dependabot-deno 0.378.0 → 0.379.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4c68a5487f9d6a5ecf33733f6bdfde5912e4b995724503fdb67bc134247ac2a4
-  data.tar.gz: e3763f86ce236ceae251ba9ab0c161b6eca6aaf27a9d751ac1e7eed9c5966493
+  metadata.gz: db549557d14756fc5ba5f9fde9bf887724c585d8f7698c75c4168c2cca7a81c9
+  data.tar.gz: 8fa9f06eda624534c3cee85eb1de7f6ffb26eed35ff216c53ca140901cefd59e
 SHA512:
-  metadata.gz: 882fc5fcf9ba6efdfe1694df6fcbcb532b40372e0489c53ffea6a977c1eeb674466afd08d69414e5fabac8e99b60f0325e6d5534bbe0cc7554a9cfe233269aa5
-  data.tar.gz: c58c39f8f1e91219d894cac7f61d4362c5872c576b533b17b2061a4d6dba38aa4a12b34818ec3085ce33975fdca2d199def91f224f128f73126cde2ef56d19ec
+  metadata.gz: 0fef03bebbd283a3cc0f24cc2a059bb1abd8f4a88f315840cf70f50458789f10f26859a296a5362e41c20c4b2a2a63fabbeccd931b803866ed05e730edc6b7ec
+  data.tar.gz: '08c3f276772d8fe09521879ce3dc48b12fd2b6a7119e2323186d9894c9fc7c3c2f6c2f4c6f8f96e134c3692d4154050d064aec196690477531f533165fd39759'

data/lib/dependabot/deno/file_updater/lockfile_updater.rb

@@ -0,0 +1,119 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+require "dependabot/dependency"
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/shared_helpers"
+require "dependabot/deno/file_updater"
+require "dependabot/deno/file_updater/manifest_updater"
+require "dependabot/deno/helpers"
+
+module Dependabot
+  module Deno
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      class LockfileUpdater
+        extend T::Sig
+
+        LOCKFILE_FILENAME = T.let("deno.lock", String)
+
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential]
+          ).void
+        end
+        def initialize(dependencies:, dependency_files:, credentials:)
+          @dependencies = dependencies
+          @dependency_files = dependency_files
+          # Reserved for DENO_AUTH_TOKENS / private registry support — accepted now
+          # so callers don't need a signature change when that lands.
+          @credentials = credentials
+        end
+
+        sig { returns(String) }
+        def updated_lockfile_content
+          @updated_lockfile_content ||= T.let(
+            regenerate_lockfile,
+            T.nilable(String)
+          )
+        end
+
+        private
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
+        attr_reader :dependencies
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { returns(String) }
+        def regenerate_lockfile
+          # Deno rewrites `deno.lock` holistically (not surgically) when its
+          # input manifest references newer constraints. Don't try to
+          # preserve unrelated entries here — that's deno install's job.
+          #
+          # Note on error detection: `deno install` exits 0 even when a
+          # specifier can't be resolved (missing package, unsatisfiable
+          # constraint) — it just silently leaves the lockfile unchanged.
+          # The byte-equal check below is the primary defense; the rescue
+          # wraps the rare-but-real cases where deno does exit non-zero
+          # (malformed config, binary missing, filesystem errors).
+          original_lockfile_content = T.must(lockfile.content)
+
+          new_content =
+            begin
+              SharedHelpers.in_a_temporary_directory do |dir|
+                write_temporary_files(dir.to_s)
+                Helpers.run_deno_command("install", "--frozen=false", dir: dir.to_s)
+                File.read(File.join(dir.to_s, LOCKFILE_FILENAME))
+              end
+            rescue SharedHelpers::HelperSubprocessFailed, Errno::ENOENT => e
+              raise Dependabot::DependencyFileNotResolvable, e.message
+            end
+
+          if new_content == original_lockfile_content
+            raise Dependabot::DependencyFileNotResolvable,
+                  "deno install did not change #{LOCKFILE_FILENAME}; manifest bump did not take effect"
+          end
+
+          new_content
+        end
+
+        sig { params(dir: String).void }
+        def write_temporary_files(dir)
+          File.write(File.join(dir, manifest.name), updated_manifest_content)
+          File.write(File.join(dir, LOCKFILE_FILENAME), T.must(lockfile.content))
+        end
+
+        sig { returns(String) }
+        def updated_manifest_content
+          ManifestUpdater.new(dependencies: dependencies, manifest: manifest).updated_manifest_content
+        end
+
+        sig { returns(Dependabot::DependencyFile) }
+        def manifest
+          @manifest ||= T.let(
+            T.must(dependency_files.find { |f| FileUpdater::MANIFEST_FILENAMES.include?(f.name) }),
+            T.nilable(Dependabot::DependencyFile)
+          )
+        end
+
+        sig { returns(Dependabot::DependencyFile) }
+        def lockfile
+          @lockfile ||= T.let(
+            T.must(dependency_files.find { |f| f.name == LOCKFILE_FILENAME }),
+            T.nilable(Dependabot::DependencyFile)
+          )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/deno/file_updater/manifest_updater.rb

@@ -0,0 +1,73 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/dependency"
+require "dependabot/dependency_file"
+require "dependabot/deno/file_updater"
+
+module Dependabot
+  module Deno
+    class FileUpdater
+      class ManifestUpdater
+        extend T::Sig
+
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            manifest: Dependabot::DependencyFile
+          ).void
+        end
+        def initialize(dependencies:, manifest:)
+          @dependencies = dependencies
+          @manifest = manifest
+        end
+
+        sig { returns(String) }
+        def updated_manifest_content
+          content = T.must(manifest.content).dup
+
+          dependencies.each do |dep|
+            prev_reqs = (dep.previous_requirements || []).select { |r| r[:file] == manifest.name }
+            new_reqs = dep.requirements.select { |r| r[:file] == manifest.name }
+
+            prev_reqs.zip(new_reqs).each do |prev_req, new_req|
+              content = apply_substitution(content, dep, prev_req, T.must(new_req))
+            end
+          end
+
+          content
+        end
+
+        private
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
+        attr_reader :dependencies
+
+        sig { returns(Dependabot::DependencyFile) }
+        attr_reader :manifest
+
+        sig do
+          params(
+            content: String,
+            dep: Dependabot::Dependency,
+            prev_req: T::Hash[Symbol, T.untyped],
+            new_req: T::Hash[Symbol, T.untyped]
+          ).returns(String)
+        end
+        def apply_substitution(content, dep, prev_req, new_req)
+          source_type = prev_req[:source][:type]
+          prev_req_str = prev_req[:requirement]
+          new_req_str = new_req[:requirement]
+
+          base = "#{source_type}:#{dep.name}"
+          old_specifier = prev_req_str ? "#{base}@#{prev_req_str}" : base
+          new_specifier = "#{base}@#{new_req_str}"
+
+          content.gsub(%r{#{Regexp.escape(old_specifier)}(?=["/])}, new_specifier)
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/deno/file_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/file_updaters"
@@ -9,6 +9,9 @@ module Dependabot
     class FileUpdater < Dependabot::FileUpdaters::Base
       extend T::Sig
 
+      require_relative "file_updater/manifest_updater"
+      require_relative "file_updater/lockfile_updater"
+
       MANIFEST_FILENAMES = T.let(%w(deno.json deno.jsonc).freeze, T::Array[String])
 
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }
@@ -24,6 +27,13 @@ module Dependabot
           updated_files << updated_file(file: file, content: new_content)
         end
 
+        if lockfile
+          updated_files << updated_file(
+            file: T.must(lockfile),
+            content: lockfile_updater.updated_lockfile_content
+          )
+        end
+
         updated_files
       end
 
@@ -36,28 +46,29 @@ module Dependabot
         raise "No deno.json or deno.jsonc found!"
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns(String) }
-      def update_manifest_content(file)
-        content = T.must(file.content)
-
-        dependencies.each do |dep|
-          prev_reqs = dep.previous_requirements&.select { |r| r[:file] == file.name } || []
-          new_reqs = dep.requirements.select { |r| r[:file] == file.name }
-
-          prev_reqs.zip(new_reqs).each do |prev_req, new_req|
-            source_type = prev_req[:source][:type]
-            prev_req_str = prev_req[:requirement]
-            new_req_str = T.must(new_req)[:requirement]
-
-            base = "#{source_type}:#{dep.name}"
-            old_specifier = prev_req_str ? "#{base}@#{prev_req_str}" : base
-            new_specifier = "#{base}@#{new_req_str}"
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def lockfile
+        @lockfile ||= T.let(
+          dependency_files.find { |f| f.name == "deno.lock" },
+          T.nilable(Dependabot::DependencyFile)
+        )
+      end
 
-            content = content.gsub(%r{#{Regexp.escape(old_specifier)}(?=["/])}, new_specifier)
-          end
-        end
+      sig { returns(LockfileUpdater) }
+      def lockfile_updater
+        @lockfile_updater ||= T.let(
+          LockfileUpdater.new(
+            dependencies: dependencies,
+            dependency_files: dependency_files,
+            credentials: credentials
+          ),
+          T.nilable(LockfileUpdater)
+        )
+      end
 
-        content
+      sig { params(file: Dependabot::DependencyFile).returns(String) }
+      def update_manifest_content(file)
+        ManifestUpdater.new(dependencies: dependencies, manifest: file).updated_manifest_content
       end
     end
   end

data/lib/dependabot/deno/helpers.rb

@@ -0,0 +1,33 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module Deno
+    module Helpers
+      extend T::Sig
+
+      # Wraps `deno <args>` via Dependabot's standard subprocess helper, so
+      # failures surface as Dependabot::SharedHelpers::HelperSubprocessFailed
+      # (consistent with cargo / bun / npm_and_yarn). DENO_DIR is scoped to
+      # the working directory so concurrent jobs don't trample each other's
+      # module cache.
+      sig do
+        params(
+          args: String,
+          dir: String
+        ).returns(String)
+      end
+      def self.run_deno_command(*args, dir:)
+        Dependabot::SharedHelpers.run_shell_command(
+          "deno #{args.join(' ')}",
+          cwd: dir,
+          env: { "DENO_DIR" => File.join(dir, ".deno_cache") }
+        )
+      end
+    end
+  end
+end

data/lib/dependabot/deno.rb

@@ -9,6 +9,7 @@ require "dependabot/deno/update_checker"
 require "dependabot/deno/file_updater"
 require "dependabot/deno/metadata_finder"
 require "dependabot/deno/package/package_details_fetcher"
+require "dependabot/deno/helpers"
 require "dependabot/deno/version"
 require "dependabot/deno/requirement"
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-deno
 version: !ruby/object:Gem::Version
-  version: 0.378.0
+  version: 0.379.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.378.0
+        version: 0.379.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.378.0
+        version: 0.379.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -245,6 +245,9 @@ files:
 - lib/dependabot/deno/file_fetcher.rb
 - lib/dependabot/deno/file_parser.rb
 - lib/dependabot/deno/file_updater.rb
+- lib/dependabot/deno/file_updater/lockfile_updater.rb
+- lib/dependabot/deno/file_updater/manifest_updater.rb
+- lib/dependabot/deno/helpers.rb
 - lib/dependabot/deno/metadata_finder.rb
 - lib/dependabot/deno/package/package_details_fetcher.rb
 - lib/dependabot/deno/requirement.rb
@@ -256,7 +259,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.378.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.379.0
 rdoc_options: []
 require_paths:
 - lib