dependabot-npm_and_yarn 0.101.1 → 0.101.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1cf6617f329cb9987316bd94cfa8d5015ee5c2385e843f94a6c07195af7c9d81
-  data.tar.gz: 258fa046ee0b0e3435b0a9c16a5bda624c77917ece08d3772701138ebeb6cad9
+  metadata.gz: f1a5c4f55d424ecda702c33195e05fc6c90185bb195b35db644b08423839b848
+  data.tar.gz: bdce9e00488a04b7281c757aa304800ce9072c06a98d4908156a794b0e4fff95
 SHA512:
-  metadata.gz: f889d16cc3e211ac41d5d4fb4154ea084a371bfbe7341fc8b8d4c616a1688d5743615e93d02a8fe27aff8933287d8e5d2b625cf315925cab44aed1567c5b2820
-  data.tar.gz: 734982d233f792584c01832efa2b8379fd30552986fcf879ed2df435681fd4e1b5660c546fca86900ee11166232289698effd34f168fa9a97141689e70e15c38
+  metadata.gz: ce2976feca5e45c4d6efe3571b2b1a8fd98ed5f43187f4872d2ab524a784a44934b3740868af80fdd6b94b15c4b420445138d29c8825c36f6840ba484643d374
+  data.tar.gz: bf20c7ba5a9743796f3afd1403bed3f345121586fceb7874172c9574cc56a3eb0fbd66182e4f21716da3ccfd1d0af9fcbb147ed33f27852e3bfebf0a88ca242b

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -151,7 +151,7 @@ module Dependabot
             # If there's been a release that includes the current pinned ref
             # or that the current branch is behind, we switch to that release.
             if git_branch_or_ref_in_latest_release?
-              latest_release.fetch(:version)
+              latest_released_version
             elsif version_class.correct?(dependency.version)
               latest_git_version_details[:version] &&
                 version_class.new(latest_git_version_details[:version])
@@ -161,9 +161,9 @@ module Dependabot
           end
       end
 
-      def latest_release
-        @latest_release ||=
-          latest_version_finder.latest_version_details_from_registry
+      def latest_released_version
+        @latest_released_version ||=
+          latest_version_finder.latest_version_from_registry
       end
 
       def should_switch_source_from_git_to_registry?
@@ -175,16 +175,14 @@ module Dependabot
       end
 
       def git_branch_or_ref_in_latest_release?
-        return false unless latest_release
+        return false unless latest_released_version
 
         if defined?(@git_branch_or_ref_in_latest_release)
           return @git_branch_or_ref_in_latest_release
         end
 
         @git_branch_or_ref_in_latest_release ||=
-          git_commit_checker.branch_or_ref_in_release?(
-            latest_release.fetch(:version)
-          )
+          git_commit_checker.branch_or_ref_in_release?(latest_released_version)
       end
 
       def latest_version_details
@@ -192,7 +190,7 @@ module Dependabot
           if git_dependency? && !should_switch_source_from_git_to_registry?
             latest_git_version_details
           else
-            latest_version_finder.latest_version_details_from_registry
+            { version: latest_released_version }
           end
       end
 
@@ -202,7 +200,8 @@ module Dependabot
             dependency: dependency,
             credentials: credentials,
             dependency_files: dependency_files,
-            ignored_versions: ignored_versions
+            ignored_versions: ignored_versions,
+            security_advisories: security_advisories
           )
       end
 

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -16,20 +16,20 @@ module Dependabot
         class RegistryError < StandardError; end
 
         def initialize(dependency:, credentials:, dependency_files:,
-                       ignored_versions:)
-          @dependency       = dependency
-          @credentials      = credentials
-          @dependency_files = dependency_files
-          @ignored_versions = ignored_versions
+                       ignored_versions:, security_advisories:)
+          @dependency          = dependency
+          @credentials         = credentials
+          @dependency_files    = dependency_files
+          @ignored_versions    = ignored_versions
+          @security_advisories = security_advisories
         end
 
-        def latest_version_details_from_registry
+        def latest_version_from_registry
           return unless valid_npm_details?
-          return { version: version_from_dist_tags } if version_from_dist_tags
+          return version_from_dist_tags if version_from_dist_tags
           return if specified_dist_tag_requirement?
 
-          version = possible_versions.find { |v| !yanked?(v) }
-          { version: version }
+          possible_versions.find { |v| !yanked?(v) }
         rescue Excon::Error::Socket, Excon::Error::Timeout, RegistryError
           raise if dependency_registry == "registry.npmjs.org"
           # Custom registries can be flaky. We don't want to make that
@@ -48,10 +48,6 @@ module Dependabot
           # our problem, so we quietly return `nil` here.
         end
 
-        def possible_versions
-          possible_versions_with_details.map(&:first)
-        end
-
         def possible_versions_with_details
           npm_details.fetch("versions", {}).
             reject { |_, details| details["deprecated"] }.
@@ -61,10 +57,14 @@ module Dependabot
             sort_by(&:first).reverse
         end
 
+        def possible_versions
+          possible_versions_with_details.map(&:first)
+        end
+
         private
 
         attr_reader :dependency, :credentials, :dependency_files,
-                    :ignored_versions
+                    :ignored_versions, :security_advisories
 
         def valid_npm_details?
           !npm_details&.fetch("dist-tags", nil).nil?

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -110,7 +110,8 @@ module Dependabot
               dependency: dep,
               credentials: credentials,
               dependency_files: dependency_files,
-              ignored_versions: []
+              ignored_versions: [],
+              security_advisories: []
             )
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.101.1
+  version: 0.101.2
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.101.1
+        version: 0.101.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.101.1
+        version: 0.101.2
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement