dependabot-npm_and_yarn 0.196.0 → 0.196.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3461d61de14b92511754889ae9a9a5edafe20a6967037ec7946c5f6ec33e3615
-  data.tar.gz: f334af6509d4cb9e1afdcc9d06db1b5f200b597a5af4d2f617a0005922577677
+  metadata.gz: 7b7522d7728466cae083fc498a0e5c4a7923c46a56a38546f36834de5470fe84
+  data.tar.gz: a55c8659f731d24c8b93a13853d2d05bdc11eb72466873ab002b56b5d8a8ed99
 SHA512:
-  metadata.gz: 880b9e022bca930c2b0f4b66d7e56c381739682893a5aa209f391d668da544dcab947d8ff5fd319fe39cdf1686864e47f191431d476cf8224ecea314689d3f5a
-  data.tar.gz: 322da33f31ae13dee139041931b7c5e6a7ac9df4947679e1d00d413920b2cd9aae7e041247400ec265a17103a77870f04177926ea51985237c59cb3412671617
+  metadata.gz: f5c67225a4f85b8887d2318f236b078820c201e5daf654cde802633723005f98b7136f3581a9c1edc09d6f2923839454f4340580fc2e3f9e96d478de1de44de4
+  data.tar.gz: 7dd77797d4c581508b60c49adb083e6fab1f2fecdb74456f1b8d9fc2023172f6349cf3b12d2a70f0ab6af5930d73777fa62764dcbb39d2ccde12583e3e2bfec3

data/helpers/lib/npm/conflicting-dependency-parser.js

@@ -15,6 +15,8 @@ const semver = require("semver");
 async function findConflictingDependencies(directory, depName, targetVersion) {
   const arb = new Arborist({
     path: directory,
+    dryRun: true,
+    ignoreScripts: true,
   });
 
   return await arb.loadVirtual().then((tree) => {

data/helpers/lib/npm/vulnerability-auditor.js

@@ -34,6 +34,8 @@ const exec = promisify(require('child_process').exec)
 async function findVulnerableDependencies(directory, advisories) {
   const npmConfig = await loadNpmConfig()
   const caCerts = loadCACerts(npmConfig)
+  const registryOpts = extractRegistryOptions(npmConfig)
+  const registryCreds = loadNpmConfigCredentials(directory)
 
   const arb = new Arborist({
     path: directory,
@@ -41,6 +43,9 @@ async function findVulnerableDependencies(directory, advisories) {
     ca: caCerts,
     force: true,
     dryRun: true,
+    ignoreScripts: true,
+    ...registryOpts,
+    ...registryCreds,
   })
 
   const scope = nock('http://localhost:9999')
@@ -170,6 +175,39 @@ async function loadNpmConfig() {
   return JSON.parse(configOutput.stdout)
 }
 
+function extractRegistryOptions(npmConfig) {
+  const opts = []
+  for (const [key, value] of Object.entries(npmConfig)) {
+    if (key == "registry" || key.endsWith(":registry")) {
+      opts.push([key, value])
+    }
+  }
+  return Object.fromEntries(opts)
+}
+
+// loadNpmConfig doesn't return registry credentials so we need to manually extract them. If available,
+// Dependabot will have written them to the project's .npmrc file.
+const ini = require('ini')
+const path = require('path')
+
+const credKeys = ['token', '_authToken', '_auth']
+
+function loadNpmConfigCredentials(projectDir) {
+  const projectNpmrc = maybeReadFile(path.join(projectDir, '.npmrc'))
+  if (!projectNpmrc) {
+    return {}
+  }
+
+  const credentials = []
+  const config = ini.parse(projectNpmrc)
+  for (const [key, value] of Object.entries(config)) {
+    if (credKeys.includes(key) || credKeys.some((credKey) => key.endsWith(':' + credKey))) {
+      credentials.push([key, value])
+    }
+  }
+  return Object.fromEntries(credentials)
+}
+
 // sourced from npm's cli/lib/utils/config/definitions.js for reading certs from the cafile option
 const fs = require('fs')
 const maybeReadFile = file => {