feat: update gitea vendor

package/gitea/source/modules/packages/npm/creator.go

@@ -14,9 +14,9 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	"github.com/hashicorp/go-version"
 )
@@ -103,7 +103,7 @@ type PackageMetadataVersion struct {
 	DevDependencies      map[string]string   `json:"devDependencies,omitempty"`
 	PeerDependencies     map[string]string   `json:"peerDependencies,omitempty"`
 	PeerDependenciesMeta map[string]any      `json:"peerDependenciesMeta,omitempty"`
-	Bin                  map[string]string   `json:"bin,omitempty"`
+	Bin                  Bin                 `json:"bin,omitempty"`
 	OptionalDependencies map[string]string   `json:"optionalDependencies,omitempty"`
 	Readme               string              `json:"readme,omitempty"`
 	Dist                 PackageDistribution `json:"dist"`
@@ -181,10 +181,54 @@ func (u *User) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-// Repository https://github.com/npm/registry/blob/master/docs/REGISTRY-API.md#version
+// Repository https://docs.npmjs.com/cli/v11/configuring-npm/package-json#repository
 type Repository struct {
-	Type string `json:"type"`
-	URL  string `json:"url"`
+	Type      string `json:"type"`
+	URL       string `json:"url"`
+	Directory string `json:"directory,omitempty"`
+}
+
+// UnmarshalJSON is needed because the repository field can be a string or an object.
+func (r *Repository) UnmarshalJSON(data []byte) error {
+	switch data[0] {
+	case '"':
+		var value string
+		if err := json.Unmarshal(data, &value); err != nil {
+			return err
+		}
+		r.URL = value
+	case '{':
+		type repositoryAlias Repository // avoid recursion into this method
+		var value repositoryAlias
+		if err := json.Unmarshal(data, &value); err != nil {
+			return err
+		}
+		*r = Repository(value)
+	}
+	return nil
+}
+
+// Bin maps command names to executable files. npm also allows a single string,
+// in which case the command is named after the package (resolved in ParsePackage).
+type Bin map[string]string
+
+// UnmarshalJSON is needed because the bin field can be a string or an object.
+func (b *Bin) UnmarshalJSON(data []byte) error {
+	switch data[0] {
+	case '"':
+		var value string
+		if err := json.Unmarshal(data, &value); err != nil {
+			return err
+		}
+		*b = Bin{"": value}
+	case '{':
+		var value map[string]string
+		if err := json.Unmarshal(data, &value); err != nil {
+			return err
+		}
+		*b = value
+	}
+	return nil
 }
 
 // PackageAttachment https://github.com/npm/registry/blob/master/docs/REGISTRY-API.md#package
@@ -228,6 +272,11 @@ func ParsePackage(r io.Reader) (*Package, error) {
 			meta.Homepage = ""
 		}
 
+		// A string "bin" means a single executable named after the package.
+		if cmd, ok := meta.Bin[""]; ok && len(meta.Bin) == 1 {
+			meta.Bin = Bin{name: cmd}
+		}
+
 		p := &Package{
 			Name:     meta.Name,
 			Version:  v.String(),

package/gitea/source/modules/packages/npm/creator_test.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -28,8 +28,9 @@ func TestParsePackage(t *testing.T) {
 	data := "H4sIAAAAAAAA/ytITM5OTE/VL4DQelnF+XkMVAYGBgZmJiYK2MRBwNDcSIHB2NTMwNDQzMwAqA7IMDUxA9LUdgg2UFpcklgEdAql5kD8ogCnhwio5lJQUMpLzE1VslJQcihOzi9I1S9JLS7RhSYIJR2QgrLUouLM/DyQGkM9Az1D3YIiqExKanFyUWZBCVQ2BKhVwQVJDKwosbQkI78IJO/tZ+LsbRykxFXLNdA+HwWjYBSMgpENACgAbtAACAAA"
 	integrity := "sha512-yA4FJsVhetynGfOC1jFf79BuS+jrHbm0fhh+aHzCQkOaOBXKf9oBnC4a6DnLLnEsHQDRLYd00cwj8sCXpC+wIg=="
 	repository := Repository{
-		Type: "gitea",
-		URL:  "http://localhost:3000/gitea/test.git",
+		Type:      "gitea",
+		URL:       "http://localhost:3000/gitea/test.git",
+		Directory: "packages/test-package",
 	}
 
 	t.Run("InvalidUpload", func(t *testing.T) {
@@ -298,6 +299,7 @@ func TestParsePackage(t *testing.T) {
 		assert.Equal(t, "1.2.0", p.Metadata.Dependencies["package"])
 		assert.Equal(t, repository.Type, p.Metadata.Repository.Type)
 		assert.Equal(t, repository.URL, p.Metadata.Repository.URL)
+		assert.Equal(t, repository.Directory, p.Metadata.Repository.Directory)
 	})
 
 	t.Run("ValidLicenseMap", func(t *testing.T) {
@@ -324,4 +326,31 @@ func TestParsePackage(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, "MIT", string(p.Metadata.License))
 	})
+
+	t.Run("ValidRepositoryAndBinAsString", func(t *testing.T) {
+		// npm allows "repository" and "bin" to be plain strings, not only objects.
+		packageJSON := `{
+  "versions": {
+		"0.1.1": {
+			"name": "dev-null",
+			"version": "0.1.1",
+			"bin": "./cli.js",
+			"repository": "https://gitea.io/gitea/test.git",
+			"dist": {
+				"integrity": "sha256-"
+			}
+		}
+	},
+	"_attachments": {
+		"foo": {
+			"data": "AAAA"
+		}
+	}
+}`
+		p, err := ParsePackage(strings.NewReader(packageJSON))
+		require.NoError(t, err)
+		require.Equal(t, "https://gitea.io/gitea/test.git", p.Metadata.Repository.URL)
+		// a string bin is named after the package
+		require.Equal(t, "./cli.js", p.Metadata.Bin["dev-null"])
+	})
 }