cycode 3.16.3.dev2__py3-none-any.whl → 3.16.3.dev4__py3-none-any.whl

cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.16.3.dev2'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.16.3.dev4'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

cycode/cli/consts.py

@@ -102,6 +102,7 @@ SCA_CONFIGURATION_SCAN_SUPPORTED_FILES = (  # keep in lowercase
     'deno.lock',
     'deno.json',
     'pnpm-lock.yaml',
+    'bun.lock',
     'npm-shrinkwrap.json',
     'packages.config',
     'project.assets.json',
@@ -165,6 +166,7 @@ PROJECT_FILES_BY_ECOSYSTEM_MAP = {
         'npm-shrinkwrap.json',
         '.npmrc',
         'pnpm-lock.yaml',
+        'bun.lock',
         'deno.lock',
         'deno.json',
     ],

cycode/cli/files_collector/sca/npm/restore_bun_dependencies.py

@@ -0,0 +1,113 @@
+import json
+import re
+from pathlib import Path
+from typing import Optional
+
+import typer
+
+from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies, build_dep_tree_path
+from cycode.cli.models import Document
+from cycode.cli.utils.path_utils import get_file_content
+from cycode.cli.utils.shell_executor import shell
+from cycode.logger import get_logger
+
+logger = get_logger('Bun Restore Dependencies')
+
+BUN_MANIFEST_FILE_NAME = 'package.json'
+BUN_LOCK_FILE_NAME = 'bun.lock'
+
+# Only Bun >=1.2 produces the text-based `bun.lock` lockfile that we parse.
+# Older Bun versions emit a binary `bun.lockb`, which is not supported.
+MINIMUM_BUN_VERSION = (1, 2)
+BUN_VERSION_COMMAND = ['bun', '--version']
+
+
+def _indicates_bun(package_json_content: Optional[str]) -> bool:
+    """Return True if package.json content signals that this project uses Bun."""
+    if not package_json_content:
+        return False
+    try:
+        data = json.loads(package_json_content)
+    except (json.JSONDecodeError, ValueError):
+        return False
+
+    package_manager = data.get('packageManager', '')
+    if isinstance(package_manager, str) and package_manager.startswith('bun'):
+        return True
+
+    engines = data.get('engines', {})
+    return isinstance(engines, dict) and 'bun' in engines
+
+
+def _parse_bun_version(raw_version: Optional[str]) -> Optional[tuple[int, int]]:
+    """Parse the (major, minor) version from `bun --version` output (e.g. '1.2.3')."""
+    if not raw_version:
+        return None
+    match = re.match(r'(\d+)\.(\d+)', raw_version.strip())
+    if not match:
+        return None
+    return int(match.group(1)), int(match.group(2))
+
+
+class RestoreBunDependencies(BaseRestoreDependencies):
+    def __init__(self, ctx: typer.Context, is_git_diff: bool, command_timeout: int) -> None:
+        super().__init__(ctx, is_git_diff, command_timeout)
+
+    def is_project(self, document: Document) -> bool:
+        if Path(document.path).name != BUN_MANIFEST_FILE_NAME:
+            return False
+
+        manifest_dir = self.get_manifest_dir(document)
+        if manifest_dir and (Path(manifest_dir) / BUN_LOCK_FILE_NAME).is_file():
+            return True
+
+        return _indicates_bun(document.content)
+
+    def _is_supported_bun_version(self) -> bool:
+        """Verify that the installed Bun is >=1.2, which is required to generate a text bun.lock."""
+        raw_version = shell(command=BUN_VERSION_COMMAND, timeout=self.command_timeout, silent_exc_info=True)
+        version = _parse_bun_version(raw_version)
+        minimum = '.'.join(str(part) for part in MINIMUM_BUN_VERSION)
+        if version is None:
+            logger.warning(
+                'Could not determine Bun version; Bun %s+ is required to restore Bun dependencies, %s',
+                minimum,
+                {'raw_version': raw_version},
+            )
+            return False
+        if version < MINIMUM_BUN_VERSION:
+            logger.warning(
+                'Unsupported Bun version; Bun %s+ is required to restore Bun dependencies, %s',
+                minimum,
+                {'detected_version': '.'.join(str(part) for part in version)},
+            )
+            return False
+        return True
+
+    def try_restore_dependencies(self, document: Document) -> Optional[Document]:
+        manifest_dir = self.get_manifest_dir(document)
+        lockfile_path = Path(manifest_dir) / BUN_LOCK_FILE_NAME if manifest_dir else None
+
+        if lockfile_path and lockfile_path.is_file():
+            # Lockfile already exists — read it directly without running bun.
+            # A text bun.lock only exists when generated by Bun >=1.2, so no version check is needed here.
+            content = get_file_content(str(lockfile_path))
+            relative_path = build_dep_tree_path(document.path, BUN_LOCK_FILE_NAME)
+            logger.debug('Using existing bun.lock, %s', {'path': str(lockfile_path)})
+            return Document(relative_path, content, self.is_git_diff)
+
+        # Lockfile absent — must generate it via `bun install`. This requires Bun >=1.2,
+        # otherwise an older Bun would emit a binary bun.lockb that we cannot parse.
+        if not self._is_supported_bun_version():
+            return None
+
+        return super().try_restore_dependencies(document)
+
+    def get_commands(self, manifest_file_path: str) -> list[list[str]]:
+        return [['bun', 'install', '--ignore-scripts']]
+
+    def get_lock_file_name(self) -> str:
+        return BUN_LOCK_FILE_NAME
+
+    def get_lock_file_names(self) -> list[str]:
+        return [BUN_LOCK_FILE_NAME]

cycode/cli/files_collector/sca/npm/restore_npm_dependencies.py

@@ -11,7 +11,7 @@ logger = get_logger('NPM Restore Dependencies')
 NPM_MANIFEST_FILE_NAME = 'package.json'
 NPM_LOCK_FILE_NAME = 'package-lock.json'
 # These lockfiles indicate another package manager owns the project — NPM should not run
-_ALTERNATIVE_LOCK_FILES = ('yarn.lock', 'pnpm-lock.yaml', 'deno.lock')
+_ALTERNATIVE_LOCK_FILES = ('yarn.lock', 'pnpm-lock.yaml', 'deno.lock', 'bun.lock')
 
 
 class RestoreNpmDependencies(BaseRestoreDependencies):
@@ -23,6 +23,15 @@ class RestoreNpmDependencies(BaseRestoreDependencies):
 
         Yarn and pnpm projects are handled by their dedicated handlers, which run before
         this one in the handler list. This handler is the npm fallback.
+
+        NOTE: this guard only excludes a project when an alternative lockfile is *physically
+        present on disk*. It does not inspect the `packageManager`/`engines` signal in
+        package.json. So a project that declares e.g. `packageManager: "bun@..."` (or pnpm)
+        but has no lockfile yet is claimed by BOTH the dedicated handler and this npm fallback,
+        and both restores run. This is pre-existing behavior shared by pnpm/yarn/bun and is
+        accepted for now (a real Bun/pnpm project ships a lockfile, so npm correctly skips).
+        If this ever needs tightening, also skip here when package.json declares a non-npm
+        packageManager/engines signal.
         """
         if Path(document.path).name != NPM_MANIFEST_FILE_NAME:
             return False

cycode/cli/files_collector/sca/sca_file_collector.py

@@ -10,6 +10,7 @@ from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestore
 from cycode.cli.files_collector.sca.go.restore_go_dependencies import RestoreGoDependencies
 from cycode.cli.files_collector.sca.maven.restore_gradle_dependencies import RestoreGradleDependencies
 from cycode.cli.files_collector.sca.maven.restore_maven_dependencies import RestoreMavenDependencies
+from cycode.cli.files_collector.sca.npm.restore_bun_dependencies import RestoreBunDependencies
 from cycode.cli.files_collector.sca.npm.restore_deno_dependencies import RestoreDenoDependencies
 from cycode.cli.files_collector.sca.npm.restore_npm_dependencies import RestoreNpmDependencies
 from cycode.cli.files_collector.sca.npm.restore_pnpm_dependencies import RestorePnpmDependencies
@@ -157,8 +158,9 @@ def _get_restore_handlers(ctx: typer.Context, is_git_diff: bool) -> list[BaseRes
         RestoreNugetDependencies(ctx, is_git_diff, build_dep_tree_timeout),
         RestoreYarnDependencies(ctx, is_git_diff, build_dep_tree_timeout),
         RestorePnpmDependencies(ctx, is_git_diff, build_dep_tree_timeout),
+        RestoreBunDependencies(ctx, is_git_diff, build_dep_tree_timeout),
         RestoreDenoDependencies(ctx, is_git_diff, build_dep_tree_timeout),
-        RestoreNpmDependencies(ctx, is_git_diff, build_dep_tree_timeout),  # Must be after Yarn & Pnpm for fallback
+        RestoreNpmDependencies(ctx, is_git_diff, build_dep_tree_timeout),  # Must be after Yarn, Pnpm & Bun for fallback
         RestoreRubyDependencies(ctx, is_git_diff, build_dep_tree_timeout),
         RestoreUvDependencies(ctx, is_git_diff, build_dep_tree_timeout),  # Must be before Poetry for pyproject.toml
         RestorePoetryDependencies(ctx, is_git_diff, build_dep_tree_timeout),

{cycode-3.16.3.dev2.dist-info → cycode-3.16.3.dev4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.16.3.dev2
+Version: 3.16.3.dev4
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.16.3.dev2.dist-info → cycode-3.16.3.dev4.dist-info}/RECORD

@@ -1,4 +1,4 @@
-cycode/__init__.py,sha256=a02DIWGLRttTo50tdayCtRosK8xi_hs0uTrsl0YxH90,396
+cycode/__init__.py,sha256=M9P-K1qrr5klIKq7_vzZPAbHawccu47Rp-dd-QFoMPQ,396
 cycode/__main__.py,sha256=Z3bD5yrA7yPvAChcADQrqCaZd0ChGI1gdiwALwbWJ6U,104
 cycode/cli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/app.py,sha256=AlR2durAEbsa47PDfIj7JtMvJDWA_Dq6wPtVuMJYSCs,10250
@@ -94,7 +94,7 @@ cycode/cli/apps/status/version_command.py,sha256=c6Iko_rmZo9T_kQSd3HUloBi40Qv7cj
 cycode/cli/cli_types.py,sha256=QbFWJLtlsEnHGdqdHbLolJqT57RfhocvsPAhlcNcCRE,3354
 cycode/cli/config.py,sha256=Op-lX_neanJtvPvoOEx4ByBdveh5ygElIga1FdSHhOI,299
 cycode/cli/console.py,sha256=vp-DHwlkwpwdsPyfwGdjsPF-6-Bi3f8W7G-W_YXCMH8,1914
-cycode/cli/consts.py,sha256=DA64POP-TWR4jTOkBzzN-paHX_S_9A_qPs6GCIW-U9s,9651
+cycode/cli/consts.py,sha256=L900JVQyOILWFg6D6miNQHv0h2Wr6PYA4FuiDSymzaw,9687
 cycode/cli/exceptions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/exceptions/custom_exceptions.py,sha256=mTPLPI6V5JrEM6IQ8f7An9P207oYWEgJr-l9UpieSWk,4232
 cycode/cli/exceptions/handle_ai_remediation_errors.py,sha256=mA70upSYXK3rL_fmanzKYeUzLENhpXdkW8k3aIHrKzU,785
@@ -120,8 +120,9 @@ cycode/cli/files_collector/sca/maven/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeu
 cycode/cli/files_collector/sca/maven/restore_gradle_dependencies.py,sha256=hwsdJby0_7i3s6YmCU-tB6B3TfsfbyQyeTVwEy6c6SA,2699
 cycode/cli/files_collector/sca/maven/restore_maven_dependencies.py,sha256=zObNN8n6yUriNVB3ZdvAkoKXXrMvzU9Lpd5lNhVo_so,4003
 cycode/cli/files_collector/sca/npm/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+cycode/cli/files_collector/sca/npm/restore_bun_dependencies.py,sha256=HI0X_19wCM6B_vRpX6uD12dXsQbU6LCcLQdobPZDgAs,4580
 cycode/cli/files_collector/sca/npm/restore_deno_dependencies.py,sha256=XL0VXEPL0jf6ruZZkCpv99lkU8-MNc09CU1fgGgTbHs,1768
-cycode/cli/files_collector/sca/npm/restore_npm_dependencies.py,sha256=oUPJa1qwzCg3h1eZeVrU95Fluubo7p5gNlGmjJQem-4,2477
+cycode/cli/files_collector/sca/npm/restore_npm_dependencies.py,sha256=Uwoemv18PX2_9pSGzyYJ7wixQtgDZVOuuJuHIjdnF7M,3173
 cycode/cli/files_collector/sca/npm/restore_pnpm_dependencies.py,sha256=CcvJOox2JpWl_UeCjMP9I8fP85bPZXfhH7IwLzq2U8E,2708
 cycode/cli/files_collector/sca/npm/restore_yarn_dependencies.py,sha256=903Ra2YOKwlJnknG47embjPLQUajUb8_1j94GAVcnX0,2698
 cycode/cli/files_collector/sca/nuget/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -136,7 +137,7 @@ cycode/cli/files_collector/sca/ruby/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQ
 cycode/cli/files_collector/sca/ruby/restore_ruby_dependencies.py,sha256=Vqswcxte9YjGnvIm9oZ8r91jNyhuiYDf1mouaTaLg3U,694
 cycode/cli/files_collector/sca/sbt/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/files_collector/sca/sbt/restore_sbt_dependencies.py,sha256=cfBUR4iQcfplX_O2QPjYh2wSyBteze8wZcT_dG9d1d4,709
-cycode/cli/files_collector/sca/sca_file_collector.py,sha256=YnO1SYvzDM-9YjKLjfPJJ-El7MrvqCdV8PyjOeY3THk,9925
+cycode/cli/files_collector/sca/sca_file_collector.py,sha256=POvajFssRea-Lax9YG3taAlYvI5by1EbMqso401SQ8M,10099
 cycode/cli/files_collector/walk_ignore.py,sha256=nvOM6oDmT2SxSI4pU-bLlc9LwTgkfTd2egse69ixf3g,2464
 cycode/cli/files_collector/zip_documents.py,sha256=FMzbA2Vog7Zl_ntizNQJK8AFqoGu0QlPIMIBpgmBiVI,1852
 cycode/cli/logger.py,sha256=mlaYEQGYd582fTCc3SC3cFMj0PKTB6EsaI12Q4VL1z8,65
@@ -208,8 +209,8 @@ cycode/cyclient/report_client.py,sha256=Scq30NeJPzgXv0hPLO1U05AdE9i_2iu6cIrSKpEJ
 cycode/cyclient/scan_client.py,sha256=6TK5FQkfrvV7PHqRnUzEn1PBNd2oPYVamvIixcUfe3c,16755
 cycode/cyclient/scan_config_base.py,sha256=mXsPZGYCtp85rv5GIige40yQZXuRcEKUW-VQJ0vgFzk,1201
 cycode/logger.py,sha256=EfZGRK6VC5rE_LAjIcRrHFiQCueylCDXoG6bvGkrIME,2111
-cycode-3.16.3.dev2.dist-info/METADATA,sha256=DBWx5RMjw0IZkbH7-ltfRf7zZxQ8NyjE6iczyICIUk0,89245
-cycode-3.16.3.dev2.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
-cycode-3.16.3.dev2.dist-info/entry_points.txt,sha256=iDcVJM8ByLElVgvBgtYxDjw1kT7O8Mo0LcWZIT5L3Ig,45
-cycode-3.16.3.dev2.dist-info/licenses/LICENCE,sha256=2Wx4N6mD_4xB7-E3hPkZ3MPhpJy__k_I8MaCSO-PDRo,1068
-cycode-3.16.3.dev2.dist-info/RECORD,,
+cycode-3.16.3.dev4.dist-info/METADATA,sha256=6TbdbNG3KBoVsoR1J6Oy4jje6zfnlxg0WVN5iuvBU4I,89245
+cycode-3.16.3.dev4.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
+cycode-3.16.3.dev4.dist-info/entry_points.txt,sha256=iDcVJM8ByLElVgvBgtYxDjw1kT7O8Mo0LcWZIT5L3Ig,45
+cycode-3.16.3.dev4.dist-info/licenses/LICENCE,sha256=2Wx4N6mD_4xB7-E3hPkZ3MPhpJy__k_I8MaCSO-PDRo,1068
+cycode-3.16.3.dev4.dist-info/RECORD,,