dependabot-npm_and_yarn 0.186.0 → 0.188.0

data/helpers/package.json

@@ -12,13 +12,13 @@
     "@dependabot/yarn-lib": "^1.21.1",
     "@npmcli/arborist": "^5.1.0",
     "detect-indent": "^6.1.0",
-    "npm": "6.14.16",
+    "npm": "6.14.17",
     "semver": "^7.3.7"
   },
   "devDependencies": {
-    "eslint": "^8.13.0",
+    "eslint": "^8.15.0",
     "eslint-config-prettier": "^8.5.0",
-    "jest": "^27.5.1",
+    "jest": "^28.1.0",
     "prettier": "^2.6.2",
     "rimraf": "^3.0.2"
   }

data/lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb

@@ -48,7 +48,9 @@ module Dependabot
         end
 
         def global_registry # rubocop:disable Metrics/PerceivedComplexity
-          @global_registry ||=
+          return @global_registry if defined?(@global_registry)
+
+          @global_registry =
             registry_credentials.find do |cred|
               next false if CENTRAL_REGISTRIES.include?(cred["registry"])
 
@@ -132,21 +134,24 @@ module Dependabot
         def credential_lines_for_npmrc
           lines = []
           registry_credentials.each do |cred|
-            registry = cred.fetch("registry").sub(%r{\/?$}, "/")
+            registry = cred.fetch("registry")
 
             lines += registry_scopes(registry) if registry_scopes(registry)
 
             token = cred.fetch("token", nil)
             next unless token
 
+            # We need to ensure the registry uri ends with a trailing slash in the npmrc file
+            # but we do not want to add one if it already exists
+            registry_with_trailing_slash = registry.sub(%r{\/?$}, "/")
             if token.include?(":")
               encoded_token = Base64.encode64(token).delete("\n")
-              lines << "//#{registry}:_auth=#{encoded_token}"
+              lines << "//#{registry_with_trailing_slash}:_auth=#{encoded_token}"
             elsif Base64.decode64(token).ascii_only? &&
                   Base64.decode64(token).include?(":")
-              lines << %(//#{registry}:_auth=#{token.delete("\n")})
+              lines << %(//#{registry_with_trailing_slash}:_auth=#{token.delete("\n")})
             else
-              lines << "//#{registry}:_authToken=#{token}"
+              lines << "//#{registry_with_trailing_slash}:_authToken=#{token}"
             end
           end
 
@@ -169,7 +174,6 @@ module Dependabot
         def registry_scopes(registry)
           # Central registries don't just apply to scopes
           return if CENTRAL_REGISTRIES.include?(registry)
-
           return unless dependency_urls
 
           other_regs =

data/lib/dependabot/npm_and_yarn/package_name.rb

@@ -3,17 +3,17 @@
 module Dependabot
   module NpmAndYarn
     class PackageName
-      DEFINITELY_TYPED_SCOPE = /types/i.freeze
-      PACKAGE_NAME_REGEX     = %r{
+      PACKAGE_NAME_REGEX = %r{
           \A                                         # beginning of string
           (?=.{1,214}\z)                             # enforce length (1 - 214)
           (@(?<scope>[a-z0-9\-~][a-z0-9\-\._~]*)\/)? # capture 'scope' if present
           (?<name>[a-z0-9\-~][a-z0-9\-._~]*)         # capture package name
           \z                                         # end of string
       }xi.freeze                                     # multi-line/case-insensitive
+
       TYPES_PACKAGE_NAME_REGEX = %r{
           \A                                         # beginning of string
-          @#{DEFINITELY_TYPED_SCOPE}\/               # starts with @types/
+          @types\/                                   # starts with @types/
           ((?<scope>.+)__)?                          # capture scope
           (?<name>.+)                                # capture name
           \z                                         # end of string
@@ -81,7 +81,7 @@ module Dependabot
       end
 
       def types_package?
-        DEFINITELY_TYPED_SCOPE.match?(@scope)
+        "types".casecmp?(@scope)
       end
     end
   end

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -252,7 +252,10 @@ module Dependabot
 
           return false unless latest_allowable_version.backwards_compatible_with?(latest_types_package_version)
 
+          return false unless version_class.correct?(types_package.version)
+
           current_types_package_version = version_class.new(types_package.version)
+
           return false unless current_types_package_version < latest_types_package_version
 
           true
@@ -261,9 +264,12 @@ module Dependabot
         def original_package_update_available?
           return false if original_package.nil?
 
-          latest_version = latest_version_finder(original_package).latest_version_from_registry
+          return false unless version_class.correct?(original_package.version)
+
           original_package_version = version_class.new(original_package.version)
 
+          latest_version = latest_version_finder(original_package).latest_version_from_registry
+
           original_package_version < latest_version
         end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.186.0
+  version: 0.188.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-10 00:00:00.000000000 Z
+date: 2022-05-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.186.0
+        version: 0.188.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.186.0
+        version: 0.188.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.28.2
+        version: 1.29.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.28.2
+        version: 1.29.1
 - !ruby/object:Gem::Dependency
   name: ruby-debug-ide
   requirement: !ruby/object:Gem::Requirement