dependabot-npm_and_yarn 0.112.10 → 0.112.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b13d2c459caace1e2df9528e94bb409f7d6cbee7e3c1b70499578ba5c5a3a9fb
-  data.tar.gz: 666653f1a8ba1042b1c52a0cf4279c5e8f359fbf12b88c88cd4e44a40a9969ff
+  metadata.gz: ba5afd2ba5fd74b6edcff1c4fb4547d90c8de492bd33d6413b24332572aefcbf
+  data.tar.gz: 5c3d6a10b641cdc7a4a7ee9f96567e36ee4010c05d94bc0131141bab62d2365a
 SHA512:
-  metadata.gz: 2a4b52a15f487122385341c0b917c1167b33d35c3feb2f446941c74e3b431f2bd05543e6bd1402782e6b6ceb6b2be2cbdd79254d62b43ef6b22e8bc8c66a77ec
-  data.tar.gz: 0e5632f65d3249f86acc0d4c00fda5f0c32595bbc4dfd2c3ffe3b238e2deaa2c3f93c1e08be552b822576ca02bb4b8c5411116db7b169151dd187f60d2dfaa56
+  metadata.gz: d4264491e936d9726b4e8507ca2dcea6a4d9f23f9359653901388c5f273f4c1abad1a1bd97f4fdd0e422bfa736c42437a131488262e3f3acc77e0743ed690aa0
+  data.tar.gz: a4fcdb71691d0a58a4de4929536ddfce680474547a7921159bf8847b7625a3c42738671e53beae3cefc77b9189d8b9ac327e616a699a121b07012acab177fac4

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -103,6 +103,13 @@ module Dependabot
         return if ignore_requirement?(requirement)
         return if workspace_package_names.include?(name)
 
+        # TODO: Handle aliased packages:
+        # https://github.com/dependabot/dependabot-core/pull/1115
+        #
+        # Ignore dependencies with an alias in the name (only supported by Yarn)
+        # Example: "my-fetch-factory@npm:fetch-factory"
+        return if aliased_package_name?(name)
+
         Dependency.new(
           name: name,
           version: version,
@@ -124,7 +131,8 @@ module Dependabot
         return true if local_path?(requirement)
         return true if non_git_url?(requirement)
 
-        # TODO: Handle aliased packages
+        # TODO: Handle aliased packages:
+        # https://github.com/dependabot/dependabot-core/pull/1115
         alias_package?(requirement)
       end
 
@@ -150,6 +158,10 @@ module Dependabot
         !requirement.match(GIT_URL_REGEX).named_captures.fetch("semver").nil?
       end
 
+      def aliased_package_name?(name)
+        name.include?("@npm:")
+      end
+
       def workspace_package_names
         @workspace_package_names ||=
           package_files.map { |f| JSON.parse(f.content)["name"] }.compact

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.112.10
+  version: 0.112.11
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.10
+        version: 0.112.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.10
+        version: 0.112.11
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement