Merge branch 'master' into master

.github/dependabot.yml

@@ -29,7 +29,15 @@ updates:
 
   # GH actions
   - package-ecosystem: 'github-actions'
-    directory: '/'
+    # all composite actions must be individually listed here
+    # https://github.com/dependabot/dependabot-core/issues/6704
+    directories:
+      - '/'
+      - '/.github/actions/core-tests'
+      - '/.github/actions/integration-tests'
+      - '/.github/actions/package-tests'
+      - '/.github/actions/service-tests'
+      - '/.github/actions/setup'
     schedule:
       interval: weekly
     open-pull-requests-limit: 99

.github/workflows/test-integration-21.yml → .github/workflows/test-integration-22.yml

@@ -1,4 +1,4 @@
-name: Integration@node 21
+name: Integration@node 22
 on:
   pull_request:
     types: [opened, reopened, synchronize]
@@ -8,7 +8,7 @@ on:
       - 'dependabot/**'
 
 jobs:
-  test-integration-21:
+  test-integration-22:
     runs-on: ubuntu-latest
     env:
       PAT_EXISTS: ${{ secrets.GH_PAT != '' }}
@@ -35,7 +35,7 @@ jobs:
       - name: Setup
         uses: ./.github/actions/setup
         with:
-          node-version: 21
+          node-version: 22
         env:
           NPM_CONFIG_ENGINE_STRICT: 'false'
 

.github/workflows/test-main-21.yml → .github/workflows/test-main-22.yml

@@ -1,4 +1,4 @@
-name: Main@node 21
+name: Main@node 22
 on:
   pull_request:
     types: [opened, reopened, synchronize]
@@ -8,7 +8,7 @@ on:
       - 'dependabot/**'
 
 jobs:
-  test-main-21:
+  test-main-22:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -17,7 +17,7 @@ jobs:
       - name: Setup
         uses: ./.github/actions/setup
         with:
-          node-version: 21
+          node-version: 22
         env:
           NPM_CONFIG_ENGINE_STRICT: 'false'
 

.github/workflows/test-package-cli.yml

@@ -19,6 +19,7 @@ jobs:
           - node: '16'
           - node: '18'
           - node: '20'
+          - node: '22'
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/test-package-lib.yml

@@ -22,6 +22,9 @@ jobs:
           - node: '20'
             npm: '^10'
             engine-strict: 'true'
+          - node: '22'
+            npm: '^10'
+            engine-strict: 'false'
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/test-services-21.yml → .github/workflows/test-services-22.yml

@@ -1,4 +1,4 @@
-name: Services@node 21
+name: Services@node 22
 on:
   pull_request:
     types: [opened, edited, reopened, synchronize]
@@ -7,7 +7,7 @@ on:
       - 'gh-readonly-queue/**'
 
 jobs:
-  test-services-21:
+  test-services-22:
     runs-on: ubuntu-latest
 
     steps:
@@ -17,7 +17,7 @@ jobs:
       - name: Setup
         uses: ./.github/actions/setup
         with:
-          node-version: 21
+          node-version: 22
         env:
           NPM_CONFIG_ENGINE_STRICT: 'false'
 

README.md

@@ -99,7 +99,7 @@ If you intend on reporting or contributing a fix related to security vulnerabili
 ## Development
 
 1. Install Node 20 or later. You can use the [package manager][] of your choice.
-   Tests need to pass in Node 20 and 21.
+   Tests need to pass in Node 20 and 22.
 2. Clone this repository.
 3. Run `npm ci` to install the dependencies.
 4. Run `npm start` to start the badge server and the frontend dev server.

doc/server-secrets.md

@@ -114,7 +114,7 @@ generated API key.
 
 Using a token for Discord is optional but will allow higher API rates.
 
-- `DISCORD_BOT_TOKEN` (yml: `discord_bot_token`)
+- `DISCORD_BOT_TOKEN` (yml: `private.discord_bot_token`)
 
 Register an application in the [Discord developer console](https://discord.com/developers).
 To obtain a token, simply create a bot for your application.
@@ -269,15 +269,15 @@ of a package.
 
 ### OpenCollective
 
-- `OPENCOLLECTIVE_TOKEN` (yml: `opencollective_token`)
+- `OPENCOLLECTIVE_TOKEN` (yml: `private.opencollective_token`)
 
 OpenCollective's GraphQL API only allows 10 reqs/minute for anonymous users.
 An [API token](https://graphql-docs-v2.opencollective.com/access)
 can be provided to access a higher rate limit of 100 reqs/minute.
 
 ### Pepy
 
-- `PEPY_KEY` (yml: `pepy_key`)
+- `PEPY_KEY` (yml: `private.pepy_key`)
 
 The Pepy API requires authentication. To obtain a key,
 Create an account, sign in and obtain generate a key on your
@@ -330,8 +330,8 @@ access to your private nexus repositories.
 
 ### Twitch
 
-- `TWITCH_CLIENT_ID` (yml: `twitch_client_id`)
-- `TWITCH_CLIENT_SECRET` (yml: `twitch_client_secret`)
+- `TWITCH_CLIENT_ID` (yml: `private.twitch_client_id`)
+- `TWITCH_CLIENT_SECRET` (yml: `private.twitch_client_secret`)
 
 Register an application in the [Twitch developer console](https://dev.twitch.tv/console)
 in order to obtain a client id and a client secret for making Twitch API calls.

services/librariesio/librariesio-api-provider.js

@@ -17,7 +17,7 @@ export default class LibrariesIoApiProvider {
     })
 
     if (this.withPooling) {
-      this.standardTokens = new TokenPool({ batchSize: 45 })
+      this.standardTokens = new TokenPool({ batchSize: 10 })
       tokens.forEach(t => this.standardTokens.add(t, {}, defaultRateLimit))
     }
   }
@@ -48,7 +48,8 @@ export default class LibrariesIoApiProvider {
     // If the header is absent, we just use the current timestamp to
     // advance the value to _something_
     const retryAfter = headers['retry-after']
-    const nextReset = Date.now() + (retryAfter ? +retryAfter * 1000 : 0)
+    const nextReset =
+      ((Date.now() + (retryAfter ? +retryAfter * 1000 : 0)) / 1000) >>> 0
 
     return {
       rateLimit,

services/librariesio/librariesio-api-provider.spec.js

@@ -80,7 +80,7 @@ describe('LibrariesIoApiProvider', function () {
 
       expect(token.update).to.have.been.calledWith(
         remaining,
-        nextReset * 1000 + tickTime,
+        ((nextReset * 1000 + tickTime) / 1000) >>> 0,
       )
       expect(token.invalidate).not.to.have.been.called
     })
@@ -98,7 +98,10 @@ describe('LibrariesIoApiProvider', function () {
       const mockRequest = sinon.stub().resolves(response)
       await provider.fetch(mockRequest, '/npm/badge-maker')
 
-      expect(token.update).to.have.been.calledWith(remaining, tickTime)
+      expect(token.update).to.have.been.calledWith(
+        remaining,
+        (tickTime / 1000) >>> 0,
+      )
       expect(token.invalidate).not.to.have.been.called
     })
 
@@ -109,7 +112,10 @@ describe('LibrariesIoApiProvider', function () {
       const mockRequest = sinon.stub().resolves(response)
       await provider.fetch(mockRequest, '/npm/badge-maker')
 
-      expect(token.update).to.have.been.calledWith(remaining - 1, tickTime)
+      expect(token.update).to.have.been.calledWith(
+        remaining - 1,
+        (tickTime / 1000) >>> 0,
+      )
       expect(token.invalidate).not.to.have.been.called
     })
   })

services/pypi/pypi-status.service.js

@@ -28,6 +28,7 @@ export default class PypiStatus extends PypiBase {
       stable: 'brightgreen',
       mature: 'brightgreen',
       inactive: 'red',
+      unknown: 'lightgrey',
     }[status]
 
     return {
@@ -48,7 +49,7 @@ export default class PypiStatus extends PypiBase {
     // - Development Status :: 6 - Mature
     // - Development Status :: 7 - Inactive
     // https://pypi.org/pypi?%3Aaction=list_classifiers
-    const status = parseClassifiers(
+    let status = parseClassifiers(
       packageData,
       /^Development Status :: (\d - \S+)$/,
     )
@@ -57,6 +58,10 @@ export default class PypiStatus extends PypiBase {
       .map(classifier => classifier.replace(/production\/stable/i, 'stable'))
       .pop()
 
+    if (!status) {
+      status = 'Unknown'
+    }
+
     return this.constructor.render({ status })
   }
 }

services/pypi/pypi-status.tester.js

@@ -13,6 +13,10 @@ t.create('status (valid, beta)')
   .get('/django/2.0rc1.json')
   .expectBadge({ label: 'status', message: 'beta' })
 
+t.create('status (status not specified)')
+  .get('/arcgis2geojson/3.0.2.json')
+  .expectBadge({ label: 'status', message: 'unknown' })
+
 t.create('status (invalid)')
   .get('/not-a-package.json')
   .expectBadge({ label: 'status', message: 'package or version not found' })