dependabot-npm_and_yarn 0.190.0 → 0.191.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e8fd36a5cc2b38c9b0c0b80cec9d429d7508464c740e44adf606da01c20edb2e
-  data.tar.gz: 2fbded9b7042c860af26060f14295e58fe6726382d26842e26546e96fae94ed3
+  metadata.gz: e5a135e31fe825f130a0500d45bdc43f2afdbc81ada4261e395f42121d731039
+  data.tar.gz: 9c99e2a1c9e815a43c08286cb68f034ae55df6e4482a66ea78fa3cfcae9ce8c3
 SHA512:
-  metadata.gz: 62340ef66e71ce68d7e62b8a31eb5798e74396b7689bdf5a1b77d64f392520def2fb8878135eb687519a8d4dc3557e70f64c67ec0cdced4d7d410827e72df6e5
-  data.tar.gz: 165eb6197b0a244e07774cfacc3215bde58726916ee99f3e1fd2c94b683eba6f906eb6437cfc89e5c1d78f77578915c1aaf05fda8a46b566c2c3b8e4298cf1df
+  metadata.gz: b0c7b3c84aad4c38ccc544a394649cde556152767c7ab3342930ca246c6d0667453868004488c298da81aaab5f58fe1ecf1b66bf88d56e6522c70fce7f7e55c9
+  data.tar.gz: 8bfda18f03db02a4a3dc5a82e49fb244e10a9d1e0fa1af7b5dfdc37d414937042a8e7ff91764d24fa9f8c4caa3418d3f774abee5e374bef9b1bcd4d6f8d7fc10

data/helpers/test/npm6/fixtures/updater/updated/package-lock.json

@@ -10,7 +10,7 @@
     "left-pad": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.1.3.tgz",
-      "integrity": "sha1-YS9hwDPzqeCOk58crr7qQbbzGZo="
+      "integrity": "sha512-m3z9QHpSXmd2H8Z5jnSXbGONPty4dFQfH1QpGgivzrEzICgsi50j9S+aGc77EaLoHpbw0BzP5+k1pp2UajTRuw=="
     }
   }
 }

data/helpers/test/yarn/fixtures/updater/updated/yarn.lock

@@ -9,4 +9,4 @@ is-positive@^3.1.0:
 left-pad@^1.1.3:
   version "1.1.3"
   resolved "https://registry.yarnpkg.com/left-pad/-/left-pad-1.1.3.tgz#612f61c033f3a9e08e939f1caebeea41b6f3199a"
-  integrity sha1-YS9hwDPzqeCOk58crr7qQbbzGZo=
+  integrity sha512-m3z9QHpSXmd2H8Z5jnSXbGONPty4dFQfH1QpGgivzrEzICgsi50j9S+aGc77EaLoHpbw0BzP5+k1pp2UajTRuw==

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -3,7 +3,9 @@
 require "json"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
+require "dependabot/npm_and_yarn/helpers"
 require "dependabot/npm_and_yarn/file_parser"
+require "dependabot/npm_and_yarn/file_parser/lockfile_parser"
 
 module Dependabot
   module NpmAndYarn
@@ -43,10 +45,25 @@ module Dependabot
         fetched_files += workspace_package_jsons
         fetched_files += lerna_packages
         fetched_files += path_dependencies(fetched_files)
+        instrument_package_manager_version
 
         fetched_files.uniq
       end
 
+      def instrument_package_manager_version
+        package_managers = {}
+
+        package_managers["npm"] =  Helpers.npm_version_numeric(package_lock.content) if package_lock
+        package_managers["yarn"] = 1 if yarn_lock
+        package_managers["shrinkwrap"] = 1 if shrinkwrap
+
+        Dependabot.instrument(
+          Notifications::FILE_PARSER_PACKAGE_MANAGER_VERSION_PARSED,
+          ecosystem: "npm",
+          package_managers: package_managers
+        )
+      end
+
       def package_json
         @package_json ||= fetch_file_from_host("package.json")
       end
@@ -304,18 +321,22 @@ module Dependabot
 
       # Only expands globs one level deep, so path/**/* gets expanded to path/
       def expanded_paths(path)
-        ignored_paths = path.scan(/!\((.*?)\)/).flatten
+        ignored_path = path.match?(/!\(.*?\)/) && path.gsub(/(!\((.*?)\))/, '\2')
 
         dir = directory.gsub(%r{(^/|/$)}, "")
         path = path.gsub(%r{^\./}, "").gsub(/!\(.*?\)/, "*")
         unglobbed_path = path.split("*").first&.gsub(%r{(?<=/)[^/]*$}, "") ||
                          "."
 
-        repo_contents(dir: unglobbed_path, raise_errors: false).
+        results =
+          repo_contents(dir: unglobbed_path, raise_errors: false).
           select { |file| file.type == "dir" }.
           map { |f| f.path.gsub(%r{^/?#{Regexp.escape(dir)}/?}, "") }.
-          select { |filename| File.fnmatch?(path, filename) }.
-          reject { |fn| ignored_paths.any? { |p| fn.include?(p) } }
+          select { |filename| File.fnmatch?(path, filename) }
+
+        return results unless ignored_path
+
+        results.reject { |filename| File.fnmatch?(ignored_path, filename) }
       end
 
       def parsed_package_json

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -4,12 +4,16 @@ module Dependabot
   module NpmAndYarn
     module Helpers
       def self.npm_version(lockfile_content)
-        return "npm8" unless lockfile_content
-        return "npm8" if JSON.parse(lockfile_content)["lockfileVersion"] >= 2
+        "npm#{npm_version_numeric(lockfile_content)}"
+      end
+
+      def self.npm_version_numeric(lockfile_content)
+        return 8 unless lockfile_content
+        return 8 if JSON.parse(lockfile_content)["lockfileVersion"] >= 2
 
-        "npm6"
+        6
       rescue JSON::ParserError
-        "npm6"
+        6
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.190.0
+  version: 0.191.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-23 00:00:00.000000000 Z
+date: 2022-06-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.190.0
+        version: 0.191.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.190.0
+        version: 0.191.1
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement