dependabot-npm_and_yarn 0.101.2 → 0.102.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f1a5c4f55d424ecda702c33195e05fc6c90185bb195b35db644b08423839b848
-  data.tar.gz: bdce9e00488a04b7281c757aa304800ce9072c06a98d4908156a794b0e4fff95
+  metadata.gz: e065249385d5d40fa7a235a1f3eae13f38cc1e3f4da10599f195b4701cdc5421
+  data.tar.gz: 8e02e117d6956a77d0ee4af6f7468ea40638d3a4889cd82d84e5b2151b57b003
 SHA512:
-  metadata.gz: ce2976feca5e45c4d6efe3571b2b1a8fd98ed5f43187f4872d2ab524a784a44934b3740868af80fdd6b94b15c4b420445138d29c8825c36f6840ba484643d374
-  data.tar.gz: bf20c7ba5a9743796f3afd1403bed3f345121586fceb7874172c9574cc56a3eb0fbd66182e4f21716da3ccfd1d0af9fcbb147ed33f27852e3bfebf0a88ca242b
+  metadata.gz: 7d4c25c44cc1b8e03508f635a9c74cc91930191214f42782786110b2fabc832a1c8199381eddb5832898783c770e31c31c6b210498de24a079f0c6f4b95708ee
+  data.tar.gz: 6e9205e22f72554828eb6c86d9ac9020c0189caed145f19abf7be4f434c6052d8512b4acab5daa247f9a2f56b06f81c4ccd8324e0688bc24d5b1ec79731cbaff

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -39,8 +39,8 @@ module Dependabot
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
 
-        # TODO: Implement this properly!
-        latest_resolvable_version
+        # TODO: Might want to check resolvability here?
+        latest_version_finder.lowest_security_fix_version
       end
 
       def latest_resolvable_version_with_no_unlock
@@ -70,8 +70,6 @@ module Dependabot
           RequirementsUpdater.new(
             requirements: dependency.requirements,
             updated_source: updated_source,
-            latest_version:
-              latest_version_details&.fetch(:version, nil)&.to_s,
             latest_resolvable_version: resolvable_version,
             update_strategy: requirements_update_strategy
           ).updated_requirements
@@ -112,7 +110,6 @@ module Dependabot
           requirements: RequirementsUpdater.new(
             requirements: original_dep.requirements,
             updated_source: original_dep == dependency ? updated_source : nil,
-            latest_version: update_details[:version].to_s,
             latest_resolvable_version: update_details[:version].to_s,
             update_strategy: requirements_update_strategy
           ).updated_requirements,

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -48,6 +48,24 @@ module Dependabot
           # our problem, so we quietly return `nil` here.
         end
 
+        def lowest_security_fix_version
+          return unless valid_npm_details?
+
+          versions_array =
+            if specified_dist_tag_requirement?
+              [version_from_dist_tags].compact
+            else possible_versions
+            end
+
+          secure_versions = filter_vulnerable_versions(versions_array)
+          secure_versions = filter_lower_versions(secure_versions)
+          secure_versions.reverse.find { |version| !yanked?(version) }
+        rescue Excon::Error::Socket, Excon::Error::Timeout
+          raise if dependency_registry == "registry.npmjs.org"
+          # Sometimes custom registries are flaky. We don't want to make that
+          # our problem, so we quietly return `nil` here.
+        end
+
         def possible_versions_with_details
           npm_details.fetch("versions", {}).
             reject { |_, details| details["deprecated"] }.
@@ -70,15 +88,32 @@ module Dependabot
           !npm_details&.fetch("dist-tags", nil).nil?
         end
 
-        def filter_out_of_range_versions(possible_versions)
+        def filter_out_of_range_versions(versions_array)
           reqs = dependency.requirements.map do |r|
             NpmAndYarn::Requirement.requirements_array(r.fetch(:requirement))
           end.compact
 
-          possible_versions.
+          versions_array.
             select { |v| reqs.all? { |r| r.any? { |o| o.satisfied_by?(v) } } }
         end
 
+        def filter_vulnerable_versions(versions_array)
+          updated_versions_array = versions_array
+
+          security_advisories.each do |advisory|
+            updated_versions_array =
+              updated_versions_array.
+              reject { |v| advisory.vulnerable?(v) }
+          end
+
+          updated_versions_array
+        end
+
+        def filter_lower_versions(versions_array)
+          versions_array.
+            select { |version| version > version_class.new(dependency.version) }
+        end
+
         def version_from_dist_tags
           dist_tags = npm_details["dist-tags"].keys
 

data/lib/dependabot/npm_and_yarn/update_checker/requirements_updater.rb

@@ -19,14 +19,13 @@ module Dependabot
           %i(widen_ranges bump_versions bump_versions_if_necessary).freeze
 
         def initialize(requirements:, updated_source:, update_strategy:,
-                       latest_version:, latest_resolvable_version:)
+                       latest_resolvable_version:)
           @requirements = requirements
           @updated_source = updated_source
           @update_strategy = update_strategy
 
           check_update_strategy
 
-          @latest_version = version_class.new(latest_version) if latest_version
           return unless latest_resolvable_version
 
           @latest_resolvable_version =
@@ -53,7 +52,7 @@ module Dependabot
         private
 
         attr_reader :requirements, :updated_source, :update_strategy,
-                    :latest_version, :latest_resolvable_version
+                    :latest_resolvable_version
 
         def check_update_strategy
           return if ALLOWED_UPDATE_STRATEGIES.include?(update_strategy)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.101.2
+  version: 0.102.0
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.101.2
+        version: 0.102.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.101.2
+        version: 0.102.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement