dependabot-javascript 0.296.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: e1a6baa9e79aa9cd7d64e96693546469b2d2ad636d72f439d301d9139fe286c8
+  data.tar.gz: a2fe19f72bdfe6387ebce218dfa1a6f96c7703e52dec88aa5bc0b7b251482e23
+SHA512:
+  metadata.gz: 000f2f1bcccb6a184c4afb61a5c0934fbd3ff3c50bb19f5683ff845a8f739aab0117eb4bfd0d4a345434a5a322ea1afd21c0cb78536670b27ced3a517f224417
+  data.tar.gz: 121c902aa072824c42ff89bb7491f22a58a2327c2fbf4f4d53960a51d9aa5dc335688b34d977adba067aca1781c46ed8886c11f0a3c774a75c3c71915b336afc

data/lib/dependabot/bun.rb

@@ -0,0 +1,49 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "zeitwerk"
+
+loader = Zeitwerk::Loader.new
+
+# Set autoload paths for common/lib, excluding files whose content does not match the filename
+loader.push_dir(File.join(__dir__, "../../../common/lib"))
+loader.ignore(File.join(__dir__, "../../../common/lib/dependabot/errors.rb"))
+loader.ignore(File.join(__dir__, "../../../common/lib/dependabot/logger.rb"))
+loader.ignore(File.join(__dir__, "../../../common/lib/dependabot/notices.rb"))
+loader.ignore(File.join(__dir__, "../../../common/lib/dependabot/clients/codecommit.rb"))
+
+loader.push_dir(File.join(__dir__, ".."))
+loader.ignore("#{__dir__}/../script", "#{__dir__}/../spec", "#{__dir__}/../dependabot-javascript.gemspec")
+
+loader.on_load do |_file|
+  require "json"
+  require "sorbet-runtime"
+  require "dependabot/errors"
+  require "dependabot/logger"
+  require "dependabot/notices"
+  require "dependabot/clients/codecommit"
+end
+
+loader.log! if ENV["DEBUG"]
+loader.setup
+
+Dependabot::PullRequestCreator::Labeler
+  .register_label_details("bun", name: "javascript", colour: "168700")
+
+Dependabot::Dependency.register_production_check("bun", ->(_) { true })
+
+module Dependabot
+  module Javascript
+    module Bun
+      ECOSYSTEM = "bun"
+    end
+  end
+end
+
+Dependabot::FileFetchers.register("bun", Dependabot::Javascript::Bun::FileFetcher)
+Dependabot::FileParsers.register("bun", Dependabot::Javascript::Bun::FileParser)
+Dependabot::FileUpdaters.register("bun", Dependabot::Javascript::Bun::FileUpdater)
+Dependabot::UpdateCheckers.register("bun", Dependabot::Javascript::Bun::UpdateChecker)
+Dependabot::MetadataFinders.register("bun", Dependabot::Javascript::Shared::MetadataFinder)
+Dependabot::Utils.register_requirement_class("bun", Dependabot::Javascript::Bun::Requirement)
+Dependabot::Utils.register_version_class("bun", Dependabot::Javascript::Bun::Version)

data/lib/dependabot/javascript/bun/file_fetcher.rb

@@ -0,0 +1,77 @@
+# typed: strong
+# frozen_string_literal: true
+
+module Dependabot
+  module Javascript
+    module Bun
+      class FileFetcher < Shared::FileFetcher
+        extend T::Sig
+        extend T::Helpers
+
+        sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
+        def self.required_files_in?(filenames)
+          filenames.include?("package.json")
+        end
+
+        sig { override.returns(String) }
+        def self.required_files_message
+          "Repo must contain a package.json."
+        end
+
+        sig { override.returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def ecosystem_versions
+          return unknown_ecosystem_versions unless ecosystem_enabled?
+
+          {
+            package_managers: {
+              "bun" => 1
+            }
+          }
+        end
+
+        sig { override.returns(T::Array[DependencyFile]) }
+        def fetch_files
+          fetched_files = T.let([], T::Array[DependencyFile])
+          fetched_files << package_json(self)
+          fetched_files += bun_files if ecosystem_enabled?
+          fetched_files += workspace_package_jsons(self)
+          fetched_files += path_dependencies(self, fetched_files)
+
+          fetched_files.uniq
+        end
+
+        private
+
+        sig { returns(T::Array[DependencyFile]) }
+        def bun_files
+          [bun_lock].compact
+        end
+
+        sig { returns(T.nilable(DependencyFile)) }
+        def bun_lock
+          return @bun_lock if defined?(@bun_lock)
+
+          @bun_lock ||= T.let(fetch_file_if_present(PackageManager::LOCKFILE_NAME), T.nilable(DependencyFile))
+
+          return @bun_lock if @bun_lock || directory == "/"
+
+          @bun_lock = fetch_file_from_parent_directories(self, PackageManager::LOCKFILE_NAME)
+        end
+
+        sig { returns(T::Boolean) }
+        def ecosystem_enabled?
+          allow_beta_ecosystems? && Experiments.enabled?(:enable_bun_ecosystem)
+        end
+
+        sig { returns(T::Hash[Symbol, String]) }
+        def unknown_ecosystem_versions
+          {
+            package_managers: {
+              "unknown" => 0
+            }
+          }
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/javascript/bun/file_parser/bun_lock.rb

@@ -0,0 +1,156 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Dependabot
+  module Javascript
+    module Bun
+      class FileParser
+        class BunLock < Shared::FileParser::Lockfile
+          extend T::Sig
+
+          sig { params(dependency_file: DependencyFile).void }
+          def initialize(dependency_file)
+            super
+            @parsed = T.let(
+              nil,
+              T.nilable(T::Hash[String, T.any(Integer, String, T::Array[String], T::Hash[String, String])])
+            )
+          end
+
+          sig { override.returns(T::Hash[String, T.untyped]) }
+          def parsed
+            @parsed ||= begin
+              content = begin
+                # Since bun.lock is a JSONC file, which is a subset of YAML, we can use YAML to parse it
+                YAML.load(T.must(@dependency_file.content))
+              rescue Psych::SyntaxError => e
+                raise_invalid!("malformed JSONC at line #{e.line}, column #{e.column}")
+              end
+              raise_invalid!("expected to be an object") unless content.is_a?(Hash)
+
+              version = content["lockfileVersion"]
+              raise_invalid!("expected 'lockfileVersion' to be an integer") unless version.is_a?(Integer)
+              raise_invalid!("expected 'lockfileVersion' to be >= 0") unless version >= 0
+
+              content
+            end
+          end
+
+          sig { override.returns(Dependabot::FileParsers::Base::DependencySet) }
+          def dependencies
+            dependency_set = Dependabot::FileParsers::Base::DependencySet.new
+
+            # bun.lock v0 format:
+            # https://github.com/oven-sh/bun/blob/c130df6c589fdf28f9f3c7f23ed9901140bc9349/src/install/bun.lock.zig#L595-L605
+
+            packages = parsed["packages"]
+            raise_invalid!("expected 'packages' to be an object") unless packages.is_a?(Hash)
+
+            packages.each do |key, details|
+              raise_invalid!("expected 'packages.#{key}' to be an array") unless details.is_a?(Array)
+
+              resolution = details.first
+              raise_invalid!("expected 'packages.#{key}[0]' to be a string") unless resolution.is_a?(String)
+
+              name, version = resolution.split(/(?<=\w)\@/)
+              next if name.empty?
+
+              semver = Version.semver_for(version)
+              next unless semver
+
+              dependency_set << Dependency.new(
+                name: name,
+                version: semver.to_s,
+                package_manager: "bun",
+                requirements: []
+              )
+            end
+
+            dependency_set
+          end
+
+          sig do
+            override
+              .params(
+                dependency_name: String,
+                requirement: T.untyped,
+                manifest_name: String
+              )
+              .returns(T.nilable(T::Hash[String, T.untyped]))
+          end
+          def details(dependency_name, requirement, manifest_name) # rubocop:disable Lint/UnusedMethodArgument
+            packages = parsed["packages"]
+            return unless packages.is_a?(Hash)
+
+            candidates =
+              packages
+              .select { |name, _| name == dependency_name }
+              .values
+
+            # If there's only one entry for this dependency, use it, even if
+            # the requirement in the lockfile doesn't match
+            if candidates.one?
+              parse_details(candidates.first)
+            else
+              candidate = candidates.find do |label, _|
+                label.scan(/(?<=\w)\@(?:npm:)?([^\s,]+)/).flatten.include?(requirement)
+              end&.last
+              parse_details(candidate)
+            end
+          end
+
+          private
+
+          sig { params(message: String).void }
+          def raise_invalid!(message)
+            raise Dependabot::DependencyFileNotParseable.new(@dependency_file.path, "Invalid bun.lock file: #{message}")
+          end
+
+          sig do
+            params(entry: T.nilable(T::Array[T.untyped])).returns(T.nilable(T::Hash[String, T.untyped]))
+          end
+          def parse_details(entry)
+            return unless entry.is_a?(Array)
+
+            # Either:
+            # - "{name}@{version}", registry, details, integrity
+            # - "{name}@{resolution}", details
+            resolution = entry.first
+            return unless resolution.is_a?(String)
+
+            name, version = resolution.split(/(?<=\w)\@/)
+            semver = Version.semver_for(version)
+
+            if semver
+              registry, details, integrity = entry[1..3]
+              {
+                "name" => name,
+                "version" => semver.to_s,
+                "registry" => registry,
+                "details" => details,
+                "integrity" => integrity
+              }
+            else
+              details = entry[1]
+              {
+                "name" => name,
+                "resolution" => version,
+                "details" => details
+              }
+            end
+          end
+        end
+
+        sig { override.returns(T::Array[Dependabot::Dependency]) }
+        def parse
+          []
+        end
+
+        private
+
+        sig { override.void }
+        def check_required_files; end
+      end
+    end
+  end
+end

data/lib/dependabot/javascript/bun/file_parser/lockfile_parser.rb

@@ -0,0 +1,55 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Dependabot
+  module Javascript
+    module Bun
+      class FileParser
+        class LockfileParser < Shared::FileParser::LockfileParser
+          extend T::Sig
+
+          DEFAULT_LOCKFILES = %w(bun.lock).freeze
+
+          sig { override.returns(Dependabot::FileParsers::Base::DependencySet) }
+          def parse_set
+            dependency_set = Dependabot::FileParsers::Base::DependencySet.new
+
+            bun_locks.each do |file|
+              dependency_set += lockfile_for(file).dependencies
+            end
+
+            dependency_set
+          end
+
+          sig { override.returns(T::Array[String]) }
+          def default_lockfiles
+            DEFAULT_LOCKFILES
+          end
+
+          private
+
+          sig { override.params(file: DependencyFile).returns(BunLock) }
+          def lockfile_for(file)
+            @lockfiles ||= T.let({}, T.nilable(T::Hash[String, BunLock]))
+            @lockfiles[file.name] ||= case file.name
+                                      when *bun_locks.map(&:name)
+                                        Bun::FileParser::BunLock.new(file)
+                                      else
+                                        raise "Unexpected lockfile: #{file.name}"
+                                      end
+          end
+
+          sig { returns(T::Array[DependencyFile]) }
+          def bun_locks
+            @bun_locks ||= T.let(select_files_by_extension("bun.lock"), T.nilable(T::Array[DependencyFile]))
+          end
+
+          sig { override.returns(T.class_of(Version)) }
+          def version_class
+            Version
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/javascript/bun/file_parser.rb

@@ -0,0 +1,74 @@
+# typed: strong
+# frozen_string_literal: true
+
+# See https://docs.npmjs.com/files/package.json for package.json format docs.
+
+module Dependabot
+  module Javascript
+    module Bun
+      class FileParser < Shared::FileParser
+        extend T::Sig
+
+        sig { override.returns(Ecosystem) }
+        def ecosystem
+          @ecosystem ||= T.let(
+            Ecosystem.new(
+              name: ECOSYSTEM,
+              package_manager: PackageManager.new(detected_version:),
+              language: Shared::Language.new(detected_version:)
+            ),
+            T.nilable(Ecosystem)
+          )
+        end
+
+        private
+
+        sig { returns(T.nilable(String)) }
+        def detected_version
+          Helpers.local_package_manager_version(Bun::PackageManager::NAME)
+        end
+
+        sig { override.returns(T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)]) }
+        def lockfiles
+          {
+            bun: bun_lock
+          }
+        end
+
+        sig { override.returns(LockfileParser) }
+        def lockfile_parser
+          @lockfile_parser ||= T.let(LockfileParser.new(
+                                       dependency_files: dependency_files
+                                     ), T.nilable(LockfileParser))
+        end
+
+        sig { override.returns(T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)]) }
+        def registry_config_files
+          {
+            npmrc: npmrc
+          }
+        end
+
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
+        def bun_lock
+          @bun_lock ||= T.let(dependency_files.find do |f|
+            f.name.end_with?(PackageManager::LOCKFILE_NAME)
+          end, T.nilable(Dependabot::DependencyFile))
+        end
+
+        sig { override.returns(T.class_of(Version)) }
+        def version_class
+          Version
+        end
+
+        sig { override.returns(T.class_of(Requirement)) }
+        def requirement_class
+          Requirement
+        end
+
+        sig { override.void }
+        def check_required_files; end
+      end
+    end
+  end
+end

data/lib/dependabot/javascript/bun/file_updater/lockfile_updater.rb

@@ -0,0 +1,138 @@
+# typed: true
+# frozen_string_literal: true
+
+module Dependabot
+  module Javascript
+    module Bun
+      class FileUpdater
+        class LockfileUpdater
+          def initialize(dependencies:, dependency_files:, repo_contents_path:, credentials:)
+            @dependencies = dependencies
+            @dependency_files = dependency_files
+            @repo_contents_path = repo_contents_path
+            @credentials = credentials
+          end
+
+          def updated_bun_lock_content(bun_lock)
+            @updated_bun_lock_content ||= {}
+            return @updated_bun_lock_content[bun_lock.name] if @updated_bun_lock_content[bun_lock.name]
+
+            new_content = run_bun_update(bun_lock: bun_lock)
+            @updated_bun_lock_content[bun_lock.name] = new_content
+          rescue SharedHelpers::HelperSubprocessFailed => e
+            handle_bun_lock_updater_error(e, bun_lock)
+          end
+
+          private
+
+          attr_reader :dependencies
+          attr_reader :dependency_files
+          attr_reader :repo_contents_path
+          attr_reader :credentials
+
+          ERR_PATTERNS = {
+            /get .* 404/i => Dependabot::DependencyNotFound,
+            /installfailed cloning repository/i => Dependabot::DependencyNotFound,
+            /file:.* failed to resolve/i => Dependabot::DependencyNotFound,
+            /no version matching/i => Dependabot::DependencyFileNotResolvable,
+            /failed to resolve/i => Dependabot::DependencyFileNotResolvable
+          }.freeze
+
+          def run_bun_update(bun_lock:)
+            SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
+              File.write(".npmrc", npmrc_content(bun_lock))
+
+              SharedHelpers.with_git_configured(credentials: credentials) do
+                run_bun_updater
+
+                write_final_package_json_files
+
+                run_bun_install
+
+                File.read(bun_lock.name)
+              end
+            end
+          end
+
+          def run_bun_updater
+            dependency_updates = dependencies.map do |d|
+              "#{d.name}@#{d.version}"
+            end.join(" ")
+
+            Helpers.run_bun_command(
+              "install #{dependency_updates} --save-text-lockfile",
+              fingerprint: "install <dependency_updates> --save-text-lockfile"
+            )
+          end
+
+          def run_bun_install
+            Helpers.run_bun_command(
+              "install --save-text-lockfile"
+            )
+          end
+
+          def lockfile_dependencies(lockfile)
+            @lockfile_dependencies ||= {}
+            @lockfile_dependencies[lockfile.name] ||=
+              FileParser.new(
+                dependency_files: [lockfile, *package_files],
+                source: nil,
+                credentials: credentials
+              ).parse
+          end
+
+          def handle_bun_lock_updater_error(error, _bun_lock)
+            error_message = error.message
+
+            ERR_PATTERNS.each do |pattern, error_class|
+              raise error_class, error_message if error_message.match?(pattern)
+            end
+
+            raise error
+          end
+
+          def write_final_package_json_files
+            package_files.each do |file|
+              path = file.name
+              FileUtils.mkdir_p(Pathname.new(path).dirname)
+              File.write(path, updated_package_json_content(file))
+            end
+          end
+
+          def npmrc_content(bun_lock)
+            Dependabot::Javascript::Shared::FileUpdater::NpmrcBuilder.new(
+              credentials: credentials,
+              dependency_files: dependency_files,
+              dependencies: lockfile_dependencies(bun_lock)
+            ).npmrc_content
+          end
+
+          def updated_package_json_content(file)
+            @updated_package_json_content ||= {}
+            @updated_package_json_content[file.name] ||=
+              Dependabot::Javascript::Shared::FileUpdater::PackageJsonUpdater.new(
+                package_json: file,
+                dependencies: dependencies
+              ).updated_package_json.content
+          end
+
+          def package_files
+            @package_files ||= dependency_files.select { |f| f.name.end_with?("package.json") }
+          end
+
+          def base_dir
+            dependency_files.first.directory
+          end
+
+          def npmrc_file
+            dependency_files.find { |f| f.name == ".npmrc" }
+          end
+
+          def sanitize_message(message)
+            message.gsub(/"|\[|\]|\}|\{/, "")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/javascript/bun/file_updater.rb

@@ -0,0 +1,75 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Dependabot
+  module Javascript
+    module Bun
+      class FileUpdater < Shared::FileUpdater
+        sig { override.returns(T::Array[Regexp]) }
+        def self.updated_files_regex
+          [
+            %r{^(?:.*/)?package\.json$},
+            %r{^(?:.*/)?bun\.lock$} # Matches bun.lock files
+          ]
+        end
+
+        private
+
+        sig { override.returns(T.class_of(FileParser::LockfileParser)) }
+        def lockfile_parser_class
+          FileParser::LockfileParser
+        end
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        def bun_locks
+          @bun_locks ||= T.let(
+            filtered_dependency_files
+            .select { |f| f.name.end_with?("bun.lock") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
+        end
+
+        sig { params(bun_lock: Dependabot::DependencyFile).returns(T::Boolean) }
+        def bun_lock_changed?(bun_lock)
+          bun_lock.content != updated_bun_lock_content(bun_lock)
+        end
+
+        sig { override.returns(T::Array[Dependabot::DependencyFile]) }
+        def updated_lockfiles
+          updated_files = []
+
+          bun_locks.each do |bun_lock|
+            next unless bun_lock_changed?(bun_lock)
+
+            updated_files << updated_file(
+              file: bun_lock,
+              content: updated_bun_lock_content(bun_lock)
+            )
+          end
+
+          updated_files
+        end
+
+        sig { params(bun_lock: Dependabot::DependencyFile).returns(String) }
+        def updated_bun_lock_content(bun_lock)
+          @updated_bun_lock_content ||= T.let({}, T.nilable(T::Hash[String, T.nilable(String)]))
+          @updated_bun_lock_content[bun_lock.name] ||=
+            bun_lockfile_updater.updated_bun_lock_content(bun_lock)
+        end
+
+        sig { returns(Bun::FileUpdater::LockfileUpdater) }
+        def bun_lockfile_updater
+          @bun_lockfile_updater ||= T.let(
+            LockfileUpdater.new(
+              dependencies: dependencies,
+              dependency_files: dependency_files,
+              repo_contents_path: repo_contents_path,
+              credentials: credentials
+            ),
+            T.nilable(Bun::FileUpdater::LockfileUpdater)
+          )
+        end
+      end
+    end
+  end
+end