Bump importmap-rails from 2.0.1 to 2.0.3 (#5098)

* Bump importmap-rails from 2.0.1 to 2.0.2

Bumps [importmap-rails](https://github.com/rails/importmap-rails) from 2.0.1 to 2.0.2.
- [Release notes](https://github.com/rails/importmap-rails/releases)
- [Commits](rails/importmap-rails@v2.0.1...v2.0.2)

---
updated-dependencies:
- dependency-name: importmap-rails
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

* Update importmap vendored javascript with new comment

Add `rake importmap:pristine` to redownload and add comment.
Fix importmap's incomplete semver regex that loses prereleases.
The regex used is from semver.org.

Change `rake importmap:verify` to discard the comment when comparing
content of vendored javascript files.
Add VERBOSE to importmap:verify to diagnose problems.

* don't include the regex for now

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Martin Emde <[email protected]>
Co-authored-by: Martin Emde <[email protected]>

Gemfile.lock

@@ -351,7 +351,7 @@ GEM
     http_accept_language (2.1.1)
     i18n (1.14.6)
       concurrent-ruby (~> 1.0)
-    importmap-rails (2.0.1)
+    importmap-rails (2.0.3)
       actionpack (>= 6.0.0)
       activesupport (>= 6.0.0)
       railties (>= 6.0.0)
@@ -1134,7 +1134,7 @@ CHECKSUMS
   http-form_data (2.3.0) sha256=cc4eeb1361d9876821e31d7b1cf0b68f1cf874b201d27903480479d86448a5f3
   http_accept_language (2.1.1) sha256=0043f0d55a148cf45b604dbdd197cb36437133e990016c68c892d49dbea31634
   i18n (1.14.6) sha256=dc229a74f5d181f09942dd60ab5d6e667f7392c4ee826f35096db36d1fe3614c
-  importmap-rails (2.0.1) sha256=e739a6e70c09f797688c6983fa79567ec1edc9becc30d55b3f7cc897b1825586
+  importmap-rails (2.0.3) sha256=c56764941f9b637791fb87123b38f206f27cc55ef03cb19894f1994184e98cc8
   inline_svg (1.10.0) sha256=5b652934236fd9f8adc61f3fd6e208b7ca3282698b19f28659971da84bf9a10f
   io-console (0.7.2) sha256=f0dccff252f877a4f60d04a4dc6b442b185ebffb4b320ab69212a92b48a7a221
   irb (1.14.1) sha256=5975003b58d36efaf492380baa982ceedf5aed36967a4d5b40996bc5c66e80f8

config/importmap.rb

@@ -1,12 +1,11 @@
 # Pin npm packages by running ./bin/importmap
 
 pin "jquery" # @3.7.1
-pin "@rails/ujs", to: "@rails--ujs.js" # @7.1.3
+pin "@rails/ujs", to: "@rails--ujs.js" # @7.1.3-4
 pin "application"
 pin_all_from "app/javascript/src", under: "src"
 
-# stimulus.min.js is a compiled asset from stimulus-rails gem
-pin "@hotwired/stimulus", to: "stimulus.min.js"
+pin "@hotwired/stimulus", to: "@hotwired--stimulus.js" # @3.2.2
 # stimulus-loading.js is a compiled asset only available from stimulus-rails gem
 pin "@hotwired/stimulus-loading", to: "stimulus-loading.js"
 pin_all_from "app/javascript/controllers", under: "controllers"

lib/tasks/helpers/importmap_helper.rb

@@ -9,43 +9,60 @@ class Packager < Importmap::Packager
     self.endpoint = URI("https://api.jspm.io/generate")
 
     # Copied from https://github.com/rails/importmap-rails/pull/237
-    def verify(package, url)
+    def verify(package, url, verbose: false)
       ensure_vendor_directory_exists
 
-      return unless vendored_package_path(package).file?
-      verify_vendored_package(package, url)
+      unless vendored_package_path(package).file?
+        raise ImportmapHelper::VerifyError, "Pinned #{package}#{extract_package_version_from(url)} does not exist in vendor/javascript"
+      end
+      verify_vendored_package(package, url, verbose:)
     end
 
-    def verify_vendored_package(package, url)
+    def verify_vendored_package(package, url, verbose: false)
       vendored_body = vendored_package_path(package).read.strip
-      remote_body = load_package_file(package, url).strip
+      vendored_body = vendored_body.lines[2..].join if vendored_body.start_with?("//") # remove the importmap-rails comment
+      remote_body = load_package_file(url).strip
 
       return true if vendored_body == remote_body
 
-      raise ImportmapHelper::VerifyError, "Vendored #{package}#{extract_package_version_from(url)} does not match remote #{url}"
+      verbose_error = verbose ? verbose_diff(remote_body, vendored_body) : " (run with VERBOSE=true for diff)"
+      raise ImportmapHelper::VerifyError, "Vendored #{package}#{extract_package_version_from(url)} does not match remote #{url}#{verbose_error}"
     end
 
-    def load_package_file(package, url)
+    def load_package_file(url)
       response = Net::HTTP.get_response(URI(url))
 
       if response.code == "200"
-        format_vendored_package(package, url, response.body)
+        format_vendored_package(response.body)
       else
         handle_failure_response(response)
       end
     end
 
-    def format_vendored_package(package, url, source)
-      formatted = +""
-      if Gem::Version.new(Importmap::VERSION) > Gem::Version.new("2.0.1")
-        formatted.concat "// #{package}#{extract_package_version_from(url)} downloaded from #{url}\n\n"
+    def format_vendored_package(source)
+      remove_sourcemap_comment_from(source).force_encoding("UTF-8")
+    end
+
+    def save_vendored_package(package, url, source)
+      File.open(vendored_package_path(package), "w+") do |vendored_package|
+        vendored_package.write "// #{package}#{extract_package_version_from(url)} downloaded from #{url}\n\n"
+
+        vendored_package.write remove_sourcemap_comment_from(source).force_encoding("UTF-8")
       end
-      formatted.concat remove_sourcemap_comment_from(source).force_encoding("UTF-8")
-      formatted
     end
 
-    def save_vendored_package(package, _url, source)
-      File.write(vendored_package_path(package), source)
+    def verbose_diff(remote_body, vendored_body)
+      require "diff/lcs"
+      diffs = Diff::LCS.sdiff(remote_body.split("\n"), vendored_body.split("\n"))
+      out = "\n\nDiff:\n- Remote\n+ Vendored\n\n"
+      out + diffs.map do |diff|
+        case diff.action
+        when "-" then "- #{diff.old_element}"
+        when "!" then "- #{diff.old_element}\n+ #{diff.new_element}"
+        when "+" then "+ #{diff.new_element}"
+        when "=" then "  #{diff.old_element}"
+        end
+      end.join("\n")
     end
 
     public :vendored_package_path

lib/tasks/importmap.rake

@@ -6,6 +6,7 @@ require "tasks/helpers/importmap_helper"
 namespace :importmap do
   desc "Verify downloaded packages in vendor/javascript"
   task :verify do # rubocop:disable Rails/RakeEnvironment
+    options = { env: "production", from: "jspm.io" }
     all_files = Rails.root.glob("vendor/javascript/*.js").map { |p| p.relative_path_from(Rails.root) }
     all_files.delete(Pathname.new("vendor/javascript/github-buttons.js")) || raise("importmap:verify expected github-buttons.js not found")
     all_files.delete(Pathname.new("vendor/javascript/webauthn-json.js")) || raise("importmap:verify expected webauthn-json.js not found")
@@ -20,10 +21,10 @@ namespace :importmap do
 
     packager = ImportmapHelper::Packager.new
 
-    if (imports = packager.import(*packages, env: "production", from: "jspm.io"))
+    if (imports = packager.import(*packages, env: options[:env], from: options[:from]))
       imports.each do |package, url|
         puts %(Verifying "#{package}" download from #{url})
-        packager.verify(package, url)
+        packager.verify(package, url, verbose: ENV["VERBOSE"])
         path = packager.vendored_package_path(package)
         puts %(Verified  "#{package}" at #{path})
         all_files.delete path
@@ -45,4 +46,27 @@ namespace :importmap do
       exit 1
     end
   end
+
+  desc "Re-download all packages in the importmap with the same versions"
+  task pristine: :environment do
+    options = { env: "production", from: "jspm.io" }
+    npm = Importmap::Npm.new(Rails.root.join("config/importmap.rb"))
+
+    packages = npm.packages_with_versions.map do |p, v|
+      v.blank? ? p : [p, v].join("@")
+    end
+
+    puts "Downloading pristine packages from #{options[:from]} to vendor/javascript"
+
+    packager = ImportmapHelper::Packager.new
+
+    if (imports = packager.import(*packages, env: options[:env], from: options[:from]))
+      imports.each do |package, url|
+        puts %(Downloading pinned "#{package}" to #{packager.vendor_path}/#{package}.js from #{url})
+        packager.download(package, url)
+      end
+    else
+      puts "Couldn't find any packages in #{packages.inspect} on #{options[:from]}"
+    end
+  end
 end