Fix packageManager write crash and harden dist-tag check

- getSection() now validates source field is an object before using `in`
  operator, fixing "Cannot use 'in' operator" crash when writing
  packageManager updates (string field, not object)
- Dist-tag check in resolve-dependency guards against non-object distTags
- Adversarial tests for non-object source fields (string, number, bool,
  null, array)
- Regression test for packageManager write flow

Author: vcode-sh

CHANGELOG.md

@@ -2,11 +2,12 @@
 
 Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Semver because I'm not a psychopath.
 
-## [1.1.1] - 2026-03-31
+## [1.1.2] - 2026-03-31
 
 ### Fixed
 
 - **Dist-tag versions no longer cause false resolution errors** -- dependencies using dist-tags as their version (e.g., `npm:@fumadocs/base-ui@latest`, `next`, `canary`) are now correctly skipped instead of failing with "Failed to resolve from registry". Dist-tags resolve dynamically at install time, so there is nothing to update.
+- **`packageManager` write no longer crashes with `Cannot use 'in' operator`** -- the `packageManager` field is a string (e.g., `bun@1.3.10`), not an object. The write loop now guards against non-object source fields instead of blindly using the `in` operator on them.
 
 ## [1.1.0] - 2026-03-29
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "depfresh",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Keep your npm dependencies fresh. Fast, correct, zero-config.",
   "type": "module",
   "license": "MIT",

src/io/resolve/resolve-dependency.ts

@@ -103,7 +103,11 @@ export async function resolveDependency(
   }
 
   // Skip dist-tag versions (e.g., "latest", "next") — they resolve dynamically at install time
-  if (currentVersion in pkgData.distTags) {
+  if (
+    pkgData.distTags &&
+    typeof pkgData.distTags === 'object' &&
+    currentVersion in pkgData.distTags
+  ) {
     logger.debug(`Skipping ${dep.name}: version "${currentVersion}" is a dist-tag`)
     return null
   }

src/io/write/package-json.ts

@@ -82,5 +82,7 @@ function getSection(raw: Record<string, unknown>, source: string): Record<string
     }
     return current as Record<string, string> | null
   }
-  return (raw[source] as Record<string, string>) ?? null
+  const value = raw[source]
+  if (!value || typeof value !== 'object') return null
+  return value as Record<string, string>
 }

src/io/write/write.package-json.adversarial.test.ts

@@ -0,0 +1,251 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import type { PackageMeta, ResolvedDepChange } from '../../types'
+import { writePackage } from './index'
+
+function makeChange(overrides: Partial<ResolvedDepChange> = {}): ResolvedDepChange {
+  return {
+    name: 'test-pkg',
+    currentVersion: '^1.0.0',
+    source: 'dependencies',
+    update: true,
+    parents: [],
+    targetVersion: '^2.0.0',
+    diff: 'major',
+    pkgData: { name: 'test-pkg', versions: ['1.0.0', '2.0.0'], distTags: { latest: '2.0.0' } },
+    ...overrides,
+  }
+}
+
+function makePkg(
+  filepath: string,
+  raw: Record<string, unknown>,
+  overrides: Partial<PackageMeta> = {},
+): PackageMeta {
+  return {
+    name: (raw.name as string) ?? 'test-project',
+    type: 'package.json',
+    filepath,
+    deps: [],
+    resolved: [],
+    raw,
+    indent: '  ',
+    ...overrides,
+  }
+}
+
+describe('writePackage adversarial: non-object source fields', () => {
+  let tmpDir: string
+
+  beforeEach(() => {
+    tmpDir = mkdtempSync(join(tmpdir(), 'depfresh-adv-'))
+  })
+
+  afterEach(() => {
+    rmSync(tmpDir, { recursive: true, force: true })
+  })
+
+  it('does not crash when source field is a string (packageManager)', () => {
+    const filepath = join(tmpDir, 'package.json')
+    const raw = {
+      name: 'test',
+      packageManager: 'bun@1.3.10',
+      dependencies: { foo: '^1.0.0' },
+    }
+    const content = `${JSON.stringify(raw, null, 2)}\n`
+    writeFileSync(filepath, content)
+
+    const pkg = makePkg(filepath, raw, {
+      packageManager: { name: 'bun', version: '1.3.10', raw: 'bun@1.3.10' },
+    })
+
+    expect(() => {
+      writePackage(
+        pkg,
+        [
+          makeChange({
+            name: 'bun',
+            source: 'packageManager' as ResolvedDepChange['source'],
+            currentVersion: '1.3.10',
+            targetVersion: '1.3.11',
+            diff: 'patch',
+          }),
+        ],
+        'silent',
+      )
+    }).not.toThrow()
+
+    const parsed = JSON.parse(readFileSync(filepath, 'utf-8'))
+    expect(parsed.packageManager).toBe('bun@1.3.11')
+  })
+
+  it('does not crash when source field is a number', () => {
+    const filepath = join(tmpDir, 'package.json')
+    const raw = { name: 'test', weirdField: 42, dependencies: { foo: '^1.0.0' } }
+    const content = `${JSON.stringify(raw, null, 2)}\n`
+    writeFileSync(filepath, content)
+
+    const pkg = makePkg(filepath, raw)
+
+    expect(() => {
+      writePackage(
+        pkg,
+        [
+          makeChange({
+            name: 'something',
+            source: 'weirdField' as ResolvedDepChange['source'],
+            targetVersion: '2.0.0',
+          }),
+        ],
+        'silent',
+      )
+    }).not.toThrow()
+  })
+
+  it('does not crash when source field is a boolean', () => {
+    const filepath = join(tmpDir, 'package.json')
+    const raw = { name: 'test', private: true }
+    const content = `${JSON.stringify(raw, null, 2)}\n`
+    writeFileSync(filepath, content)
+
+    const pkg = makePkg(filepath, raw)
+
+    expect(() => {
+      writePackage(
+        pkg,
+        [
+          makeChange({
+            name: 'pkg',
+            source: 'private' as ResolvedDepChange['source'],
+            targetVersion: '1.0.0',
+          }),
+        ],
+        'silent',
+      )
+    }).not.toThrow()
+  })
+
+  it('does not crash when source field is null', () => {
+    const filepath = join(tmpDir, 'package.json')
+    const raw = { name: 'test', nullField: null }
+    const content = `${JSON.stringify(raw, null, 2)}\n`
+    writeFileSync(filepath, content)
+
+    const pkg = makePkg(filepath, raw)
+
+    expect(() => {
+      writePackage(
+        pkg,
+        [
+          makeChange({
+            name: 'pkg',
+            source: 'nullField' as ResolvedDepChange['source'],
+            targetVersion: '1.0.0',
+          }),
+        ],
+        'silent',
+      )
+    }).not.toThrow()
+  })
+
+  it('does not crash when source field is an array', () => {
+    const filepath = join(tmpDir, 'package.json')
+    const raw = { name: 'test', files: ['dist', 'src'] }
+    const content = `${JSON.stringify(raw, null, 2)}\n`
+    writeFileSync(filepath, content)
+
+    const pkg = makePkg(filepath, raw)
+
+    expect(() => {
+      writePackage(
+        pkg,
+        [
+          makeChange({
+            name: 'dist',
+            source: 'files' as ResolvedDepChange['source'],
+            targetVersion: '1.0.0',
+          }),
+        ],
+        'silent',
+      )
+    }).not.toThrow()
+  })
+
+  it('packageManager with hash is preserved through write', () => {
+    const filepath = join(tmpDir, 'package.json')
+    const raw = {
+      name: 'test',
+      packageManager: 'pnpm@9.0.0+sha512.deadbeef',
+    }
+    const content = `${JSON.stringify(raw, null, 2)}\n`
+    writeFileSync(filepath, content)
+
+    const pkg = makePkg(filepath, raw, {
+      packageManager: {
+        name: 'pnpm',
+        version: '9.0.0',
+        hash: 'sha512.deadbeef',
+        raw: 'pnpm@9.0.0+sha512.deadbeef',
+      },
+    })
+
+    writePackage(
+      pkg,
+      [
+        makeChange({
+          name: 'pnpm',
+          source: 'packageManager' as ResolvedDepChange['source'],
+          currentVersion: '9.0.0',
+          targetVersion: '10.0.0',
+          diff: 'major',
+        }),
+      ],
+      'silent',
+    )
+
+    const parsed = JSON.parse(readFileSync(filepath, 'utf-8'))
+    expect(parsed.packageManager).toBe('pnpm@10.0.0+sha512.deadbeef')
+  })
+
+  it('mixed packageManager + dependency changes work together', () => {
+    const filepath = join(tmpDir, 'package.json')
+    const raw = {
+      name: 'test',
+      packageManager: 'bun@1.3.10',
+      dependencies: { lodash: '^4.17.0' },
+    }
+    const content = `${JSON.stringify(raw, null, 2)}\n`
+    writeFileSync(filepath, content)
+
+    const pkg = makePkg(filepath, raw, {
+      packageManager: { name: 'bun', version: '1.3.10', raw: 'bun@1.3.10' },
+    })
+
+    writePackage(
+      pkg,
+      [
+        makeChange({
+          name: 'bun',
+          source: 'packageManager' as ResolvedDepChange['source'],
+          currentVersion: '1.3.10',
+          targetVersion: '1.3.11',
+          diff: 'patch',
+        }),
+        makeChange({
+          name: 'lodash',
+          source: 'dependencies',
+          currentVersion: '^4.17.0',
+          targetVersion: '^4.18.0',
+          diff: 'minor',
+        }),
+      ],
+      'silent',
+    )
+
+    const parsed = JSON.parse(readFileSync(filepath, 'utf-8'))
+    expect(parsed.packageManager).toBe('bun@1.3.11')
+    expect(parsed.dependencies.lodash).toBe('^4.18.0')
+  })
+})

src/io/write/write.package-json.test.ts

@@ -222,6 +222,36 @@ describe('writePackage', () => {
     expect(result).toBe(content)
   })
 
+  it('does not crash when packageManager change goes through source loop', () => {
+    const filepath = join(tmpDir, 'package.json')
+    const raw = {
+      name: 'test',
+      packageManager: 'bun@1.3.10',
+      dependencies: { foo: '^1.0.0' },
+    }
+    const content = `${JSON.stringify(raw, null, 2)}\n`
+    writeFileSync(filepath, content)
+
+    const pkg = makePkg(filepath, raw, {
+      packageManager: { name: 'bun', version: '1.3.10', raw: 'bun@1.3.10' },
+    })
+    const changes = [
+      makeChange({
+        name: 'bun',
+        source: 'packageManager' as ResolvedDepChange['source'],
+        currentVersion: '1.3.10',
+        targetVersion: '1.3.11',
+        diff: 'patch',
+      }),
+    ]
+
+    writePackage(pkg, changes, 'silent')
+
+    const result = readFileSync(filepath, 'utf-8')
+    const parsed = JSON.parse(result)
+    expect(parsed.packageManager).toBe('bun@1.3.11')
+  })
+
   it('handles pnpm.overrides dotted source path', () => {
     const filepath = join(tmpDir, 'package.json')
     const raw = {