dependabot-npm_and_yarn 0.197.0 → 0.200.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 866b96901b075a70bbd36550219418d1b1e0e8c0f6cfb237785bebd8076f3b61
-  data.tar.gz: ba5e0030c5f9122c7607bc4462040519b287184cba1d1002821f7dd9a392b070
+  metadata.gz: 02e28f1047d8b7ef5a5ddb4cf6c15baad65b0fc4b2da7baead4b4818d18a601e
+  data.tar.gz: 650320fa6e03b9bee507e587a4605f52d50aee0e53c1618e8c43aab895e2a346
 SHA512:
-  metadata.gz: 3ce4c3daf6f9395f650e76955a9d71ed9f5747273880dede7f46afe21c4c3f24aacb24fa6a77ce932d0008fa9d8c9fde8584fdf78e272006d912bc73868e32ca
-  data.tar.gz: a4eff1acb0059fbbad93339b04768a48d85a9e3de5cc5b6958faaee93c7d2693657cfc33c7bf65f3ac573f0824cdb6b087d7c7cda8c50b8f0aeac3d34a839164
+  metadata.gz: 1545d4d8906a2d5af7d5372a2deff11238f7ba5430098f3a93e3f460d1c8c966e33b24455aecfced09fdd4ea037c65e61adc85b815db1ce9a5b2f721082a111c
+  data.tar.gz: 02653cb6ff3299d82549f0e7ed33863cfc8aa540828f00abf38c3ff2a7332778e1b0d017d18ac3df610731b69a900edd4a6521c8310ec762d1e448865d021a9d

data/helpers/lib/npm/vulnerability-auditor.js

@@ -28,7 +28,7 @@
 
 const Arborist = require('@npmcli/arborist')
 const nock = require('nock')
-const { promisify } = require('util');
+const { inspect, promisify } = require('util');
 const exec = promisify(require('child_process').exec)
 
 async function findVulnerableDependencies(directory, advisories) {
@@ -136,7 +136,8 @@ function convertAdvisoriesToRegistryBulkFormat(advisories) {
 }
 
 /* Traverses all effects originating from the named dependency in the
- * audit report and builds an array of all dependency chains,
+ * audit report and returns an array of dependency chains rooted in the named
+ * dependency,
  *   [
  *    {
  *      fixAvailable: true | false | object,
@@ -153,21 +154,56 @@ function convertAdvisoriesToRegistryBulkFormat(advisories) {
  * applies to the first item in the chain (if that item is fixable, then
  * every item after it must be fixable, too).
  */
-function buildDependencyChains(auditReport, name, chain = { items: [] }) {
-  const vuln = auditReport.get(name)
-  const version = [...vuln.nodes][0].version
-  const item = { name, version }
-
-  if (!vuln.effects.size) {
-    // If the current vuln has no effects, we've reached the end of this chain.
-    return [{ fixAvailable: vuln.fixAvailable, items: [item, ...chain.items] }]
+function buildDependencyChains(auditReport, name) {
+  const helper = (name, chain, visited) => {
+    // The vuln for this dependency.
+    const vuln = auditReport.get(name)
+
+    // The current version of this dependency.
+    const version = [...vuln.nodes][0].version
+
+    // The item that will represent this dependency in this chain.
+    const item = { name, version }
+
+    // Array of effects, excluding cycles.
+    const effects = [...vuln.effects]
+
+    if (visited.has(name)) {
+      // We've already visited this dependency in this chain, so we've detected a cycle.
+      // We currently throw when this happens. Ultimately we want to gracefully handle
+      // cycles and still return the recommended fix updates.
+      const source = chain.items[chain.items.length-1]
+      const message = `Cycle detected while traversing effects from ` +
+        `${source.name}@${source.version}: ` +
+        inspect([name, ...visited], {
+          breakLength: Infinity,
+          depth: 1,
+          maxStringLength: 255,
+        })
+      throw new Error(message)
+    }
+
+    if (!effects.length) {
+      // If the current vuln has no effects, we've reached the end of this chain.
+      return [{ fixAvailable: vuln.fixAvailable, items: [item, ...chain.items] }]
+    }
+
+    return effects.reduce((chains, effect) => {
+      return chains.concat(
+        helper(effect.name, { items: [item, ...chain.items] }, new Set([name, ...visited])))
+    }, [])
   }
 
-  return [...vuln.effects].reduce((chains, effect) => {
-    return chains.concat(
-      buildDependencyChains(
-        auditReport, effect.name, { items: [item, ...chain.items] }))
-  }, [])
+  const chains = helper(name, { items: [] }, new Set())
+  const seen = new Set()
+  return chains.filter(chain => {
+    const head = chain.items[0]
+    if (seen.has(head.name)) {
+      return false
+    }
+    seen.add(head.name)
+    return true
+  })
 }
 
 async function loadNpmConfig() {

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.197.0
+  version: 0.200.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-07-15 00:00:00.000000000 Z
+date: 2022-07-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.197.0
+        version: 0.200.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.197.0
+        version: 0.200.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement