dependabot-npm_and_yarn 0.197.0 → 0.198.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 866b96901b075a70bbd36550219418d1b1e0e8c0f6cfb237785bebd8076f3b61
-  data.tar.gz: ba5e0030c5f9122c7607bc4462040519b287184cba1d1002821f7dd9a392b070
+  metadata.gz: 8b4af608f94aedfc8112da94b62a4691f1c496af6f47d41cc8445171cbd32e5a
+  data.tar.gz: 0d765146b3970caf42148f34d1d849beb0c71d02045330835dc14a4d4179a16b
 SHA512:
-  metadata.gz: 3ce4c3daf6f9395f650e76955a9d71ed9f5747273880dede7f46afe21c4c3f24aacb24fa6a77ce932d0008fa9d8c9fde8584fdf78e272006d912bc73868e32ca
-  data.tar.gz: a4eff1acb0059fbbad93339b04768a48d85a9e3de5cc5b6958faaee93c7d2693657cfc33c7bf65f3ac573f0824cdb6b087d7c7cda8c50b8f0aeac3d34a839164
+  metadata.gz: 4a9ef601dfaa9aa8afec0658a373e94f34e274ae1da55f45c4468dc7b2e2fe7664ae3936b233124c8a0fb6405043b968477715d16d952a2082101f3bd7c8e593
+  data.tar.gz: 692756d692992aa35ef3fca4a8055ee6f31444df48d42c036f1c7398514bf7a802f307914e9671905c4c924fab155ece1b631655931df3f9d4112fec86182185

data/helpers/lib/npm/vulnerability-auditor.js

@@ -28,7 +28,7 @@
 
 const Arborist = require('@npmcli/arborist')
 const nock = require('nock')
-const { promisify } = require('util');
+const { inspect, promisify } = require('util');
 const exec = promisify(require('child_process').exec)
 
 async function findVulnerableDependencies(directory, advisories) {
@@ -136,7 +136,8 @@ function convertAdvisoriesToRegistryBulkFormat(advisories) {
 }
 
 /* Traverses all effects originating from the named dependency in the
- * audit report and builds an array of all dependency chains,
+ * audit report and returns an array of dependency chains rooted in the named
+ * dependency,
  *   [
  *    {
  *      fixAvailable: true | false | object,
@@ -153,21 +154,56 @@ function convertAdvisoriesToRegistryBulkFormat(advisories) {
  * applies to the first item in the chain (if that item is fixable, then
  * every item after it must be fixable, too).
  */
-function buildDependencyChains(auditReport, name, chain = { items: [] }) {
-  const vuln = auditReport.get(name)
-  const version = [...vuln.nodes][0].version
-  const item = { name, version }
-
-  if (!vuln.effects.size) {
-    // If the current vuln has no effects, we've reached the end of this chain.
-    return [{ fixAvailable: vuln.fixAvailable, items: [item, ...chain.items] }]
+function buildDependencyChains(auditReport, name) {
+  const helper = (name, chain, visited) => {
+    // The vuln for this dependency.
+    const vuln = auditReport.get(name)
+
+    // The current version of this dependency.
+    const version = [...vuln.nodes][0].version
+
+    // The item that will represent this dependency in this chain.
+    const item = { name, version }
+
+    // Array of effects, excluding cycles.
+    const effects = [...vuln.effects]
+
+    if (visited.has(name)) {
+      // We've already visited this dependency in this chain, so we've detected a cycle.
+      // We currently throw when this happens. Ultimately we want to gracefully handle
+      // cycles and still return the recommended fix updates.
+      const source = chain.items[chain.items.length-1]
+      const message = `Cycle detected while traversing effects from ` +
+        `${source.name}@${source.version}: ` +
+        inspect([name, ...visited], {
+          breakLength: Infinity,
+          depth: 1,
+          maxStringLength: 255,
+        })
+      throw new Error(message)
+    }
+
+    if (!effects.length) {
+      // If the current vuln has no effects, we've reached the end of this chain.
+      return [{ fixAvailable: vuln.fixAvailable, items: [item, ...chain.items] }]
+    }
+
+    return effects.reduce((chains, effect) => {
+      return chains.concat(
+        helper(effect.name, { items: [item, ...chain.items] }, new Set([name, ...visited])))
+    }, [])
   }
 
-  return [...vuln.effects].reduce((chains, effect) => {
-    return chains.concat(
-      buildDependencyChains(
-        auditReport, effect.name, { items: [item, ...chain.items] }))
-  }, [])
+  const chains = helper(name, { items: [] }, new Set())
+  const seen = new Set()
+  return chains.filter(chain => {
+    const head = chain.items[0]
+    if (seen.has(head.name)) {
+      return false
+    }
+    seen.add(head.name)
+    return true
+  })
 }
 
 async function loadNpmConfig() {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.197.0
+  version: 0.198.0
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.197.0
+        version: 0.198.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.197.0
+        version: 0.198.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement