feat!: replace got with node fetch

packages/osv-offline-updater/package.json

@@ -17,7 +17,6 @@
     "@octokit/rest": "22.0.1",
     "adm-zip": "0.5.17",
     "fs-extra": "11.3.5",
-    "got": "15.0.5",
     "luxon": "3.7.2",
     "signale": "1.4.0"
   },

packages/osv-offline-updater/src/client/osv.ts

@@ -1,19 +1,26 @@
 import { format } from 'util';
 
 import AdmZip from 'adm-zip';
-import got from 'got';
 import type { Ecosystem, Osv } from '@renovatebot/osv-offline-db';
 
+export type Fetcher = typeof globalThis.fetch;
+
 export class OsvDownloader {
   private static readonly downloadUrlFormat =
     'https://osv-vulnerabilities.storage.googleapis.com/%s/all.zip';
 
-  constructor(private readonly ecosystem: Ecosystem) {}
+  constructor(
+    private readonly ecosystem: Ecosystem,
+    private readonly fetcher: Fetcher = globalThis.fetch
+  ) {}
 
   public async download(): Promise<Osv.Vulnerability[]> {
     const downloadUrl = format(OsvDownloader.downloadUrlFormat, this.ecosystem);
-    const response = await got.get(downloadUrl, { responseType: 'buffer' });
-    return new AdmZip(Buffer.from(response.body))
+    const response = await this.fetcher(downloadUrl);
+    if (!response.ok) {
+      throw new Error(`Download failed with status ${response.status}`);
+    }
+    return new AdmZip(Buffer.from(await response.arrayBuffer()))
       .getEntries()
       .map(
         (entry) => JSON.parse(entry.getData().toString()) as Osv.Vulnerability

packages/osv-offline/package.json

@@ -16,7 +16,6 @@
     "adm-zip": "~0.5.17",
     "debug": "^4.4.3",
     "fs-extra": "^11.3.5",
-    "got": "^15.0.5",
     "luxon": "^3.7.2"
   },
   "devDependencies": {

packages/osv-offline/src/lib/download.ts

@@ -1,5 +1,4 @@
 import fs from 'fs-extra';
-import got from 'got';
 import { pipeline } from 'node:stream/promises';
 import { OsvOfflineDb } from '@renovatebot/osv-offline-db';
 import path from 'path';
@@ -8,9 +7,13 @@ import AdmZip from 'adm-zip';
 import { Result, failure, success } from './types.ts';
 import debug from 'debug';
 
+export type Fetcher = typeof globalThis.fetch;
+
 const logger = debug('osv-offline:download');
 
-export async function tryDownloadDb(): Promise<Result> {
+export async function tryDownloadDb(
+  fetcher: Fetcher = globalThis.fetch
+): Promise<Result> {
   await fs.ensureDir(OsvOfflineDb.rootDirectory);
 
   if (process.env.OSV_OFFLINE_DISABLE_DOWNLOAD?.toLowerCase() === 'true') {
@@ -41,10 +44,14 @@ export async function tryDownloadDb(): Promise<Result> {
     const databaseUrl =
       process.env.OSV_OFFLINE_DATABASE_URL ??
       'https://github.com/renovatebot/osv-offline/releases/latest/download/osv-offline.zip';
-    const stream = got.stream(databaseUrl);
+    const response = await fetcher(databaseUrl);
+    if (!response.ok || !response.body) {
+      return failure(
+        new Error(`Download failed with status ${response.status}`)
+      );
+    }
     const zipPath = path.join(OsvOfflineDb.rootDirectory, 'osv-offline.zip');
-    const writeStream = fs.createWriteStream(zipPath);
-    await pipeline(stream, writeStream);
+    await pipeline(response.body, fs.createWriteStream(zipPath));
     logger('Downloading databases done.');
     logger('Extracting databases ...');
     const zip = new AdmZip(zipPath);

packages/osv-offline/src/lib/download.unit.spec.ts

@@ -4,16 +4,6 @@ import path from 'path';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { tryDownloadDb } from './download.ts';
 
-const mockStream = vi.hoisted(() => vi.fn());
-
-vi.mock('got', () => {
-  const mockGot = { stream: mockStream };
-  return {
-    default: mockGot,
-    got: mockGot,
-  };
-});
-
 describe('packages/osv-offline/src/lib/download.unit', () => {
   describe('tryDownloadDb', () => {
     beforeEach(async () => {
@@ -24,34 +14,43 @@ describe('packages/osv-offline/src/lib/download.unit', () => {
         'osv-offline.zip'
       );
       await fs.rm(zipFilePath, { force: true });
-      vi.clearAllMocks();
     });
 
     it('uses default URL when OSV_OFFLINE_DATABASE_URL is not set', async () => {
-      mockStream.mockImplementationOnce(() => {
-        throw new Error('intentional stream error');
-      });
+      const fetcher = vi
+        .fn()
+        .mockResolvedValue(new Response(null, { status: 500 }));
 
-      const result = await tryDownloadDb();
+      const result = await tryDownloadDb(fetcher);
 
       expect(result.success).toBe(false);
-      expect(mockStream).toHaveBeenCalledWith(
+      expect(fetcher).toHaveBeenCalledWith(
         'https://github.com/renovatebot/osv-offline/releases/latest/download/osv-offline.zip'
       );
     });
 
     it('uses OSV_OFFLINE_DATABASE_URL when set', async () => {
       const customUrl = 'https://example.com/custom-db.zip';
       process.env.OSV_OFFLINE_DATABASE_URL = customUrl;
+      const fetcher = vi
+        .fn()
+        .mockResolvedValue(new Response(null, { status: 500 }));
 
-      mockStream.mockImplementationOnce(() => {
-        throw new Error('intentional stream error');
-      });
+      const result = await tryDownloadDb(fetcher);
 
-      const result = await tryDownloadDb();
+      expect(result.success).toBe(false);
+      expect(fetcher).toHaveBeenCalledWith(customUrl);
+    });
+
+    it('returns failure when response has no body', async () => {
+      const fetcher = vi.fn().mockResolvedValue({
+        ok: true,
+        body: null,
+        status: 200,
+      });
 
+      const result = await tryDownloadDb(fetcher);
       expect(result.success).toBe(false);
-      expect(mockStream).toHaveBeenCalledWith(customUrl);
     });
   });
 });