From e3cfa18a746d4da445e34b2476986a7ab6e5ead7 Mon Sep 17 00:00:00 2001 From: Anne-Marie <102995847+am-stead@users.noreply.github.com> Date: Thu, 13 Feb 2025 16:20:12 +0000 Subject: [PATCH] Add Dependabot ecosystem support for bun - [GA] #16918 (#54219) --- .../dependabot-options-reference.md | 3 +++ ...figuration-of-private-registries-for-dependabot.md | 10 ++++++++++ data/features/dependabot-bun-support.yml | 6 ++++++ .../dependabot/supported-package-managers.md | 11 +++++++++++ 4 files changed, 30 insertions(+) create mode 100644 data/features/dependabot-bun-support.yml diff --git a/content/code-security/dependabot/working-with-dependabot/dependabot-options-reference.md b/content/code-security/dependabot/working-with-dependabot/dependabot-options-reference.md index 0f05c2f0ed..bf9b1497fa 100644 --- a/content/code-security/dependabot/working-with-dependabot/dependabot-options-reference.md +++ b/content/code-security/dependabot/working-with-dependabot/dependabot-options-reference.md @@ -372,6 +372,9 @@ When `open-pull-requests-limit` is defined: Package manager | YAML value | Supported versions | ---------------|------------------|:------------------:| +| {% ifversion dependabot-bun-support %} | +| Bun | `bun` | >=v1.1.39 | +| {% endif %} | | Bundler | `bundler` | {% ifversion ghes < 3.15 %}v1, {% endif %}v2 | | Cargo | `cargo` | v1 | | Composer | `composer` | {% ifversion dependabot-updates-composerv1-closing-down %}v2{% else %}v1, v2{% endif %} | diff --git a/content/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot.md b/content/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot.md index 1a32f7edd2..15ddd0c932 100644 --- a/content/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot.md +++ b/content/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot.md @@ -28,6 +28,8 @@ This article contains recommendations and advice to help you configure {% data v You'll find detailed guidance for the setup of the following package managers: +{% ifversion dependabot-bun-support %} +* [Bun](#bun){% endif %} * [Bundler](#bundler){% ifversion dependabot-updates-cargo-private-registry-support %} * [Cargo](#cargo){% endif %} * [Docker](#docker) @@ -52,6 +54,14 @@ You'll also find recommendations for the setup of the following registry hosts: ## Configuring package managers +{% ifversion dependabot-bun-support %} + +### Bun + +Bun adheres to the same configuration guidelines as npm. Note that the `.npmrc` file is not required, but can be provided in order to customize the configuration. For detailed steps, see [npm](#npm). + +{% endif %} + ### Bundler Supported by Artifactory, Artifacts, Cloudsmith, {% data variables.product.prodname_registry %} registry, Nexus, and ProGet. diff --git a/data/features/dependabot-bun-support.yml b/data/features/dependabot-bun-support.yml new file mode 100644 index 0000000000..6e8a1eb68a --- /dev/null +++ b/data/features/dependabot-bun-support.yml @@ -0,0 +1,6 @@ +# Reference: #16918 +# Bun support for Dependabot +versions: + fpt: '*' + ghec: '*' + ghes: '> 3.16' diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index 6773bc381c..3a318da32d 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -1,5 +1,8 @@ Package manager | YAML value | Supported versions | Version updates | Security updates | Private repositories | Private registries | Vendoring | ---------------|------------------|------------------|:---:|:---:|:---:|:---:|:---:| +| {% ifversion dependabot-bun-support %} | +[Bun](#bun) | `bun` | >=v1.1.39 | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | +| {% endif %} | Bundler | `bundler` | {% ifversion ghes < 3.15 %}v1, {% endif %}v2 | {% octicon "check" aria-label="Supported" %}| {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | [Cargo](#cargo) | `cargo` | v1 | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %}{% ifversion dependabot-updates-cargo-private-registry-support %}{% else %} (Git only){% endif %} | {% octicon "x" aria-label="Not supported" %} | Composer | `composer` | {% ifversion dependabot-updates-composerv1-closing-down %}v2{% else %}v1, v2{% endif %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | @@ -38,6 +41,14 @@ poetry | `pip` | v1 | {% octicon "check" aria-l For further information about ecosystem support for {% data variables.product.prodname_dependabot_security_updates %}, see also [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/dependency-graph-supported-package-ecosystems). +{% ifversion dependabot-bun-support %} + +#### Bun + +{% data variables.product.prodname_dependabot %} supports the current default text-based `bun.lock` file, but not the legacy binary `bun.lockb` file. The `bun.lock` file is supported in version 1.1.39 and above. For more information, see [Lockfile](https://bun.sh/docs/install/lockfile) in the Bun documentation. + +{% endif %} + #### Cargo {% ifversion dependabot-updates-cargo-private-registry-support %}Private registry support includes cargo registries, so you can use {% data variables.product.prodname_dependabot %} to keep your Rust dependencies up-to-date. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot#cargo).{% else %}Private registry support applies to Git registries, and doesn't include cargo registries.{% endif %}