dependabot-npm_and_yarn 0.148.2 → 0.148.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/dependabot/npm_and_yarn/file_parser.rb +0 -5
- data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb +1 -7
- data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb +1 -5
- data/lib/dependabot/npm_and_yarn/metadata_finder.rb +3 -3
- data/lib/dependabot/npm_and_yarn/update_checker/registry_finder.rb +13 -6
- metadata +3 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 4b40cff952bef4f82021885dda1255e523fe13f1f178fc20cb458f240bc9a782
|
4
|
+
data.tar.gz: 6feac5795b74ef7e7370a8fc611aee70ac880d9134b476517f34fe3115facf2e
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 34964357c3f0f42fae7a66d1a548546b13beaa1d325960fae1784384e411359547f866238a13f2fe0d1b852e532a6c85a5a0f81511f87d300cbadfd6208ee06d
|
7
|
+
data.tar.gz: 661f53b8ecadb665fa2ce903a671c42b38ace02423a97301d460ed0830eaa71836325344a2bc3845e19711f49632a4c80124afb6bdecb92b8896673911163c53
|
@@ -20,11 +20,6 @@ module Dependabot
|
|
20
20
|
|
21
21
|
DEPENDENCY_TYPES =
|
22
22
|
%w(dependencies devDependencies optionalDependencies).freeze
|
23
|
-
CENTRAL_REGISTRIES = %w(
|
24
|
-
https://registry.npmjs.org
|
25
|
-
http://registry.npmjs.org
|
26
|
-
https://registry.yarnpkg.com
|
27
|
-
).freeze
|
28
23
|
GIT_URL_REGEX = %r{
|
29
24
|
(?<git_prefix>^|^git.*?|^github:|^bitbucket:|^gitlab:|github\.com/)
|
30
25
|
(?<username>[a-z0-9-]+)/
|
@@ -436,17 +436,11 @@ module Dependabot
|
|
436
436
|
find { |f| f.name.end_with?(".yarnrc") }
|
437
437
|
).registry
|
438
438
|
|
439
|
-
return if central_registry?(reg) && !package_name.start_with?("@")
|
439
|
+
return if UpdateChecker::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")
|
440
440
|
|
441
441
|
raise Dependabot::PrivateSourceAuthenticationFailure, reg
|
442
442
|
end
|
443
443
|
|
444
|
-
def central_registry?(registry)
|
445
|
-
NpmAndYarn::FileParser::CENTRAL_REGISTRIES.any? do |r|
|
446
|
-
r.include?(registry)
|
447
|
-
end
|
448
|
-
end
|
449
|
-
|
450
444
|
def resolvable_before_update?
|
451
445
|
return @resolvable_before_update if defined?(@resolvable_before_update)
|
452
446
|
|
@@ -420,15 +420,11 @@ module Dependabot
|
|
420
420
|
yarnrc_file: yarnrc_file
|
421
421
|
).registry
|
422
422
|
|
423
|
-
return if central_registry?(reg) && !package_name.start_with?("@")
|
423
|
+
return if UpdateChecker::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")
|
424
424
|
|
425
425
|
raise PrivateSourceAuthenticationFailure, reg
|
426
426
|
end
|
427
427
|
|
428
|
-
def central_registry?(registry)
|
429
|
-
FileParser::CENTRAL_REGISTRIES.any? { |r| r.include?(registry) }
|
430
|
-
end
|
431
|
-
|
432
428
|
def raise_resolvability_error(error_message, yarn_lock)
|
433
429
|
dependency_names = dependencies.map(&:name).join(", ")
|
434
430
|
msg = "Error whilst updating #{dependency_names} in "\
|
@@ -6,6 +6,7 @@ require "time"
|
|
6
6
|
require "dependabot/metadata_finders"
|
7
7
|
require "dependabot/metadata_finders/base"
|
8
8
|
require "dependabot/shared_helpers"
|
9
|
+
require "dependabot/npm_and_yarn/update_checker/registry_finder"
|
9
10
|
require "dependabot/npm_and_yarn/version"
|
10
11
|
|
11
12
|
module Dependabot
|
@@ -92,9 +93,8 @@ module Dependabot
|
|
92
93
|
|
93
94
|
def new_source
|
94
95
|
sources = dependency.requirements.
|
95
|
-
map { |r| r.fetch(:source) }.uniq.compact
|
96
|
-
|
97
|
-
raise "Multiple sources! #{sources.join(', ')}" if sources.count > 1
|
96
|
+
map { |r| r.fetch(:source) }.uniq.compact.
|
97
|
+
sort_by { |source| UpdateChecker::RegistryFinder.central_registry?(source[:url]) ? 1 : 0 }
|
98
98
|
|
99
99
|
sources.first
|
100
100
|
end
|
@@ -8,6 +8,11 @@ module Dependabot
|
|
8
8
|
module NpmAndYarn
|
9
9
|
class UpdateChecker
|
10
10
|
class RegistryFinder
|
11
|
+
CENTRAL_REGISTRIES = %w(
|
12
|
+
https://registry.npmjs.org
|
13
|
+
http://registry.npmjs.org
|
14
|
+
https://registry.yarnpkg.com
|
15
|
+
).freeze
|
11
16
|
NPM_AUTH_TOKEN_REGEX =
|
12
17
|
%r{//(?<registry>.*)/:_authToken=(?<token>.*)$}.freeze
|
13
18
|
NPM_GLOBAL_REGISTRY_REGEX =
|
@@ -35,6 +40,12 @@ module Dependabot
|
|
35
40
|
"#{registry_url.gsub(%r{/+$}, '')}/#{escaped_dependency_name}"
|
36
41
|
end
|
37
42
|
|
43
|
+
def self.central_registry?(registry)
|
44
|
+
CENTRAL_REGISTRIES.any? do |r|
|
45
|
+
r.include?(registry)
|
46
|
+
end
|
47
|
+
end
|
48
|
+
|
38
49
|
private
|
39
50
|
|
40
51
|
attr_reader :dependency, :credentials, :npmrc_file, :yarnrc_file
|
@@ -212,13 +223,9 @@ module Dependabot
|
|
212
223
|
|
213
224
|
def registry_source_url
|
214
225
|
sources = dependency.requirements.
|
215
|
-
map { |r| r.fetch(:source) }.uniq.compact
|
216
|
-
|
217
|
-
# If there are multiple source types, or multiple source URLs, then
|
218
|
-
# it's unclear how we should proceed
|
219
|
-
raise "Multiple sources! #{sources.join(', ')}" if sources.map { |s| [s[:type], s[:url]] }.uniq.count > 1
|
226
|
+
map { |r| r.fetch(:source) }.uniq.compact.
|
227
|
+
sort_by { |source| self.class.central_registry?(source[:url]) ? 1 : 0 }
|
220
228
|
|
221
|
-
# Otherwise we just take the URL of the first registry
|
222
229
|
sources.find { |s| s[:type] == "registry" }&.fetch(:url)
|
223
230
|
end
|
224
231
|
end
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: dependabot-npm_and_yarn
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.148.
|
4
|
+
version: 0.148.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Dependabot
|
@@ -16,14 +16,14 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - '='
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version: 0.148.
|
19
|
+
version: 0.148.3
|
20
20
|
type: :runtime
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - '='
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: 0.148.
|
26
|
+
version: 0.148.3
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
name: byebug
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|