dependabot-npm_and_yarn 0.113.4 → 0.113.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8a9017a5f237612771fdf551da5eaed55fa1d4838b4eabf9d4cfcc756d5cd6cf
-  data.tar.gz: e2b2d8751f6afd28fb5c2f81a21db5f2e51d587b0c01de9940858c953b72cdf8
+  metadata.gz: ac64e12d04bba47b1118d8c6f43a665ee77e52385a9f73a398f15924e867d592
+  data.tar.gz: f44b85c4b264d0d97c77ca4fce7aa10acd2c077ec298ab8d9ef675ac267d2f3b
 SHA512:
-  metadata.gz: e3c82abdf1efa61e7f4841b2a9e8eea221852d376cce2ab4eee146645b700a349a52bc8d6a20335cfbb3b6debe12cb0410cc9a8cb572145dab7c20c9005f3c6e
-  data.tar.gz: dd25f70d2771bbd0f9812a2a4171efbe63a8ba8f84bf1d3176d51a3221d7ba3b0163209b362912bca18929f29ec8cc2c357403b79511d03821908467629a3133
+  metadata.gz: bdef2d9798b06557a94fc99ab8ff351bb132f246876d78c6b6667d58477144b52513e23ca185ffc2cff0d7d2e5facbad0f6e6e8777db26fc7a16a08219b4ab5b
+  data.tar.gz: 6f53c7b6cd7530b659ee6c313866f974ed3ea7d359bca1d4b7e369cce6721dc196195e6c2eeea82346b63a499723d53e2e4d66aa773f4106db8d3670680fef74

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -73,10 +73,11 @@ module Dependabot
           true
         end
 
-        def latest_resolvable_previous_version
-          resolve_latest_previous_version(dependency)
+        def latest_resolvable_previous_version(updated_version)
+          resolve_latest_previous_version(dependency, updated_version)
         end
 
+        # rubocop:disable Metrics/MethodLength
         def dependency_updates_from_full_unlock
           return if git_dependency?(dependency)
           if part_of_tightly_locked_monorepo?
@@ -87,7 +88,9 @@ module Dependabot
           updates = [{
             dependency: dependency,
             version: latest_allowable_version,
-            previous_version: latest_resolvable_previous_version
+            previous_version: latest_resolvable_previous_version(
+              latest_allowable_version
+            )
           }]
           newly_broken_peer_reqs_on_dep.each do |peer_req|
             dep_name = peer_req.fetch(:requiring_dep_name)
@@ -104,11 +107,14 @@ module Dependabot
             updates << {
               dependency: dep,
               version: updated_version,
-              previous_version: resolve_latest_previous_version(dep)
+              previous_version: resolve_latest_previous_version(
+                dep, updated_version
+              )
             }
           end
           updates.uniq
         end
+        # rubocop:enable Metrics/MethodLength
 
         private
 
@@ -126,7 +132,7 @@ module Dependabot
             )
         end
 
-        def resolve_latest_previous_version(dep)
+        def resolve_latest_previous_version(dep, updated_version)
           if dep.version && version_class.correct?(dep.version)
             return version_class.new(dep.version)
           end
@@ -143,11 +149,19 @@ module Dependabot
             # requirements. This matches the logic when combining the same
             # dependency in DependencySet from multiple manifest files where we
             # pick the lowest version from the duplicates.
-            reqs.flat_map do |req|
+            latest_previous_version = reqs.flat_map do |req|
               relevant_versions.select do |version|
                 req.any? { |r| r.satisfied_by?(version) }
               end.max
             end.min
+
+            # Handle cases where the latest resolvable previous version is the
+            # latest version. This often happens if you don't have lockfiles and
+            # have requirements update strategy set to bump_versions, where an
+            # update might go from ^1.1.1 to ^1.1.2 (both resolve to 1.1.2).
+            return if updated_version == latest_previous_version
+
+            latest_previous_version
           end
         end
 
@@ -188,7 +202,9 @@ module Dependabot
             updates << {
               dependency: dep,
               version: updated_version,
-              previous_version: resolve_latest_previous_version(dep)
+              previous_version: resolve_latest_previous_version(
+                dep, updated_version
+              )
             }
           end
 

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -54,8 +54,8 @@ module Dependabot
         latest_version_finder.latest_version_with_no_unlock
       end
 
-      def latest_resolvable_previous_version
-        version_resolver.latest_resolvable_previous_version
+      def latest_resolvable_previous_version(updated_version)
+        version_resolver.latest_resolvable_previous_version(updated_version)
       end
 
       def updated_requirements

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.113.4
+  version: 0.113.5
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-09-27 00:00:00.000000000 Z
+date: 2019-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.113.4
+        version: 0.113.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.113.4
+        version: 0.113.5
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement