dependabot-bun 0.393.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 923b839c39e732c6fb6811cf6c9d1d7ec632278e3ea3e53a869091ebbf4ebf3f
-  data.tar.gz: 39e1cf8df33890c3eb795c37ca76d05a13407a0147cbd30c61cd89d192983aed
+  metadata.gz: 58c6e65516abb330782b80eb404d962d2f275f52d283c50849004b0bfd1156e6
+  data.tar.gz: a6ccf3ca258033e75af17af705d6df2daa2ac2c61593b1fbb3756a1ec7721ff2
 SHA512:
-  metadata.gz: 4954f66e622be9eee7f56ab6ce81d65a8874b3308140b63d2c98bf2a0316eead317e296cb71e173b810170047995f9fc9fe9230b543fdbcf1939c2990399a207
-  data.tar.gz: 8f4ed98c474f44bd4f385ea10f54506294776b9b4a6ba2f72150d07c544b9eef60cdd3bddbe5a2ec93ebcf76eaa58281244bb5cebe4c5356d8d213e13225452a
+  metadata.gz: 5f7e979b6ea89101fd6257465ae92c00a42a448404ee790fd010cf1be5c60dcaea094933b4a10c77cab94b9560ffaf8528859a6a019a2c5fe4620b5471a590c9
+  data.tar.gz: 43d0c921178052889623bc74cf29e13a46f4d4d631f4f6ae2ce55f2536d170494ea2ba9c13a0b2d3c8533d5e6c3cd905adf445690fbb365b2acc4b539f223f7c

data/lib/dependabot/bun/package/package_details_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "json"
@@ -6,6 +6,7 @@ require "excon"
 require "time"
 require "dependabot/package/package_release"
 require "dependabot/package/package_details"
+require "dependabot/package/npm_registry_package"
 require "dependabot/bun/package/registry_finder"
 
 module Dependabot
@@ -21,17 +22,8 @@ module Dependabot
         API_AUTHORIZATION_VALUE_BASIC_PREFIX = "Basic"
         API_RESPONSE_STATUS_SUCCESS_PREFIX = "2"
 
-        RELEASE_TIME_KEY = "time"
-        RELEASE_VERSIONS_KEY = "versions"
-        RELEASE_DIST_TAGS_KEY = "dist-tags"
         RELEASE_DIST_TAGS_LATEST_KEY = "latest"
-        RELEASE_ENGINES_KEY = "engines"
         RELEASE_LANGUAGE_KEY = "node"
-        RELEASE_DEPRECATION_KEY = "deprecated"
-        RELEASE_REPOSITORY_KEY = "repository"
-        RELEASE_PACKAGE_TYPE_KEY = "type"
-        RELEASE_PACKAGE_TYPE_GIT = "git"
-        RELEASE_PACKAGE_TYPE_NPM = "npm"
 
         REGISTRY_FILE_NPMRC = ".npmrc"
         REGISTRY_FILE_YARNRC = ".yarnrc"
@@ -53,7 +45,7 @@ module Dependabot
           @dependency_files = dependency_files
           @credentials = credentials
 
-          @npm_details = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+          @npm_details = T.let(nil, T.nilable(Dependabot::Package::NpmRegistryPackage))
           @dist_tags = T.let(nil, T.nilable(T::Hash[String, String]))
           @registry_finder = T.let(nil, T.nilable(Package::RegistryFinder))
           @version_endpoint_working = T.let(nil, T.nilable(T::Boolean))
@@ -84,7 +76,7 @@ module Dependabot
           !dist_tags.nil?
         end
 
-        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+        sig { returns(T.nilable(Dependabot::Package::NpmRegistryPackage)) }
         def npm_details
           @npm_details ||= fetch_npm_details
         end
@@ -158,32 +150,26 @@ module Dependabot
 
         sig do
           params(
-            npm_data: T::Hash[String, T.untyped]
+            npm_data: Dependabot::Package::NpmRegistryPackage
           ).returns(T::Array[Dependabot::Package::PackageRelease])
         end
         def parse_versions(npm_data)
-          time_data = fetch_value_from_hash(npm_data, RELEASE_TIME_KEY) || {}
-          versions_data = fetch_value_from_hash(npm_data, RELEASE_VERSIONS_KEY) || {}
+          latest_version = npm_data.dist_tags&.[](RELEASE_DIST_TAGS_LATEST_KEY)
 
-          dist_tags = fetch_value_from_hash(npm_data, RELEASE_DIST_TAGS_KEY)
-          latest_version = fetch_value_from_hash(dist_tags, RELEASE_DIST_TAGS_LATEST_KEY)
-
-          versions_data.filter_map do |version, details|
-            next unless Dependabot::Bun::Version.correct?(version)
-
-            package_type = infer_package_type(details)
+          npm_data.releases.values.filter_map do |release|
+            next unless Dependabot::Bun::Version.correct?(release.version)
 
             Dependabot::Package::PackageRelease.new(
-              version: Version.new(version),
-              released_at: time_data[version] ? Time.parse(time_data[version]) : nil,
+              version: Version.new(release.version),
+              released_at: release.released_at,
               yanked: false,
               yanked_reason: nil,
               downloads: nil,
-              latest: latest_version.to_s == version,
-              url: package_version_url(version),
-              package_type: package_type,
-              language: package_language(details),
-              details: details
+              latest: latest_version == release.version,
+              url: package_version_url(release.version),
+              package_type: release.package_type,
+              language: package_language(release.node_requirement),
+              details: release.details
             )
           end.sort_by(&:version).reverse
         end
@@ -193,39 +179,31 @@ module Dependabot
           "#{dependency_registry}/#{@dependency.name}/v/#{version}"
         end
 
-        sig do
-          params(version_details: T::Hash[String, T.untyped])
-            .returns(T.nilable(Dependabot::Package::PackageLanguage))
-        end
-        def package_language(version_details)
-          # Fetch the engines hash from the version details
-          engines = version_details.is_a?(Hash) ? version_details[RELEASE_ENGINES_KEY] : nil
-          # Check if engines is a hash and fetch the node requirement
-          node_requirement = engines.is_a?(Hash) ? engines.fetch(RELEASE_LANGUAGE_KEY, nil) : nil
-
+        sig { params(node_requirement: T.nilable(String)).returns(T.nilable(Dependabot::Package::PackageLanguage)) }
+        def package_language(node_requirement)
           return nil unless node_requirement
 
-          if node_requirement
-            Dependabot::Package::PackageLanguage.new(
-              name: RELEASE_LANGUAGE_KEY,
-              version: nil,
-              requirement: Requirement.new(node_requirement)
-            )
-          end
+          Dependabot::Package::PackageLanguage.new(
+            name: RELEASE_LANGUAGE_KEY,
+            version: nil,
+            requirement: Requirement.new(node_requirement)
+          )
         rescue Gem::Requirement::BadRequirementError
           nil
         end
 
         sig { returns(T.nilable(T::Hash[String, String])) }
         def dist_tags
-          @dist_tags ||= fetch_value_from_hash(npm_details, RELEASE_DIST_TAGS_KEY)
+          @dist_tags ||= npm_details&.dist_tags
         end
 
-        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+        sig { returns(T.nilable(Dependabot::Package::NpmRegistryPackage)) }
         def fetch_npm_details
           npm_response = fetch_npm_response
           check_npm_response(npm_response) if npm_response
-          JSON.parse(npm_response.body)
+          Dependabot::Package::NpmRegistryPackage.from_json(npm_response.body) do |version|
+            Dependabot::Bun::Version.correct?(version)
+          end
         rescue JSON::ParserError, Excon::Error::Timeout, Excon::Error::Socket, RegistryError => e
           if git_dependency?
             nil
@@ -250,10 +228,10 @@ module Dependabot
           # If a private registry returns a 500 error, check authentication
           return response unless response.status == 500
 
-          auth = fetch_value_from_hash(registry_auth_headers, API_AUTHORIZATION_KEY)
+          auth = registry_auth_headers[API_AUTHORIZATION_KEY]
           return response unless auth
 
-          return response unless auth&.start_with?(API_AUTHORIZATION_VALUE_BASIC_PREFIX)
+          return response unless auth.start_with?(API_AUTHORIZATION_VALUE_BASIC_PREFIX)
 
           decoded_token = Base64.decode64(auth.gsub("#{API_AUTHORIZATION_VALUE_BASIC_PREFIX} ", "")).strip
 
@@ -275,29 +253,6 @@ module Dependabot
           raise DependencyFileNotResolvable, e.message
         end
 
-        sig do
-          params(
-            details: T::Hash[String, T.untyped],
-            git_dependency: T::Boolean
-          )
-            .returns(String)
-        end
-        def infer_package_type(details, git_dependency: false)
-          return RELEASE_PACKAGE_TYPE_GIT if git_dependency
-
-          repository = fetch_value_from_hash(details, RELEASE_REPOSITORY_KEY)
-
-          case repository
-          when String
-            return repository.start_with?("git+") ? RELEASE_PACKAGE_TYPE_GIT : RELEASE_PACKAGE_TYPE_NPM
-          when Hash
-            type = fetch_value_from_hash(repository, RELEASE_PACKAGE_TYPE_KEY)
-            return RELEASE_PACKAGE_TYPE_GIT if type == RELEASE_PACKAGE_TYPE_GIT
-          end
-
-          RELEASE_PACKAGE_TYPE_NPM
-        end
-
         sig { params(npm_response: Excon::Response).void }
         def check_npm_response(npm_response)
           return if git_dependency?
@@ -332,7 +287,7 @@ module Dependabot
           raise RegistryError.new(status, msg)
         end
 
-        sig { params(error: StandardError).void }
+        sig { params(error: StandardError).returns(T.noreturn) }
         def raise_npm_details_error(error)
           raise if dependency_registry == GLOBAL_REGISTRY
           raise unless error.is_a?(Excon::Error::Timeout) || error.is_a?(Excon::Error::Socket)
@@ -372,8 +327,7 @@ module Dependabot
 
         sig { params(npm_response: Excon::Response).returns(T::Boolean) }
         def response_invalid_json?(npm_response)
-          result = JSON.parse(npm_response.body)
-          result.is_a?(Hash) || result.is_a?(Array)
+          T.cast(JSON.parse(npm_response.body), Object)
           false
         rescue JSON::ParserError, TypeError
           true
@@ -423,15 +377,6 @@ module Dependabot
             credentials: credentials
           ).git_dependency?
         end
-
-        # This function safely retrieves a value for a given key from a Hash.
-        # If the hash is valid and the key exists, it will return the value, otherwise nil.
-        sig { params(hash: T.untyped, key: T.untyped).returns(T.untyped) }
-        def fetch_value_from_hash(hash, key)
-          return nil unless hash.is_a?(Hash) # Return nil if the hash is not a Hash
-
-          hash.fetch(key, nil) # Fetch the value for the given key, defaulting to nil if not found
-        end
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.393.0
+  version: 0.394.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -169,14 +169,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -354,7 +354,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
 rdoc_options: []
 require_paths:
 - lib