dependabot-devbox 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 11b87d3ad83c9c545c69e83345c8173e7bd9de6873c1b2a789dd03b93998c563
+  data.tar.gz: 107abd1dd96105c923866884b0624878c3640a7f4fa82b9009ed7b4dc3e518f4
+SHA512:
+  metadata.gz: f0f380423454eb53418a9eb2d45d60cfcb8a8d1162567d16904367c9f02156fdfbfc1c6c40f5dc2b067d896140cbe911e9ec0a8d94b99b63026b2b1adc2b267c
+  data.tar.gz: 7b0fa0c022e3bd8c38dd2442057fcf721c30b6fd3386b447d798d6e6f2935bc95f120effec80c8bd5897c6e3ebc6e1dbd38ce382bc4916249578630a84d48bcf

data/exe/dependabot-devbox-update

@@ -0,0 +1,101 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "dependabot/file_fetchers"
+require "dependabot/file_parsers"
+require "dependabot/update_checkers"
+require "dependabot/file_updaters"
+require "dependabot/pull_request_creator"
+require "dependabot/devbox"
+
+repo      = ENV.fetch("GITHUB_REPOSITORY")
+token     = ENV["GITHUB_ACCESS_TOKEN"] || ENV.fetch("GITHUB_TOKEN")
+directory = ENV.fetch("DIRECTORY_PATH", "/")
+branch    = ENV.fetch("BASE_BRANCH", nil)
+
+credentials = [
+  {
+    "type" => "git_source",
+    "host" => "github.com",
+    "username" => "x-access-token",
+    "password" => token
+  }
+]
+
+source = Dependabot::Source.new(
+  provider: "github",
+  repo: repo,
+  directory: directory,
+  branch: branch
+)
+
+location = directory == "/" ? repo : "#{repo} (#{directory})"
+puts "Fetching devbox files from #{location}"
+
+fetcher = Dependabot::FileFetchers.for_package_manager("devbox").new(
+  source: source,
+  credentials: credentials
+)
+
+files  = fetcher.files
+commit = fetcher.commit
+
+parser = Dependabot::FileParsers.for_package_manager("devbox").new(
+  dependency_files: files,
+  source: source,
+  credentials: credentials
+)
+
+dependencies = parser.parse
+puts "Found #{dependencies.length} devbox package(s)"
+
+dependencies.each do |dep| # rubocop:disable Metrics/BlockLength
+  puts "Checking #{dep.name} (#{dep.version})..."
+
+  checker = Dependabot::UpdateCheckers.for_package_manager("devbox").new(
+    dependency: dep,
+    dependency_files: files,
+    credentials: credentials
+  )
+
+  if checker.up_to_date?
+    puts "  up to date"
+    next
+  end
+
+  requirements_to_unlock = checker.requirements_unlocked_or_can_be? ? :own : :none
+
+  updated_deps =
+    begin
+      checker.updated_dependencies(requirements_to_unlock: requirements_to_unlock)
+    rescue Dependabot::AllVersionsIgnored
+      puts "  all versions ignored"
+      next
+    end
+
+  updater = Dependabot::FileUpdaters.for_package_manager("devbox").new(
+    dependencies: updated_deps,
+    dependency_files: files,
+    credentials: credentials
+  )
+
+  updated_files = updater.updated_dependency_files
+
+  pr_creator = Dependabot::PullRequestCreator.new(
+    source: source,
+    base_commit: commit,
+    dependencies: updated_deps,
+    files: updated_files,
+    credentials: credentials,
+    label_language: true
+  )
+
+  pr = pr_creator.create
+  if pr
+    puts "  PR created: #{pr.html_url}"
+  else
+    puts "  PR already exists or no changes needed"
+  end
+end
+
+puts "Done."

data/lib/dependabot/devbox/file_fetcher.rb

@@ -0,0 +1,58 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/file_fetchers"
+require "dependabot/file_fetchers/base"
+
+module Dependabot
+  module Devbox
+    class FileFetcher < Dependabot::FileFetchers::Base
+      extend T::Sig
+
+      MANIFEST_FILENAME = T.let("devbox.json", String)
+      LOCKFILE_FILENAME = T.let("devbox.lock", String)
+
+      sig { override.returns(String) }
+      def self.required_files_message
+        "Repo must contain a devbox.json."
+      end
+
+      sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
+      def self.required_files_in?(filenames)
+        filenames.include?(MANIFEST_FILENAME)
+      end
+
+      sig { override.returns(T::Array[DependencyFile]) }
+      def fetch_files
+        fetched_files = [manifest_file]
+        fetched_files << T.must(lockfile) if lockfile
+        fetched_files
+      end
+
+      private
+
+      sig { returns(DependencyFile) }
+      def manifest_file
+        @manifest_file ||= T.let(
+          begin
+            file = fetch_file_if_present(MANIFEST_FILENAME)
+            raise Dependabot::DependencyFileNotFound.new(nil, self.class.required_files_message) unless file
+
+            file
+          end,
+          T.nilable(DependencyFile)
+        )
+      end
+
+      sig { returns(T.nilable(DependencyFile)) }
+      def lockfile
+        @lockfile ||= T.let(
+          fetch_file_if_present(LOCKFILE_FILENAME),
+          T.nilable(DependencyFile)
+        )
+      end
+    end
+  end
+end
+
+Dependabot::FileFetchers.register("devbox", Dependabot::Devbox::FileFetcher)

data/lib/dependabot/devbox/file_parser.rb

@@ -0,0 +1,119 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+require "dependabot/dependency"
+require "dependabot/file_parsers"
+require "dependabot/file_parsers/base"
+require "dependabot/devbox/helpers"
+require "dependabot/devbox/version"
+
+module Dependabot
+  module Devbox
+    class FileParser < Dependabot::FileParsers::Base
+      extend T::Sig
+
+      ECOSYSTEM = T.let("devbox", String)
+      MANIFEST_FILENAME = T.let("devbox.json", String)
+      LOCKFILE_FILENAME = T.let("devbox.lock", String)
+      # An entry without an "@constraint" suffix tracks the newest release.
+      DEFAULT_CONSTRAINT = T.let("latest", String)
+      SOURCE_TYPE = T.let("nixhub", String)
+
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
+      def parse
+        package_entries.filter_map do |entry|
+          next unless entry.is_a?(String)
+
+          name, constraint = split_package_entry(entry)
+          next if name.empty?
+
+          Dependabot::Dependency.new(
+            name: name,
+            version: resolved_versions[entry],
+            requirements: [{
+              requirement: constraint,
+              file: MANIFEST_FILENAME,
+              groups: [],
+              source: { type: SOURCE_TYPE }
+            }],
+            package_manager: ECOSYSTEM
+          )
+        end.sort_by(&:name)
+      end
+
+      private
+
+      sig { override.void }
+      def check_required_files
+        return if manifest
+
+        raise "No devbox.json found!"
+      end
+
+      sig { returns(T.nilable(DependencyFile)) }
+      def manifest
+        @manifest ||= T.let(
+          dependency_files.find { |f| File.basename(f.name) == MANIFEST_FILENAME },
+          T.nilable(DependencyFile)
+        )
+      end
+
+      sig { returns(T.nilable(DependencyFile)) }
+      def lockfile
+        @lockfile ||= T.let(
+          dependency_files.find { |f| File.basename(f.name) == LOCKFILE_FILENAME },
+          T.nilable(DependencyFile)
+        )
+      end
+
+      # The "packages" field in devbox.json is an array of `name@constraint`
+      # strings — the only form supported in beta. Any other shape (e.g. the
+      # object form) yields no dependencies.
+      sig { returns(T::Array[Object]) }
+      def package_entries
+        packages = Helpers.parse_json_or_jsonc(manifest&.content).fetch("packages", [])
+        return [] unless packages.is_a?(Array)
+
+        packages
+      end
+
+      # Splits a package entry on the LAST "@" so future scoped names
+      # (e.g. "@org/pkg@1.0") resolve correctly. An entry with no constraint
+      # (or a leading-"@" scoped name with none) defaults to "latest".
+      sig { params(entry: String).returns([String, String]) }
+      def split_package_entry(entry)
+        index = entry.rindex("@")
+        return [entry, DEFAULT_CONSTRAINT] if index.nil? || index.zero?
+
+        [T.must(entry[0...index]), T.must(entry[(index + 1)..])]
+      end
+
+      # Maps each manifest package entry (the full `name@constraint` string) to
+      # the resolved version recorded in devbox.lock. devbox.lock is strict JSON.
+      sig { returns(T::Hash[String, String]) }
+      def resolved_versions
+        @resolved_versions ||= T.let(parse_lockfile_versions, T.nilable(T::Hash[String, String]))
+      end
+
+      sig { returns(T::Hash[String, String]) }
+      def parse_lockfile_versions
+        content = lockfile&.content
+        return {} unless content
+
+        parsed = JSON.parse(content)
+        packages = parsed.is_a?(Hash) ? parsed.fetch("packages", {}) : {}
+        return {} unless packages.is_a?(Hash)
+
+        packages.each_with_object({}) do |(entry, data), versions|
+          version = data.is_a?(Hash) ? data["version"] : nil
+          versions[entry] = version if version.is_a?(String)
+        end
+      rescue JSON::ParserError
+        {}
+      end
+    end
+  end
+end
+
+Dependabot::FileParsers.register("devbox", Dependabot::Devbox::FileParser)

data/lib/dependabot/devbox/file_updater.rb

@@ -0,0 +1,131 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/shared_helpers"
+require "dependabot/file_updaters"
+require "dependabot/file_updaters/base"
+require "dependabot/devbox/helpers"
+
+module Dependabot
+  module Devbox
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
+      MANIFEST_FILENAME = T.let("devbox.json", String)
+      LOCKFILE_FILENAME = T.let("devbox.lock", String)
+      LATEST = T.let("latest", String)
+
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
+      def updated_dependency_files
+        updated_files = []
+
+        new_manifest_content = updated_manifest_content
+        if new_manifest_content != manifest.content
+          updated_files << updated_file(file: manifest, content: new_manifest_content)
+        end
+
+        updated_files << lockfile_dependency_file(regenerated_lockfile_content(new_manifest_content))
+
+        updated_files
+      end
+
+      private
+
+      sig { override.void }
+      def check_required_files
+        return if dependency_files.any? { |f| File.basename(f.name) == MANIFEST_FILENAME }
+
+        raise "No devbox.json found!"
+      end
+
+      sig { returns(Dependabot::DependencyFile) }
+      def manifest
+        @manifest ||= T.let(
+          T.must(dependency_files.find { |f| File.basename(f.name) == MANIFEST_FILENAME }),
+          T.nilable(Dependabot::DependencyFile)
+        )
+      end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def lockfile
+        @lockfile ||= T.let(
+          dependency_files.find { |f| File.basename(f.name) == LOCKFILE_FILENAME },
+          T.nilable(Dependabot::DependencyFile)
+        )
+      end
+
+      # Rewrites each changed `name@constraint` entry in the raw manifest text so
+      # surrounding comments/formatting survive. A `latest` constraint never
+      # changes, so those entries are left untouched (lockfile-only update).
+      sig { returns(String) }
+      def updated_manifest_content
+        content = T.must(manifest.content).dup
+
+        dependencies.each do |dep|
+          prev_reqs = (dep.previous_requirements || []).select { |r| r[:file] == manifest.name }
+          new_reqs = dep.requirements.select { |r| r[:file] == manifest.name }
+
+          prev_reqs.zip(new_reqs).each do |prev_req, new_req|
+            next unless new_req
+
+            old_constraint = prev_req[:requirement]
+            new_constraint = new_req[:requirement]
+            next if old_constraint.nil? || old_constraint == new_constraint
+
+            content = content.gsub(%("#{dep.name}@#{old_constraint}"), %("#{dep.name}@#{new_constraint}"))
+          end
+        end
+
+        content
+      end
+
+      # Regenerates devbox.lock by running `devbox update <pkg> --no-install`
+      # (metadata-only: resolves nixpkgs commits/hashes without downloading store
+      # paths) against the updated manifest in an isolated temp directory.
+      sig { params(manifest_content: String).returns(String) }
+      def regenerated_lockfile_content(manifest_content)
+        original = lockfile&.content
+
+        new_content =
+          begin
+            SharedHelpers.in_a_temporary_directory do |dir|
+              dir = dir.to_s
+              File.write(File.join(dir, MANIFEST_FILENAME), manifest_content)
+              File.write(File.join(dir, LOCKFILE_FILENAME), original) if original
+              dependencies.each do |dep|
+                Helpers.run_devbox_command("update", "--no-install", dep.name, dir: dir)
+              end
+              File.read(File.join(dir, LOCKFILE_FILENAME))
+            end
+          rescue SharedHelpers::HelperSubprocessFailed, Errno::ENOENT => e
+            raise Dependabot::DependencyFileNotResolvable, e.message
+          end
+
+        if original && new_content == original
+          raise Dependabot::DependencyFileContentNotChanged,
+                "devbox update did not change #{LOCKFILE_FILENAME}"
+        end
+
+        new_content
+      end
+
+      sig { params(content: String).returns(Dependabot::DependencyFile) }
+      def lockfile_dependency_file(content)
+        existing = lockfile
+        return updated_file(file: existing, content: content) if existing
+
+        Dependabot::DependencyFile.new(
+          name: LOCKFILE_FILENAME,
+          content: content,
+          directory: manifest.directory,
+          operation: Dependabot::DependencyFile::Operation::CREATE
+        )
+      end
+    end
+  end
+end
+
+Dependabot::FileUpdaters.register("devbox", Dependabot::Devbox::FileUpdater)

data/lib/dependabot/devbox/helpers.rb

@@ -0,0 +1,67 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module Devbox
+    module Helpers
+      extend T::Sig
+
+      # Matches either a JSON string literal (with escapes), a line comment, a
+      # block comment, or a trailing comma. The alternation lets gsub preserve
+      # strings while stripping the JSONC-only constructs, so e.g. "//" inside a
+      # URL value is not mistaken for the start of a comment.
+      JSONC_TOKEN = T.let(
+        %r{
+          ("(?:\\.|[^"\\])*")    # JSON string literal
+          | //[^\n]*             # line comment
+          | /\*.*?\*/            # block comment
+          | ,(?=\s*[\}\]])       # trailing comma
+        }mx,
+        Regexp
+      )
+
+      sig { params(content: T.nilable(String)).returns(T::Hash[String, Object]) }
+      def self.parse_json_or_jsonc(content)
+        return {} unless content
+
+        cleaned = content.gsub(JSONC_TOKEN) { ::Regexp.last_match(1) || "" }
+
+        parsed = JSON.parse(cleaned)
+        # A devbox.json must be a JSON object. Guard here so a malformed manifest
+        # (e.g. a top-level array) surfaces as a clear parse error rather than an
+        # opaque sorbet-runtime type error at the call site.
+        raise JSON::ParserError, "Expected a JSON object, got #{parsed.class}" unless parsed.is_a?(Hash)
+
+        parsed
+      end
+
+      # Wraps `devbox <args>` via Dependabot's standard subprocess helper, so
+      # failures surface as Dependabot::SharedHelpers::HelperSubprocessFailed
+      # (consistent with cargo / bun / npm_and_yarn). The Devbox/Nix caches are
+      # scoped to the working directory so concurrent jobs don't trample each
+      # other's state.
+      sig do
+        params(
+          args: String,
+          dir: String
+        ).returns(String)
+      end
+      def self.run_devbox_command(*args, dir:)
+        Dependabot::SharedHelpers.run_shell_command(
+          "devbox #{args.join(' ')}",
+          cwd: dir,
+          env: {
+            "DEVBOX_CACHE" => File.join(dir, ".devbox_cache"),
+            "XDG_CACHE_HOME" => File.join(dir, ".cache"),
+            "HOME" => dir
+          }
+        )
+      end
+    end
+  end
+end

data/lib/dependabot/devbox/metadata_finder.rb

@@ -0,0 +1,59 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "cgi"
+require "json"
+require "dependabot/metadata_finders"
+require "dependabot/metadata_finders/base"
+require "dependabot/registry_client"
+
+module Dependabot
+  module Devbox
+    class MetadataFinder < Dependabot::MetadataFinders::Base
+      extend T::Sig
+
+      SEARCH_URL = T.let("https://search.devbox.sh/v1/search", String)
+
+      private
+
+      # nixpkgs packages expose a `homepage` in the Nixhub search response. When
+      # it points at a recognised git host (e.g. GitHub) we can surface changelog
+      # and release metadata; otherwise there is no usable source.
+      sig { override.returns(T.nilable(Dependabot::Source)) }
+      def look_up_source
+        homepage = nixhub_homepage
+        return nil unless homepage
+
+        Source.from_url(homepage)
+      end
+
+      sig { returns(T.nilable(String)) }
+      def nixhub_homepage
+        homepage = package_versions.filter_map { |v| v["homepage"] if v.is_a?(Hash) }.first
+        homepage.is_a?(String) && !homepage.empty? ? homepage : nil
+      rescue JSON::ParserError, Excon::Error::Timeout, Excon::Error::Socket
+        nil
+      end
+
+      # The versions list for the exact-name package in the Nixhub search
+      # response (search is fuzzy, so match the name precisely).
+      sig { returns(T::Array[Object]) }
+      def package_versions
+        response = Dependabot::RegistryClient.get(
+          url: "#{SEARCH_URL}?q=#{CGI.escape(dependency.name)}"
+        )
+        return [] unless response.status == 200
+
+        data = JSON.parse(response.body)
+        packages = data.is_a?(Hash) ? data["packages"] : nil
+        return [] unless packages.is_a?(Array)
+
+        package = packages.find { |pkg| pkg.is_a?(Hash) && pkg["name"] == dependency.name }
+        versions = package.is_a?(Hash) ? package["versions"] : nil
+        versions.is_a?(Array) ? versions : []
+      end
+    end
+  end
+end
+
+Dependabot::MetadataFinders.register("devbox", Dependabot::Devbox::MetadataFinder)

data/lib/dependabot/devbox/package/package_details_fetcher.rb

@@ -0,0 +1,86 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "cgi"
+require "json"
+require "time"
+require "sorbet-runtime"
+require "dependabot/registry_client"
+require "dependabot/package/package_release"
+require "dependabot/devbox/version"
+
+module Dependabot
+  module Devbox
+    module Package
+      class PackageDetailsFetcher
+        extend T::Sig
+
+        SEARCH_URL = T.let("https://search.devbox.sh/v1/search", String)
+
+        sig { params(dependency: Dependabot::Dependency).void }
+        def initialize(dependency:)
+          @dependency = dependency
+        end
+
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def available_versions
+          package = fetch_package
+          return [] unless package
+
+          versions = package["versions"]
+          return [] unless versions.is_a?(Array)
+
+          versions.filter_map do |version_data|
+            next unless version_data.is_a?(Hash)
+
+            version_str = version_data["version"]
+            next unless version_str.is_a?(String) && Devbox::Version.correct?(version_str)
+
+            Dependabot::Package::PackageRelease.new(
+              version: Devbox::Version.new(version_str),
+              released_at: release_time(version_data)
+            )
+          end
+        rescue JSON::ParserError, Excon::Error::Timeout, Excon::Error::Socket
+          []
+        end
+
+        private
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        # Nixhub search is fuzzy and can return several packages; keep only the
+        # one whose name matches the dependency exactly.
+        sig { returns(T.nilable(T::Hash[String, Object])) }
+        def fetch_package
+          response = Dependabot::RegistryClient.get(
+            url: "#{SEARCH_URL}?q=#{CGI.escape(dependency.name)}"
+          )
+          return nil unless response.status == 200
+
+          data = JSON.parse(response.body)
+          packages = data.is_a?(Hash) ? data["packages"] : nil
+          return nil unless packages.is_a?(Array)
+
+          packages.find { |pkg| pkg.is_a?(Hash) && pkg["name"] == dependency.name }
+        end
+
+        # Approximates a version's release date with the earliest per-system
+        # `last_updated` (Unix epoch seconds), falling back to the top-level
+        # `last_updated`. `filter_by_cooldown` treats a nil result gracefully.
+        sig { params(version_data: T::Hash[String, Object]).returns(T.nilable(Time)) }
+        def release_time(version_data)
+          timestamps = []
+
+          systems = version_data["systems"]
+          timestamps.concat(systems.values.filter_map { |s| s["last_updated"] if s.is_a?(Hash) }) if systems.is_a?(Hash)
+          timestamps << version_data["last_updated"]
+
+          epoch = timestamps.grep(Integer).min
+          epoch ? Time.at(epoch).utc : nil
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/devbox/requirement.rb

@@ -0,0 +1,57 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/requirement"
+require "dependabot/utils"
+require "dependabot/devbox/version"
+
+# Devbox constraints are nixpkgs version prefixes declared as `name@constraint`
+# in devbox.json. We translate the prefix form into Gem::Requirement strings:
+#   latest   -> ">= 0"       (track the newest release)
+#   3        -> "~> 3.0"     (pin the major line)
+#   3.10     -> "~> 3.10.0"  (pin the minor line)
+#   3.10.19  -> "= 3.10.19"  (pin an exact version)
+
+module Dependabot
+  module Devbox
+    class Requirement < Dependabot::Requirement
+      extend T::Sig
+
+      sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Requirement]) }
+      def self.requirements_array(requirement_string)
+        [new(requirement_string)]
+      end
+
+      sig { params(requirements: T.nilable(T.any(String, T::Array[String]))).void }
+      def initialize(*requirements)
+        constraints = requirements.flatten.compact.flat_map do |req_string|
+          req_string.strip.split(/\s*,\s*/).map do |part|
+            convert_devbox_constraint_to_ruby_constraint(part.strip)
+          end
+        end
+        constraints = [">= 0"] if constraints.empty?
+
+        super(constraints)
+      end
+
+      private
+
+      sig { params(constraint: String).returns(String) }
+      def convert_devbox_constraint_to_ruby_constraint(constraint)
+        return ">= 0" if constraint.empty? || constraint == Version::LATEST
+        # Already a Ruby/Gem requirement string (e.g. ">= 0" from base-class callers
+        # like UpdateChecker::Base#can_update? or ignored_versions entries).
+        return constraint if constraint.match?(/\A[><=~!]/)
+
+        segments = constraint.split(".")
+        case segments.length
+        when 1, 2 then "~> #{constraint}.0"
+        else "= #{constraint}"
+        end
+      end
+    end
+  end
+end
+
+Dependabot::Utils.register_requirement_class("devbox", Dependabot::Devbox::Requirement)

data/lib/dependabot/devbox/update_checker/latest_version_finder.rb

@@ -0,0 +1,33 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/package/package_latest_version_finder"
+require "dependabot/package/package_details"
+require "dependabot/devbox/update_checker"
+require "dependabot/devbox/package/package_details_fetcher"
+
+module Dependabot
+  module Devbox
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
+        extend T::Sig
+
+        private
+
+        sig { override.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+        def package_details
+          @package_details ||= T.let(
+            Dependabot::Package::PackageDetails.new(
+              dependency: dependency,
+              releases: Package::PackageDetailsFetcher.new(
+                dependency: dependency
+              ).available_versions
+            ),
+            T.nilable(Dependabot::Package::PackageDetails)
+          )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/devbox/update_checker.rb

@@ -0,0 +1,89 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "dependabot/update_checkers"
+require "dependabot/update_checkers/base"
+require "dependabot/devbox/version"
+require "dependabot/devbox/requirement"
+
+module Dependabot
+  module Devbox
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
+      require_relative "update_checker/latest_version_finder"
+
+      LATEST = T.let("latest", String)
+
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
+      def latest_version
+        latest_version_finder.latest_version
+      end
+
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
+      def latest_resolvable_version
+        latest_version
+      end
+
+      sig { override.returns(T.nilable(String)) }
+      def latest_resolvable_version_with_no_unlock
+        dependency.version
+      end
+
+      sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
+      def updated_requirements
+        latest = latest_version
+        return dependency.requirements unless latest
+
+        updated = dependency.requirements.map do |req|
+          req.merge(requirement: updated_constraint(req[:requirement], latest.to_s))
+        end
+        wrap_requirements(updated)
+      end
+
+      private
+
+      sig { override.returns(T::Boolean) }
+      def latest_version_resolvable_with_full_unlock?
+        false
+      end
+
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
+      def updated_dependencies_after_full_unlock
+        []
+      end
+
+      sig { returns(LatestVersionFinder) }
+      def latest_version_finder
+        @latest_version_finder ||= T.let(
+          LatestVersionFinder.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            security_advisories: security_advisories,
+            cooldown_options: update_cooldown
+          ),
+          T.nilable(LatestVersionFinder)
+        )
+      end
+
+      # Recomputes the `name@constraint` constraint for the target version,
+      # preserving the original constraint's precision:
+      #   - "latest"  stays "latest" (the lockfile alone advances)
+      #   - a pinned-minor constraint ("3.10") keeps its two segments, so a patch
+      #     bump leaves it unchanged and only a minor/major bump rewrites it
+      #   - a pinned-exact constraint ("3.10.15") tracks every segment, so any
+      #     bump rewrites it
+      sig { params(old_constraint: T.nilable(String), latest: String).returns(T.nilable(String)) }
+      def updated_constraint(old_constraint, latest)
+        return old_constraint if old_constraint.nil? || old_constraint == LATEST
+
+        segment_count = old_constraint.split(".").length
+        latest.split(".").first(segment_count).join(".")
+      end
+    end
+  end
+end
+
+Dependabot::UpdateCheckers.register("devbox", Dependabot::Devbox::UpdateChecker)

data/lib/dependabot/devbox/version.rb

@@ -0,0 +1,64 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/version"
+require "dependabot/utils"
+require "sorbet-runtime"
+
+# Devbox package versions are nixpkgs versions. Alongside standard numeric
+# versions ("3.10.19") and short prefixes ("3", "3.10"), Devbox supports a
+# "latest" sentinel that always resolves to the newest release, so it must
+# sort above any concrete version.
+
+module Dependabot
+  module Devbox
+    class Version < Dependabot::Version
+      extend T::Sig
+
+      LATEST = "latest"
+
+      # A value that sorts above any realistic nixpkgs version, used as the
+      # internal representation of the "latest" sentinel since Gem::Version
+      # cannot parse the word itself.
+      LATEST_SENTINEL = T.let("999999", String)
+
+      sig { override.params(version: VersionParameter).returns(T::Boolean) }
+      def self.correct?(version)
+        return false if version.nil?
+        return true if version.to_s.strip == LATEST
+
+        super
+      end
+
+      sig { override.params(version: VersionParameter).void }
+      def initialize(version)
+        @version_string = T.let(version.to_s.strip, String)
+        @latest = T.let(@version_string == LATEST, T::Boolean)
+
+        super(@latest ? LATEST_SENTINEL : version)
+      end
+
+      sig { override.params(version: VersionParameter).returns(Dependabot::Devbox::Version) }
+      def self.new(version)
+        T.cast(super, Dependabot::Devbox::Version)
+      end
+
+      sig { returns(T::Boolean) }
+      def latest?
+        @latest
+      end
+
+      sig { override.returns(String) }
+      def to_s
+        @version_string
+      end
+
+      sig { override.returns(String) }
+      def inspect
+        "#<#{self.class} #{@version_string}>"
+      end
+    end
+  end
+end
+
+Dependabot::Utils.register_version_class("devbox", Dependabot::Devbox::Version)

data/lib/dependabot/devbox.rb

@@ -0,0 +1,41 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/utils"
+require "dependabot/config/file"
+
+# The published dependabot-common gem predates the devbox entry being added
+# to PACKAGE_MANAGER_LOOKUP. Patch validate_package_manager! to allow "devbox"
+# until the upstream PR merges and a new gem version is published.
+module Dependabot
+  module Utils
+    class << self
+      private
+
+      def validate_package_manager!(package_manager)
+        return if package_manager == "devbox"
+        return if Config::File::REVERSE_PACKAGE_MANAGER_LOOKUP.key?(package_manager)
+        return if %w[dummy silent].include?(package_manager)
+
+        raise "Unsupported package_manager #{package_manager}"
+      end
+    end
+  end
+end
+
+require "dependabot/devbox/file_fetcher"
+require "dependabot/devbox/file_parser"
+require "dependabot/devbox/update_checker"
+require "dependabot/devbox/file_updater"
+require "dependabot/devbox/metadata_finder"
+require "dependabot/devbox/package/package_details_fetcher"
+require "dependabot/devbox/helpers"
+require "dependabot/devbox/version"
+require "dependabot/devbox/requirement"
+
+require "dependabot/pull_request_creator/labeler"
+Dependabot::PullRequestCreator::Labeler
+  .register_label_details("devbox", name: "devbox", colour: "5c4ee5")
+
+require "dependabot/dependency"
+Dependabot::Dependency.register_production_check("devbox", ->(_) { true })

metadata

@@ -0,0 +1,75 @@
+--- !ruby/object:Gem::Specification
+name: dependabot-devbox
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Andoni A.
+autorequire:
+bindir: exe
+cert_chain: []
+date: 2026-06-29 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: dependabot-common
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.383'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.383'
+description: Automatically update Devbox (devbox.json) package versions via Dependabot.
+  Standalone gem for use before official dependabot-core support lands.
+email:
+- andonialonsof@gmail.com
+executables:
+- dependabot-devbox-update
+extensions: []
+extra_rdoc_files: []
+files:
+- exe/dependabot-devbox-update
+- lib/dependabot/devbox.rb
+- lib/dependabot/devbox/file_fetcher.rb
+- lib/dependabot/devbox/file_parser.rb
+- lib/dependabot/devbox/file_updater.rb
+- lib/dependabot/devbox/helpers.rb
+- lib/dependabot/devbox/metadata_finder.rb
+- lib/dependabot/devbox/package/package_details_fetcher.rb
+- lib/dependabot/devbox/requirement.rb
+- lib/dependabot/devbox/update_checker.rb
+- lib/dependabot/devbox/update_checker/latest_version_finder.rb
+- lib/dependabot/devbox/version.rb
+homepage: https://github.com/andoniaf/dependabot-devbox
+licenses:
+- MIT
+metadata:
+  bug_tracker_uri: https://github.com/andoniaf/dependabot-devbox/issues
+  changelog_uri: https://github.com/andoniaf/dependabot-devbox/releases
+  source_code_uri: https://github.com/andoniaf/dependabot-devbox
+  rubygems_mfa_required: 'true'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.3.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.22
+signing_key:
+specification_version: 4
+summary: Dependabot support for Devbox
+test_files: []