dependabot-common 0.399.0 → 0.401.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 25a94c1e5dc3f55727a0f4ccadd5b4ee8d420f280adb0035bc273d31370843fe
-  data.tar.gz: 5f54adb05f2d66b098cb2ab8443b30dba9bfeb684c3fad1b01fa4e10a895e97d
+  metadata.gz: e7c9b0f34b253c6689d4cdd2d2bb85af222a8d65e336201471f374d51cca42c3
+  data.tar.gz: 65ec188d41768539a3bc7b17480dcc2babfaeb0189318aea7ae5a7a3fee6bae3
 SHA512:
-  metadata.gz: 6be302598830a25eb71907c3d080aa0d603c054b70dc95a12d17ffe233725e761c5c0ee4304b1086d2ba50099bfa0d7c4fb9c8d68fe8f6e4009eb2c2a5dfa0e1
-  data.tar.gz: 3a2df82a0f866e8a2ae116d767f43c916d820ebda987f348b5a65964742403dba8882a2761e4e7ebcfe4e5ffb0db08f644f0131c27f602d206dc1b20f2c9fdc2
+  metadata.gz: 35db428ec5f1c2f7f4f45c6b8d4c28a6b8a8e44cc08aa1330c283df92837ee08b62bacbb69027ff3ca4a57be1d00eadc5762e0b640849f66f9a5b788a90ae256
+  data.tar.gz: 82b376c4f531f0b4a8e03128a6d942ba80b236b58d21d568c8604561281abaca6448e75ac1f4fee8ef55fce77f5f6c26db10138c5fa6c5cdc43395d3ba13ba92

data/lib/dependabot/config/file.rb

@@ -60,6 +60,7 @@ module Dependabot
 
       PACKAGE_MANAGER_LOOKUP = T.let(
         {
+          "apm" => "apm",
           "bazel" => "bazel",
           "bun" => "bun",
           "bundler" => "bundler",

data/lib/dependabot/git_commit_checker.rb

@@ -315,7 +315,7 @@ module Dependabot
       local_tags_matching_sha(commit_sha).map(&:name)
     end
 
-    sig { params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(Dependabot::GitTagDetails)) }
+    sig { overridable.params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(Dependabot::GitTagDetails)) }
     def max_local_tag(tags)
       max_version_tag = tags.max_by { |t| version_from_tag(t) }
 
@@ -589,7 +589,7 @@ module Dependabot
       dependency_source_details&.ref
     end
 
-    sig { params(tag: String).returns(T::Boolean) }
+    sig { overridable.params(tag: String).returns(T::Boolean) }
     def version_tag?(tag)
       tag.match?(VERSION_REGEX)
     end
@@ -605,7 +605,7 @@ module Dependabot
       end
     end
 
-    sig { params(tag: String, other_tag: String).returns(T::Boolean) }
+    sig { overridable.params(tag: String, other_tag: String).returns(T::Boolean) }
     def same_prefix?(tag, other_tag)
       tag_prefix = tag.gsub(VERSION_REGEX, "")
       other_tag_prefix = other_tag.gsub(VERSION_REGEX, "")
@@ -796,7 +796,7 @@ module Dependabot
       version_class.new(scan_version(name))
     end
 
-    sig { params(name: String).returns(String) }
+    sig { overridable.params(name: String).returns(String) }
     def scan_version(name)
       T.must(T.must(name.match(VERSION_REGEX)).named_captures.fetch("version"))
     end

data/lib/dependabot/notices.rb

@@ -158,15 +158,16 @@ module Dependabot
 
     sig { params(mode: String).returns(String) }
     def self.markdown_mode(mode)
+      # GitHub has no INFO alert; it renders NOTE, TIP, IMPORTANT, WARNING and CAUTION
       case mode
       when NoticeMode::INFO
-        "INFO"
+        "NOTE"
       when NoticeMode::WARN
         "WARNING"
       when NoticeMode::ERROR
         "IMPORTANT"
       else
-        "INFO"
+        "NOTE"
       end
     end
   end

data/lib/dependabot/package/npm_package_json.rb

@@ -13,7 +13,9 @@ module Dependabot
       extend T::Sig
 
       ObjectHash = T.type_alias { T::Hash[String, Object] }
+      CatalogEntries = T.type_alias { T::Hash[String, String] }
       DEPENDENCY_TYPES = %w(dependencies devDependencies optionalDependencies).freeze
+      CATALOG_FIELDS = %w(catalog catalogs).freeze
 
       sig { params(file: DependencyFile).returns(NpmPackageJson) }
       def self.from_file(file)
@@ -63,8 +65,62 @@ module Dependabot
         NpmPackageManagerConfig.from_package_json(@data)
       end
 
+      # The default catalog that `catalog:` requirements resolve against.
+      sig { returns(CatalogEntries) }
+      def catalog
+        prefix, fields = catalog_fields
+        value = fields["catalog"]
+        return {} unless value
+
+        catalog_entries(value, "#{prefix}catalog")
+      end
+
+      # Named catalogs that `catalog:<name>` requirements resolve against,
+      # keyed by catalog name. `default` extends the default catalog.
+      sig { returns(T::Hash[String, CatalogEntries]) }
+      def catalogs
+        prefix, fields = catalog_fields
+        value = fields["catalogs"]
+        return {} unless value
+
+        field = "#{prefix}catalogs"
+        result = T.let({}, T::Hash[String, CatalogEntries])
+        object_hash(value, field).each do |name, entries|
+          result[name] = catalog_entries(entries, "#{field}.#{name}")
+        end
+        result
+      end
+
+      # The key of the object Bun reads both catalog fields from, or nil for
+      # the root. Bun reads them from `workspaces` when it declares either of
+      # them, and ignores the root fields in that case.
+      sig { returns(T.nilable(String)) }
+      def catalog_container
+        workspaces = @data["workspaces"]
+        return unless workspaces.is_a?(Hash)
+
+        "workspaces" if CATALOG_FIELDS.any? { |field| object_hash(workspaces, "workspaces").key?(field) }
+      end
+
       private
 
+      sig { returns([String, ObjectHash]) }
+      def catalog_fields
+        container = catalog_container
+        return ["", @data] unless container
+
+        ["#{container}.", object_hash(@data[container], container)]
+      end
+
+      sig { params(value: Object, field: String).returns(CatalogEntries) }
+      def catalog_entries(value, field)
+        entries = T.let({}, CatalogEntries)
+        object_hash(value, field).each do |name, requirement|
+          entries[name] = requirement if requirement.is_a?(String)
+        end
+        entries
+      end
+
       sig { params(value: Object, field: String).returns(ObjectHash) }
       def object_hash(value, field)
         raise TypeError, "#{@path}: #{field} must be an object" unless value.is_a?(Hash)

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.399.0"
+  VERSION = "0.401.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.399.0
+  version: 0.401.0
 platform: ruby
 authors:
 - Dependabot
@@ -635,7 +635,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.401.0
 rdoc_options: []
 require_paths:
 - lib