Add a typed package.json reader

[JamieMagee]

What are you trying to accomplish?

Add a shared NpmPackageJson reader for the fields used by npm/Yarn and Bun file parsing and workspace filtering. It is typed: strong, yields string dependency requirements, and reuses NpmPackageManagerConfig for package-manager metadata.

This is the bottom layer of the stack. #16180 and #16181 migrate the consumers.

Anything you want to highlight for special attention from reviewers?

The contract follows the existing parser code and fixtures, not a complete npm schema. Fields are read lazily, requirement strings stay unchanged, and non-string requirements are skipped. Missing/null/false dependency sections remain empty; other non-object sections raise TypeError with file and field context.

flat and workspaces retain their existing Ruby truthiness, including empty arrays and objects. JSON syntax errors propagate for callers to handle. The reader never rewrites the source file.

How will you know you've accomplished your goal?

The reader and existing package-manager config specs pass all 48 examples. Repository-wide Sorbet and targeted RuboCop also pass. These checks ran in containers; I did not run the complete repository suite.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused implementation follows existing parsing conventions and has thorough behavioral coverage.

Review tier: Balanced
Findings: None

What changed in this PR

Adds a shared, strongly typed package.json reader to Dependabot Common.

Changes:

• Parses dependency sections and package metadata safely.
• Validates malformed JSON structures with contextual errors.
• Adds comprehensive tests for valid, invalid, and optional fields.

File	Description
common/​lib/​dependabot/​package/​npm_package_json.rb	Implements the typed reader.
common/​spec/​dependabot/​package/​npm_package_json_spec.rb	Covers parsing, validation, and defaults.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.