dependabot-npm_and_yarn 0.196.2 → 0.197.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17d091442f5535aee32eff806235c2c2fd5a003c1a0462020b66ed72877193c5
-  data.tar.gz: 0bc5a3ea0d891b2b146b576fa173e335b61e6495eb7d5246fffc9c7742dc2e55
+  metadata.gz: 866b96901b075a70bbd36550219418d1b1e0e8c0f6cfb237785bebd8076f3b61
+  data.tar.gz: ba5e0030c5f9122c7607bc4462040519b287184cba1d1002821f7dd9a392b070
 SHA512:
-  metadata.gz: 488838fc133bb86735d241857ce6ce2825a2b00d555568999c435426e64b94a01f657f685f53b4f354daeb2437d257dcd319b4e935303bc8eb2237379ef25bd7
-  data.tar.gz: 239df30dd2eb4694e28f7382c1bfa6c75dc64b94d3d086c7831bbe893d1d06c5cb86244ad93635a192f0e96f6d3aa91aba6cefb535464f77492bad8796454c4b
+  metadata.gz: 3ce4c3daf6f9395f650e76955a9d71ed9f5747273880dede7f46afe21c4c3f24aacb24fa6a77ce932d0008fa9d8c9fde8584fdf78e272006d912bc73868e32ca
+  data.tar.gz: a4eff1acb0059fbbad93339b04768a48d85a9e3de5cc5b6958faaee93c7d2693657cfc33c7bf65f3ac573f0824cdb6b087d7c7cda8c50b8f0aeac3d34a839164

data/helpers/lib/npm/conflicting-dependency-parser.js

@@ -15,6 +15,8 @@ const semver = require("semver");
 async function findConflictingDependencies(directory, depName, targetVersion) {
   const arb = new Arborist({
     path: directory,
+    dryRun: true,
+    ignoreScripts: true,
   });
 
   return await arb.loadVirtual().then((tree) => {

data/helpers/lib/npm/vulnerability-auditor.js

@@ -43,6 +43,7 @@ async function findVulnerableDependencies(directory, advisories) {
     ca: caCerts,
     force: true,
     dryRun: true,
+    ignoreScripts: true,
     ...registryOpts,
     ...registryCreds,
   })