"
 require "dependabot/bun/helpers"
 require "sorbet-runtime"
 
@@ -31,6 +32,8 @@ module Dependabot
             version = content["lockfileVersion"]
             raise_invalid!("expected 'lockfileVersion' to be an integer") unless version.is_a?(Integer)
             raise_invalid!("expected 'lockfileVersion' to be >= 0") unless version >= 0
+            raise_unsupported_lockfile_version!(version) if
+              version > BunPackageManager::MAX_SUPPORTED_LOCKFILE_VERSION
 
             # configVersion was introduced in Bun v1.3.2 to control install behavior.
             # When present, it must be preserved or Bun will use different install defaults.
@@ -111,6 +114,17 @@ module Dependabot
           raise Dependabot::DependencyFileNotParseable.new(@dependency_file.path, "Invalid bun.lock file: #{message}")
         end
 
+        # The lockfile is well-formed and we can read it, but the bun binary we shell out to cannot.
+        # Without this, bun discards the lockfile it failed to parse, re-resolves from scratch and
+        # writes a downgraded lockfile back, all while exiting successfully.
+        sig { params(version: Integer).returns(T.noreturn) }
+        def raise_unsupported_lockfile_version!(version)
+          raise Dependabot::DependencyFileNotSupported,
+                "Unsupported bun.lock 'lockfileVersion' #{version} in #{@dependency_file.path}. " \
+                "The bun version Dependabot runs supports up to " \
+                "#{BunPackageManager::MAX_SUPPORTED_LOCKFILE_VERSION}."
+        end
+
         sig do
           params(entry: T.nilable(T::Array[T.untyped])).returns(T.nilable(T::Hash[String, T.untyped]))
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.392.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.392.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.392.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -354,7 +354,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
 rdoc_options: []
 require_paths:
 - lib