dependabot-core 0.76.7 → 0.76.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 04c93dc65291c48cfa0f238b7e3960dbaba310448f990fb66228c7a99a7e2948
-  data.tar.gz: 97d4d500cb322bbfe6c6697493c30bbbee9ccb47e9b5cdedf4ba027374fd1946
+  metadata.gz: ad3c731aaf6e231e58e492f66c340298ae97adb594ad378bcc872ef060577228
+  data.tar.gz: 37090c354d45763a163bdc30323532ce953d762c5a0af97496359fae180a15b8
 SHA512:
-  metadata.gz: c6c26d333ccb7129755d30da45c1bea0cf185f49b355199a25579a1d997b5bac8a07a24c628172588c2bf2b45df4026e4ab7f170e8f6f8ec51942cb41ba3cee6
-  data.tar.gz: e4152afb64d7bc0eec53a2dcff7e6dc024ea62bee183faff9da48ec015d6ab07a3e10466108be2d973113d809a694fe1f7fbcea985f2fbec63ddc1da02602c88
+  metadata.gz: 9b16a7ee8bb5a809efe74153d7ceded814736f8d0f01579134b8a6284bc7a96bc44f8433dd5181d5778b20ec460c0136f218885097c03b314f514c5523394007
+  data.tar.gz: 17e73ab1ef67a9cc065dd1fcca7e484cefb83b41a54a1e993aba10a8b74e34d6eb76820b2ab47bda550729dcc00adf83ae3dd60fac717448214297fcf9042923

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## v0.76.8, 6 December 2018
+
+- JS: Build relative paths for path dependencies of unfetchable path
+  dependencies
+- JS: Get correct version for path dependencies
+
 ## v0.76.7, 6 December 2018
 
 - No code changes - testing automated releases

data/lib/dependabot/file_fetchers/java_script/npm_and_yarn/path_dependency_builder.rb

@@ -59,10 +59,15 @@ module Dependabot
             if details_from_yarn_lock
               {
                 name: dependency_name,
-                version: "0.0.1",
-                dependencies: details_from_yarn_lock["dependencies"],
+                version: details_from_yarn_lock["version"] || "0.0.1",
+                dependencies:
+                  replace_yarn_lock_file_paths(
+                    details_from_yarn_lock["dependencies"]
+                  ),
                 optionalDependencies:
-                  details_from_yarn_lock["optionalDependencies"]
+                  replace_yarn_lock_file_paths(
+                    details_from_yarn_lock["optionalDependencies"]
+                  )
               }.compact.to_json
             else
               {
@@ -73,6 +78,32 @@ module Dependabot
             end
           end
 
+          # If an unfetchable path dependency itself has path dependencies
+          # then the paths in the yarn.lock for them will be absolute, not
+          # relative. Worse, they may point to the user's local cache.
+          # We work around this by constructing a relative path to the
+          # (second-level) path dependencies.
+          def replace_yarn_lock_file_paths(dependencies_hash)
+            return unless dependencies_hash
+
+            dependencies_hash.each_with_object({}) do |(k, v), obj|
+              obj[k] = v
+              next unless v.start_with?("file:")
+
+              path_from_base =
+                parsed_yarn_lock.to_a.
+                find do |n, _|
+                  next false unless n.split(/(?<=\w)\@/).first == k
+
+                  n.split(/(?<=\w)\@/).last.start_with?("file:")
+                end&.first&.split(/(?<=\w)\@/)&.last&.gsub("file:", "")
+
+              next unless path_from_base
+
+              obj[k] = "file:" + File.join(inverted_path, path_from_base)
+            end
+          end
+
           def parsed_package_lock
             return {} unless package_lock
 
@@ -96,6 +127,16 @@ module Dependabot
               end
           end
 
+          # The path back to the root lockfile
+          def inverted_path
+            path.split("/").map do |part|
+              next part if part == "."
+              next "tmp" if part == ".."
+
+              ".."
+            end.join("/")
+          end
+
           def yarn_helper_path
             project_root = File.join(File.dirname(__FILE__), "../../../../..")
             File.join(project_root, "helpers/yarn/bin/run.js")

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.76.7"
+  VERSION = "0.76.8"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-core
 version: !ruby/object:Gem::Version
-  version: 0.76.7
+  version: 0.76.8
 platform: ruby
 authors:
 - Dependabot