dependabot-vcpkg 0.398.0 → 0.400.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 518a47b3ca02431938c1d73d84a1dcfefe2f1de41a7d626afdc081123bc470e2
-  data.tar.gz: 317d51a65e62f67b835a6f9cabb754c0743c44783de8d4077383dd68926b935e
+  metadata.gz: eef88987d897016f4050ef6a6f7f01706a1ae69ebb500f751bf10e1f9492d477
+  data.tar.gz: a7f4001d7cec04609c37940363fd94f201e93dede0c74cf25d949b18c5bf29ee
 SHA512:
-  metadata.gz: a0ac23f74427aa1cad0cd797a16bae12465498f65d48885c153679dad4bfea3e38be4ea220a74654c72eeae392dfaaa211be1698c474b1632f201c7303414a26
-  data.tar.gz: ce1479969c093e4cc2d1cf1ceb39ab508f1e4be18110ed7980baf7b7787c858357e9edfed793444edf23c13ccd46976aec9f81ba6213694276711871ed82f927
+  metadata.gz: 74583f0eb7dfcb426e20191a874415027ec6be2dd37851db03966e2615e344ed34605dcf233eb9b0786c297b259406b47aa883d460bede9eb189c2bfd9cd7e63
+  data.tar.gz: 49a5e550db7e20e9ffe3b15f9d1fa5545af97c822a1e08dba5b4a0868ce48be68a666b42ac6f36f5182394e86863db97bc0b1c4a1f609502b35b63593440503b

data/lib/dependabot/vcpkg/file_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -11,6 +11,7 @@ require "dependabot/logger"
 require "dependabot/vcpkg"
 require "dependabot/vcpkg/language"
 require "dependabot/vcpkg/manifest_baseline"
+require "dependabot/vcpkg/manifest_document"
 require "dependabot/vcpkg/package/versions_database"
 require "dependabot/vcpkg/package_manager"
 require "dependabot/vcpkg/version"
@@ -58,20 +59,20 @@ module Dependabot
         return [] unless dependency_file.content
 
         case dependency_file.name
-        in VCPKG_JSON_FILENAME then parse_vcpkg_json(dependency_file)
-        in VCPKG_CONFIGURATION_JSON_FILENAME then parse_vcpkg_configuration_json(dependency_file)
+        when VCPKG_JSON_FILENAME then parse_vcpkg_json(dependency_file)
+        when VCPKG_CONFIGURATION_JSON_FILENAME then parse_vcpkg_configuration_json(dependency_file)
         else []
         end
       end
 
       sig { params(dependency_file: Dependabot::DependencyFile).returns(T::Array[Dependabot::Dependency]) }
       def parse_vcpkg_json(dependency_file)
-        contents = T.must(dependency_file.content)
-        parsed_json = JSON.parse(contents)
+        document = ManifestDocument.from_file(dependency_file)
 
         dependencies = []
 
-        parsed_json["builtin-baseline"]&.then do |baseline|
+        baseline = document.builtin_baseline
+        if baseline
           dependencies << Dependabot::Dependency.new(
             name: VCPKG_DEFAULT_BASELINE_DEPENDENCY_NAME,
             version: baseline,
@@ -89,63 +90,38 @@ module Dependabot
           )
         end
 
-        parsed_json["dependencies"]&.each do |dep|
-          dependency = parse_port_dependency(dep:, dependency_file:)
+        document.ports.each do |port|
+          dependency = build_port_dependency(name: port.name, constraint: port.constraint, dependency_file:)
           dependencies << dependency if dependency
         end
 
         dependencies.compact
-      rescue JSON::ParserError
-        Dependabot.logger.warn("Failed to parse #{dependency_file.name}: #{dependency_file.content}")
-        raise Dependabot::DependencyFileNotParseable, T.must(dependency_files.first).path
+      rescue Dependabot::DependencyFileNotParseable => e
+        Dependabot.logger.warn(e.message)
+        raise
       end
 
       sig { params(dependency_file: Dependabot::DependencyFile).returns(T::Array[Dependabot::Dependency]) }
       def parse_vcpkg_configuration_json(dependency_file)
-        contents = T.must(dependency_file.content)
-        parsed_json = JSON.parse(contents)
+        document = ManifestDocument.from_file(dependency_file)
 
         dependencies = []
 
         # Parse default-registry if it exists
-        parsed_json["default-registry"]&.then do |registry|
-          dependency = parse_registry_dependency(registry:, dependency_file:, is_default: true)
-          dependencies << dependency if dependency
+        default_registry = document.default_registry
+        if default_registry
+          dependencies << parse_registry_dependency(registry: default_registry, dependency_file:, is_default: true)
         end
 
         # Parse registries array if it exists
-        parsed_json["registries"]&.each do |registry|
-          dependency = parse_registry_dependency(registry:, dependency_file:, is_default: false)
-          dependencies << dependency if dependency
+        document.registries.each do |registry|
+          dependencies << parse_registry_dependency(registry:, dependency_file:, is_default: false)
         end
 
         dependencies.compact
-      rescue JSON::ParserError
-        Dependabot.logger.warn("Failed to parse #{dependency_file.name}: #{dependency_file.content}")
-        raise Dependabot::DependencyFileNotParseable, dependency_file.path
-      end
-
-      sig do
-        params(
-          dep: Object,
-          dependency_file: Dependabot::DependencyFile
-        )
-          .returns(T.nilable(Dependabot::Dependency))
-      end
-      def parse_port_dependency(dep:, dependency_file:)
-        case dep
-        when String
-          build_port_dependency(name: dep, constraint: nil, dependency_file:)
-        when Hash
-          name = dep["name"]
-          return nil unless name.is_a?(String)
-
-          constraint = dep[VCPKG_VERSION_CONSTRAINT_KEY]
-          build_port_dependency(name:, constraint: constraint.is_a?(String) ? constraint : nil, dependency_file:)
-        else
-          Dependabot.logger.warn("Skipping unknown vcpkg dependency format: #{dep.inspect}")
-          nil
-        end
+      rescue Dependabot::DependencyFileNotParseable => e
+        Dependabot.logger.warn(e.message)
+        raise
       end
 
       # A port's version comes from its `version>=` constraint, the registry baseline, or both.
@@ -226,66 +202,28 @@ module Dependabot
 
       sig do
         params(
-          registry: T::Hash[String, T.untyped],
+          registry: ManifestDocument::Registry,
           dependency_file: Dependabot::DependencyFile,
           is_default: T::Boolean
         )
-          .returns(T.nilable(Dependabot::Dependency))
+          .returns(Dependabot::Dependency)
       end
-      def parse_registry_dependency(registry:, dependency_file:, is_default: false) # rubocop:disable Metrics/MethodLength
-        kind = registry["kind"]
-        baseline = registry["baseline"]
-
-        # Only track git and builtin registries
-        return nil unless VCPKG_SUPPORTED_REGISTRY_TYPES.include?(kind)
-        return nil unless baseline.is_a?(String)
+      def parse_registry_dependency(registry:, dependency_file:, is_default: false)
+        metadata = { default: is_default }
+        metadata[:builtin] = true if registry.builtin
 
-        case kind
-        when "git"
-          repository = registry["repository"]
-          return nil unless repository.is_a?(String)
-
-          reference = registry["reference"] || "HEAD"
-
-          Dependabot::Dependency.new(
-            name: repository,
-            version: baseline,
-            package_manager: "vcpkg",
-            requirements: [{
-              requirement: nil,
-              groups: [],
-              source: {
-                type: "git",
-                url: repository,
-                ref: reference
-              },
-              file: dependency_file.name
-            }],
-            metadata: {
-              default: is_default
-            }
-          )
-        when "builtin"
-          Dependabot::Dependency.new(
-            name: VCPKG_DEFAULT_BASELINE_DEPENDENCY_NAME,
-            version: baseline,
-            package_manager: "vcpkg",
-            requirements: [{
-              requirement: nil,
-              groups: [],
-              source: {
-                type: "git",
-                url: VCPKG_DEFAULT_BASELINE_URL,
-                ref: VCPKG_DEFAULT_BASELINE_DEFAULT_BRANCH
-              },
-              file: dependency_file.name
-            }],
-            metadata: {
-              builtin: true,
-              default: is_default
-            }
-          )
-        end
+        Dependabot::Dependency.new(
+          name: registry.name,
+          version: registry.baseline,
+          package_manager: "vcpkg",
+          requirements: [{
+            requirement: nil,
+            groups: [],
+            source: { type: "git", url: registry.repository, ref: registry.reference },
+            file: dependency_file.name
+          }],
+          metadata: metadata
+        )
       end
 
       # A project relying on a global vcpkg install has no baseline to update.
@@ -301,7 +239,7 @@ module Dependabot
         config = vcpkg_configuration_file
         if config.nil?
           synthetic_baseline_dependency(file_name: manifest.name)
-        elsif default_registry.nil?
+        elsif !parsed_document(config)&.default_registry_present?
           synthetic_baseline_dependency(
             file_name: config.name,
             metadata: { default: true, create_default_registry: true }
@@ -310,7 +248,7 @@ module Dependabot
       end
 
       sig do
-        params(file_name: String, metadata: T::Hash[Symbol, T.untyped]).returns(Dependabot::Dependency)
+        params(file_name: String, metadata: T::Hash[Symbol, T::Boolean]).returns(Dependabot::Dependency)
       end
       def synthetic_baseline_dependency(file_name:, metadata: {})
         Dependabot::Dependency.new(
@@ -341,30 +279,20 @@ module Dependabot
         manifest = vcpkg_manifest_file
         return false unless manifest
 
-        parsed_json(manifest)&.dig("builtin-baseline").is_a?(String)
+        !parsed_document(manifest)&.builtin_baseline.nil?
       end
 
       sig { returns(T::Boolean) }
       def default_registry_baseline_present?
-        registry = default_registry
-        !!(registry && registry["baseline"].is_a?(String))
-      end
-
-      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
-      def default_registry
         config = vcpkg_configuration_file
-        return nil unless config
+        return false unless config
 
-        registry = parsed_json(config)&.dig("default-registry")
-        registry.is_a?(Hash) ? registry : nil
+        !parsed_document(config)&.default_registry_baseline.nil?
       end
 
       sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
       def manifest_declares_dependencies?(file)
-        declared = parsed_json(file)&.dig("dependencies")
-        return false unless declared.is_a?(Array)
-
-        !declared.empty?
+        parsed_document(file)&.dependencies_declared? || false
       end
 
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
@@ -377,14 +305,12 @@ module Dependabot
         dependency_files.find { |file| file.name == VCPKG_CONFIGURATION_JSON_FILENAME }
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Hash[String, T.untyped])) }
-      def parsed_json(file)
-        content = file.content
-        return nil unless content
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(ManifestDocument)) }
+      def parsed_document(file)
+        return nil unless file.content
 
-        parsed = JSON.parse(content)
-        parsed.is_a?(Hash) ? parsed : nil
-      rescue JSON::ParserError
+        ManifestDocument.from_file(file)
+      rescue Dependabot::DependencyFileNotParseable
         nil
       end
 

data/lib/dependabot/vcpkg/file_updater.rb

@@ -1,13 +1,13 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
-require "json"
 require "sorbet-runtime"
 
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/vcpkg"
 require "dependabot/vcpkg/manifest_baseline"
+require "dependabot/vcpkg/manifest_document"
 require "dependabot/vcpkg/version"
 
 module Dependabot
@@ -59,60 +59,50 @@ module Dependabot
 
       sig { params(file: Dependabot::DependencyFile).returns(String) }
       def updated_vcpkg_json_content(file)
-        content = T.must(file.content)
-        parsed_content = JSON.parse(content)
+        document = ManifestDocument.from_file(file)
 
         dependencies
           .filter_map { |dep| [dep, dep.requirements.find { |requirement| requirement.file == file.name }] }
           .select { |_, requirement| requirement }
-          .each { |dependency, _| update_dependency_in_content(parsed_content, dependency, file.name) }
+          .each { |dependency, _| update_dependency_in_content(document, dependency, file.name) }
 
-        apply_security_baseline(parsed_content, file.name)
+        apply_security_baseline(document, file.name)
 
-        JSON.pretty_generate(parsed_content)
-      rescue JSON::ParserError
-        raise Dependabot::DependencyFileNotParseable, file.path
+        document.content
       end
 
       sig { params(file: Dependabot::DependencyFile).returns(String) }
       def updated_vcpkg_configuration_json_content(file)
-        content = T.must(file.content)
-        parsed_content = JSON.parse(content)
+        document = ManifestDocument.from_file(file)
 
         dependencies
           .filter_map { |dep| [dep, dep.requirements.find { |requirement| requirement.file == file.name }] }
           .select { |_, requirement| requirement }
-          .each { |dependency, _| update_registry_dependency_in_content(parsed_content, dependency, file.name) }
+          .each { |dependency, _| update_registry_dependency_in_content(document, dependency, file.name) }
 
-        apply_security_baseline(parsed_content, file.name)
+        apply_security_baseline(document, file.name)
 
-        JSON.pretty_generate(parsed_content)
-      rescue JSON::ParserError
-        raise Dependabot::DependencyFileNotParseable, file.path
+        document.content
       end
 
-      sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency, filename: String).void }
-      def update_dependency_in_content(content, dependency, filename)
+      sig { params(document: ManifestDocument, dependency: Dependabot::Dependency, filename: String).void }
+      def update_dependency_in_content(document, dependency, filename)
         case dependency.name
         when VCPKG_DEFAULT_BASELINE_DEPENDENCY_NAME
-          update_baseline_in_content(content, dependency, filename)
+          baseline = baseline_for(dependency, filename)
+          document.set_baseline(path: [VCPKG_BUILTIN_BASELINE_KEY], baseline: baseline) if baseline
         else
-          update_port_dependency_in_content(content, dependency, filename)
+          update_port_dependency_in_content(document, dependency, filename)
         end
       end
 
-      sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency, filename: String).void }
-      def update_baseline_in_content(content, dependency, filename)
-        update_baseline_field(content, dependency, filename, VCPKG_BUILTIN_BASELINE_KEY)
-      end
-
-      sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency, filename: String).void }
-      def update_port_dependency_in_content(content, dependency, filename)
+      sig { params(document: ManifestDocument, dependency: Dependabot::Dependency, filename: String).void }
+      def update_port_dependency_in_content(document, dependency, filename)
         case remediation_for(dependency, filename)
-        when :override then apply_override(content, dependency)
+        when :override then document.set_override(name: dependency.name, version: dependency.version)
         # A baseline bump moves the port's version floor, so the port entry needs no change.
         when :baseline then nil
-        else update_version_constraint(content, dependency)
+        else document.set_port_version(name: dependency.name, version: dependency.version)
         end
       end
 
@@ -125,51 +115,6 @@ module Dependabot
                   &.metadata_symbol("security_remediation")
       end
 
-      sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency).void }
-      def update_version_constraint(content, dependency)
-        entries = content[VCPKG_DEPENDENCIES_KEY]
-        return unless entries.is_a?(Array)
-
-        index = entries.index { |entry| port_entry_name(entry) == dependency.name }
-        return unless index
-
-        entry = entries[index]
-        # A port declared as a bare string has to become an object to carry a constraint.
-        entry = { "name" => entry } if entry.is_a?(String)
-        return unless entry.is_a?(Hash)
-
-        entry[VCPKG_VERSION_CONSTRAINT_KEY] = dependency.version
-        entries[index] = entry
-      end
-
-      # vcpkg cannot compare versions across schemes, so when no safe version shares the current
-      # one's scheme, the only way to move the port is to pin it outright. `version` is the
-      # scheme-agnostic key, and the port version belongs in it as a `#N` suffix: the separate
-      # `port-version` key and the scheme-specific keys are both deprecated.
-      # See https://learn.microsoft.com/vcpkg/reference/vcpkg-json#overrides
-      sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency).void }
-      def apply_override(content, dependency)
-        entry = { "name" => dependency.name, "version" => dependency.version }
-
-        overrides = content[VCPKG_OVERRIDES_KEY]
-        unless overrides.is_a?(Array)
-          overrides = []
-          content[VCPKG_OVERRIDES_KEY] = overrides
-        end
-
-        index = overrides.index { |override| override.is_a?(Hash) && override["name"] == dependency.name }
-        index ? overrides[index] = entry : overrides << entry
-      end
-
-      sig { params(entry: T.untyped).returns(T.nilable(String)) }
-      def port_entry_name(entry)
-        return entry if entry.is_a?(String)
-        return nil unless entry.is_a?(Hash)
-
-        name = entry["name"]
-        name.is_a?(String) ? name : nil
-      end
-
       # Where the fix wants the registry baseline moved to, if anywhere.
       sig { returns(T.nilable(T::Hash[Symbol, String])) }
       def security_baseline
@@ -193,19 +138,12 @@ module Dependabot
         { file: location.first, commit_sha: }
       end
 
-      sig { params(content: T::Hash[String, T.untyped], filename: String).void }
-      def apply_security_baseline(content, filename)
+      sig { params(document: ManifestDocument, filename: String).void }
+      def apply_security_baseline(document, filename)
         baseline = security_baseline
         return unless baseline && baseline[:file] == filename
 
-        path = T.must(manifest_baseline.location).last
-        key = path.last
-        return unless key
-
-        target = T.must(path[0...-1]).reduce(content) { |node, segment| node.is_a?(Hash) ? node[segment] : nil }
-        return unless target.is_a?(Hash)
-
-        target[key] = baseline[:commit_sha]
+        document.set_baseline(path: T.must(manifest_baseline.location).last, baseline: baseline.fetch(:commit_sha))
       end
 
       sig { returns(Dependabot::Vcpkg::ManifestBaseline) }
@@ -216,92 +154,27 @@ module Dependabot
         )
       end
 
-      sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency, filename: String).void }
-      def update_registry_dependency_in_content(content, dependency, filename)
-        # Check if this is a default registry update based on metadata
+      sig { params(document: ManifestDocument, dependency: Dependabot::Dependency, filename: String).void }
+      def update_registry_dependency_in_content(document, dependency, filename)
+        baseline = baseline_for(dependency, filename)
+        return unless baseline
+
         if dependency.metadata[:default]
-          update_default_registry(content, dependency, filename)
+          document.set_default_registry_baseline(
+            baseline: baseline, create: !!dependency.metadata[:create_default_registry]
+          )
         else
-          # For registries array, find by repository URL
-          update_registry_by_name(content, dependency, filename)
-        end
-      end
-
-      sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency, filename: String).void }
-      def update_default_registry(content, dependency, filename)
-        default_registry = content["default-registry"]
-        if default_registry.is_a?(Hash)
-          update_baseline_field(default_registry, dependency, filename, "baseline")
-        elsif dependency.metadata[:create_default_registry]
-          created_registry = build_default_registry(dependency, filename)
-          content["default-registry"] = created_registry if created_registry
+          document.set_registry_baseline(
+            baseline: baseline,
+            repository: dependency.requirements.first&.source_string("url"),
+            builtin: !!dependency.metadata[:builtin]
+          )
         end
       end
 
-      sig do
-        params(dependency: Dependabot::Dependency, filename: String)
-          .returns(T.nilable(T::Hash[String, String]))
-      end
-      def build_default_registry(dependency, filename)
-        requirement = dependency.requirements.find { |candidate| candidate.file == filename }
-        return unless requirement
-
-        baseline = requirement.source_string("ref")
-        return unless baseline
-
-        {
-          "kind" => "git",
-          "repository" => VCPKG_DEFAULT_REGISTRY_REPOSITORY,
-          "baseline" => baseline
-        }
-      end
-
-      sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency, filename: String).void }
-      def update_registry_by_name(content, dependency, filename)
-        registries = content["registries"]
-        return unless registries.is_a?(Array)
-
-        # Find registry based on dependency characteristics
-        registry = find_target_registry(registries, dependency)
-        return unless registry
-
-        update_baseline_field(registry, dependency, filename, "baseline")
-      end
-
-      sig do
-        params(
-          target: T::Hash[String, T.untyped],
-          dependency: Dependabot::Dependency,
-          filename: String,
-          field_name: String
-        ).void
-      end
-      def update_baseline_field(target, dependency, filename, field_name)
-        # Find the requirement for this specific file
-        requirement = dependency.requirements.find { |candidate| candidate.file == filename }
-        return unless requirement
-
-        # Extract and validate the new baseline
-        new_baseline = requirement.source_string("ref")
-        target[field_name] = new_baseline if new_baseline
-      end
-
-      sig do
-        params(
-          registries: T::Array[T.untyped],
-          dependency: Dependabot::Dependency
-        )
-          .returns(T.nilable(T::Hash[String, T.untyped]))
-      end
-      def find_target_registry(registries, dependency)
-        if dependency.metadata[:builtin]
-          # For builtin registries, find by kind
-          registries.find { |r| r.is_a?(Hash) && r["kind"] == "builtin" }
-        else
-          # For git registries, find by repository URL
-          repository_url = dependency.requirements.first&.source_string("url")
-          registries.find { |r| r.is_a?(Hash) && r["repository"] == repository_url }
-        end
+      sig { params(dependency: Dependabot::Dependency, filename: String).returns(T.nilable(String)) }
+      def baseline_for(dependency, filename)
+        dependency.requirements.find { |candidate| candidate.file == filename }&.source_string("ref")
       end
     end
   end

data/lib/dependabot/vcpkg/manifest_baseline.rb

@@ -1,12 +1,12 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
-require "json"
 require "sorbet-runtime"
 
 require "dependabot/dependency_file"
 
 require "dependabot/vcpkg"
+require "dependabot/vcpkg/manifest_document"
 
 module Dependabot
   module Vcpkg
@@ -52,36 +52,31 @@ module Dependabot
         manifest = vcpkg_manifest_file
         return nil unless manifest
 
-        baseline = parsed_json(manifest)&.dig(VCPKG_BUILTIN_BASELINE_KEY)
-        baseline.is_a?(String) ? baseline : nil
+        parsed_document(manifest)&.builtin_baseline
+      rescue Dependabot::DependencyFileNotParseable
+        nil
       end
 
       sig { returns(T.nilable(String)) }
       def default_registry_builtin_baseline
-        registry = default_registry
-        return nil unless registry
-        return nil unless builtin_registry?(registry)
-
-        baseline = registry["baseline"]
-        baseline.is_a?(String) ? baseline : nil
-      end
-
-      sig { returns(T.nilable(T::Hash[String, Object])) }
-      def default_registry
         config = vcpkg_configuration_file
         return nil unless config
 
-        registry = parsed_json(config)&.dig("default-registry")
-        registry.is_a?(Hash) ? registry : nil
+        document = parsed_document(config)
+        return nil unless document && builtin_registry?(document)
+
+        document.default_registry_baseline
+      rescue Dependabot::DependencyFileNotParseable
+        nil
       end
 
-      sig { params(registry: T::Hash[String, Object]).returns(T::Boolean) }
-      def builtin_registry?(registry)
-        return true if registry["kind"] == "builtin"
-        return false unless registry["kind"] == "git"
+      sig { params(document: ManifestDocument).returns(T::Boolean) }
+      def builtin_registry?(document)
+        return true if document.default_registry_kind == "builtin"
+        return false unless document.default_registry_kind == "git"
 
-        repository = registry["repository"]
-        return false unless repository.is_a?(String)
+        repository = document.default_registry_repository
+        return false unless repository
 
         official = [VCPKG_DEFAULT_REGISTRY_REPOSITORY, VCPKG_DEFAULT_BASELINE_URL]
         official.include?(repository.delete_suffix("/"))
@@ -97,14 +92,12 @@ module Dependabot
         dependency_files.find { |file| file.name == VCPKG_CONFIGURATION_JSON_FILENAME }
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Hash[String, Object])) }
-      def parsed_json(file)
-        content = file.content
-        return nil unless content
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(ManifestDocument)) }
+      def parsed_document(file)
+        return nil unless file.content
 
-        parsed = JSON.parse(content)
-        parsed.is_a?(Hash) ? parsed : nil
-      rescue JSON::ParserError
+        ManifestDocument.from_file(file)
+      rescue Dependabot::DependencyFileNotParseable
         nil
       end
     end

data/lib/dependabot/vcpkg/manifest_document.rb

@@ -0,0 +1,259 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/logger"
+require "dependabot/vcpkg"
+
+module Dependabot
+  module Vcpkg
+    class ManifestDocument
+      extend T::Sig
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+      class Port < T::ImmutableStruct
+        const :name, String
+        const :constraint, T.nilable(String)
+      end
+
+      class Registry < T::ImmutableStruct
+        const :name, String
+        const :baseline, String
+        const :repository, String
+        const :reference, String
+        const :builtin, T::Boolean
+      end
+
+      sig { params(file: DependencyFile).returns(ManifestDocument) }
+      def self.from_file(file)
+        new(file)
+      end
+
+      sig { params(file: DependencyFile).void }
+      def initialize(file)
+        @path = T.let(file.path, String)
+        @data = T.let(object(T.cast(JSON.parse(T.must(file.content)), Object), "root"), ObjectHash)
+      rescue JSON::ParserError
+        raise DependencyFileNotParseable.new(@path, "#{@path}: invalid JSON")
+      end
+
+      sig { returns(T.nilable(String)) }
+      def builtin_baseline
+        value = @data[VCPKG_BUILTIN_BASELINE_KEY]
+        return if value.nil?
+
+        string(value, VCPKG_BUILTIN_BASELINE_KEY)
+      end
+
+      sig { returns(T::Boolean) }
+      def dependencies_declared?
+        !array(@data[VCPKG_DEPENDENCIES_KEY], VCPKG_DEPENDENCIES_KEY).empty?
+      end
+
+      sig { returns(T::Array[Port]) }
+      def ports
+        array(@data[VCPKG_DEPENDENCIES_KEY], VCPKG_DEPENDENCIES_KEY).filter_map do |entry|
+          case entry
+          when String
+            Port.new(name: entry, constraint: nil)
+          when Hash
+            fields = object(entry, "dependency")
+            name = fields["name"]
+            next unless name.is_a?(String)
+
+            constraint = fields[VCPKG_VERSION_CONSTRAINT_KEY]
+            Port.new(name: name, constraint: constraint.is_a?(String) ? constraint : nil)
+          else
+            Dependabot.logger.warn("Skipping unknown vcpkg dependency format: #{entry.inspect}")
+            nil
+          end
+        end
+      end
+
+      sig { returns(T::Boolean) }
+      def default_registry_present?
+        !default_registry_fields.nil?
+      end
+
+      sig { returns(T.nilable(String)) }
+      def default_registry_kind
+        value = default_registry_fields&.[]("kind")
+        value if value.is_a?(String)
+      end
+
+      sig { returns(T.nilable(String)) }
+      def default_registry_repository
+        value = default_registry_fields&.[]("repository")
+        value if value.is_a?(String)
+      end
+
+      sig { returns(T.nilable(String)) }
+      def default_registry_baseline
+        value = default_registry_fields&.[]("baseline")
+        value if value.is_a?(String)
+      end
+
+      sig { returns(T.nilable(Registry)) }
+      def default_registry
+        fields = default_registry_fields
+        registry(fields, "default-registry") if fields
+      end
+
+      sig { returns(T::Array[Registry]) }
+      def registries
+        array(@data["registries"], "registries").each_with_index.filter_map do |entry, index|
+          field = "registries[#{index}]"
+          registry(object(entry, field), field)
+        end
+      end
+
+      sig { params(name: String, version: T.nilable(String)).void }
+      def set_port_version(name:, version:)
+        entries = array(@data[VCPKG_DEPENDENCIES_KEY], VCPKG_DEPENDENCIES_KEY)
+        index = entries.index { |entry| port_name(entry) == name }
+        return unless index
+
+        entry = entries.fetch(index)
+        fields = entry.is_a?(String) ? { "name" => entry } : object(entry, "dependencies[#{index}]")
+        fields[VCPKG_VERSION_CONSTRAINT_KEY] = version
+        entries[index] = fields
+        @data[VCPKG_DEPENDENCIES_KEY] = entries
+      end
+
+      # Overrides replace the whole pin so deprecated scheme/port-version fields cannot conflict.
+      sig { params(name: String, version: T.nilable(String)).void }
+      def set_override(name:, version:)
+        overrides = object_array(@data[VCPKG_OVERRIDES_KEY], VCPKG_OVERRIDES_KEY)
+        index = overrides.index { |entry| entry["name"] == name }
+        entry = { "name" => name, "version" => version }
+        index ? overrides[index] = entry : overrides << entry
+        @data[VCPKG_OVERRIDES_KEY] = overrides
+      end
+
+      sig { params(baseline: String, create: T::Boolean).void }
+      def set_default_registry_baseline(baseline:, create:)
+        fields = default_registry_fields
+        if fields
+          fields["baseline"] = baseline
+        elsif create
+          @data["default-registry"] = {
+            "kind" => "git",
+            "repository" => VCPKG_DEFAULT_REGISTRY_REPOSITORY,
+            "baseline" => baseline
+          }
+        end
+      end
+
+      sig { params(baseline: String, repository: T.nilable(String), builtin: T::Boolean).void }
+      def set_registry_baseline(baseline:, repository:, builtin:)
+        entries = object_array(@data["registries"], "registries")
+        registry = entries.find do |entry|
+          builtin ? entry["kind"] == "builtin" : entry["repository"] == repository
+        end
+        registry["baseline"] = baseline if registry
+      end
+
+      sig { params(path: T::Array[String], baseline: String).void }
+      def set_baseline(path:, baseline:)
+        target = @data
+        path[0...-1].to_a.each_with_index do |segment, index|
+          target = object(target[segment], path.take(index + 1).join("."))
+        end
+        target[T.must(path.last)] = baseline
+      end
+
+      sig { returns(String) }
+      def content
+        JSON.pretty_generate(@data)
+      end
+
+      private
+
+      sig { returns(T.nilable(ObjectHash)) }
+      def default_registry_fields
+        value = @data["default-registry"]
+        object(value, "default-registry") unless value.nil?
+      end
+
+      sig { params(fields: ObjectHash, field: String).returns(T.nilable(Registry)) }
+      def registry(fields, field)
+        kind = fields["kind"]
+        baseline = fields["baseline"]
+        return unless VCPKG_SUPPORTED_REGISTRY_TYPES.include?(kind) && baseline.is_a?(String)
+
+        if kind == "builtin"
+          Registry.new(
+            name: VCPKG_DEFAULT_BASELINE_DEPENDENCY_NAME,
+            baseline: baseline,
+            repository: VCPKG_DEFAULT_BASELINE_URL,
+            reference: VCPKG_DEFAULT_BASELINE_DEFAULT_BRANCH,
+            builtin: true
+          )
+        else
+          repository = fields["repository"]
+          return unless repository.is_a?(String)
+
+          Registry.new(
+            name: repository,
+            baseline: baseline,
+            repository: repository,
+            reference: string(fields["reference"] || "HEAD", "#{field}.reference"),
+            builtin: false
+          )
+        end
+      end
+
+      sig { params(entry: Object).returns(T.nilable(String)) }
+      def port_name(entry)
+        return entry if entry.is_a?(String)
+        return unless entry.is_a?(Hash)
+
+        name = object(entry, "dependency")["name"]
+        name if name.is_a?(String)
+      end
+
+      sig { params(value: Object, field: String).returns(ObjectHash) }
+      def object(value, field)
+        invalid(field, "must be an object") unless value.is_a?(Hash)
+
+        value.each_key do |raw_key|
+          invalid(field, "keys must be strings") unless T.cast(raw_key, Object).is_a?(String)
+        end
+        # Keep the parsed node's identity so nested edits reach the serialized document.
+        value
+      end
+
+      sig { params(value: Object, field: String).returns(T::Array[ObjectHash]) }
+      def object_array(value, field)
+        array(value, field).each_with_index.map do |entry, index|
+          object(entry, "#{field}[#{index}]")
+        end
+      end
+
+      sig { params(value: Object, field: String).returns(T::Array[Object]) }
+      def array(value, field)
+        return [] if value.nil?
+
+        invalid(field, "must be an array") unless value.is_a?(Array)
+
+        value.map { |entry| T.cast(entry, Object) }
+      end
+
+      sig { params(value: Object, field: String).returns(String) }
+      def string(value, field)
+        return value if value.is_a?(String)
+
+        invalid(field, "must be a string")
+      end
+
+      sig { params(field: String, message: String).returns(T.noreturn) }
+      def invalid(field, message)
+        raise DependencyFileNotParseable.new(@path, "#{@path}: #{field} #{message}")
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-vcpkg
 version: !ruby/object:Gem::Version
-  version: 0.398.0
+  version: 0.400.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.400.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.400.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -245,6 +245,7 @@ files:
 - lib/dependabot/vcpkg/file_updater.rb
 - lib/dependabot/vcpkg/language.rb
 - lib/dependabot/vcpkg/manifest_baseline.rb
+- lib/dependabot/vcpkg/manifest_document.rb
 - lib/dependabot/vcpkg/metadata_finder.rb
 - lib/dependabot/vcpkg/package/package_details_fetcher.rb
 - lib/dependabot/vcpkg/package/versions_database.rb
@@ -259,7 +260,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.398.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
 rdoc_options: []
 require_paths:
 - lib