dependabot-npm_and_yarn 0.153.0 → 0.154.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e2777bfb9c1f62ee544293d44f304e5035ca22248cef99844b43d7a39aeacef
-  data.tar.gz: 34e23f42bfde5035c268f00c71ba3ae9bad6237aa6ed3389d1a204b0dda031db
+  metadata.gz: ee906342bdb5d0aefcf1787a905edc4695599d1b0ae6b6a107b262f9c10804d2
+  data.tar.gz: 1cbce2f27ef4ad2bad6ac330b6a76d7d587bcb292014d6700108142143fe654b
 SHA512:
-  metadata.gz: 3bc217b4e1207054ec67a376a878328c91499f010fc0faa90ddae72e0a537cdaf98df1bf0096eb3dbbcdf3e2076363eb58d80e14cfd64f731430df62c447cd54
-  data.tar.gz: aee4de95e19f880537816108df9a535d97dcec816db8091f841fa9f8be717e78f9c3951a218b3031191eefd9aaaaea7addbb70f3e5885d054d516790217d420e
+  metadata.gz: c7cd1fd9841cecc6001e138b52349e242cb8471fe7ddfb2eb3b8ae070ba456646e549bca5c0a7ffe328431a988023cf36cd823abec0696ee6fe59d0a3800a487
+  data.tar.gz: 84b1ddbc2c096cac50491289492421ea18feb60d23422325e211b9d8307ad0b09d12040989c91e6d36e9207ef6bf7ec467487c95840362678aea157c920ab6d6

data/helpers/package-lock.json

@@ -7,7 +7,7 @@
       "name": "@dependabot/helper",
       "dependencies": {
         "@dependabot/yarn-lib": "^1.21.1",
-        "@npmcli/arborist": "^2.6.2",
+        "@npmcli/arborist": "^2.6.3",
         "detect-indent": "^6.1.0",
         "npm": "6.14.13",
         "semver": "^7.3.4"
@@ -16,7 +16,7 @@
         "helper": "run.js"
       },
       "devDependencies": {
-        "eslint": "^7.28.0",
+        "eslint": "^7.29.0",
         "eslint-config-prettier": "^8.3.0",
         "jest": "^27.0.4",
         "prettier": "^2.3.1",
@@ -1430,9 +1430,9 @@
       }
     },
     "node_modules/@npmcli/arborist": {
-      "version": "2.6.2",
-      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.6.2.tgz",
-      "integrity": "sha512-CAo0HSziRdlpGUUheERmOrADnKHfBYpLAl/HmWGwGCtWKB3BCxfgb0rJ7MsFg38wy7YF3+fDs7R9dMVCH89K/A==",
+      "version": "2.6.3",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.6.3.tgz",
+      "integrity": "sha512-R8U2dZ8+jeE7go+qNU4Mt6aiXyBu3mM75iRIugNCA4P0OWlsLOpuDPPhsaRcOVbtXheOGZXrqe36qP1g+M68KQ==",
       "dependencies": {
         "@npmcli/installed-package-contents": "^1.0.7",
         "@npmcli/map-workspaces": "^1.0.2",
@@ -1453,6 +1453,7 @@
         "npm-registry-fetch": "^11.0.0",
         "pacote": "^11.2.6",
         "parse-conflict-json": "^1.1.1",
+        "proc-log": "^1.0.0",
         "promise-all-reject-late": "^1.0.0",
         "promise-call-limit": "^1.0.1",
         "read-package-json-fast": "^2.0.2",
@@ -3260,9 +3261,9 @@
       }
     },
     "node_modules/eslint": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.28.0.tgz",
-      "integrity": "sha512-UMfH0VSjP0G4p3EWirscJEQ/cHqnT/iuH6oNZOB94nBjWbMnhGEPxsZm1eyIW0C/9jLI0Fow4W5DXLjEI7mn1g==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.29.0.tgz",
+      "integrity": "sha512-82G/JToB9qIy/ArBzIWG9xvvwL3R86AlCjtGw+A29OMZDqhTybz/MByORSukGxeI+YPCR4coYyITKk8BFH9nDA==",
       "dev": true,
       "dependencies": {
         "@babel/code-frame": "7.12.11",
@@ -12553,6 +12554,11 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/proc-log": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-1.0.0.tgz",
+      "integrity": "sha512-aCk8AO51s+4JyuYGg3Q/a6gnrlDO09NpVWePtjp7xwphcoQ04x5WAfCyugcsbLooWcMJ87CLkD4+604IckEdhg=="
+    },
     "node_modules/process-nextick-args": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
@@ -15480,9 +15486,9 @@
       }
     },
     "@npmcli/arborist": {
-      "version": "2.6.2",
-      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.6.2.tgz",
-      "integrity": "sha512-CAo0HSziRdlpGUUheERmOrADnKHfBYpLAl/HmWGwGCtWKB3BCxfgb0rJ7MsFg38wy7YF3+fDs7R9dMVCH89K/A==",
+      "version": "2.6.3",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.6.3.tgz",
+      "integrity": "sha512-R8U2dZ8+jeE7go+qNU4Mt6aiXyBu3mM75iRIugNCA4P0OWlsLOpuDPPhsaRcOVbtXheOGZXrqe36qP1g+M68KQ==",
       "requires": {
         "@npmcli/installed-package-contents": "^1.0.7",
         "@npmcli/map-workspaces": "^1.0.2",
@@ -15503,6 +15509,7 @@
         "npm-registry-fetch": "^11.0.0",
         "pacote": "^11.2.6",
         "parse-conflict-json": "^1.1.1",
+        "proc-log": "^1.0.0",
         "promise-all-reject-late": "^1.0.0",
         "promise-call-limit": "^1.0.1",
         "read-package-json-fast": "^2.0.2",
@@ -16970,9 +16977,9 @@
       }
     },
     "eslint": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.28.0.tgz",
-      "integrity": "sha512-UMfH0VSjP0G4p3EWirscJEQ/cHqnT/iuH6oNZOB94nBjWbMnhGEPxsZm1eyIW0C/9jLI0Fow4W5DXLjEI7mn1g==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.29.0.tgz",
+      "integrity": "sha512-82G/JToB9qIy/ArBzIWG9xvvwL3R86AlCjtGw+A29OMZDqhTybz/MByORSukGxeI+YPCR4coYyITKk8BFH9nDA==",
       "dev": true,
       "requires": {
         "@babel/code-frame": "7.12.11",
@@ -23759,6 +23766,11 @@
         }
       }
     },
+    "proc-log": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-1.0.0.tgz",
+      "integrity": "sha512-aCk8AO51s+4JyuYGg3Q/a6gnrlDO09NpVWePtjp7xwphcoQ04x5WAfCyugcsbLooWcMJ87CLkD4+604IckEdhg=="
+    },
     "process-nextick-args": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",

data/helpers/package.json

@@ -10,13 +10,13 @@
   },
   "dependencies": {
     "@dependabot/yarn-lib": "^1.21.1",
-    "@npmcli/arborist": "^2.6.2",
+    "@npmcli/arborist": "^2.6.3",
     "detect-indent": "^6.1.0",
     "npm": "6.14.13",
     "semver": "^7.3.4"
   },
   "devDependencies": {
-    "eslint": "^7.28.0",
+    "eslint": "^7.29.0",
     "eslint-config-prettier": "^8.3.0",
     "jest": "^27.0.4",
     "prettier": "^2.3.1",

data/lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb

@@ -170,7 +170,7 @@ module Dependabot
                   [{ production: !details["dev"] }]
               end
 
-              dependency_set << Dependency.new(dependency_args)
+              dependency_set << Dependency.new(**dependency_args)
               dependency_set += recursively_fetch_npm_lock_dependencies(details)
             end
 

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -2,6 +2,7 @@
 
 require "excon"
 require "dependabot/npm_and_yarn/update_checker"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/npm_and_yarn/update_checker/registry_finder"
 require "dependabot/npm_and_yarn/version"
 require "dependabot/npm_and_yarn/requirement"
@@ -58,15 +59,17 @@ module Dependabot
         def lowest_security_fix_version
           return unless valid_npm_details?
 
-          versions_array =
+          secure_versions =
             if specified_dist_tag_requirement?
               [version_from_dist_tags].compact
             else possible_versions(filter_ignored: false)
             end
 
-          secure_versions = filter_vulnerable_versions(versions_array)
+          secure_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(secure_versions,
+                                                                                                  security_advisories)
           secure_versions = filter_ignored_versions(secure_versions)
           secure_versions = filter_lower_versions(secure_versions)
+
           secure_versions.reverse.find { |version| !yanked?(version) }
         rescue Excon::Error::Socket, Excon::Error::Timeout
           raise if dependency_registry == "registry.npmjs.org"
@@ -125,18 +128,6 @@ module Dependabot
             select { |v| reqs.all? { |r| r.any? { |o| o.satisfied_by?(v) } } }
         end
 
-        def filter_vulnerable_versions(versions_array)
-          updated_versions_array = versions_array
-
-          security_advisories.each do |advisory|
-            updated_versions_array =
-              updated_versions_array.
-              reject { |v| advisory.vulnerable?(v) }
-          end
-
-          updated_versions_array
-        end
-
         def filter_lower_versions(versions_array)
           return versions_array unless dependency.version && version_class.correct?(dependency.version)
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.153.0
+  version: 0.154.4
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-14 00:00:00.000000000 Z
+date: 2021-06-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.153.0
+        version: 0.154.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.153.0
+        version: 0.154.4
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement