dependabot-npm_and_yarn 0.148.0 → 0.148.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 205bd66b38e559ec6496b5e2d61b040e51ea8f1774704d969bb0c8802c9c1db1
-  data.tar.gz: 3b121f2b5cd2501bf0b1ad1641119cb9765668b7ace34f93d3845e70d390fa5a
+  metadata.gz: 2d7f4c007c7e3a783ab6eaed74855629a4f217d4496145f2f009d1925c7a6f66
+  data.tar.gz: 9926fbd0af64116fc774c90cfa2e1bf079535a89a403ed862afbde04ff6ceb95
 SHA512:
-  metadata.gz: 8156fefdb9e41bbf8ad6d26f7e79813c1d6f17f8281601e57fe80d6f3f8329fa585a00d9cb7e696683416c256f65291b59530b9a8b5edca84e41f50a33fb6700
-  data.tar.gz: d5e82f76e5c778639161c3c155102ae190d1fbd5ff349bb970b6ea3f7b7b7424b3a81b4d1edff44643acdfad317754a98dfd9c61edf35100222623c823998e58
+  metadata.gz: 479cf156ddc8bcdb5080afd3b34d8b73a5c654b70e56397ccb2d62bc377cb718c90bd7376a16401683343a862aa9e7a27375d5a6a660d74d614daa3c11c7ccc7
+  data.tar.gz: 28367969816a951f6f7b17a7de576eef6455b14278dc029d10648ff1c4aa8839604ccd2e6ad6b0528240724b13b0fd736ff9440e8e157793cb85f49096a578e1

data/helpers/package-lock.json

@@ -7,7 +7,7 @@
       "name": "@dependabot/helper",
       "dependencies": {
         "@dependabot/yarn-lib": "^1.21.1",
-        "@npmcli/arborist": "^2.5.0",
+        "@npmcli/arborist": "^2.6.0",
         "detect-indent": "^6.0.0",
         "npm": "6.14.13",
         "semver": "^7.3.4"
@@ -1425,9 +1425,9 @@
       }
     },
     "node_modules/@npmcli/arborist": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.5.0.tgz",
-      "integrity": "sha512-YPSkV/8vofpbAJyeu52J12YnC5VTkYIcfcNkRoSW6qjfQG+QybgbJtCbcdx+M0YxfdzDKS6iDTjpNMoETZ8HOA==",
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.6.0.tgz",
+      "integrity": "sha512-6njRVuPMgGRvQUmsXwGdp1ItZtJuSdt5ouoQe4AeFTTZoMufKWLeXFDOlWj7qbMAzqw+guNEAZwBiwm04J7T2g==",
       "dependencies": {
         "@npmcli/installed-package-contents": "^1.0.7",
         "@npmcli/map-workspaces": "^1.0.2",
@@ -1459,6 +1459,9 @@
       },
       "bin": {
         "arborist": "bin/index.js"
+      },
+      "engines": {
+        "node": ">= 10"
       }
     },
     "node_modules/@npmcli/arborist/node_modules/npm-registry-fetch": {
@@ -17257,9 +17260,9 @@
       }
     },
     "@npmcli/arborist": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.5.0.tgz",
-      "integrity": "sha512-YPSkV/8vofpbAJyeu52J12YnC5VTkYIcfcNkRoSW6qjfQG+QybgbJtCbcdx+M0YxfdzDKS6iDTjpNMoETZ8HOA==",
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.6.0.tgz",
+      "integrity": "sha512-6njRVuPMgGRvQUmsXwGdp1ItZtJuSdt5ouoQe4AeFTTZoMufKWLeXFDOlWj7qbMAzqw+guNEAZwBiwm04J7T2g==",
       "requires": {
         "@npmcli/installed-package-contents": "^1.0.7",
         "@npmcli/map-workspaces": "^1.0.2",

data/helpers/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {
     "@dependabot/yarn-lib": "^1.21.1",
-    "@npmcli/arborist": "^2.5.0",
+    "@npmcli/arborist": "^2.6.0",
     "detect-indent": "^6.0.0",
     "npm": "6.14.13",
     "semver": "^7.3.4"

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -20,11 +20,6 @@ module Dependabot
 
       DEPENDENCY_TYPES =
         %w(dependencies devDependencies optionalDependencies).freeze
-      CENTRAL_REGISTRIES = %w(
-        https://registry.npmjs.org
-        http://registry.npmjs.org
-        https://registry.yarnpkg.com
-      ).freeze
       GIT_URL_REGEX = %r{
         (?<git_prefix>^|^git.*?|^github:|^bitbucket:|^gitlab:|github\.com/)
         (?<username>[a-z0-9-]+)/

data/lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb

@@ -56,10 +56,11 @@ module Dependabot
           parsed_lockfile = parse_package_lock(lockfile)
 
           if Helpers.npm_version(lockfile.content) == "npm7"
-            parsed_lockfile.dig(
-              "packages",
-              node_modules_path(manifest_name, dependency_name)
-            )&.slice("version", "resolved", "integrity", "dev")
+            # NOTE: npm 7 sometimes doesn't install workspace dependencies in the
+            # workspace folder so we need to fallback to checking top-level
+            nested_details = parsed_lockfile.dig("packages", node_modules_path(manifest_name, dependency_name))
+            details = nested_details || parsed_lockfile.dig("packages", "node_modules/#{dependency_name}")
+            details&.slice("version", "resolved", "integrity", "dev")
           else
             parsed_lockfile.dig("dependencies", dependency_name)
           end

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -436,17 +436,11 @@ module Dependabot
                          find { |f| f.name.end_with?(".yarnrc") }
           ).registry
 
-          return if central_registry?(reg) && !package_name.start_with?("@")
+          return if UpdateChecker::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")
 
           raise Dependabot::PrivateSourceAuthenticationFailure, reg
         end
 
-        def central_registry?(registry)
-          NpmAndYarn::FileParser::CENTRAL_REGISTRIES.any? do |r|
-            r.include?(registry)
-          end
-        end
-
         def resolvable_before_update?
           return @resolvable_before_update if defined?(@resolvable_before_update)
 

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -420,15 +420,11 @@ module Dependabot
             yarnrc_file: yarnrc_file
           ).registry
 
-          return if central_registry?(reg) && !package_name.start_with?("@")
+          return if UpdateChecker::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")
 
           raise PrivateSourceAuthenticationFailure, reg
         end
 
-        def central_registry?(registry)
-          FileParser::CENTRAL_REGISTRIES.any? { |r| r.include?(registry) }
-        end
-
         def raise_resolvability_error(error_message, yarn_lock)
           dependency_names = dependencies.map(&:name).join(", ")
           msg = "Error whilst updating #{dependency_names} in "\

data/lib/dependabot/npm_and_yarn/metadata_finder.rb

@@ -6,6 +6,7 @@ require "time"
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/shared_helpers"
+require "dependabot/npm_and_yarn/update_checker/registry_finder"
 require "dependabot/npm_and_yarn/version"
 
 module Dependabot
@@ -92,9 +93,8 @@ module Dependabot
 
       def new_source
         sources = dependency.requirements.
-                  map { |r| r.fetch(:source) }.uniq.compact
-
-        raise "Multiple sources! #{sources.join(', ')}" if sources.count > 1
+                  map { |r| r.fetch(:source) }.uniq.compact.
+                  sort_by { |source| UpdateChecker::RegistryFinder.central_registry?(source[:url]) ? 1 : 0 }
 
         sources.first
       end

data/lib/dependabot/npm_and_yarn/update_checker/registry_finder.rb

@@ -8,6 +8,11 @@ module Dependabot
   module NpmAndYarn
     class UpdateChecker
       class RegistryFinder
+        CENTRAL_REGISTRIES = %w(
+          https://registry.npmjs.org
+          http://registry.npmjs.org
+          https://registry.yarnpkg.com
+        ).freeze
         NPM_AUTH_TOKEN_REGEX =
           %r{//(?<registry>.*)/:_authToken=(?<token>.*)$}.freeze
         NPM_GLOBAL_REGISTRY_REGEX =
@@ -35,6 +40,12 @@ module Dependabot
           "#{registry_url.gsub(%r{/+$}, '')}/#{escaped_dependency_name}"
         end
 
+        def self.central_registry?(registry)
+          CENTRAL_REGISTRIES.any? do |r|
+            r.include?(registry)
+          end
+        end
+
         private
 
         attr_reader :dependency, :credentials, :npmrc_file, :yarnrc_file
@@ -212,13 +223,9 @@ module Dependabot
 
         def registry_source_url
           sources = dependency.requirements.
-                    map { |r| r.fetch(:source) }.uniq.compact
-
-          # If there are multiple source types, or multiple source URLs, then
-          # it's unclear how we should proceed
-          raise "Multiple sources! #{sources.join(', ')}" if sources.map { |s| [s[:type], s[:url]] }.uniq.count > 1
+                    map { |r| r.fetch(:source) }.uniq.compact.
+                    sort_by { |source| self.class.central_registry?(source[:url]) ? 1 : 0 }
 
-          # Otherwise we just take the URL of the first registry
           sources.find { |s| s[:type] == "registry" }&.fetch(:url)
         end
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.148.0
+  version: 0.148.5
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-05-19 00:00:00.000000000 Z
+date: 2021-05-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.148.0
+        version: 0.148.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.148.0
+        version: 0.148.5
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement