dependabot-npm_and_yarn 0.190.1 → 0.192.0
Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 84d86e305584a9618478b577321f23f3deb822ec60f1e202dddef4e92a69bfda
|
4
|
+
data.tar.gz: 6aabe28b029811df4cba03a6b3a4476e5d520c87a36257ecfc9d51200f049015
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 50554ba9711f1b3b07e22d813696e17967984c70295a09b9a542a6515bd2083b162bd6225d539c239baf2860ca4c8dfc5b8a258625261cd8e909ebeb24c2332e
|
7
|
+
data.tar.gz: 26c338472ad8d98aa47da37e2f0a3a20f3a68167c6281356dfe6a37e3bb35d7e9ff74cb74f2dab4f5470e4d81e6c61ad0a2e0a3db7a6fef32eb4f7d79585ec11
|
@@ -3,7 +3,9 @@
|
|
3
3
|
require "json"
|
4
4
|
require "dependabot/file_fetchers"
|
5
5
|
require "dependabot/file_fetchers/base"
|
6
|
+
require "dependabot/npm_and_yarn/helpers"
|
6
7
|
require "dependabot/npm_and_yarn/file_parser"
|
8
|
+
require "dependabot/npm_and_yarn/file_parser/lockfile_parser"
|
7
9
|
|
8
10
|
module Dependabot
|
9
11
|
module NpmAndYarn
|
@@ -43,10 +45,25 @@ module Dependabot
|
|
43
45
|
fetched_files += workspace_package_jsons
|
44
46
|
fetched_files += lerna_packages
|
45
47
|
fetched_files += path_dependencies(fetched_files)
|
48
|
+
instrument_package_manager_version
|
46
49
|
|
47
50
|
fetched_files.uniq
|
48
51
|
end
|
49
52
|
|
53
|
+
def instrument_package_manager_version
|
54
|
+
package_managers = {}
|
55
|
+
|
56
|
+
package_managers["npm"] = Helpers.npm_version_numeric(package_lock.content) if package_lock
|
57
|
+
package_managers["yarn"] = 1 if yarn_lock
|
58
|
+
package_managers["shrinkwrap"] = 1 if shrinkwrap
|
59
|
+
|
60
|
+
Dependabot.instrument(
|
61
|
+
Notifications::FILE_PARSER_PACKAGE_MANAGER_VERSION_PARSED,
|
62
|
+
ecosystem: "npm",
|
63
|
+
package_managers: package_managers
|
64
|
+
)
|
65
|
+
end
|
66
|
+
|
50
67
|
def package_json
|
51
68
|
@package_json ||= fetch_file_from_host("package.json")
|
52
69
|
end
|
@@ -304,18 +321,22 @@ module Dependabot
|
|
304
321
|
|
305
322
|
# Only expands globs one level deep, so path/**/* gets expanded to path/
|
306
323
|
def expanded_paths(path)
|
307
|
-
|
324
|
+
ignored_path = path.match?(/!\(.*?\)/) && path.gsub(/(!\((.*?)\))/, '\2')
|
308
325
|
|
309
326
|
dir = directory.gsub(%r{(^/|/$)}, "")
|
310
327
|
path = path.gsub(%r{^\./}, "").gsub(/!\(.*?\)/, "*")
|
311
328
|
unglobbed_path = path.split("*").first&.gsub(%r{(?<=/)[^/]*$}, "") ||
|
312
329
|
"."
|
313
330
|
|
314
|
-
|
331
|
+
results =
|
332
|
+
repo_contents(dir: unglobbed_path, raise_errors: false).
|
315
333
|
select { |file| file.type == "dir" }.
|
316
334
|
map { |f| f.path.gsub(%r{^/?#{Regexp.escape(dir)}/?}, "") }.
|
317
|
-
select { |filename| File.fnmatch?(path, filename) }
|
318
|
-
|
335
|
+
select { |filename| File.fnmatch?(path, filename) }
|
336
|
+
|
337
|
+
return results unless ignored_path
|
338
|
+
|
339
|
+
results.reject { |filename| File.fnmatch?(ignored_path, filename) }
|
319
340
|
end
|
320
341
|
|
321
342
|
def parsed_package_json
|
@@ -4,12 +4,16 @@ module Dependabot
|
|
4
4
|
module NpmAndYarn
|
5
5
|
module Helpers
|
6
6
|
def self.npm_version(lockfile_content)
|
7
|
-
|
8
|
-
|
7
|
+
"npm#{npm_version_numeric(lockfile_content)}"
|
8
|
+
end
|
9
|
+
|
10
|
+
def self.npm_version_numeric(lockfile_content)
|
11
|
+
return 8 unless lockfile_content
|
12
|
+
return 8 if JSON.parse(lockfile_content)["lockfileVersion"] >= 2
|
9
13
|
|
10
|
-
|
14
|
+
6
|
11
15
|
rescue JSON::ParserError
|
12
|
-
|
16
|
+
6
|
13
17
|
end
|
14
18
|
end
|
15
19
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: dependabot-npm_and_yarn
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.
|
4
|
+
version: 0.192.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Dependabot
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2022-
|
11
|
+
date: 2022-06-13 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: dependabot-common
|
@@ -16,14 +16,14 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - '='
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version: 0.
|
19
|
+
version: 0.192.0
|
20
20
|
type: :runtime
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - '='
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: 0.
|
26
|
+
version: 0.192.0
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
name: debase
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|