dependabot-npm_and_yarn 0.196.0 → 0.196.1

data/helpers/package.json

@@ -10,16 +10,16 @@
   },
   "dependencies": {
     "@dependabot/yarn-lib": "^1.21.1",
-    "@npmcli/arborist": "^5.2.0",
+    "@npmcli/arborist": "^5.2.3",
     "detect-indent": "^6.1.0",
-    "nock": "^13.2.4",
+    "nock": "^13.2.7",
     "npm": "6.14.17",
     "semver": "^7.3.7"
   },
   "devDependencies": {
     "eslint": "^8.18.0",
     "eslint-config-prettier": "^8.5.0",
-    "jest": "^28.1.0",
+    "jest": "^28.1.1",
     "prettier": "^2.7.1",
     "rimraf": "^3.0.2"
   }

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -142,18 +142,12 @@ module Dependabot
       end
 
       def conflicting_updated_dependencies
-        top_level_dependencies = FileParser.new(
-          dependency_files: dependency_files,
-          credentials: credentials,
-          source: nil
-        ).parse.select(&:top_level?)
-
-        top_level_dependency_lookup = top_level_dependencies.map { |dep| [dep.name, dep] }.to_h
+        top_level_dependencies = top_level_dependency_lookup
 
         updated_deps = []
         vulnerability_audit["fix_updates"].each do |update|
           dependency_name = update["dependency_name"]
-          requirements = top_level_dependency_lookup[dependency_name]&.requirements || []
+          requirements = top_level_dependencies[dependency_name]&.requirements || []
           conflicting_dep = Dependency.new(
             name: dependency_name,
             package_manager: "npm_and_yarn",
@@ -178,7 +172,19 @@ module Dependabot
           )
         end
 
-        updated_deps
+        # Target dependency should be first in the result to support rebases
+        updated_deps.select { |dep| dep.name == dependency.name } +
+          updated_deps.reject { |dep| dep.name == dependency.name }
+      end
+
+      def top_level_dependency_lookup
+        top_level_dependencies = FileParser.new(
+          dependency_files: dependency_files,
+          credentials: credentials,
+          source: nil
+        ).parse.select(&:top_level?)
+
+        top_level_dependencies.map { |dep| [dep.name, dep] }.to_h
       end
 
       def build_updated_dependency(update_details)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.196.0
+  version: 0.196.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-06-24 00:00:00.000000000 Z
+date: 2022-06-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.196.0
+        version: 0.196.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.196.0
+        version: 0.196.1
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement