dependabot-npm_and_yarn 0.117.10 → 0.117.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a2140aba254b93bc17f56ff914f1143600d0421714ff620e617c096e5316dd3
-  data.tar.gz: cb22bb075e6659dc2cfb4a83a133fd1285df36660984a7957fc3f34286f21bac
+  metadata.gz: ced95874055ca68e09ae76a51de53356493a6f58e94a964f45550e78126e71a5
+  data.tar.gz: 747342cd54ef2beab3b71936c32f66032465a730d870ba2b1528dd90f9be7dc1
 SHA512:
-  metadata.gz: 24206d1994c3283b99c3e27c24b10931e6751bd9b3d9b384eea83cb42f3107ef78238a232e794fc601ee46a2a98d7cbe323b6f88514051ca06c6ae4ad9d5f711
-  data.tar.gz: ebed279d7e651c390125528b6a317608e404971c80f07ac3701a05f6bb5859593bab327e11487be3e9c9a068189238ed9f623c5fc8da931011db77933a9be826
+  metadata.gz: 8577265d2d2b2299efc3bc1ff7e0435a25f2f63bcb63fcee7aac76fd8f1e5ad756c19d56f12c0ba01674db02943c0a62c4af19416bb463ada3783ebc8fe90fbc
+  data.tar.gz: d2458523a01725c0950ff0e4ab419c1a351c0d9b2e6110ff5f0d38f576d88ab9880cab636fa3059aec8bfe73aba0becc366cef3ce42857bb532c58c6693edbf0

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -205,6 +205,7 @@ module Dependabot
             credentials: credentials,
             dependency_files: dependency_files,
             ignored_versions: ignored_versions,
+            raise_on_ignored: raise_on_ignored,
             security_advisories: security_advisories
           )
       end
@@ -306,7 +307,9 @@ module Dependabot
         @git_commit_checker ||=
           GitCommitChecker.new(
             dependency: dependency,
-            credentials: credentials
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            raise_on_ignored: raise_on_ignored
           )
       end
     end

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -21,11 +21,13 @@ module Dependabot
         end
 
         def initialize(dependency:, credentials:, dependency_files:,
-                       ignored_versions:, security_advisories:)
+                       ignored_versions:, security_advisories:,
+                       raise_on_ignored: false)
           @dependency          = dependency
           @credentials         = credentials
           @dependency_files    = dependency_files
           @ignored_versions    = ignored_versions
+          @raise_on_ignored    = raise_on_ignored
           @security_advisories = security_advisories
         end
 
@@ -59,10 +61,11 @@ module Dependabot
           versions_array =
             if specified_dist_tag_requirement?
               [version_from_dist_tags].compact
-            else possible_versions
+            else possible_versions(filter_ignored: false)
             end
 
           secure_versions = filter_vulnerable_versions(versions_array)
+          secure_versions = filter_ignored_versions(secure_versions)
           secure_versions = filter_lower_versions(secure_versions)
           secure_versions.reverse.find { |version| !yanked?(version) }
         rescue Excon::Error::Socket, Excon::Error::Timeout
@@ -80,14 +83,18 @@ module Dependabot
           end
         end
 
-        def possible_versions_with_details
-          possible_previous_versions_with_details.
-            reject { |_, details| details["deprecated"] }.
-            reject { |v, _| ignore_reqs.any? { |r| r.satisfied_by?(v) } }
+        def possible_versions_with_details(filter_ignored: true)
+          versions = possible_previous_versions_with_details.
+                     reject { |_, details| details["deprecated"] }
+
+          return filter_ignored_versions(versions) if filter_ignored
+
+          versions
         end
 
-        def possible_versions
-          possible_versions_with_details.map(&:first)
+        def possible_versions(filter_ignored: true)
+          possible_versions_with_details(filter_ignored: filter_ignored).
+            map(&:first)
         end
 
         private
@@ -99,6 +106,18 @@ module Dependabot
           !npm_details&.fetch("dist-tags", nil).nil?
         end
 
+        def filter_ignored_versions(versions_array)
+          filtered = versions_array.reject do |v, _|
+            ignore_reqs.any? { |r| r.satisfied_by?(v) }
+          end
+
+          if @raise_on_ignored && filtered.empty? && versions_array.any?
+            raise AllVersionsIgnored
+          end
+
+          filtered
+        end
+
         def filter_out_of_range_versions(versions_array)
           reqs = dependency.requirements.map do |r|
             NpmAndYarn::Requirement.requirements_array(r.fetch(:requirement))
@@ -397,6 +416,7 @@ module Dependabot
 
         # TODO: Remove need for me
         def git_dependency?
+          # ignored_version/raise_on_ignored are irrelevant.
           GitCommitChecker.new(
             dependency: dependency,
             credentials: credentials

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -364,6 +364,7 @@ module Dependabot
         end
 
         def git_dependency?(dep)
+          # ignored_version/raise_on_ignored are irrelevant.
           GitCommitChecker.
             new(dependency: dep, credentials: credentials).
             git_dependency?

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.117.10
+  version: 0.117.11
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-05-21 00:00:00.000000000 Z
+date: 2020-05-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.117.10
+        version: 0.117.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.117.10
+        version: 0.117.11
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement