dependabot-npm_and_yarn 0.196.4 → 0.199.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 69ba3d07e5c8921abc3968db377134c08c1704171291ec76c130f4fbdd3449a5
-  data.tar.gz: 79f23aa0fe41a68fa6f1d64d89ef62d91e03cccd606ce92c0905a5d884e1f377
+  metadata.gz: 8c0fcc145eb52dad9645d7ccc70869973fc1314c91d1b0b1d12776fef1b69047
+  data.tar.gz: 2368f8ad52b64b386ae28eaca6fe0f00d468dfbc54c335cb2b063b637674161b
 SHA512:
-  metadata.gz: 629aaedf620875cf21accb159c6bff0315d9047f4835853eccdabd1147346e7697d001e83c7fcb0e3f2312c7eb716eeb19c344a8c79e123a68901126a2c46976
-  data.tar.gz: 2cfd3991a035b564218c7f1dd01fc60e66f224a14ffb3b2c4f8256373884fcec77e81f7310e65b858e204c806bac223d5f38931810a4eda58b35ff2e3885dd49
+  metadata.gz: 7f1314a97d127c4d3e203bae73074d7c97f833cd1830f17c44ba2b54de122344224a752047d8e0e08eb09f4e1c2c36ac69709585d1b2317869b2fca2afdc76eb
+  data.tar.gz: 285a995834eaa0d8115d52be7157e6e24e5dbd7a93daeb19bbb137436043c18ed6742380ec99dc0bb5c225fb00f961187c5e13a71550155f22cb380b81555b83

data/helpers/lib/npm/vulnerability-auditor.js

@@ -28,7 +28,7 @@
 
 const Arborist = require('@npmcli/arborist')
 const nock = require('nock')
-const { promisify } = require('util');
+const { inspect, promisify } = require('util');
 const exec = promisify(require('child_process').exec)
 
 async function findVulnerableDependencies(directory, advisories) {
@@ -136,7 +136,8 @@ function convertAdvisoriesToRegistryBulkFormat(advisories) {
 }
 
 /* Traverses all effects originating from the named dependency in the
- * audit report and builds an array of all dependency chains,
+ * audit report and returns an array of dependency chains rooted in the named
+ * dependency,
  *   [
  *    {
  *      fixAvailable: true | false | object,
@@ -153,21 +154,56 @@ function convertAdvisoriesToRegistryBulkFormat(advisories) {
  * applies to the first item in the chain (if that item is fixable, then
  * every item after it must be fixable, too).
  */
-function buildDependencyChains(auditReport, name, chain = { items: [] }) {
-  const vuln = auditReport.get(name)
-  const version = [...vuln.nodes][0].version
-  const item = { name, version }
-
-  if (!vuln.effects.size) {
-    // If the current vuln has no effects, we've reached the end of this chain.
-    return [{ fixAvailable: vuln.fixAvailable, items: [item, ...chain.items] }]
+function buildDependencyChains(auditReport, name) {
+  const helper = (name, chain, visited) => {
+    // The vuln for this dependency.
+    const vuln = auditReport.get(name)
+
+    // The current version of this dependency.
+    const version = [...vuln.nodes][0].version
+
+    // The item that will represent this dependency in this chain.
+    const item = { name, version }
+
+    // Array of effects, excluding cycles.
+    const effects = [...vuln.effects]
+
+    if (visited.has(name)) {
+      // We've already visited this dependency in this chain, so we've detected a cycle.
+      // We currently throw when this happens. Ultimately we want to gracefully handle
+      // cycles and still return the recommended fix updates.
+      const source = chain.items[chain.items.length-1]
+      const message = `Cycle detected while traversing effects from ` +
+        `${source.name}@${source.version}: ` +
+        inspect([name, ...visited], {
+          breakLength: Infinity,
+          depth: 1,
+          maxStringLength: 255,
+        })
+      throw new Error(message)
+    }
+
+    if (!effects.length) {
+      // If the current vuln has no effects, we've reached the end of this chain.
+      return [{ fixAvailable: vuln.fixAvailable, items: [item, ...chain.items] }]
+    }
+
+    return effects.reduce((chains, effect) => {
+      return chains.concat(
+        helper(effect.name, { items: [item, ...chain.items] }, new Set([name, ...visited])))
+    }, [])
   }
 
-  return [...vuln.effects].reduce((chains, effect) => {
-    return chains.concat(
-      buildDependencyChains(
-        auditReport, effect.name, { items: [item, ...chain.items] }))
-  }, [])
+  const chains = helper(name, { items: [] }, new Set())
+  const seen = new Set()
+  return chains.filter(chain => {
+    const head = chain.items[0]
+    if (seen.has(head.name)) {
+      return false
+    }
+    seen.add(head.name)
+    return true
+  })
 }
 
 async function loadNpmConfig() {

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.196.4
+  version: 0.199.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-07-14 00:00:00.000000000 Z
+date: 2022-07-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.196.4
+        version: 0.199.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.196.4
+        version: 0.199.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement