dependabot-npm_and_yarn 0.101.0 → 0.101.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c9e0c9d6c0b14886296fc65c5fa0a4d69292a0562c8ff5c654fbb676814a3d95
-  data.tar.gz: f91706007b71f7594ebabad31b5196afb988b0197dbc680332a7dddfbba86d88
+  metadata.gz: 1cf6617f329cb9987316bd94cfa8d5015ee5c2385e843f94a6c07195af7c9d81
+  data.tar.gz: 258fa046ee0b0e3435b0a9c16a5bda624c77917ece08d3772701138ebeb6cad9
 SHA512:
-  metadata.gz: c941364a2f9b0fbcbc767e2bac507c2c35c030d81fb17e3e5ce83ae08a4e61821e4d2362a370bd3652bfb0e86212972e49b2d5e159c952b885baf70c56d913ee
-  data.tar.gz: 3ef9c44d8e4dedd0094f69b69e00d0f1ad466aafdb0a1b7ee749655821fb51e4b7e4745e317e35d7c8001dcaed51e125f505d0efcaa1d8182a5c50049827c22e
+  metadata.gz: f889d16cc3e211ac41d5d4fb4154ea084a371bfbe7341fc8b8d4c616a1688d5743615e93d02a8fe27aff8933287d8e5d2b625cf315925cab44aed1567c5b2820
+  data.tar.gz: 734982d233f792584c01832efa2b8379fd30552986fcf879ed2df435681fd4e1b5660c546fca86900ee11166232289698effd34f168fa9a97141689e70e15c38

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -24,36 +24,24 @@ module Dependabot
         end
 
         def latest_version_details_from_registry
-          return nil unless npm_details&.fetch("dist-tags", nil)
+          return unless valid_npm_details?
+          return { version: version_from_dist_tags } if version_from_dist_tags
+          return if specified_dist_tag_requirement?
 
-          dist_tag_version = version_from_dist_tags(npm_details)
-          return { version: dist_tag_version } if dist_tag_version
-          return nil if specified_dist_tag_requirement?
-
-          { version: version_from_versions_array }
+          version = possible_versions.find { |v| !yanked?(v) }
+          { version: version }
         rescue Excon::Error::Socket, Excon::Error::Timeout, RegistryError
           raise if dependency_registry == "registry.npmjs.org"
           # Custom registries can be flaky. We don't want to make that
           # our problem, so we quietly return `nil` here.
         end
 
-        def latest_resolvable_version_with_no_unlock
-          return unless npm_details
-
-          if specified_dist_tag_requirement?
-            return version_from_dist_tags(npm_details)
-          end
+        def latest_version_with_no_unlock
+          return unless valid_npm_details?
+          return version_from_dist_tags if specified_dist_tag_requirement?
 
-          reqs = dependency.requirements.map do |r|
-            NpmAndYarn::Requirement.
-              requirements_array(r.fetch(:requirement))
-          end.compact
-
-          possible_versions.
-            find do |version|
-              reqs.all? { |r| r.any? { |opt| opt.satisfied_by?(version) } } &&
-                !yanked?(version)
-            end
+          in_range_versions = filter_out_of_range_versions(possible_versions)
+          in_range_versions.find { |version| !yanked?(version) }
         rescue Excon::Error::Socket, Excon::Error::Timeout
           raise if dependency_registry == "registry.npmjs.org"
           # Sometimes custom registries are flaky. We don't want to make that
@@ -61,12 +49,7 @@ module Dependabot
         end
 
         def possible_versions
-          npm_details.fetch("versions", {}).
-            reject { |_, details| details["deprecated"] }.
-            keys.map { |v| version_class.new(v) }.
-            reject { |v| v.prerelease? && !related_to_current_pre?(v) }.
-            reject { |v| ignore_reqs.any? { |r| r.satisfied_by?(v) } }.
-            sort.reverse
+          possible_versions_with_details.map(&:first)
         end
 
         def possible_versions_with_details
@@ -83,7 +66,20 @@ module Dependabot
         attr_reader :dependency, :credentials, :dependency_files,
                     :ignored_versions
 
-        def version_from_dist_tags(npm_details)
+        def valid_npm_details?
+          !npm_details&.fetch("dist-tags", nil).nil?
+        end
+
+        def filter_out_of_range_versions(possible_versions)
+          reqs = dependency.requirements.map do |r|
+            NpmAndYarn::Requirement.requirements_array(r.fetch(:requirement))
+          end.compact
+
+          possible_versions.
+            select { |v| reqs.all? { |r| r.any? { |o| o.satisfied_by?(v) } } }
+        end
+
+        def version_from_dist_tags
           dist_tags = npm_details["dist-tags"].keys
 
           # Check if a dist tag was specified as a requirement. If it was, and
@@ -166,10 +162,6 @@ module Dependabot
           end
         end
 
-        def version_from_versions_array
-          possible_versions.find { |version| !yanked?(version) }
-        end
-
         def yanked?(version)
           @yanked ||= {}
           return @yanked[version] if @yanked.key?(version)
@@ -178,20 +170,18 @@ module Dependabot
             begin
               status = Excon.get(
                 dependency_url + "/#{version}",
-                SharedHelpers.excon_defaults.merge(
-                  headers: registry_auth_headers,
-                  idempotent: true
-                )
+                headers: registry_auth_headers,
+                idempotent: true,
+                **SharedHelpers.excon_defaults
               ).status
 
               if status == 404 && dependency_registry != "registry.npmjs.org"
                 # Some registries don't handle escaped package names properly
                 status = Excon.get(
                   dependency_url.gsub("%2F", "/") + "/#{version}",
-                  SharedHelpers.excon_defaults.merge(
-                    headers: registry_auth_headers,
-                    idempotent: true
-                  )
+                  headers: registry_auth_headers,
+                  idempotent: true,
+                  **SharedHelpers.excon_defaults
                 ).status
               end
 
@@ -214,10 +204,9 @@ module Dependabot
             begin
               Excon.get(
                 dependency_url + "/latest",
-                SharedHelpers.excon_defaults.merge(
-                  headers: registry_auth_headers,
-                  idempotent: true
-                )
+                headers: registry_auth_headers,
+                idempotent: true,
+                **SharedHelpers.excon_defaults
               ).status < 400
             rescue Excon::Error::Timeout
               # Give the benefit of the doubt if the registry is playing up
@@ -248,10 +237,9 @@ module Dependabot
         def fetch_npm_response
           response = Excon.get(
             dependency_url,
-            SharedHelpers.excon_defaults.merge(
-              headers: registry_auth_headers,
-              idempotent: true
-            )
+            headers: registry_auth_headers,
+            idempotent: true,
+            **SharedHelpers.excon_defaults
           )
 
           return response unless response.status == 500
@@ -266,11 +254,10 @@ module Dependabot
           username, password = decoded_token.split(":")
           Excon.get(
             dependency_url,
-            SharedHelpers.excon_defaults.merge(
-              user: username,
-              password: password,
-              idempotent: true
-            )
+            user: username,
+            password: password,
+            idempotent: true,
+            **SharedHelpers.excon_defaults
           )
         end
 
@@ -330,26 +317,34 @@ module Dependabot
         end
 
         def registry_finder
-          @registry_finder ||=
-            RegistryFinder.new(
-              dependency: dependency,
-              credentials: credentials,
-              npmrc_file: dependency_files.
-                          find { |f| f.name.end_with?(".npmrc") },
-              yarnrc_file: dependency_files.
-                           find { |f| f.name.end_with?(".yarnrc") }
-            )
+          @registry_finder ||= RegistryFinder.new(
+            dependency: dependency,
+            credentials: credentials,
+            npmrc_file: npmrc_file,
+            yarnrc_file: yarnrc_file
+          )
         end
 
         def ignore_reqs
-          ignored_versions.
-            map { |req| NpmAndYarn::Requirement.new(req.split(",")) }
+          ignored_versions.map { |req| requirement_class.new(req.split(",")) }
         end
 
         def version_class
           NpmAndYarn::Version
         end
 
+        def requirement_class
+          NpmAndYarn::Requirement
+        end
+
+        def npmrc_file
+          dependency_files.find { |f| f.name.end_with?(".npmrc") }
+        end
+
+        def yarnrc_file
+          dependency_files.find { |f| f.name.end_with?(".yarnrc") }
+        end
+
         # TODO: Remove need for me
         def git_dependency?
           GitCommitChecker.new(

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -50,13 +50,15 @@ module Dependabot
           return latest_resolvable_version_with_no_unlock_for_git_dependency
         end
 
-        latest_version_finder.latest_resolvable_version_with_no_unlock
+        latest_version_finder.latest_version_with_no_unlock
       end
 
       def updated_requirements
         resolvable_version =
-          if [version_class, NilClass].include?(preferred_resolvable_version)
-            preferred_resolvable_version&.to_s
+          if preferred_resolvable_version.is_a?(version_class)
+            preferred_resolvable_version.to_s
+          elsif preferred_resolvable_version.nil?
+            nil
           else
             # If the preferred_resolvable_version came back as anything other
             # than a version class or `nil` it must be because this is a git

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.101.0
+  version: 0.101.1
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.101.0
+        version: 0.101.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.101.0
+        version: 0.101.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement