Add nub package manager ecosystem (nub.lock)

.github/ci-filters.yml

@@ -83,6 +83,9 @@ nix:
 npm_and_yarn:
   - *shared
   - 'npm_and_yarn/**'
+nub:
+  - *shared
+  - 'nub/**'
 nuget:
   - *shared
   - 'nuget/**'

.github/dependabot.yml

@@ -127,6 +127,7 @@ updates:
     directories:
       - "/bun/helpers"
       - "/npm_and_yarn/helpers"
+      - "/nub/helpers"
     schedule:
       interval: "weekly"
       day: "sunday"

.github/issue-labeler.yml

@@ -93,3 +93,6 @@
 
 "L: sbt":
     - '(sbt)'
+
+"L: nub":
+    - '(nub)'

.github/labeler.yml

@@ -51,6 +51,7 @@
   - any-glob-to-any-file:
     - bun/**
     - npm_and_yarn/**
+    - nub/**
 
 "L: java:gradle":
 - changed-files:

.github/smoke-filters.yml

@@ -56,6 +56,9 @@ nix:
 npm_and_yarn:
   - *common
   - 'npm_and_yarn/**'
+nub:
+  - *common
+  - 'nub/**'
 nuget:
   - *common
   - 'nuget/**'

.github/smoke-matrix.json

@@ -99,6 +99,11 @@
     "test": "npm",
     "ecosystem": "npm"
   },
+  {
+    "core": "nub",
+    "test": "nub",
+    "ecosystem": "nub"
+  },
   {
     "core": "nuget",
     "test": "nuget-resolvability",

.github/workflows/ci.yml

@@ -43,6 +43,7 @@ jobs:
           - { path: maven, name: maven, ecosystem: maven }
           - { path: nix, name: nix, ecosystem: nix }
           - { path: npm_and_yarn, name: npm_and_yarn, ecosystem: npm }
+          - { path: nub, name: nub, ecosystem: nub }
           - { path: nuget, name: nuget, ecosystem: nuget }
           - { path: opentofu, name: opentofu, ecosystem: opentofu }
           - { path: pre_commit, name: pre_commit, ecosystem: pre-commit }

Dockerfile.updater-core

@@ -167,7 +167,7 @@ COPY --chown=dependabot:dependabot --parents */.bundle */*.gemspec common/lib/de
 # Entries are either "<name>" (gem lives in a directory matching its name) or
 # "<name>:<dir>" when multiple gems share a directory (e.g. dependabot-docker
 # and dependabot-docker_compose both ship from docker/).
-ARG ECOSYSTEM_LIST="bazel bun bundler cargo composer conda deno devcontainers docker docker_compose:docker dotnet_sdk elm git_submodules github_actions go_modules gradle helm hex julia maven nix npm_and_yarn nuget opentofu pre_commit pub python rust_toolchain sbt silent swift terraform uv vcpkg"
+ARG ECOSYSTEM_LIST="bazel bun bundler cargo composer conda deno devcontainers docker docker_compose:docker dotnet_sdk elm git_submodules github_actions go_modules gradle helm hex julia maven nix npm_and_yarn nub nuget opentofu pre_commit pub python rust_toolchain sbt silent swift terraform uv vcpkg"
 # prevent having all the source in every ecosystem image
 RUN for entry in $ECOSYSTEM_LIST; do \
     name="${entry%%:*}"; \

Gemfile

@@ -24,6 +24,7 @@ gem "dependabot-hex", path: "hex"
 gem "dependabot-julia", path: "julia"
 gem "dependabot-maven", path: "maven"
 gem "dependabot-npm_and_yarn", path: "npm_and_yarn"
+gem "dependabot-nub", path: "nub"
 gem "dependabot-nuget", path: "nuget"
 gem "dependabot-opentofu", path: "opentofu"
 gem "dependabot-pre_commit", path: "pre_commit"

Gemfile.lock

@@ -152,6 +152,13 @@ PATH
     dependabot-npm_and_yarn (0.394.0)
       dependabot-common (= 0.394.0)
 
+PATH
+  remote: nub
+  specs:
+    dependabot-nub (0.394.0)
+      dependabot-common (= 0.394.0)
+      dependabot-npm_and_yarn (= 0.394.0)
+
 PATH
   remote: nuget
   specs:
@@ -498,6 +505,7 @@ DEPENDENCIES
   dependabot-julia!
   dependabot-maven!
   dependabot-npm_and_yarn!
+  dependabot-nub!
   dependabot-nuget!
   dependabot-opentofu!
   dependabot-pre_commit!
@@ -569,6 +577,7 @@ CHECKSUMS
   dependabot-julia (0.394.0)
   dependabot-maven (0.394.0)
   dependabot-npm_and_yarn (0.394.0)
+  dependabot-nub (0.394.0)
   dependabot-nuget (0.394.0)
   dependabot-opentofu (0.394.0)
   dependabot-pre_commit (0.394.0)

bin/docker-dev-shell

@@ -255,6 +255,12 @@ docker run --rm -ti \
   -v "$(pwd)/npm_and_yarn/lib:$CODE_DIR/npm_and_yarn/lib" \
   -v "$(pwd)/npm_and_yarn/script:$CODE_DIR/npm_and_yarn/script" \
   -v "$(pwd)/npm_and_yarn/spec:$CODE_DIR/npm_and_yarn/spec" \
+  -v "$(pwd)/nub/.rubocop.yml:$CODE_DIR/nub/.rubocop.yml" \
+  -v "$(pwd)/nub/dependabot-nub.gemspec:$CODE_DIR/nub/dependabot-nub.gemspec" \
+  -v "$(pwd)/nub/helpers:$CODE_DIR/nub/helpers" \
+  -v "$(pwd)/nub/lib:$CODE_DIR/nub/lib" \
+  -v "$(pwd)/nub/script:$CODE_DIR/nub/script" \
+  -v "$(pwd)/nub/spec:$CODE_DIR/nub/spec" \
   -v "$(pwd)/nuget/.rubocop.yml:$CODE_DIR/nuget/.rubocop.yml" \
   -v "$(pwd)/nuget/dependabot-nuget.gemspec:$CODE_DIR/nuget/dependabot-nuget.gemspec" \
   -v "$(pwd)/nuget/helpers:$CODE_DIR/nuget/helpers" \

bin/dry-run.rb

@@ -36,6 +36,7 @@
 # - hex
 # - maven
 # - npm_and_yarn
+# - nub
 # - nuget
 # - pip (includes pipenv)
 # - pre_commit
@@ -81,6 +82,7 @@
 $LOAD_PATH << "./maven/lib"
 $LOAD_PATH << "./nix/lib"
 $LOAD_PATH << "./npm_and_yarn/lib"
+$LOAD_PATH << "./nub/lib"
 $LOAD_PATH << "./nuget/lib"
 $LOAD_PATH << "./pre_commit/lib"
 $LOAD_PATH << "./pub/lib"
@@ -139,6 +141,7 @@
 require "dependabot/julia"
 require "dependabot/maven"
 require "dependabot/npm_and_yarn"
+require "dependabot/nub"
 require "dependabot/nuget"
 require "dependabot/pre_commit"
 require "dependabot/pub"
@@ -390,6 +393,7 @@
   hex
   maven
   npm_and_yarn
+  nub
   nuget
   pip
   pre_commit

common/lib/dependabot/config/file.rb

@@ -82,6 +82,7 @@ def self.parse(config)
           "mix" => "hex",
           "nix" => "nix",
           "npm" => "npm_and_yarn",
+          "nub" => "nub",
           "nuget" => "nuget",
           "opentofu" => "opentofu",
           "pip" => "pip",

docker-bake.hcl

@@ -38,6 +38,7 @@ variable "ECOSYSTEMS" {
     { name = "maven", image = "maven", dockerfile = "maven/Dockerfile" },
     { name = "nix", image = "nix", dockerfile = "nix/Dockerfile" },
     { name = "npm_and_yarn", image = "npm", dockerfile = "npm_and_yarn/Dockerfile" },
+    { name = "nub", image = "nub", dockerfile = "nub/Dockerfile" },
     { name = "nuget", image = "nuget", dockerfile = "nuget/Dockerfile" },
     { name = "pre_commit", image = "pre-commit", dockerfile = "pre_commit/Dockerfile" },
     { name = "pub", image = "pub", dockerfile = "pub/Dockerfile" },

nub/.bundle/config

@@ -0,0 +1 @@
+BUNDLE_GEMFILE: "../dependabot-updater/Gemfile"

nub/.gitignore

@@ -0,0 +1,7 @@
+/.bundle/*
+!.bundle/config
+/.env
+/tmp
+/dependabot-*.gem
+/helpers/node_modules
+/helpers/install-dir

nub/.rubocop.yml

@@ -0,0 +1,48 @@
+inherit_from: ../.rubocop.yml
+
+Sorbet/ForbidTUnsafe:
+  Exclude:
+    - lib/dependabot/nub/update_checker.rb
+    - lib/dependabot/nub/update_checker/latest_version_finder.rb
+    - lib/dependabot/nub/update_checker/version_resolver.rb
+
+# The lib below models parsed package.json / npm-registry / lockfile JSON, which is genuinely
+# heterogeneous — the same `T::Hash[String, T.untyped]` shapes bun and npm_and_yarn carry. Those
+# gems grandfather the identical files under Sorbet/ForbidTUntyped in the root .rubocop_todo.yml;
+# nub cannot, because script/sorbet-untyped-ratchet forbids adding NEW files to that list, so the
+# exclusion lives here per-gem instead. Same rationale as the RSpec/Lint entries below.
+Sorbet/ForbidTUntyped:
+  Exclude:
+    - lib/dependabot/nub/dependency_files_filterer.rb
+    - lib/dependabot/nub/file_fetcher.rb
+    - lib/dependabot/nub/file_parser.rb
+    - lib/dependabot/nub/file_parser/lockfile_parser.rb
+    - lib/dependabot/nub/file_parser/nub_lock.rb
+    - lib/dependabot/nub/file_updater.rb
+    - lib/dependabot/nub/file_updater/package_json_updater.rb
+    - lib/dependabot/nub/metadata_finder.rb
+    - lib/dependabot/nub/package/package_details_fetcher.rb
+    - lib/dependabot/nub/package/registry_finder.rb
+    - lib/dependabot/nub/package_manager.rb
+    - lib/dependabot/nub/registry_helper.rb
+    - lib/dependabot/nub/registry_parser.rb
+    - lib/dependabot/nub/update_checker.rb
+    - lib/dependabot/nub/update_checker/latest_version_finder.rb
+    - lib/dependabot/nub/update_checker/library_detector.rb
+    - lib/dependabot/nub/update_checker/requirements_updater.rb
+    - lib/dependabot/nub/update_checker/version_resolver.rb
+    - lib/dependabot/nub/update_checker/vulnerability_auditor.rb
+
+# ERR_PATTERNS follows a `private` — harmless (constants ignore visibility). bun grandfathers the
+# byte-identical bun_lockfile_updater.rb for this cop in the root todo.
+Lint/UselessConstantScoping:
+  Exclude:
+    - lib/dependabot/nub/file_updater/nub_lockfile_updater.rb
+
+# Stubbing idioms inherited from bun's update_checker_spec, which bun/npm_and_yarn grandfather.
+RSpec/AnyInstance:
+  Exclude:
+    - spec/dependabot/nub/update_checker_spec.rb
+RSpec/StubbedMock:
+  Exclude:
+    - spec/dependabot/nub/update_checker_spec.rb

nub/Dockerfile

@@ -0,0 +1,43 @@
+# syntax=docker.io/docker/dockerfile:1.20
+FROM ghcr.io/dependabot/dependabot-updater-core
+
+# Check for updates at https://github.com/nubjs/nub/releases
+ARG NUB_VERSION=0.8.0
+
+# See https://github.com/nodesource/distributions#installation-instructions
+ARG NODEJS_VERSION=24
+
+# Install Node and nub.
+# nub is distributed as @nubjs/nub with per-platform binary optionalDependencies
+# (@nubjs/nub-<platform>) placed by its postinstall; the container is linux-x64 (glibc).
+RUN mkdir -p /etc/apt/keyrings \
+  && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
+  && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_${NODEJS_VERSION}.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends \
+  nodejs \
+  && rm -rf /var/lib/apt/lists/* \
+  && npm install -g @nubjs/nub@$NUB_VERSION \
+  && rm -rf ~/.npm
+
+USER dependabot
+
+# Use our custom CA bundle.
+ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
+
+# Silence warning messages that aren't useful within the Dependabot context.
+# These env vars are consumed by the Dependabot native helpers, which rely on npm/pnpm.
+# CAUTION: `NPM_CONFIG_*` vars take precedence over the user's .npmrc settings. For these it always makes sense, but for
+# other non-default configs it might be better to set them in a global .npmrc instead so users' .npmrc settings are respected.
+ENV NPM_CONFIG_AUDIT=false \
+    NPM_CONFIG_FUND=false
+
+ENV DEPENDABOT_NATIVE_HELPERS_PATH="/opt"
+COPY --chown=dependabot:dependabot nub/helpers /opt/nub/helpers
+RUN bash /opt/nub/helpers/build
+
+# nub depends on dependabot-npm_and_yarn (nub.lock is pnpm-lock v9, so nub reuses its
+# pnpm-format Ruby classes). The updater-core base only stubs sibling ecosystems, so the
+# full npm_and_yarn lib must be copied in — same pattern as pre_commit/Dockerfile.
+COPY --chown=dependabot:dependabot --parents nub npm_and_yarn common $DEPENDABOT_HOME/
+COPY --chown=dependabot:dependabot updater $DEPENDABOT_HOME/dependabot-updater

nub/README.md

@@ -0,0 +1,18 @@
+## `dependabot-nub`
+
+Nub support for [`dependabot-core`][core-repo].
+
+### Running locally
+
+1. Start a development shell
+
+  ```
+  $ bin/docker-dev-shell nub
+  ```
+
+2. Run tests
+   ```
+   [dependabot-core-dev] ~ $ cd nub && rspec
+   ```
+
+[core-repo]: https://github.com/dependabot/dependabot-core

nub/dependabot-nub.gemspec

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+Gem::Specification.new do |spec|
+  common_gemspec =
+    Bundler.load_gemspec_uncached("../common/dependabot-common.gemspec")
+
+  spec.name         = "dependabot-nub"
+  spec.summary      = "Provides Dependabot support for Javascript"
+  spec.description  = "Dependabot-Nub provides support for bumping Javascript libraries via " \
+                      "Dependabot. " \
+                      "If you want support for multiple package managers, you probably want the meta-gem " \
+                      "dependabot-omnibus."
+
+  spec.author       = common_gemspec.author
+  spec.email        = common_gemspec.email
+  spec.homepage     = common_gemspec.homepage
+  spec.license      = common_gemspec.license
+
+  spec.metadata = {
+    "bug_tracker_uri" => common_gemspec.metadata["bug_tracker_uri"],
+    "changelog_uri" => common_gemspec.metadata["changelog_uri"]
+  }
+
+  spec.version = common_gemspec.version
+  spec.required_ruby_version = common_gemspec.required_ruby_version
+  spec.required_rubygems_version = common_gemspec.required_ruby_version
+
+  spec.require_path = "lib"
+  spec.files        = []
+
+  spec.add_dependency "dependabot-common", Dependabot::VERSION
+  # nub.lock is byte-compatible with pnpm-lock v9, so nub reuses npm_and_yarn's
+  # pnpm-format classes (aliased/subclassed) rather than re-cloning them.
+  spec.add_dependency "dependabot-npm_and_yarn", Dependabot::VERSION
+
+  common_gemspec.development_dependencies.each do |dep|
+    spec.add_development_dependency dep.name, *dep.requirement.as_list
+  end
+
+  next unless File.exist?("../.gitignore")
+
+  spec.files += `git -C #{__dir__} ls-files lib helpers -z`.split("\x0")
+end

nub/helpers/.eslintrc

@@ -0,0 +1,11 @@
+{
+  "extends": [
+    "prettier"
+  ],
+  "env": {
+    "node": true
+  },
+  "parserOptions": {
+    "ecmaVersion": "latest"
+  }
+}

nub/helpers/README.md

@@ -0,0 +1,29 @@
+Native JavaScript helpers
+-------------------------
+
+This directory contains helper functions for npm and yarn, natively written in
+Javascript so that we can utilize the package managers internal APIs and other
+native tooling for these ecosystems.
+
+These helpers are called from the Ruby code via `run.js`, they are passed
+arguments via stdin and return JSON data to stdout.
+
+## Testing
+
+When working on these helpers, it's convenient to write some high level tests in
+JavaScript to make it easier to debug the code.
+
+You can now run the tests from this directory by running:
+
+```
+yarn test path/to/test.js
+```
+
+### Debugging
+
+In order to run an interactive debugger:
+
+- `node --inspect-brk node_modules/.bin/jest --runInBand path/to/test/test.js`
+- In Chrome, navigate to `chrome://inspect`
+- Click `Open dedicated DevTools for Node`
+- You'll now be able to interactively debug using the Chrome dev tools.