dependabot-npm_and_yarn 0.125.1 → 0.125.2

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -13,6 +13,7 @@ module Dependabot
       require_relative "update_checker/latest_version_finder"
       require_relative "update_checker/version_resolver"
       require_relative "update_checker/subdependency_version_resolver"
+      require_relative "update_checker/conflicting_dependency_resolver"
 
       def latest_version
         @latest_version ||=
@@ -93,6 +94,16 @@ module Dependabot
         library? ? :widen_ranges : :bump_versions
       end
 
+      def conflicting_dependencies
+        ConflictingDependencyResolver.new(
+          dependency_files: dependency_files,
+          credentials: credentials
+        ).conflicting_dependencies(
+          dependency: dependency,
+          target_version: lowest_security_fix_version
+        )
+      end
+
       private
 
       def latest_version_resolvable_with_full_unlock?

data/lib/dependabot/npm_and_yarn/update_checker/conflicting_dependency_resolver.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require "dependabot/dependency"
+require "dependabot/errors"
+require "dependabot/npm_and_yarn/file_parser"
+require "dependabot/npm_and_yarn/native_helpers"
+require "dependabot/npm_and_yarn/update_checker"
+require "dependabot/npm_and_yarn/update_checker/dependency_files_builder"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module NpmAndYarn
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
+      class ConflictingDependencyResolver
+        def initialize(dependency_files:, credentials:)
+          @dependency_files = dependency_files
+          @credentials = credentials
+        end
+
+        # Finds any dependencies in the `yarn.lock` or `package-lock.json` that
+        # have a subdependency on the given dependency that does not satisfly
+        # the target_version.
+        #
+        # @param dependency [Dependabot::Dependency] the dependency to check
+        # @param target_version [String] the version to check
+        # @return [Array<Hash{String => String}]
+        #   * name [String] the blocking dependencies name
+        #   * version [String] the version of the blocking dependency
+        #   * requirement [String] the requirement on the target_dependency
+        def conflicting_dependencies(dependency:, target_version:)
+          SharedHelpers.in_a_temporary_directory do
+            dependency_files_builder = DependencyFilesBuilder.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              credentials: credentials
+            )
+            dependency_files_builder.write_temporary_dependency_files
+
+            if dependency_files_builder.yarn_locks.any?
+              SharedHelpers.run_helper_subprocess(
+                command: NativeHelpers.helper_path,
+                function: "yarn:findConflictingDependencies",
+                args: [Dir.pwd, dependency.name, target_version.to_s]
+              )
+            else
+              SharedHelpers.run_helper_subprocess(
+                command: NativeHelpers.helper_path,
+                function: "npm:findConflictingDependencies",
+                args: [Dir.pwd, dependency.name, target_version.to_s]
+              )
+            end
+          end
+        rescue SharedHelpers::HelperSubprocessFailed
+          []
+        end
+
+        private
+
+        attr_reader :dependency_files, :credentials
+      end
+    end
+  end
+end

data/lib/dependabot/npm_and_yarn/update_checker/dependency_files_builder.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+require "dependabot/npm_and_yarn/file_updater/npmrc_builder"
+require "dependabot/npm_and_yarn/file_updater/package_json_preparer"
+
+module Dependabot
+  module NpmAndYarn
+    class UpdateChecker
+      class DependencyFilesBuilder
+        def initialize(dependency:, dependency_files:, credentials:)
+          @dependency = dependency
+          @dependency_files = dependency_files
+          @credentials = credentials
+        end
+
+        def write_temporary_dependency_files
+          write_lock_files
+
+          File.write(".npmrc", npmrc_content)
+
+          package_files.each do |file|
+            path = file.name
+            FileUtils.mkdir_p(Pathname.new(path).dirname)
+            File.write(file.name, prepared_package_json_content(file))
+          end
+        end
+
+        def package_locks
+          @package_locks ||=
+            dependency_files.
+            select { |f| f.name.end_with?("package-lock.json") }
+        end
+
+        def yarn_locks
+          @yarn_locks ||=
+            dependency_files.
+            select { |f| f.name.end_with?("yarn.lock") }
+        end
+
+        def shrinkwraps
+          @shrinkwraps ||=
+            dependency_files.
+            select { |f| f.name.end_with?("npm-shrinkwrap.json") }
+        end
+
+        def lockfiles
+          [*package_locks, *shrinkwraps, *yarn_locks]
+        end
+
+        def package_files
+          @package_files ||=
+            dependency_files.
+            select { |f| f.name.end_with?("package.json") }
+        end
+
+        private
+
+        attr_reader :dependency, :dependency_files, :credentials
+
+        def write_lock_files
+          yarn_locks.each do |f|
+            FileUtils.mkdir_p(Pathname.new(f.name).dirname)
+            File.write(f.name, prepared_yarn_lockfile_content(f.content))
+          end
+
+          [*package_locks, *shrinkwraps].each do |f|
+            FileUtils.mkdir_p(Pathname.new(f.name).dirname)
+            File.write(f.name, f.content)
+          end
+        end
+
+        # Duplicated in NpmLockfileUpdater
+        # Remove the dependency we want to update from the lockfile and let
+        # yarn find the latest resolvable version and fix the lockfile
+        def prepared_yarn_lockfile_content(content)
+          content.gsub(/^#{Regexp.quote(dependency.name)}\@.*?\n\n/m, "")
+        end
+
+        def prepared_package_json_content(file)
+          NpmAndYarn::FileUpdater::PackageJsonPreparer.new(
+            package_json_content: file.content
+          ).prepared_content
+        end
+
+        def npmrc_content
+          NpmAndYarn::FileUpdater::NpmrcBuilder.new(
+            credentials: credentials,
+            dependency_files: dependency_files
+          ).npmrc_content
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -1,15 +1,16 @@
 # frozen_string_literal: true
 
 require "dependabot/dependency"
-require "dependabot/shared_helpers"
 require "dependabot/errors"
-require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/npm_and_yarn/file_parser"
-require "dependabot/npm_and_yarn/version"
-require "dependabot/npm_and_yarn/native_helpers"
 require "dependabot/npm_and_yarn/file_updater/npmrc_builder"
 require "dependabot/npm_and_yarn/file_updater/package_json_preparer"
+require "dependabot/npm_and_yarn/native_helpers"
 require "dependabot/npm_and_yarn/sub_dependency_files_filterer"
+require "dependabot/npm_and_yarn/update_checker"
+require "dependabot/npm_and_yarn/update_checker/dependency_files_builder"
+require "dependabot/npm_and_yarn/version"
+require "dependabot/shared_helpers"
 
 module Dependabot
   module NpmAndYarn
@@ -29,7 +30,7 @@ module Dependabot
           return if bundled_dependency?
 
           SharedHelpers.in_a_temporary_directory do
-            write_temporary_dependency_files
+            dependency_files_builder.write_temporary_dependency_files
 
             updated_lockfiles = filtered_lockfiles.map do |lockfile|
               updated_content = update_subdependency_in_lockfile(lockfile)
@@ -67,9 +68,9 @@ module Dependabot
 
         def version_from_updated_lockfiles(updated_lockfiles)
           updated_files = dependency_files -
-                          yarn_locks -
-                          package_locks -
-                          shrinkwraps +
+                          dependency_files_builder.yarn_locks -
+                          dependency_files_builder.package_locks -
+                          dependency_files_builder.shrinkwraps +
                           updated_lockfiles
 
           updated_version = NpmAndYarn::FileParser.new(
@@ -118,84 +119,10 @@ module Dependabot
           end
         end
 
-        def write_temporary_dependency_files
-          write_lock_files
-
-          File.write(".npmrc", npmrc_content)
-
-          package_files.each do |file|
-            path = file.name
-            FileUtils.mkdir_p(Pathname.new(path).dirname)
-            File.write(file.name, prepared_package_json_content(file))
-          end
-        end
-
-        def write_lock_files
-          yarn_locks.each do |f|
-            FileUtils.mkdir_p(Pathname.new(f.name).dirname)
-            File.write(f.name, prepared_yarn_lockfile_content(f.content))
-          end
-
-          [*package_locks, *shrinkwraps].each do |f|
-            FileUtils.mkdir_p(Pathname.new(f.name).dirname)
-            File.write(f.name, f.content)
-          end
-        end
-
-        # Duplicated in NpmLockfileUpdater
-        # Remove the dependency we want to update from the lockfile and let
-        # yarn find the latest resolvable version and fix the lockfile
-        def prepared_yarn_lockfile_content(content)
-          content.gsub(/^#{Regexp.quote(dependency.name)}\@.*?\n\n/m, "")
-        end
-
-        def prepared_package_json_content(file)
-          NpmAndYarn::FileUpdater::PackageJsonPreparer.new(
-            package_json_content: file.content
-          ).prepared_content
-        end
-
-        def npmrc_content
-          NpmAndYarn::FileUpdater::NpmrcBuilder.new(
-            credentials: credentials,
-            dependency_files: dependency_files
-          ).npmrc_content
-        end
-
         def version_class
           NpmAndYarn::Version
         end
 
-        def package_locks
-          @package_locks ||=
-            dependency_files.
-            select { |f| f.name.end_with?("package-lock.json") }
-        end
-
-        def yarn_locks
-          @yarn_locks ||=
-            dependency_files.
-            select { |f| f.name.end_with?("yarn.lock") }
-        end
-
-        def shrinkwraps
-          @shrinkwraps ||=
-            dependency_files.
-            select { |f| f.name.end_with?("npm-shrinkwrap.json") }
-        end
-
-        def lockfiles
-          [*package_locks, *shrinkwraps, *yarn_locks]
-        end
-
-        def filtered_lockfiles
-          @filtered_lockfiles ||=
-            SubDependencyFilesFilterer.new(
-              dependency_files: dependency_files,
-              updated_dependencies: [updated_dependency]
-            ).files_requiring_update
-        end
-
         def updated_dependency
           Dependabot::Dependency.new(
             name: dependency.name,
@@ -206,10 +133,21 @@ module Dependabot
           )
         end
 
-        def package_files
-          @package_files ||=
-            dependency_files.
-            select { |f| f.name.end_with?("package.json") }
+        def filtered_lockfiles
+          @filtered_lockfiles ||=
+            SubDependencyFilesFilterer.new(
+              dependency_files: dependency_files,
+              updated_dependencies: [updated_dependency]
+            ).files_requiring_update
+        end
+
+        def dependency_files_builder
+          @dependency_files_builder ||=
+            DependencyFilesBuilder.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              credentials: credentials
+            )
         end
 
         # TODO: We should try and fix this by updating the parent that's not

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -230,7 +230,7 @@ module Dependabot
           # here (since problematic repos will be resolved here before they're
           # seen by the FileUpdater)
           SharedHelpers.in_a_temporary_directory do
-            write_temporary_dependency_files
+            dependency_files_builder.write_temporary_dependency_files
 
             filtered_package_files.flat_map do |file|
               path = Pathname.new(file.name).dirname
@@ -385,8 +385,8 @@ module Dependabot
         def run_checker(path:, version:)
           # If there are both yarn lockfiles and npm lockfiles only run the
           # yarn updater, yarn is also used when only a package.json exists
-          if lockfiles_for_path(lockfiles: yarn_locks, path: path).any? ||
-             lockfiles_for_path(lockfiles: lockfiles, path: path).none?
+          if lockfiles_for_path(lockfiles: dependency_files_builder.yarn_locks, path: path).any? ||
+             lockfiles_for_path(lockfiles: dependency_files_builder.lockfiles, path: path).none?
             return run_yarn_checker(path: path, version: version)
           end
 
@@ -438,48 +438,6 @@ module Dependabot
           end.compact
         end
 
-        def write_temporary_dependency_files
-          write_lock_files
-
-          File.write(".npmrc", npmrc_content)
-
-          package_files.each do |file|
-            path = file.name
-            FileUtils.mkdir_p(Pathname.new(path).dirname)
-            File.write(file.name, prepared_package_json_content(file))
-          end
-        end
-
-        def write_lock_files
-          yarn_locks.each do |f|
-            FileUtils.mkdir_p(Pathname.new(f.name).dirname)
-            File.write(f.name, f.content)
-          end
-
-          package_locks.each do |f|
-            FileUtils.mkdir_p(Pathname.new(f.name).dirname)
-            File.write(f.name, f.content)
-          end
-
-          shrinkwraps.each do |f|
-            FileUtils.mkdir_p(Pathname.new(f.name).dirname)
-            File.write(f.name, f.content)
-          end
-        end
-
-        def prepared_package_json_content(file)
-          NpmAndYarn::FileUpdater::PackageJsonPreparer.new(
-            package_json_content: file.content
-          ).prepared_content
-        end
-
-        def npmrc_content
-          NpmAndYarn::FileUpdater::NpmrcBuilder.new(
-            credentials: credentials,
-            dependency_files: dependency_files
-          ).npmrc_content
-        end
-
         # Top level dependencies are required in the peer dep checker
         # to fetch the manifests for all top level deps which may contain
         # "peerDependency" requirements
@@ -491,34 +449,6 @@ module Dependabot
           ).parse.select(&:top_level?)
         end
 
-        def lockfiles
-          [*yarn_locks, *package_locks, *shrinkwraps]
-        end
-
-        def package_locks
-          @package_locks ||=
-            dependency_files.
-            select { |f| f.name.end_with?("package-lock.json") }
-        end
-
-        def yarn_locks
-          @yarn_locks ||=
-            dependency_files.
-            select { |f| f.name.end_with?("yarn.lock") }
-        end
-
-        def shrinkwraps
-          @shrinkwraps ||=
-            dependency_files.
-            select { |f| f.name.end_with?("npm-shrinkwrap.json") }
-        end
-
-        def package_files
-          @package_files ||=
-            dependency_files.
-            select { |f| f.name.end_with?("package.json") }
-        end
-
         def filtered_package_files
           @filtered_package_files ||=
             DependencyFilesFilterer.new(
@@ -527,6 +457,15 @@ module Dependabot
             ).package_files_requiring_update
         end
 
+        def dependency_files_builder
+          @dependency_files_builder ||=
+            DependencyFilesBuilder.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              credentials: credentials
+            )
+        end
+
         def version_for_dependency(dep)
           return version_class.new(dep.version) if dep.version && version_class.correct?(dep.version)