fix: preserve YAML inline comments when updating deps

🐛 **Critical Fix:** YAML comments are now preserved during dependency updates

**Problem:**
When updating dependencies in YAML files, inline comments were being stripped:
- Before: \`node: ^22.12.0 # only temporarily needed until bun & vue-tsc issue is resolved\`
- After: \`node: ^22.17.1\` ❌ (comment lost)

**Root Cause:**
The regex pattern \`([^\\n\\r]*)\` captured everything after the colon, including
comments, then replaced the entire match with just the version number.

**Solution:**
Enhanced regex to capture three distinct parts:
1. \`(\\s*\\bpackage\\b\\s*:\\s*)\` - package name and colon
2. \`([^\\s#\\n\\r]+)\` - version part only (stops at whitespace or #)
3. \`(\\s*#.*)?\` - optional comment part

Replacement now preserves: \`package + colon + new version + original comment\`

**Regex Changes:**
- Old: \`package: version-and-comment-together\` → \`package: new-version\` ❌
- New: \`package: version # comment\` → \`package: new-version # comment\` ✅

**Test Coverage:**
- ✅ Single dependency with comment preservation
- ✅ Multiple dependencies with mixed comments
- ✅ Dependencies without comments (no change)
- ✅ Full-line comments remain untouched
- ✅ All existing constraint preservation tests still pass

**Real-world Impact:**
✅ \`node: ^22.12.0 # only temporarily needed until bun & vue-tsc issue is resolved\`
✅ Updates to: \`node: ^22.17.1 # only temporarily needed until bun & vue-tsc issue is resolved\`

No more losing valuable context information in dependency files

Author: chrisbbreuer

src/utils/dependency-file-parser.ts

@@ -142,17 +142,26 @@ export async function updateDependencyFile(filePath: string, content: string, up
       // Create regex to find the package line and update its version
       // Handle various YAML formats: "package: version", "package:version", "  package: ^version"
       // Use word boundaries to prevent partial matches (e.g., "zip" matching "unzip")
+      // Capture: (1) package name and colon, (2) version part, (3) optional comment part
       const packageRegex = new RegExp(
-        `(\\s*\\b${cleanPackageName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b\\s*:\\s*)([^\\n\\r]*)`,
+        `(\\s*\\b${cleanPackageName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b\\s*:\\s*)([^\\s#\\n\\r]+)(\\s*#.*)?`,
         'g',
       )
 
       // Extract the original version prefix (^, ~, >=, etc.) or lack thereof
       const currentMatch = updatedContent.match(packageRegex)
       if (currentMatch) {
-        const currentVersionMatch = currentMatch[0].match(/:[ \t]*([^\\nr]+)/)
-        if (currentVersionMatch) {
-          const currentVersionInFile = currentVersionMatch[1].trim()
+        const fullMatch = currentMatch[0]
+        // Parse the match into parts: package+colon, version, comment
+        const matchParts = fullMatch.match(new RegExp(
+          `(\\s*\\b${cleanPackageName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b\\s*:\\s*)([^\\s#\\n\\r]+)(\\s*#.*)?`,
+        ))
+
+        if (matchParts) {
+          const packageAndColon = matchParts[1] // "  package: "
+          const currentVersionInFile = matchParts[2] // "^1.0.0"
+          const commentPart = matchParts[3] || '' // " # comment" or empty
+
           const versionPrefixMatch = currentVersionInFile.match(/^(\D*)/)
           const originalPrefix = versionPrefixMatch ? versionPrefixMatch[1] : ''
 
@@ -162,7 +171,9 @@ export async function updateDependencyFile(filePath: string, content: string, up
           // Use newVersion as-is if it already has a prefix, otherwise preserve original prefix
           const finalVersion = newVersionHasPrefix ? update.newVersion : `${originalPrefix}${update.newVersion}`
 
-          updatedContent = updatedContent.replace(packageRegex, `$1${finalVersion}`)
+          // Replace with: package+colon + new version + preserved comment
+          const replacement = `${packageAndColon}${finalVersion}${commentPart}`
+          updatedContent = updatedContent.replace(packageRegex, replacement)
         }
       }
     }

test/regression-deps-constraint.test.ts

@@ -191,4 +191,110 @@ dependencies:
       expect(result).toContain('"@types/node-fetch": ^2.0.0')
     })
   })
+
+  describe('YAML comment preservation', () => {
+    it('should preserve inline comments when updating dependencies', async () => {
+      const content = `dependencies:
+  aws/cli: ^2.22.26
+  bun: ^1.2.19
+  gh: ^2.76.1
+  zip: ^3.0
+  unzip: ^6.0
+  sqlite3: ^3.50.3
+  node: ^22.12.0 # only temporarily needed until bun & vue-tsc issue is resolved`
+
+      const updates: PackageUpdate[] = [
+        {
+          name: 'node',
+          currentVersion: '^22.12.0',
+          newVersion: '22.17.1',
+          updateType: 'minor',
+          dependencyType: 'dependencies',
+          file: 'deps.yaml',
+          metadata: undefined,
+        },
+      ]
+
+      const result = await updateDependencyFile('deps.yaml', content, updates)
+
+      // Should update the version but preserve the comment
+      expect(result).toContain('node: ^22.17.1 # only temporarily needed until bun & vue-tsc issue is resolved')
+      expect(result).not.toContain('node: ^22.12.0') // Old version should be gone
+      expect(result).not.toContain('node: ^22.17.1\n') // Should not strip the comment
+    })
+
+    it('should preserve comments for multiple dependencies with comments', async () => {
+      const content = `dependencies:
+  aws/cli: ^2.22.26 # AWS command line interface
+  bun: ^1.2.19 # JavaScript runtime
+  node: ^22.12.0 # only temporarily needed until bun & vue-tsc issue is resolved
+  # redis: ^7.4.1 # disabled for now
+  sqlite3: ^3.50.3 # database engine`
+
+      const updates: PackageUpdate[] = [
+        {
+          name: 'aws/cli',
+          currentVersion: '^2.22.26',
+          newVersion: '2.27.60',
+          updateType: 'minor',
+          dependencyType: 'dependencies',
+          file: 'deps.yaml',
+          metadata: undefined,
+        },
+        {
+          name: 'node',
+          currentVersion: '^22.12.0',
+          newVersion: '22.17.1',
+          updateType: 'minor',
+          dependencyType: 'dependencies',
+          file: 'deps.yaml',
+          metadata: undefined,
+        },
+      ]
+
+      const result = await updateDependencyFile('deps.yaml', content, updates)
+
+      // Should update versions but preserve all comments
+      expect(result).toContain('aws/cli: ^2.27.60 # AWS command line interface')
+      expect(result).toContain('bun: ^1.2.19 # JavaScript runtime')
+      expect(result).toContain('node: ^22.17.1 # only temporarily needed until bun & vue-tsc issue is resolved')
+      expect(result).toContain('# redis: ^7.4.1 # disabled for now') // Full-line comments should remain
+      expect(result).toContain('sqlite3: ^3.50.3 # database engine')
+    })
+
+    it('should handle dependencies without comments alongside ones with comments', async () => {
+      const content = `dependencies:
+  zip: ^3.0
+  unzip: ^6.0 # extraction utility
+  sqlite3: ^3.50.3`
+
+      const updates: PackageUpdate[] = [
+        {
+          name: 'zip',
+          currentVersion: '^3.0',
+          newVersion: '3.0.0',
+          updateType: 'patch',
+          dependencyType: 'dependencies',
+          file: 'deps.yaml',
+          metadata: undefined,
+        },
+        {
+          name: 'unzip',
+          currentVersion: '^6.0',
+          newVersion: '6.0.0',
+          updateType: 'patch',
+          dependencyType: 'dependencies',
+          file: 'deps.yaml',
+          metadata: undefined,
+        },
+      ]
+
+      const result = await updateDependencyFile('deps.yaml', content, updates)
+
+      // Should update both, preserving comment only where it exists
+      expect(result).toContain('zip: ^3.0.0')
+      expect(result).toContain('unzip: ^6.0.0 # extraction utility')
+      expect(result).toContain('sqlite3: ^3.50.3')
+    })
+  })
 })