dependabot-npm_and_yarn 0.190.1 → 0.192.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c1e71518c6b7d019932082e6ca55a5c323362fb55834e90cdf5ea71dc827095d
-  data.tar.gz: 2fc41215a1d9272dafc6c289bc5baa499b53ec91f927c2ac2a6dc1a7579c665d
+  metadata.gz: 84d86e305584a9618478b577321f23f3deb822ec60f1e202dddef4e92a69bfda
+  data.tar.gz: 6aabe28b029811df4cba03a6b3a4476e5d520c87a36257ecfc9d51200f049015
 SHA512:
-  metadata.gz: 81683a57bd5c0796682b769bd107c51c76fdb75a984af53484d4faa612d2dc7f8a7e767115df1780234067719ad693cc08492bbf0ead0e911289277cabf58399
-  data.tar.gz: 3f3201bdff681d127be04df52071d10bf2795667954da36f37868c87657760e99daf5e0eb41294a3b623c3d165997327a952afb444653bcb9b4c4b3ce42d8107
+  metadata.gz: 50554ba9711f1b3b07e22d813696e17967984c70295a09b9a542a6515bd2083b162bd6225d539c239baf2860ca4c8dfc5b8a258625261cd8e909ebeb24c2332e
+  data.tar.gz: 26c338472ad8d98aa47da37e2f0a3a20f3a68167c6281356dfe6a37e3bb35d7e9ff74cb74f2dab4f5470e4d81e6c61ad0a2e0a3db7a6fef32eb4f7d79585ec11

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -3,7 +3,9 @@
 require "json"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
+require "dependabot/npm_and_yarn/helpers"
 require "dependabot/npm_and_yarn/file_parser"
+require "dependabot/npm_and_yarn/file_parser/lockfile_parser"
 
 module Dependabot
   module NpmAndYarn
@@ -43,10 +45,25 @@ module Dependabot
         fetched_files += workspace_package_jsons
         fetched_files += lerna_packages
         fetched_files += path_dependencies(fetched_files)
+        instrument_package_manager_version
 
         fetched_files.uniq
       end
 
+      def instrument_package_manager_version
+        package_managers = {}
+
+        package_managers["npm"] =  Helpers.npm_version_numeric(package_lock.content) if package_lock
+        package_managers["yarn"] = 1 if yarn_lock
+        package_managers["shrinkwrap"] = 1 if shrinkwrap
+
+        Dependabot.instrument(
+          Notifications::FILE_PARSER_PACKAGE_MANAGER_VERSION_PARSED,
+          ecosystem: "npm",
+          package_managers: package_managers
+        )
+      end
+
       def package_json
         @package_json ||= fetch_file_from_host("package.json")
       end
@@ -304,18 +321,22 @@ module Dependabot
 
       # Only expands globs one level deep, so path/**/* gets expanded to path/
       def expanded_paths(path)
-        ignored_paths = path.scan(/!\((.*?)\)/).flatten
+        ignored_path = path.match?(/!\(.*?\)/) && path.gsub(/(!\((.*?)\))/, '\2')
 
         dir = directory.gsub(%r{(^/|/$)}, "")
         path = path.gsub(%r{^\./}, "").gsub(/!\(.*?\)/, "*")
         unglobbed_path = path.split("*").first&.gsub(%r{(?<=/)[^/]*$}, "") ||
                          "."
 
-        repo_contents(dir: unglobbed_path, raise_errors: false).
+        results =
+          repo_contents(dir: unglobbed_path, raise_errors: false).
           select { |file| file.type == "dir" }.
           map { |f| f.path.gsub(%r{^/?#{Regexp.escape(dir)}/?}, "") }.
-          select { |filename| File.fnmatch?(path, filename) }.
-          reject { |fn| ignored_paths.any? { |p| fn.include?(p) } }
+          select { |filename| File.fnmatch?(path, filename) }
+
+        return results unless ignored_path
+
+        results.reject { |filename| File.fnmatch?(ignored_path, filename) }
       end
 
       def parsed_package_json

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -4,12 +4,16 @@ module Dependabot
   module NpmAndYarn
     module Helpers
       def self.npm_version(lockfile_content)
-        return "npm8" unless lockfile_content
-        return "npm8" if JSON.parse(lockfile_content)["lockfileVersion"] >= 2
+        "npm#{npm_version_numeric(lockfile_content)}"
+      end
+
+      def self.npm_version_numeric(lockfile_content)
+        return 8 unless lockfile_content
+        return 8 if JSON.parse(lockfile_content)["lockfileVersion"] >= 2
 
-        "npm6"
+        6
       rescue JSON::ParserError
-        "npm6"
+        6
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.190.1
+  version: 0.192.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-31 00:00:00.000000000 Z
+date: 2022-06-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.190.1
+        version: 0.192.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.190.1
+        version: 0.192.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement