dependabot-npm_and_yarn 0.175.0 → 0.178.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c07f155a90a67db8072626219fa6d797c7294ebb3531565c6fe5b7163378f3e
-  data.tar.gz: 5ededcae3a93518dd184c7e5b202a63b9f80c0614ceba6a9a59a9c32c92980af
+  metadata.gz: bdd9e2679b6d836b64ac2090230587d4d40a481d53f8c2b7fdb6a45e1d359de4
+  data.tar.gz: 6017374515a9ee5db91fb0963a9de3eec230ccf2d770089da1d6ddc283c16a0f
 SHA512:
-  metadata.gz: ef4274999e5373d0e7d20c5697214836c67750719061b9e9768f688a42f2fb84a80dc841363158f2520d8330eb2b913e5d4ab4af318bdd6b9faed192cc0f6767
-  data.tar.gz: 2b739c355b0096994ee83157bfdf4f514a310ca0981ef649d550d446951b40ce87d174802c1ec4c0b9446bf207d5d123f1876a6741de7e67100f2cbec5604f6e
+  metadata.gz: ec0a20c4b6ba2bf326c02a5a7bb3cf455ab11c1d7959df1ac80b62b2037f2470122d2247600b527470754732716c7c3dea88c81ef1b19a8136b563142372b28b
+  data.tar.gz: 5d5be3e55457b6813aa91f5484b221630f1723043df6b287bd84a165b99c96cbc9b9b9577b9bd7881aafca5ad959d228a7b910430d002c37ad535dbb7c9d4e7d

data/helpers/package-lock.json

@@ -12003,9 +12003,9 @@
       }
     },
     "node_modules/object-path": {
-      "version": "0.11.5",
-      "resolved": "https://registry.npmjs.org/object-path/-/object-path-0.11.5.tgz",
-      "integrity": "sha512-jgSbThcoR/s+XumvGMTMf81QVBmah+/Q7K7YduKeKVWL7N111unR2d6pZZarSk6kY/caeNxUDyxOvMWyzoU2eg==",
+      "version": "0.11.8",
+      "resolved": "https://registry.npmjs.org/object-path/-/object-path-0.11.8.tgz",
+      "integrity": "sha512-YJjNZrlXJFM42wTBn6zgOJVar9KFJvzx6sTWDte8sWZF//cnjl0BxHNpfZx+ZffXX63A9q0b1zsFiBX4g4X5KA==",
       "engines": {
         "node": ">= 10.12.0"
       }
@@ -23163,9 +23163,9 @@
       "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA=="
     },
     "object-path": {
-      "version": "0.11.5",
-      "resolved": "https://registry.npmjs.org/object-path/-/object-path-0.11.5.tgz",
-      "integrity": "sha512-jgSbThcoR/s+XumvGMTMf81QVBmah+/Q7K7YduKeKVWL7N111unR2d6pZZarSk6kY/caeNxUDyxOvMWyzoU2eg=="
+      "version": "0.11.8",
+      "resolved": "https://registry.npmjs.org/object-path/-/object-path-0.11.8.tgz",
+      "integrity": "sha512-YJjNZrlXJFM42wTBn6zgOJVar9KFJvzx6sTWDte8sWZF//cnjl0BxHNpfZx+ZffXX63A9q0b1zsFiBX4g4X5KA=="
     },
     "object.omit": {
       "version": "2.0.1",

data/lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb

@@ -55,8 +55,8 @@ module Dependabot
         def npm_lockfile_details(lockfile, dependency_name, manifest_name)
           parsed_lockfile = parse_package_lock(lockfile)
 
-          if Helpers.npm_version(lockfile.content) == "npm7"
-            # NOTE: npm 7 sometimes doesn't install workspace dependencies in the
+          if Helpers.npm_version(lockfile.content) == "npm8"
+            # NOTE: npm 8 sometimes doesn't install workspace dependencies in the
             # workspace folder so we need to fallback to checking top-level
             nested_details = parsed_lockfile.dig("packages", node_modules_path(manifest_name, dependency_name))
             details = nested_details || parsed_lockfile.dig("packages", "node_modules/#{dependency_name}")

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -45,9 +45,9 @@ module Dependabot
         # TODO: look into fixing this in npm, seems like a bug in the git
         # downloader introduced in npm 7
         #
-        # NOTE: error message returned from arborist/npm 7 when trying to
+        # NOTE: error message returned from arborist/npm 8 when trying to
         # fetching a invalid/non-existent git ref
-        NPM7_MISSING_GIT_REF = /already exists and is not an empty directory/.freeze
+        NPM8_MISSING_GIT_REF = /already exists and is not an empty directory/.freeze
         NPM6_MISSING_GIT_REF = /did not match any file\(s\) known to git/.freeze
 
         def updated_lockfile_content
@@ -141,8 +141,8 @@ module Dependabot
         end
 
         def run_npm_top_level_updater(top_level_dependencies:)
-          if npm7?
-            run_npm_7_top_level_updater(top_level_dependencies: top_level_dependencies)
+          if npm8?
+            run_npm8_top_level_updater(top_level_dependencies: top_level_dependencies)
           else
             SharedHelpers.run_helper_subprocess(
               command: NativeHelpers.helper_path,
@@ -156,7 +156,7 @@ module Dependabot
           end
         end
 
-        def run_npm_7_top_level_updater(top_level_dependencies:)
+        def run_npm8_top_level_updater(top_level_dependencies:)
           dependencies_in_current_package_json = top_level_dependencies.any? do |dependency|
             dependency_in_package_json?(dependency)
           end
@@ -195,8 +195,8 @@ module Dependabot
         end
 
         def run_npm_subdependency_updater
-          if npm7?
-            run_npm_7_subdependency_updater
+          if npm8?
+            run_npm8_subdependency_updater
           else
             SharedHelpers.run_helper_subprocess(
               command: NativeHelpers.helper_path,
@@ -206,9 +206,9 @@ module Dependabot
           end
         end
 
-        def run_npm_7_subdependency_updater
+        def run_npm8_subdependency_updater
           dependency_names = sub_dependencies.map(&:name)
-          SharedHelpers.run_shell_command(NativeHelpers.npm7_subdependency_update_command(dependency_names))
+          SharedHelpers.run_shell_command(NativeHelpers.npm8_subdependency_update_command(dependency_names))
           { lockfile_basename => File.read(lockfile_basename) }
         end
 
@@ -365,12 +365,12 @@ module Dependabot
              error_message.include?("Non-registry package missing package") ||
              error_message.include?("Invalid tag name") ||
              error_message.match?(NPM6_MISSING_GIT_REF) ||
-             error_message.match?(NPM7_MISSING_GIT_REF)) &&
+             error_message.match?(NPM8_MISSING_GIT_REF)) &&
              !resolvable_before_update?
             raise_resolvability_error(error_message)
           end
 
-          # NOTE: This check was introduced in npm7/arborist
+          # NOTE: This check was introduced in npm8/arborist
           if error_message.include?("must provide string spec")
             msg = "Error parsing your package.json manifest: the version requirement must be a string"
             raise Dependabot::DependencyFileNotParseable, msg
@@ -500,6 +500,8 @@ module Dependabot
         # levels deep it is indented.
         def detect_indentation(json)
           indentation = json.scan(/^\s+/).min_by(&:length)
+          return "" if indentation.nil? # let npm set the default if we can't detect any indentation
+
           indentation_size = indentation.length
           indentation_type = indentation.scan(/\t/).any? ? "\t" : " "
 
@@ -609,10 +611,10 @@ module Dependabot
           # Restore lockfile name attribute from the original lockfile
           updated_lockfile_content = replace_project_name(updated_lockfile_content, parsed_updated_lockfile_content)
 
-          # Restore npm 7 "packages" "name" entry from package.json if previously set
+          # Restore npm 8 "packages" "name" entry from package.json if previously set
           updated_lockfile_content = restore_packages_name(updated_lockfile_content, parsed_updated_lockfile_content)
 
-          # Switch back npm 7 lockfile "packages" requirements from the package.json
+          # Switch back npm 8 lockfile "packages" requirements from the package.json
           updated_lockfile_content = restore_locked_package_dependencies(
             updated_lockfile_content, parsed_updated_lockfile_content
           )
@@ -634,7 +636,7 @@ module Dependabot
         end
 
         def restore_packages_name(updated_lockfile_content, parsed_updated_lockfile_content)
-          return updated_lockfile_content unless npm7?
+          return updated_lockfile_content unless npm8?
 
           current_name = parsed_updated_lockfile_content.dig("packages", "", "name")
           original_name = parsed_lockfile.dig("packages", "", "name")
@@ -679,7 +681,7 @@ module Dependabot
         end
 
         # NOTE: This is a workaround to "sync" what's in package.json
-        # requirements and the `packages.""` entry in npm 7 v2 lockfiles. These
+        # requirements and the `packages.""` entry in npm 8 v2 lockfiles. These
         # get out of sync because we lock git dependencies (that are not being
         # updated) to a specific sha to prevent unrelated updates and the way we
         # invoke the `npm install` cli, where we might tell npm to install a
@@ -688,7 +690,7 @@ module Dependabot
         # need to copy this from the manifest to the lockfile after the update
         # has finished.
         def restore_locked_package_dependencies(updated_lockfile_content, parsed_updated_lockfile_content)
-          return updated_lockfile_content unless npm7?
+          return updated_lockfile_content unless npm8?
 
           dependency_names_to_restore = (dependencies.map(&:name) + git_dependencies_to_lock.keys).uniq
 
@@ -729,10 +731,10 @@ module Dependabot
             # updates the lockfile "from" field to the new git commit when we
             # run npm install
             original_from = %("from": "#{details[:from]}")
-            if npm7?
+            if npm8?
               # NOTE: The `from` syntax has changed in npm 7 to inclued the dependency name
-              npm7_locked_from = %("from": "#{dependency_name}@#{details[:version]}")
-              updated_lockfile_content = updated_lockfile_content.gsub(npm7_locked_from, original_from)
+              npm8_locked_from = %("from": "#{dependency_name}@#{details[:version]}")
+              updated_lockfile_content = updated_lockfile_content.gsub(npm8_locked_from, original_from)
             else
               npm6_locked_from = %("from": "#{details[:version]}")
               updated_lockfile_content = updated_lockfile_content.gsub(npm6_locked_from, original_from)
@@ -796,10 +798,10 @@ module Dependabot
           npmrc_content.match?(/^package-lock\s*=\s*false/)
         end
 
-        def npm7?
-          return @npm7 if defined?(@npm7)
+        def npm8?
+          return @npm8 if defined?(@npm8)
 
-          @npm7 = Dependabot::NpmAndYarn::Helpers.npm_version(lockfile.content) == "npm7"
+          @npm8 = Dependabot::NpmAndYarn::Helpers.npm_version(lockfile.content) == "npm8"
         end
 
         def sanitized_package_json_content(content)

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -4,8 +4,8 @@ module Dependabot
   module NpmAndYarn
     module Helpers
       def self.npm_version(lockfile_content)
-        return "npm7" unless lockfile_content
-        return "npm7" if JSON.parse(lockfile_content)["lockfileVersion"] >= 2
+        return "npm8" unless lockfile_content
+        return "npm8" if JSON.parse(lockfile_content)["lockfileVersion"] >= 2
 
         "npm6"
       rescue JSON::ParserError

data/lib/dependabot/npm_and_yarn/native_helpers.rb

@@ -14,7 +14,7 @@ module Dependabot
         File.join(__dir__, "../../../helpers")
       end
 
-      def self.npm7_subdependency_update_command(dependency_names)
+      def self.npm8_subdependency_update_command(dependency_names)
         # NOTE: npm options
         # - `--force` ignores checks for platform (os, cpu) and engines
         # - `--dry-run=false` the updater sets a global .npmrc with dry-run: true to

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -114,8 +114,8 @@ module Dependabot
             Dir.chdir(path) do
               npm_version = Dependabot::NpmAndYarn::Helpers.npm_version(lockfile_content)
 
-              if npm_version == "npm7"
-                SharedHelpers.run_shell_command(NativeHelpers.npm7_subdependency_update_command([dependency.name]))
+              if npm_version == "npm8"
+                SharedHelpers.run_shell_command(NativeHelpers.npm8_subdependency_update_command([dependency.name]))
                 { lockfile_name => File.read(lockfile_name) }
               else
                 SharedHelpers.run_helper_subprocess(

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -54,7 +54,7 @@ module Dependabot
         # or with two semver constraints:
         # npm ERR! Could not resolve dependency:
         # npm ERR! peer @opentelemetry/api@">=1.0.0 <1.1.0" from @opentelemetry/context-async-hooks@1.0.1
-        NPM7_PEER_DEP_ERROR_REGEX =
+        NPM8_PEER_DEP_ERROR_REGEX =
           /
             npm\s(?:WARN|ERR!)\sCould\snot\sresolve\sdependency:\n
             npm\s(?:WARN|ERR!)\speer\s(?<required_dep>\S+@\S+(\s\S+)?)\sfrom\s(?<requiring_dep>\S+@\S+)
@@ -258,8 +258,8 @@ module Dependabot
                 e.message.scan(NPM6_PEER_DEP_ERROR_REGEX) do
                   errors << Regexp.last_match.named_captures
                 end
-              elsif e.message.match?(NPM7_PEER_DEP_ERROR_REGEX)
-                e.message.scan(NPM7_PEER_DEP_ERROR_REGEX) do
+              elsif e.message.match?(NPM8_PEER_DEP_ERROR_REGEX)
+                e.message.scan(NPM8_PEER_DEP_ERROR_REGEX) do
                   errors << Regexp.last_match.named_captures
                 end
               elsif e.message.match?(YARN_PEER_DEP_ERROR_REGEX)
@@ -440,7 +440,7 @@ module Dependabot
               end
               npm_version = Dependabot::NpmAndYarn::Helpers.npm_version(package_lock&.content)
 
-              return run_npm7_checker(version: version) if npm_version == "npm7"
+              return run_npm8_checker(version: version) if npm_version == "npm8"
 
               SharedHelpers.run_helper_subprocess(
                 command: NativeHelpers.helper_path,
@@ -457,16 +457,16 @@ module Dependabot
           end
         end
 
-        def run_npm7_checker(version:)
+        def run_npm8_checker(version:)
           cmd =
             "npm install #{version_install_arg(version: version)} --package-lock-only --dry-run=true --ignore-scripts"
           output = SharedHelpers.run_shell_command(cmd)
-          if output.match?(NPM7_PEER_DEP_ERROR_REGEX)
+          if output.match?(NPM8_PEER_DEP_ERROR_REGEX)
             error_context = { command: cmd, process_exit_value: 1 }
             raise SharedHelpers::HelperSubprocessFailed.new(message: output, error_context: error_context)
           end
         rescue SharedHelpers::HelperSubprocessFailed => e
-          raise if e.message.match?(NPM7_PEER_DEP_ERROR_REGEX)
+          raise if e.message.match?(NPM8_PEER_DEP_ERROR_REGEX)
         end
 
         def version_install_arg(version:)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.175.0
+  version: 0.178.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-02-25 00:00:00.000000000 Z
+date: 2022-03-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.175.0
+        version: 0.178.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.175.0
+        version: 0.178.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement