dependabot-common 0.400.0 → 0.401.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca5d9fe2c8d7aed67f4d924ed8ccbe5ebe3c943ede793a6839d9d56f3451f042
-  data.tar.gz: ccfff2df64d29f5aadc3da412298efd882fd871cce94a84cba03f80e2f8540d0
+  metadata.gz: e7c9b0f34b253c6689d4cdd2d2bb85af222a8d65e336201471f374d51cca42c3
+  data.tar.gz: 65ec188d41768539a3bc7b17480dcc2babfaeb0189318aea7ae5a7a3fee6bae3
 SHA512:
-  metadata.gz: 315d65c2835be9e73dde08b837325d7091542e02035192f96e866ec84d521eedb18707da905e84c1c7a5ac9ec38e1660c1241eb607ed0eddbe0120be78a9c7ce
-  data.tar.gz: 5978d638b88f6fc39395421fb3f96c341205f80d9ecec77faaddb53adc9b28f2c719f7c0062987a26d6820baec24c40f28d8412fc94f6250d63cc11c32770e00
+  metadata.gz: 35db428ec5f1c2f7f4f45c6b8d4c28a6b8a8e44cc08aa1330c283df92837ee08b62bacbb69027ff3ca4a57be1d00eadc5762e0b640849f66f9a5b788a90ae256
+  data.tar.gz: 82b376c4f531f0b4a8e03128a6d942ba80b236b58d21d568c8604561281abaca6448e75ac1f4fee8ef55fce77f5f6c26db10138c5fa6c5cdc43395d3ba13ba92

data/lib/dependabot/package/npm_package_json.rb

@@ -13,7 +13,9 @@ module Dependabot
       extend T::Sig
 
       ObjectHash = T.type_alias { T::Hash[String, Object] }
+      CatalogEntries = T.type_alias { T::Hash[String, String] }
       DEPENDENCY_TYPES = %w(dependencies devDependencies optionalDependencies).freeze
+      CATALOG_FIELDS = %w(catalog catalogs).freeze
 
       sig { params(file: DependencyFile).returns(NpmPackageJson) }
       def self.from_file(file)
@@ -63,8 +65,62 @@ module Dependabot
         NpmPackageManagerConfig.from_package_json(@data)
       end
 
+      # The default catalog that `catalog:` requirements resolve against.
+      sig { returns(CatalogEntries) }
+      def catalog
+        prefix, fields = catalog_fields
+        value = fields["catalog"]
+        return {} unless value
+
+        catalog_entries(value, "#{prefix}catalog")
+      end
+
+      # Named catalogs that `catalog:<name>` requirements resolve against,
+      # keyed by catalog name. `default` extends the default catalog.
+      sig { returns(T::Hash[String, CatalogEntries]) }
+      def catalogs
+        prefix, fields = catalog_fields
+        value = fields["catalogs"]
+        return {} unless value
+
+        field = "#{prefix}catalogs"
+        result = T.let({}, T::Hash[String, CatalogEntries])
+        object_hash(value, field).each do |name, entries|
+          result[name] = catalog_entries(entries, "#{field}.#{name}")
+        end
+        result
+      end
+
+      # The key of the object Bun reads both catalog fields from, or nil for
+      # the root. Bun reads them from `workspaces` when it declares either of
+      # them, and ignores the root fields in that case.
+      sig { returns(T.nilable(String)) }
+      def catalog_container
+        workspaces = @data["workspaces"]
+        return unless workspaces.is_a?(Hash)
+
+        "workspaces" if CATALOG_FIELDS.any? { |field| object_hash(workspaces, "workspaces").key?(field) }
+      end
+
       private
 
+      sig { returns([String, ObjectHash]) }
+      def catalog_fields
+        container = catalog_container
+        return ["", @data] unless container
+
+        ["#{container}.", object_hash(@data[container], container)]
+      end
+
+      sig { params(value: Object, field: String).returns(CatalogEntries) }
+      def catalog_entries(value, field)
+        entries = T.let({}, CatalogEntries)
+        object_hash(value, field).each do |name, requirement|
+          entries[name] = requirement if requirement.is_a?(String)
+        end
+        entries
+      end
+
       sig { params(value: Object, field: String).returns(ObjectHash) }
       def object_hash(value, field)
         raise TypeError, "#{@path}: #{field} must be an object" unless value.is_a?(Hash)

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.400.0"
+  VERSION = "0.401.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.400.0
+  version: 0.401.0
 platform: ruby
 authors:
 - Dependabot
@@ -635,7 +635,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.401.0
 rdoc_options: []
 require_paths:
 - lib