dependabot-npm_and_yarn 0.141.0 → 0.143.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7185b49c47c4662e5905a620fa5a77b953479da0186634dc19dace4ad84e5437
-  data.tar.gz: bcd927c079983451a06359830e5f5d15395aa0d327a61e379abe197e95500cdc
+  metadata.gz: 27e3f75539fb3d7ef8d9e1611c8953882c98c7a6882721b9bb49938da1ae0490
+  data.tar.gz: b3d759d8c36f5b672e8fb5eb118dd9d694576f445a7d26d149e4c18b0774e80d
 SHA512:
-  metadata.gz: 3b02f7c54c5c8a328713e74a83325cf2ca0f6b9a87a8aa14d940d469680358eb684b1da0d0cd62cbb5b791e52a2643f5d5120d4e9792245ca2fae36e88675508
-  data.tar.gz: 02b78ceed412526ffe25a848308b438fa066098fe78866ea77dd2773082a42938dc04b2f2c011852fd271759e96f23a17ef3b5d31780553a65cf40c7ef52e660
+  metadata.gz: 12f0d8551da6ff0a2f5d0b81fa8cd8ae73d57039132aafa974ca2f76d6950a0147883298be9f8a42669f81a2809f14d5e0c58a558e9fe61e8f0eca9da0ad33b3
+  data.tar.gz: 41e0e76bce54c26eac6debbe62e075700406f4bc00005cf094c4746d8d3ea4b8d4e6436d7aa15cc30a15afefadb5c578d61405e79dd9a70d38d9e7949cec0cfc

data/helpers/package-lock.json

@@ -9,7 +9,7 @@
         "@dependabot/yarn-lib": "^1.21.1",
         "@npmcli/arborist": "^2.3.0",
         "detect-indent": "^6.0.0",
-        "npm": "6.14.12",
+        "npm": "6.14.13",
         "semver": "^7.3.4"
       },
       "bin": {
@@ -17,7 +17,7 @@
       },
       "devDependencies": {
         "eslint": "^7.24.0",
-        "eslint-config-prettier": "^8.1.0",
+        "eslint-config-prettier": "^8.2.0",
         "jest": "^26.6.3",
         "prettier": "^2.2.1",
         "rimraf": "^3.0.2"
@@ -3510,9 +3510,9 @@
       }
     },
     "node_modules/eslint-config-prettier": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-8.1.0.tgz",
-      "integrity": "sha512-oKMhGv3ihGbCIimCAjqkdzx2Q+jthoqnXSP+d86M9tptwugycmTFdVR4IpLgq2c4SHifbwO90z2fQ8/Aio73yw==",
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-8.2.0.tgz",
+      "integrity": "sha512-dWV9EVeSo2qodOPi1iBYU/x6F6diHv8uujxbxr77xExs3zTAlNXvVZKiyLsQGNz7yPV2K49JY5WjPzNIuDc2Bw==",
       "dev": true,
       "bin": {
         "eslint-config-prettier": "bin/cli.js"
@@ -8069,9 +8069,9 @@
       }
     },
     "node_modules/npm": {
-      "version": "6.14.12",
-      "resolved": "https://registry.npmjs.org/npm/-/npm-6.14.12.tgz",
-      "integrity": "sha512-La0TNNm1TLYaSeOyit+p3xGTRYYRsHae6/RG69MVXurZsWna9jccPP7FOi/u7V9WdiCV5OOojrfMD+WstO5MZQ==",
+      "version": "6.14.13",
+      "resolved": "https://registry.npmjs.org/npm/-/npm-6.14.13.tgz",
+      "integrity": "sha512-SRl4jJi0EBHY2xKuu98FLRMo3VhYQSA6otyLnjSEiHoSG/9shXCFNJy9tivpUJvtkN9s6VDdItHa5Rn+fNBzag==",
       "bundleDependencies": [
         "abbrev",
         "ansicolors",
@@ -8460,7 +8460,7 @@
         "glob": "^7.1.6",
         "graceful-fs": "^4.2.4",
         "has-unicode": "~2.0.1",
-        "hosted-git-info": "^2.8.8",
+        "hosted-git-info": "^2.8.9",
         "iferr": "^1.0.2",
         "imurmurhash": "*",
         "infer-owner": "^1.0.4",
@@ -8537,7 +8537,7 @@
         "slide": "~1.1.6",
         "sorted-object": "~2.0.1",
         "sorted-union-stream": "~2.1.3",
-        "ssri": "^6.0.1",
+        "ssri": "^6.0.2",
         "stringify-package": "^1.0.1",
         "tar": "^4.4.13",
         "text-table": "~0.2.0",
@@ -9994,7 +9994,7 @@
       "license": "ISC"
     },
     "node_modules/npm/node_modules/hosted-git-info": {
-      "version": "2.8.8",
+      "version": "2.8.9",
       "inBundle": true,
       "license": "ISC"
     },
@@ -11853,7 +11853,7 @@
       }
     },
     "node_modules/npm/node_modules/ssri": {
-      "version": "6.0.1",
+      "version": "6.0.2",
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
@@ -19026,9 +19026,9 @@
       }
     },
     "eslint-config-prettier": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-8.1.0.tgz",
-      "integrity": "sha512-oKMhGv3ihGbCIimCAjqkdzx2Q+jthoqnXSP+d86M9tptwugycmTFdVR4IpLgq2c4SHifbwO90z2fQ8/Aio73yw==",
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-8.2.0.tgz",
+      "integrity": "sha512-dWV9EVeSo2qodOPi1iBYU/x6F6diHv8uujxbxr77xExs3zTAlNXvVZKiyLsQGNz7yPV2K49JY5WjPzNIuDc2Bw==",
       "dev": true,
       "requires": {}
     },
@@ -22425,9 +22425,9 @@
       }
     },
     "npm": {
-      "version": "6.14.12",
-      "resolved": "https://registry.npmjs.org/npm/-/npm-6.14.12.tgz",
-      "integrity": "sha512-La0TNNm1TLYaSeOyit+p3xGTRYYRsHae6/RG69MVXurZsWna9jccPP7FOi/u7V9WdiCV5OOojrfMD+WstO5MZQ==",
+      "version": "6.14.13",
+      "resolved": "https://registry.npmjs.org/npm/-/npm-6.14.13.tgz",
+      "integrity": "sha512-SRl4jJi0EBHY2xKuu98FLRMo3VhYQSA6otyLnjSEiHoSG/9shXCFNJy9tivpUJvtkN9s6VDdItHa5Rn+fNBzag==",
       "requires": {
         "abbrev": "~1.1.1",
         "ansicolors": "~0.3.2",
@@ -22459,7 +22459,7 @@
         "glob": "^7.1.6",
         "graceful-fs": "^4.2.4",
         "has-unicode": "~2.0.1",
-        "hosted-git-info": "^2.8.8",
+        "hosted-git-info": "^2.8.9",
         "iferr": "^1.0.2",
         "imurmurhash": "*",
         "infer-owner": "^1.0.4",
@@ -22536,7 +22536,7 @@
         "slide": "~1.1.6",
         "sorted-object": "~2.0.1",
         "sorted-union-stream": "~2.1.3",
-        "ssri": "^6.0.1",
+        "ssri": "^6.0.2",
         "stringify-package": "^1.0.1",
         "tar": "^4.4.13",
         "text-table": "~0.2.0",
@@ -23576,7 +23576,7 @@
           "bundled": true
         },
         "hosted-git-info": {
-          "version": "2.8.8",
+          "version": "2.8.9",
           "bundled": true
         },
         "http-cache-semantics": {
@@ -24980,7 +24980,7 @@
           }
         },
         "ssri": {
-          "version": "6.0.1",
+          "version": "6.0.2",
           "bundled": true,
           "requires": {
             "figgy-pudding": "^3.5.1"

data/helpers/package.json

@@ -12,12 +12,12 @@
     "@dependabot/yarn-lib": "^1.21.1",
     "@npmcli/arborist": "^2.3.0",
     "detect-indent": "^6.0.0",
-    "npm": "6.14.12",
+    "npm": "6.14.13",
     "semver": "^7.3.4"
   },
   "devDependencies": {
     "eslint": "^7.24.0",
-    "eslint-config-prettier": "^8.1.0",
+    "eslint-config-prettier": "^8.2.0",
     "jest": "^26.6.3",
     "prettier": "^2.2.1",
     "rimraf": "^3.0.2"

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -252,10 +252,9 @@ module Dependabot
 
         return unless resolved_url
         return unless resolved_url.start_with?("http")
-        return if CENTRAL_REGISTRIES.any? { |u| resolved_url.start_with?(u) }
         return if resolved_url.match?(/(?<!pkg\.)github/)
 
-        private_registry_source_for(resolved_url, name)
+        registry_source_for(resolved_url, name)
       end
 
       def requirement_for(requirement)
@@ -287,7 +286,7 @@ module Dependabot
         }
       end
 
-      def private_registry_source_for(resolved_url, name)
+      def registry_source_for(resolved_url, name)
         url =
           if resolved_url.include?("/~/")
             # Gemfury format
@@ -305,7 +304,7 @@ module Dependabot
           else resolved_url.split("/")[0..2].join("/")
           end
 
-        { type: "private_registry", url: url }
+        { type: "registry", url: url }
       end
 
       def url_for_relevant_cred(resolved_url)

data/lib/dependabot/npm_and_yarn/metadata_finder.rb

@@ -39,7 +39,7 @@ module Dependabot
 
         case source_type
         when "git" then find_source_from_git_url
-        when "private_registry" then find_source_from_registry
+        when "registry" then find_source_from_registry
         else raise "Unexpected source type: #{source_type}"
         end
       end

data/lib/dependabot/npm_and_yarn/requirement.rb

@@ -45,9 +45,9 @@ module Dependabot
       end
 
       def initialize(*requirements)
-        requirements = requirements.flatten.flat_map do |req_string|
-          convert_js_constraint_to_ruby_constraint(req_string)
-        end
+        requirements = requirements.flatten.
+                       flat_map { |req_string| req_string.split(",").map(&:strip) }.
+                       flat_map { |req_string| convert_js_constraint_to_ruby_constraint(req_string) }
 
         super(requirements)
       end

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -106,7 +106,7 @@ module Dependabot
 
         def filter_ignored_versions(versions_array)
           filtered = versions_array.reject do |v, _|
-            ignore_reqs.any? { |r| r.satisfied_by?(v) }
+            ignore_requirements.any? { |r| r.satisfied_by?(v) }
           end
 
           raise AllVersionsIgnored if @raise_on_ignored && filtered.empty? && versions_array.any?
@@ -201,7 +201,7 @@ module Dependabot
           return false if related_to_current_pre?(ver) ^ ver.prerelease?
           return false if current_version_greater_than?(ver)
           return false if current_requirement_greater_than?(ver)
-          return false if ignore_reqs.any? { |r| r.satisfied_by?(ver) }
+          return false if ignore_requirements.any? { |r| r.satisfied_by?(ver) }
           return false if yanked?(ver)
 
           true
@@ -388,8 +388,8 @@ module Dependabot
           )
         end
 
-        def ignore_reqs
-          ignored_versions.map { |req| requirement_class.new(req.split(",")) }
+        def ignore_requirements
+          ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
         end
 
         def version_class

data/lib/dependabot/npm_and_yarn/update_checker/registry_finder.rb

@@ -62,8 +62,8 @@ module Dependabot
 
         def registry_url
           protocol =
-            if private_registry_source_url
-              private_registry_source_url.split("://").first
+            if registry_source_url
+              registry_source_url.split("://").first
             else
               "https"
             end
@@ -92,10 +92,10 @@ module Dependabot
         end
 
         def locked_registry
-          return unless private_registry_source_url
+          return unless registry_source_url
 
           lockfile_registry =
-            private_registry_source_url.
+            registry_source_url.
             gsub("https://", "").
             gsub("http://", "")
           detailed_registry =
@@ -210,7 +210,7 @@ module Dependabot
           dependency.name.gsub("/", "%2F")
         end
 
-        def private_registry_source_url
+        def registry_source_url
           sources = dependency.requirements.
                     map { |r| r.fetch(:source) }.uniq.compact
 
@@ -218,8 +218,8 @@ module Dependabot
           # it's unclear how we should proceed
           raise "Multiple sources! #{sources.join(', ')}" if sources.map { |s| [s[:type], s[:url]] }.uniq.count > 1
 
-          # Otherwise we just take the URL of the first private registry
-          sources.find { |s| s[:type] == "private_registry" }&.fetch(:url)
+          # Otherwise we just take the URL of the first registry
+          sources.find { |s| s[:type] == "registry" }&.fetch(:url)
         end
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.141.0
+  version: 0.143.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-12 00:00:00.000000000 Z
+date: 2021-04-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.141.0
+        version: 0.143.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.141.0
+        version: 0.143.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.12.0
+        version: 1.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.12.0
+        version: 1.13.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -284,7 +284,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.2.3
+rubygems_version: 3.2.15
 signing_key: 
 specification_version: 4
 summary: JS support for dependabot