dependabot-npm_and_yarn 0.148.1 → 0.148.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9d3fe3be7bc4c116c6261c990c35a5bb395a6137d1fedc5c56ac24444d62a8a6
-  data.tar.gz: 48800df1055aac9e356518cad2b75331be82fa6e445cbe89e079d6d4a7429950
+  metadata.gz: c4f5000d192deed978e6b50f65bc4dd4444f4f8b90e2e46e92190328d71cad60
+  data.tar.gz: 9c27dd71fc2df071fca445b045cff1dbe4df616e28be7ca6b57dfa74ebbe059b
 SHA512:
-  metadata.gz: 5ac988ec6109ed828b57aacfe34fb2aff085699f23a987f52b31e83b305593cc1a52f65277dda3b29e7e5834e4539d892246993f7492d513ee414cc95e3f289d
-  data.tar.gz: 1a9491a0360c02021c099d9df66e5f40590742f9f442a96dbaf9e3d5f2fd098e501088d4cc496bb04620dcf1ed5e7f9ff71424143afc42bb5a20a719cb0fa052
+  metadata.gz: a8b90c8dc2973256dc4324883db4fe41c80224a3c9506304f4f6203fe5c3189dd81c6eb9b2faa852e8d084b3a0862c3542919e40c82537cf644acbfed8782807
+  data.tar.gz: 9212fb56691953bd065e7adb860bd7121168c9c2415a9c7bd9f0ba417fbdc5e7c9f9ae376bfe8530d57f60213d0f88632790192faf4317e4085588bf7150705d

data/helpers/package-lock.json

@@ -7,7 +7,7 @@
       "name": "@dependabot/helper",
       "dependencies": {
         "@dependabot/yarn-lib": "^1.21.1",
-        "@npmcli/arborist": "^2.5.0",
+        "@npmcli/arborist": "^2.6.0",
         "detect-indent": "^6.0.0",
         "npm": "6.14.13",
         "semver": "^7.3.4"
@@ -1425,9 +1425,9 @@
       }
     },
     "node_modules/@npmcli/arborist": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.5.0.tgz",
-      "integrity": "sha512-YPSkV/8vofpbAJyeu52J12YnC5VTkYIcfcNkRoSW6qjfQG+QybgbJtCbcdx+M0YxfdzDKS6iDTjpNMoETZ8HOA==",
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.6.0.tgz",
+      "integrity": "sha512-6njRVuPMgGRvQUmsXwGdp1ItZtJuSdt5ouoQe4AeFTTZoMufKWLeXFDOlWj7qbMAzqw+guNEAZwBiwm04J7T2g==",
       "dependencies": {
         "@npmcli/installed-package-contents": "^1.0.7",
         "@npmcli/map-workspaces": "^1.0.2",
@@ -1459,6 +1459,9 @@
       },
       "bin": {
         "arborist": "bin/index.js"
+      },
+      "engines": {
+        "node": ">= 10"
       }
     },
     "node_modules/@npmcli/arborist/node_modules/npm-registry-fetch": {
@@ -17257,9 +17260,9 @@
       }
     },
     "@npmcli/arborist": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.5.0.tgz",
-      "integrity": "sha512-YPSkV/8vofpbAJyeu52J12YnC5VTkYIcfcNkRoSW6qjfQG+QybgbJtCbcdx+M0YxfdzDKS6iDTjpNMoETZ8HOA==",
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.6.0.tgz",
+      "integrity": "sha512-6njRVuPMgGRvQUmsXwGdp1ItZtJuSdt5ouoQe4AeFTTZoMufKWLeXFDOlWj7qbMAzqw+guNEAZwBiwm04J7T2g==",
       "requires": {
         "@npmcli/installed-package-contents": "^1.0.7",
         "@npmcli/map-workspaces": "^1.0.2",

data/helpers/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {
     "@dependabot/yarn-lib": "^1.21.1",
-    "@npmcli/arborist": "^2.5.0",
+    "@npmcli/arborist": "^2.6.0",
     "detect-indent": "^6.0.0",
     "npm": "6.14.13",
     "semver": "^7.3.4"

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -20,11 +20,6 @@ module Dependabot
 
       DEPENDENCY_TYPES =
         %w(dependencies devDependencies optionalDependencies).freeze
-      CENTRAL_REGISTRIES = %w(
-        https://registry.npmjs.org
-        http://registry.npmjs.org
-        https://registry.yarnpkg.com
-      ).freeze
       GIT_URL_REGEX = %r{
         (?<git_prefix>^|^git.*?|^github:|^bitbucket:|^gitlab:|github\.com/)
         (?<username>[a-z0-9-]+)/

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -436,17 +436,11 @@ module Dependabot
                          find { |f| f.name.end_with?(".yarnrc") }
           ).registry
 
-          return if central_registry?(reg) && !package_name.start_with?("@")
+          return if UpdateChecker::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")
 
           raise Dependabot::PrivateSourceAuthenticationFailure, reg
         end
 
-        def central_registry?(registry)
-          NpmAndYarn::FileParser::CENTRAL_REGISTRIES.any? do |r|
-            r.include?(registry)
-          end
-        end
-
         def resolvable_before_update?
           return @resolvable_before_update if defined?(@resolvable_before_update)
 

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -420,15 +420,11 @@ module Dependabot
             yarnrc_file: yarnrc_file
           ).registry
 
-          return if central_registry?(reg) && !package_name.start_with?("@")
+          return if UpdateChecker::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")
 
           raise PrivateSourceAuthenticationFailure, reg
         end
 
-        def central_registry?(registry)
-          FileParser::CENTRAL_REGISTRIES.any? { |r| r.include?(registry) }
-        end
-
         def raise_resolvability_error(error_message, yarn_lock)
           dependency_names = dependencies.map(&:name).join(", ")
           msg = "Error whilst updating #{dependency_names} in "\

data/lib/dependabot/npm_and_yarn/metadata_finder.rb

@@ -6,6 +6,7 @@ require "time"
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/shared_helpers"
+require "dependabot/npm_and_yarn/update_checker/registry_finder"
 require "dependabot/npm_and_yarn/version"
 
 module Dependabot
@@ -92,9 +93,8 @@ module Dependabot
 
       def new_source
         sources = dependency.requirements.
-                  map { |r| r.fetch(:source) }.uniq.compact
-
-        raise "Multiple sources! #{sources.join(', ')}" if sources.count > 1
+                  map { |r| r.fetch(:source) }.uniq.compact.
+                  sort_by { |source| UpdateChecker::RegistryFinder.central_registry?(source[:url]) ? 1 : 0 }
 
         sources.first
       end

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -138,6 +138,8 @@ module Dependabot
         end
 
         def filter_lower_versions(versions_array)
+          return versions_array unless dependency.version
+
           versions_array.
             select { |version, _| version > version_class.new(dependency.version) }
         end

data/lib/dependabot/npm_and_yarn/update_checker/registry_finder.rb

@@ -8,6 +8,11 @@ module Dependabot
   module NpmAndYarn
     class UpdateChecker
       class RegistryFinder
+        CENTRAL_REGISTRIES = %w(
+          https://registry.npmjs.org
+          http://registry.npmjs.org
+          https://registry.yarnpkg.com
+        ).freeze
         NPM_AUTH_TOKEN_REGEX =
           %r{//(?<registry>.*)/:_authToken=(?<token>.*)$}.freeze
         NPM_GLOBAL_REGISTRY_REGEX =
@@ -35,6 +40,12 @@ module Dependabot
           "#{registry_url.gsub(%r{/+$}, '')}/#{escaped_dependency_name}"
         end
 
+        def self.central_registry?(registry)
+          CENTRAL_REGISTRIES.any? do |r|
+            r.include?(registry)
+          end
+        end
+
         private
 
         attr_reader :dependency, :credentials, :npmrc_file, :yarnrc_file
@@ -212,13 +223,9 @@ module Dependabot
 
         def registry_source_url
           sources = dependency.requirements.
-                    map { |r| r.fetch(:source) }.uniq.compact
-
-          # If there are multiple source types, or multiple source URLs, then
-          # it's unclear how we should proceed
-          raise "Multiple sources! #{sources.join(', ')}" if sources.map { |s| [s[:type], s[:url]] }.uniq.count > 1
+                    map { |r| r.fetch(:source) }.uniq.compact.
+                    sort_by { |source| self.class.central_registry?(source[:url]) ? 1 : 0 }
 
-          # Otherwise we just take the URL of the first registry
           sources.find { |s| s[:type] == "registry" }&.fetch(:url)
         end
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.148.1
+  version: 0.148.6
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-05-19 00:00:00.000000000 Z
+date: 2021-05-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.148.1
+        version: 0.148.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.148.1
+        version: 0.148.6
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement