dependabot-npm_and_yarn 0.185.0 → 0.187.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5d42472b33cbd3bc18ffc46a89ec1258b99ee91c06f37df754c34d918c984054
-  data.tar.gz: 2f7ad25e3389283e30decb7d515d793d6e1ecdef2f5de75ac81b2dce53bcf15a
+  metadata.gz: 4fecb25c98d20c0537bb14fbfbf5f0ae606a09c03bcd8c69686104ae8ea2b60e
+  data.tar.gz: 49c8c245cfcbd8a7c0f56acd3fcde70fdf89ddaa22c131b0870f776af1f35d4f
 SHA512:
-  metadata.gz: 9608c5d0237700098c9488abf00b3d58d8a6c5cd9487fcd38a2a46fed9e737bef85bd3bbb7c11d8db5571701d960b96164507b709319f1ea3f7d9d89ec62227a
-  data.tar.gz: 4124eadef4cca03dbad1a826e1cc225a213920971aff8c451af0357fa6be94b7af50defb856509c20938dcb7e71c22574e32dc90971fac130cad56d7547ae04c
+  metadata.gz: 8f9b74182a2a7eea592f0087787ce6c36d95cb223fc0f2367c414e701f76944529986994e31c3699b670e68a56f5d34ba09597c0c59591440fc5a142ae765a63
+  data.tar.gz: ee6a76e595a5db7fb2ea1d61b3482a6739864c038ed0b4d1806a1c16dcd00085b7af05a8b7582e7e9dd0db9020487c98cfd459ef653ad0d9ebbd70479db12adb

data/lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb

@@ -48,7 +48,9 @@ module Dependabot
         end
 
         def global_registry # rubocop:disable Metrics/PerceivedComplexity
-          @global_registry ||=
+          return @global_registry if defined?(@global_registry)
+
+          @global_registry =
             registry_credentials.find do |cred|
               next false if CENTRAL_REGISTRIES.include?(cred["registry"])
 
@@ -132,21 +134,24 @@ module Dependabot
         def credential_lines_for_npmrc
           lines = []
           registry_credentials.each do |cred|
-            registry = cred.fetch("registry").sub(%r{\/?$}, "/")
+            registry = cred.fetch("registry")
 
             lines += registry_scopes(registry) if registry_scopes(registry)
 
             token = cred.fetch("token", nil)
             next unless token
 
+            # We need to ensure the registry uri ends with a trailing slash in the npmrc file
+            # but we do not want to add one if it already exists
+            registry_with_trailing_slash = registry.sub(%r{\/?$}, "/")
             if token.include?(":")
               encoded_token = Base64.encode64(token).delete("\n")
-              lines << "//#{registry}:_auth=#{encoded_token}"
+              lines << "//#{registry_with_trailing_slash}:_auth=#{encoded_token}"
             elsif Base64.decode64(token).ascii_only? &&
                   Base64.decode64(token).include?(":")
-              lines << %(//#{registry}:_auth=#{token.delete("\n")})
+              lines << %(//#{registry_with_trailing_slash}:_auth=#{token.delete("\n")})
             else
-              lines << "//#{registry}:_authToken=#{token}"
+              lines << "//#{registry_with_trailing_slash}:_authToken=#{token}"
             end
           end
 
@@ -169,7 +174,6 @@ module Dependabot
         def registry_scopes(registry)
           # Central registries don't just apply to scopes
           return if CENTRAL_REGISTRIES.include?(registry)
-
           return unless dependency_urls
 
           other_regs =

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "uri"
+
 require "dependabot/npm_and_yarn/file_updater"
 require "dependabot/npm_and_yarn/file_parser"
 require "dependabot/npm_and_yarn/update_checker/registry_finder"
@@ -436,7 +438,7 @@ module Dependabot
         def handle_timeout(error_message, yarn_lock)
           url = error_message.match(TIMEOUT_FETCHING_PACKAGE).
                 named_captures["url"]
-          return if url.start_with?("https://registry.npmjs.org")
+          raise if URI(url).host == "registry.npmjs.org"
 
           package_name = error_message.match(TIMEOUT_FETCHING_PACKAGE).
                          named_captures["package"]
@@ -482,7 +484,7 @@ module Dependabot
 
           return false unless yarnrc_global_registry
 
-          yarnrc_global_registry.include?("registry.npmjs.org")
+          URI(yarnrc_global_registry).host == "registry.npmjs.org"
         end
 
         def yarnrc_content

data/lib/dependabot/npm_and_yarn/package_name.rb

@@ -3,17 +3,17 @@
 module Dependabot
   module NpmAndYarn
     class PackageName
-      DEFINITELY_TYPED_SCOPE = /types/i.freeze
-      PACKAGE_NAME_REGEX     = %r{
+      PACKAGE_NAME_REGEX = %r{
           \A                                         # beginning of string
           (?=.{1,214}\z)                             # enforce length (1 - 214)
           (@(?<scope>[a-z0-9\-~][a-z0-9\-\._~]*)\/)? # capture 'scope' if present
           (?<name>[a-z0-9\-~][a-z0-9\-._~]*)         # capture package name
           \z                                         # end of string
       }xi.freeze                                     # multi-line/case-insensitive
+
       TYPES_PACKAGE_NAME_REGEX = %r{
           \A                                         # beginning of string
-          @#{DEFINITELY_TYPED_SCOPE}\/               # starts with @types/
+          @types\/                                   # starts with @types/
           ((?<scope>.+)__)?                          # capture scope
           (?<name>.+)                                # capture name
           \z                                         # end of string
@@ -37,16 +37,20 @@ module Dependabot
         end
       end
 
-      def <=>(other)
-        to_s.casecmp(other.to_s)
+      def eql?(other)
+        self.class == other.class && to_s == other.to_s
       end
 
-      def eql?(other)
-        to_s.eql?(other.to_s)
+      def hash
+        to_s.downcase.hash
+      end
+
+      def <=>(other)
+        to_s.casecmp(other.to_s)
       end
 
       def library_name
-        return self unless types_package?
+        return unless types_package?
 
         @library_name ||=
           begin
@@ -60,7 +64,7 @@ module Dependabot
       end
 
       def types_package_name
-        return self if types_package?
+        return if types_package?
 
         @types_package_name ||=
           if scoped?
@@ -77,7 +81,7 @@ module Dependabot
       end
 
       def types_package?
-        DEFINITELY_TYPED_SCOPE.match?(@scope)
+        "types".casecmp?(@scope)
       end
     end
   end

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -9,6 +9,7 @@ require "dependabot/npm_and_yarn/file_updater/npmrc_builder"
 require "dependabot/npm_and_yarn/file_updater/package_json_preparer"
 require "dependabot/npm_and_yarn/helpers"
 require "dependabot/npm_and_yarn/native_helpers"
+require "dependabot/npm_and_yarn/package_name"
 require "dependabot/npm_and_yarn/requirement"
 require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/npm_and_yarn/version"
@@ -74,6 +75,8 @@ module Dependabot
         def latest_resolvable_version
           return latest_allowable_version if git_dependency?(dependency)
           return if part_of_tightly_locked_monorepo?
+          return if types_update_available?
+          return if original_package_update_available?
 
           return latest_allowable_version unless relevant_unmet_peer_dependencies.any?
 
@@ -90,10 +93,12 @@ module Dependabot
           resolve_latest_previous_version(dependency, updated_version)
         end
 
+        # rubocop:disable Metrics/PerceivedComplexity
         def dependency_updates_from_full_unlock
           return if git_dependency?(dependency)
           return updated_monorepo_dependencies if part_of_tightly_locked_monorepo?
           return if newly_broken_peer_reqs_from_dep.any?
+          return if original_package_update_available?
 
           updates = [{
             dependency: dependency,
@@ -122,8 +127,10 @@ module Dependabot
               )
             }
           end
+          updates += updated_types_dependencies if types_update_available?
           updates.uniq
         end
+        # rubocop:enable Metrics/PerceivedComplexity
 
         private
 
@@ -222,6 +229,60 @@ module Dependabot
           updates
         end
 
+        def types_package
+          @types_package ||= begin
+            types_package_name = PackageName.new(dependency.name).types_package_name
+            top_level_dependencies.find { |d| types_package_name.to_s == d.name } if types_package_name
+          end
+        end
+
+        def original_package
+          @original_package ||= begin
+            original_package_name = PackageName.new(dependency.name).library_name
+            top_level_dependencies.find { |d| original_package_name.to_s == d.name } if original_package_name
+          end
+        end
+
+        def latest_types_package_version
+          @latest_types_package_version ||= latest_version_finder(types_package).latest_version_from_registry
+        end
+
+        def types_update_available?
+          return false if types_package.nil?
+
+          return false unless latest_allowable_version.backwards_compatible_with?(latest_types_package_version)
+
+          return false unless version_class.correct?(types_package.version)
+
+          current_types_package_version = version_class.new(types_package.version)
+
+          return false unless current_types_package_version < latest_types_package_version
+
+          true
+        end
+
+        def original_package_update_available?
+          return false if original_package.nil?
+
+          return false unless version_class.correct?(original_package.version)
+
+          original_package_version = version_class.new(original_package.version)
+
+          latest_version = latest_version_finder(original_package).latest_version_from_registry
+
+          original_package_version < latest_version
+        end
+
+        def updated_types_dependencies
+          [{
+            dependency: types_package,
+            version: latest_types_package_version,
+            previous_version: resolve_latest_previous_version(
+              types_package, latest_types_package_version
+            )
+          }]
+        end
+
         def peer_dependency_errors
           return @peer_dependency_errors if @peer_dependency_errors_checked
 

data/lib/dependabot/npm_and_yarn/version.rb

@@ -34,6 +34,27 @@ module Dependabot
         super
       end
 
+      def major
+        @major ||= segments[0] || 0
+      end
+
+      def minor
+        @minor ||= segments[1] || 0
+      end
+
+      def patch
+        @patch ||= segments[2] || 0
+      end
+
+      def backwards_compatible_with?(other)
+        case major
+        when 0
+          self == other
+        else
+          major == other.major && minor >= other.minor
+        end
+      end
+
       def to_s
         @version_string
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.185.0
+  version: 0.187.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-09 00:00:00.000000000 Z
+date: 2022-05-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.185.0
+        version: 0.187.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.185.0
+        version: 0.187.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement