Add testcase

Author: owjs3901

Cargo.lock

@@ -20,6 +20,7 @@ tracing.workspace = true
 wiremock.workspace = true
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
 rustls.workspace = true
+tracing-subscriber.workspace = true
 
 [lints]
 workspace = true

crates/node/Cargo.toml

@@ -59,19 +59,7 @@ impl JsonPatcher {
 
         for &(section, section_key) in DEPENDENCY_SECTIONS {
             if let Some(serde_json::Value::Object(deps)) = parsed.get(section_key) {
-                // Find the byte position of this section key in the text
-                let Some(section_key_pos) = find_json_key_position(text, section_key, 0) else {
-                    continue;
-                };
-
-                // Find the opening { of the section's value object
-                let search_from = section_key_pos + section_key.len() + 2; // skip past `"key"`
-                let Some(obj_start) = find_char_skipping_strings(text, '{', search_from) else {
-                    continue;
-                };
-
-                // Find the matching closing }
-                let Some(obj_end) = find_matching_brace(text, obj_start) else {
+                let Some((obj_start, obj_end)) = find_section_bounds(text, section_key) else {
                     continue;
                 };
 
@@ -128,17 +116,7 @@ impl JsonPatcher {
                 continue;
             };
 
-            // Find the byte position of this section key in the text
-            let Some(section_key_pos) = find_json_key_position(text, section_key, 0) else {
-                continue;
-            };
-
-            let search_from = section_key_pos + section_key.len() + 2;
-            let Some(obj_start) = find_char_skipping_strings(text, '{', search_from) else {
-                continue;
-            };
-
-            let Some(obj_end) = find_matching_brace(text, obj_start) else {
+            let Some((obj_start, obj_end)) = find_section_bounds(text, section_key) else {
                 continue;
             };
 
@@ -198,6 +176,19 @@ impl JsonPatcher {
     }
 }
 
+/// Find the byte range `(obj_start, obj_end)` of a dependency-section object
+/// in the raw JSON text.
+///
+/// Returns `None` if the section key cannot be located, the opening `{` is
+/// missing, or the matching `}` is missing.
+fn find_section_bounds(text: &str, section_key: &str) -> Option<(usize, usize)> {
+    let section_key_pos = find_json_key_position(text, section_key, 0)?;
+    let search_from = section_key_pos + section_key.len() + 2; // skip past `"key"`
+    let obj_start = find_char_skipping_strings(text, '{', search_from)?;
+    let obj_end = find_matching_brace(text, obj_start)?;
+    Some((obj_start, obj_end))
+}
+
 /// Find the byte position of a JSON key string in the text.
 ///
 /// Searches for `"key"` as a JSON key (followed by `:`), starting from `from`.
@@ -988,4 +979,57 @@ mod tests {
         let result = find_char_skipping_strings(text, ':', 0);
         assert!(result.is_none());
     }
+
+    #[test]
+    fn test_find_section_bounds_key_not_found() {
+        // Section key doesn't exist in text at all
+        assert!(find_section_bounds("{}", "dependencies").is_none());
+    }
+
+    #[test]
+    fn test_find_section_bounds_no_brace_after_key() {
+        // Key exists and is followed by `:`, but no `{` after it (truncated text)
+        let text = r#"{"dependencies": "#;
+        assert!(find_section_bounds(text, "dependencies").is_none());
+    }
+
+    #[test]
+    fn test_find_section_bounds_no_matching_close_brace() {
+        // Key exists and `{` found, but no matching `}`
+        let text = r#"{"dependencies": {"#;
+        assert!(find_section_bounds(text, "dependencies").is_none());
+    }
+
+    #[test]
+    fn test_find_section_bounds_valid() {
+        let text = r#"{"dependencies": {"react": "^17.0.0"}}"#;
+        let bounds = find_section_bounds(text, "dependencies");
+        assert!(bounds.is_some());
+        let (start, end) = bounds.unwrap();
+        assert_eq!(&text[start..=end], r#"{"react": "^17.0.0"}"#);
+    }
+
+    #[test]
+    fn test_scan_version_locations_unicode_escaped_section_key() {
+        // serde_json decodes \u0065 → 'e', seeing "dependencies" as the key.
+        // But find_section_bounds searches for literal "dependencies" in the
+        // raw text and won't find "depend\u0065ncies" — exercises the continue.
+        let input = "{\"depend\\u0065ncies\": {\"react\": \"^17.0.0\"}}";
+        let locations = JsonPatcher::scan_version_locations(input).unwrap();
+        assert!(locations.is_empty());
+    }
+
+    #[test]
+    fn test_find_char_skipping_whitespace_empty_from_end() {
+        // When `from == text.len()`, the slice is empty → None
+        let text = "abc";
+        assert_eq!(find_char_skipping_whitespace(text, ':', text.len()), None);
+    }
+
+    #[test]
+    fn test_find_next_quote_empty_from_end() {
+        // When `from == text.len()`, the slice is empty → None
+        let text = "abc";
+        assert_eq!(find_next_quote(text, text.len()), None);
+    }
 }

crates/node/src/patcher.rs

@@ -192,21 +192,24 @@ impl NpmRegistry {
             handles.push(handle);
         }
 
-        let mut results = Vec::with_capacity(deps.len());
-        for handle in handles {
-            match handle.await {
-                Ok(result) => results.push(result),
-                Err(e) => {
-                    warn!("task join error: {e}");
-                }
-            }
-        }
-
+        let mut results = collect_task_results(handles).await;
         results.sort_unstable_by_key(|(idx, _)| *idx);
         results
     }
 }
 
+/// Collect results from spawned tasks, logging any `JoinError`s (e.g. panics).
+async fn collect_task_results<T>(handles: Vec<tokio::task::JoinHandle<T>>) -> Vec<T> {
+    let mut results = Vec::with_capacity(handles.len());
+    for handle in handles {
+        match handle.await {
+            Ok(result) => results.push(result),
+            Err(e) => warn!("task join error: {e}"),
+        }
+    }
+    results
+}
+
 impl Default for NpmRegistry {
     fn default() -> Self {
         Self::new()
@@ -813,4 +816,76 @@ mod tests {
         let result = select_version("*", Some(&latest), &versions, TargetLevel::Patch);
         assert_eq!(result, Some("2.0.0".to_owned()));
     }
+
+    #[tokio::test]
+    async fn test_resolve_version_non_latest_with_tracing() {
+        use wiremock::matchers::{method, path};
+        use wiremock::{Mock, MockServer, ResponseTemplate};
+
+        install_crypto_provider();
+
+        // Install a trace-level subscriber so trace!() arguments are evaluated.
+        let subscriber = tracing_subscriber::fmt()
+            .with_max_level(tracing::Level::TRACE)
+            .with_test_writer()
+            .finish();
+        let _guard = tracing::subscriber::set_default(subscriber);
+
+        let mock_server = MockServer::start().await;
+        Mock::given(method("GET"))
+            .and(path("/react"))
+            .respond_with(
+                ResponseTemplate::new(200)
+                    .set_body_json(npm_response_body("19.0.0", &["17.0.0", "18.0.0", "19.0.0"])),
+            )
+            .mount(&mock_server)
+            .await;
+
+        let registry = NpmRegistry::with_base_url(&mock_server.uri());
+        let dep = DependencySpec {
+            name: "react".to_owned(),
+            current_req: "~17.0.0".to_owned(),
+            section: dependency_check_updates_core::DependencySection::Dependencies,
+        };
+        let result = registry
+            .resolve_version(&dep, TargetLevel::Greatest)
+            .await
+            .unwrap();
+        assert_eq!(result.selected.as_deref(), Some("19.0.0"));
+    }
+
+    #[tokio::test]
+    async fn test_collect_task_results_join_error() {
+        // Suppress panic output from the intentionally-panicking task.
+        let prev_hook = std::panic::take_hook();
+        std::panic::set_hook(Box::new(|_| {}));
+
+        let handles: Vec<tokio::task::JoinHandle<(usize, Result<ResolvedVersion, DcuError>)>> = vec![
+            tokio::spawn(async {
+                (
+                    0,
+                    Ok(ResolvedVersion {
+                        latest: Some("1.0.0".into()),
+                        selected: None,
+                    }),
+                )
+            }),
+            tokio::spawn(async { panic!("simulated join error") }),
+            tokio::spawn(async {
+                (
+                    2,
+                    Ok(ResolvedVersion {
+                        latest: Some("2.0.0".into()),
+                        selected: None,
+                    }),
+                )
+            }),
+        ];
+        let results = collect_task_results(handles).await;
+
+        std::panic::set_hook(prev_hook);
+
+        // The panicking task is dropped; only 2 results survive.
+        assert_eq!(results.len(), 2);
+    }
 }

crates/node/src/registry.rs

@@ -20,6 +20,7 @@ thiserror.workspace = true
 wiremock.workspace = true
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
 rustls.workspace = true
+tracing-subscriber.workspace = true
 
 [lints]
 workspace = true

crates/python/Cargo.toml

@@ -149,19 +149,24 @@ impl PyPiRegistry {
             handles.push(handle);
         }
 
-        let mut results = Vec::with_capacity(deps.len());
-        for handle in handles {
-            match handle.await {
-                Ok(result) => results.push(result),
-                Err(e) => warn!("task join error: {e}"),
-            }
-        }
-
+        let mut results = collect_task_results(handles).await;
         results.sort_unstable_by_key(|(idx, _)| *idx);
         results
     }
 }
 
+/// Collect results from spawned tasks, logging any `JoinError`s (e.g. panics).
+async fn collect_task_results<T>(handles: Vec<tokio::task::JoinHandle<T>>) -> Vec<T> {
+    let mut results = Vec::with_capacity(handles.len());
+    for handle in handles {
+        match handle.await {
+            Ok(result) => results.push(result),
+            Err(e) => warn!("task join error: {e}"),
+        }
+    }
+    results
+}
+
 impl Default for PyPiRegistry {
     fn default() -> Self {
         Self::new()
@@ -339,4 +344,32 @@ mod tests {
         install_crypto_provider();
         let _registry = PyPiRegistry::default();
     }
+
+    #[tokio::test]
+    async fn test_collect_task_results_join_error() {
+        use dependency_check_updates_core::{DcuError, ResolvedVersion};
+
+        // Suppress panic output from the intentionally-panicking task.
+        let prev_hook = std::panic::take_hook();
+        std::panic::set_hook(Box::new(|_| {}));
+
+        let handles: Vec<tokio::task::JoinHandle<(usize, Result<ResolvedVersion, DcuError>)>> = vec![
+            tokio::spawn(async {
+                (
+                    0,
+                    Ok(ResolvedVersion {
+                        latest: Some("1.0.0".into()),
+                        selected: None,
+                    }),
+                )
+            }),
+            tokio::spawn(async { panic!("simulated join error") }),
+        ];
+        let results = super::collect_task_results(handles).await;
+
+        std::panic::set_hook(prev_hook);
+
+        // The panicking task is dropped; only 1 result survives.
+        assert_eq!(results.len(), 1);
+    }
 }

crates/python/src/registry.rs

@@ -21,6 +21,7 @@ thiserror.workspace = true
 wiremock.workspace = true
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
 rustls.workspace = true
+tracing-subscriber.workspace = true
 
 [lints]
 workspace = true

crates/rust/Cargo.toml

@@ -582,4 +582,29 @@ features = ["derive"]
         assert_eq!(manifest.dependencies[0].name, "serde");
         assert_eq!(manifest.dependencies[0].current_req, "1.0");
     }
+
+    #[test]
+    fn test_apply_updates_unhandled_value_type() {
+        // A dependency entry that is an array (not string/inline-table/table)
+        // hits the catch-all `_ => {}` arm in update_dep_in_table.
+        let toml = r#"
+[dependencies]
+weird-dep = [1, 2, 3]
+serde = "1.0"
+"#;
+        let mut manifest = CargoTomlManifest::parse(toml).unwrap();
+        // Array-valued dep is not collected as a dependency
+        assert_eq!(manifest.dependencies.len(), 1);
+
+        // Attempting to update the array-valued dep should succeed silently
+        let updates = vec![PlannedUpdate {
+            name: "weird-dep".to_owned(),
+            section: DependencySection::Dependencies,
+            from: "1.0".to_owned(),
+            to: "2.0".to_owned(),
+        }];
+        let result = manifest.apply_updates(&updates).unwrap();
+        // Original value unchanged — the catch-all arm is a no-op
+        assert!(result.contains("weird-dep = [1, 2, 3]"));
+    }
 }