dependabot-npm_and_yarn 0.205.1 → 0.206.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d7b367f078e9c5ac0a29c0a7d7bc2f541e60c2e39c1813cf04d50d3d5fb60f1a
-  data.tar.gz: 91063ae048150cb001487cfc4415b2aab20a7887e975e86c3632af9065ac5a65
+  metadata.gz: 982bada4a5fa7c5684307f5788312a2950d623f698093e5d37ec681020f5dd25
+  data.tar.gz: f6b002ff019673222ba9e0c5a945eae620d906a6f57732130697c682b1b5d5ee
 SHA512:
-  metadata.gz: 37ef889be3aa66ad6d196543d289d38ee7ec8df99d27ae91cbdd49368d0374120f0364e7ca64a3330ae34e3a3bdf5b3edb60c839a872c962f49c2fd8721ad716
-  data.tar.gz: f49fcdf6cd6e2b266a02a13b2558dd8c542fd02c8354f72fecea6c5183d6797f5e28f99d208e0f32f57ec269e72d3de085c254f1edba481d6a0145bc11fde68a
+  metadata.gz: 884b55700d38d5f99952e8d3bb84968549b5384af0ad5ce69d64e4dc1f957eaaee5988c5fc41473c9fda406c9a3c8f712b8132a4ae04da215f7590984115eaab
+  data.tar.gz: eacdea94863a73e095719a2f3bec5616b8ee8c740dfedbb7f188b98b8666abd86c5ae099a809d893c2c16bdde3637b47c56b1eec06e0207efa06245593adf68a

data/helpers/lib/npm/vulnerability-auditor.js

@@ -28,7 +28,7 @@
 
 const Arborist = require('@npmcli/arborist')
 const nock = require('nock')
-const { inspect, promisify } = require('util');
+const { promisify } = require('util');
 const exec = promisify(require('child_process').exec)
 
 async function findVulnerableDependencies(directory, advisories) {
@@ -59,16 +59,25 @@ async function findVulnerableDependencies(directory, advisories) {
 
   try {
     const name = advisories[0].dependency_name
-    const auditReport = await arb.audit()
-    const vuln = auditReport.get(name)
-    const version = [...vuln.nodes][0].version
-    const fixAvailable = vuln.fixAvailable
     const response = {
       dependency_name: name,
-      current_version: version,
-      fix_available: Boolean(fixAvailable),
       fix_updates: [],
+      top_level_ancestors: [],
+    }
+    const auditReport = await arb.audit()
+    if (!auditReport.has(name)) {
+      if (auditReport.tree.children.has(name)) {
+        response.current_version = auditReport.tree.children.get(name).version
+      }
+      response.fix_available = false
+      return response
     }
+    const vuln = auditReport.get(name)
+    const version = [...vuln.nodes][0].version
+    const fixAvailable = vuln.fixAvailable
+
+    response.current_version = version
+    response.fix_available = Boolean(fixAvailable)
 
     if (!Boolean(fixAvailable)) {
       return response
@@ -76,24 +85,41 @@ async function findVulnerableDependencies(directory, advisories) {
 
     const chains = buildDependencyChains(auditReport, name)
 
-    // In order to consider the vuln dependency in question fixable,
+    // In order for the vuln dependency in question to be considered fixable,
     // all dependency chains originating from it must be fixable.
     if (chains.some((chain) => !Boolean(chain.fixAvailable))) {
       response.fix_available = false
       return response
     }
 
-    for (const chain of chains) {
-      const topMost = chain.items[0]
-      if (topMost.name === name) {
-        continue
-      }
+    const groupedFixUpdateChains = groupBy(chains, (chain) => chain.nodes[0].pkgid)
+    let topLevelAncestors = new Set()
+
+    for (const group of groupedFixUpdateChains.values()) {
+      const fixUpdateNode = group[0].nodes[0]
+      const groupTopLevelAncestors = group.reduce((anc, chain) => {
+        const topLevelNode = chain.nodes[chain.nodes.length - 1]
+        return anc.add(topLevelNode.name)
+      }, new Set())
+
+      // Add group's top-level ancestors to the set of all top-level ancestors of
+      // the vuln dependency in question.
+      topLevelAncestors = new Set([...topLevelAncestors, ...groupTopLevelAncestors])
+
+      // If a chain consists of only one node, chain.nodes[0].name == chain.nodes[chain.nodes.length-1].name.
+      // In such cases, don't include the fix update node as an ancestor of itself.
+      const fixUpdateNodeTopLevelAncestors =
+        [...groupTopLevelAncestors].filter((nodeName) => nodeName !== fixUpdateNode.name).sort()
+
       response.fix_updates.push({
-        dependency_name: topMost.name,
-        current_version: topMost.version,
+        dependency_name: fixUpdateNode.name,
+        current_version: fixUpdateNode.version,
+        top_level_ancestors: fixUpdateNodeTopLevelAncestors,
       })
     }
 
+    response.top_level_ancestors = [...topLevelAncestors].sort()
+
     const fixTree = await arb.audit({
       fix: true,
     })
@@ -135,75 +161,60 @@ function convertAdvisoriesToRegistryBulkFormat(advisories) {
   }, {})
 }
 
-/* Traverses all effects originating from the named dependency in the
- * audit report and returns an array of dependency chains rooted in the named
- * dependency,
+/* Returns an array of dependency chains rooted in the named dependency,
  *   [
  *    {
  *      fixAvailable: true | false | object,
- *      items: [
- *        { name: 'foo', version: '1.0.0' },
+ *      nodes: [
+ *        ArboristNode {
+ *          name: 'foo',
+ *          version: '1.0.0',
+ *          ...
+ *        },
  *        ...
  *      ]
  *    },
  *    ...
  *   ]
  *
- * The first item in the chain is always the top-most dependency affected by
- * the vulnerable dependency in question. The `fixAvailable` field
- * applies to the first item in the chain (if that item is fixable, then
- * every item after it must be fixable, too).
+ * The first node in each chain is the innermost dependency affected by the vuln;
+ * the `fixAvailable` field applies to this dependency. The last node in each
+ * chain is always a top-level dependency.
  */
 function buildDependencyChains(auditReport, name) {
-  const helper = (name, chain, visited) => {
-    // The vuln for this dependency.
-    const vuln = auditReport.get(name)
-
-    // The current version of this dependency.
-    const version = [...vuln.nodes][0].version
-
-    // The item that will represent this dependency in this chain.
-    const item = { name, version }
-
-    // Array of effects, excluding cycles.
-    const effects = [...vuln.effects]
-
-    if (visited.has(name)) {
-      // We've already visited this dependency in this chain, so we've detected a cycle.
-      // We currently throw when this happens. Ultimately we want to gracefully handle
-      // cycles and still return the recommended fix updates.
-      const source = chain.items[chain.items.length-1]
-      const message = `Cycle detected while traversing effects from ` +
-        `${source.name}@${source.version}: ` +
-        inspect([name, ...visited], {
-          breakLength: Infinity,
-          depth: 1,
-          maxStringLength: 255,
-        })
-      throw new Error(message)
+  const helper = (node, chain, visited) => {
+    if (!node) {
+      return []
     }
-
-    if (!effects.length) {
-      // If the current vuln has no effects, we've reached the end of this chain.
-      return [{ fixAvailable: vuln.fixAvailable, items: [item, ...chain.items] }]
+    if (visited.has(node.name)) {
+      // We've already seen this node; end path.
+      return []
     }
-
-    return effects.reduce((chains, effect) => {
-      return chains.concat(
-        helper(effect.name, { items: [item, ...chain.items] }, new Set([name, ...visited])))
+    if (auditReport.has(node.name)) {
+      const vuln = auditReport.get(node.name)
+      return [{ fixAvailable: vuln.fixAvailable, nodes: [node, ...chain.nodes] }]
+    }
+    if (!node.edgesOut.size) {
+      // This is a leaf node that is unaffected by the vuln; end path.
+      return []
+    }
+    return [...node.edgesOut.values()].reduce((chains, { to }) => {
+      // Only prepend current node to chain/visited if it's not the project root.
+      const newChain = node.isProjectRoot ? chain : { nodes: [node, ...chain.nodes] }
+      const newVisited = node.isProjectRoot ? visited : new Set([node.name, ...visited])
+      return chains.concat(helper(to, newChain, newVisited))
     }, [])
   }
+  return helper(auditReport.tree, { nodes: [] }, new Set())
+}
 
-  const chains = helper(name, { items: [] }, new Set())
-  const seen = new Set()
-  return chains.filter(chain => {
-    const head = chain.items[0]
-    if (seen.has(head.name)) {
-      return false
-    }
-    seen.add(head.name)
-    return true
-  })
+function groupBy(elems, fn) {
+  const groups = new Map()
+  for (const [index, elem] of [...elems].entries()) {
+    const key = fn(elem, index, elems)
+    groups.set(key, (groups.get(key) || []).concat([elem]))
+  }
+  return groups
 }
 
 async function loadNpmConfig() {

data/lib/dependabot/npm_and_yarn/update_checker/vulnerability_auditor.rb

@@ -36,11 +36,16 @@ module Dependabot
         #     * :dependency_name [String] the name of the blocking dependency
         #     * :current_version [String] the current version of the blocking dependency
         #     * :target_version [String] the target version of the blocking dependency
+        #     * :top_level_ancestors [Array<String>] the names of top-level dependencies with a transitive
+        #       dependency on the blocking dependency
+        #   * :top_level_ancestors [Array<String>] the names of all top-level dependencies with a transitive
+        #     dependency on the dependency
         def audit(dependency:, security_advisories:)
           fix_unavailable = {
             "dependency_name" => dependency.name,
             "fix_available" => false,
-            "fix_updates" => []
+            "fix_updates" => [],
+            "top_level_ancestors" => []
           }
 
           SharedHelpers.in_a_temporary_directory do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.205.1
+  version: 0.206.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-08 00:00:00.000000000 Z
+date: 2022-08-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.205.1
+        version: 0.206.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.205.1
+        version: 0.206.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.31.2
+        version: 1.33.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.31.2
+        version: 1.33.0
 - !ruby/object:Gem::Dependency
   name: ruby-debug-ide
   requirement: !ruby/object:Gem::Requirement