dependabot-npm_and_yarn 0.205.1 → 0.208.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d7b367f078e9c5ac0a29c0a7d7bc2f541e60c2e39c1813cf04d50d3d5fb60f1a
-  data.tar.gz: 91063ae048150cb001487cfc4415b2aab20a7887e975e86c3632af9065ac5a65
+  metadata.gz: 5990fccf1bcbb74dcdb4344897dd59a8a8c7a733c6d9b591d80df770fa5f7c12
+  data.tar.gz: 7f7bf93df6bf5340484968dffd1558d1edd899718986f19d5d8b016fd45cb4f9
 SHA512:
-  metadata.gz: 37ef889be3aa66ad6d196543d289d38ee7ec8df99d27ae91cbdd49368d0374120f0364e7ca64a3330ae34e3a3bdf5b3edb60c839a872c962f49c2fd8721ad716
-  data.tar.gz: f49fcdf6cd6e2b266a02a13b2558dd8c542fd02c8354f72fecea6c5183d6797f5e28f99d208e0f32f57ec269e72d3de085c254f1edba481d6a0145bc11fde68a
+  metadata.gz: '09974c6a5f64107c6611e011c7555a964560f5efaa09e22b99340b0c230ff01461f1f977db70620b67ed7362acc0fdbd0a5aeef4a6748d4af345cee89f7eff95'
+  data.tar.gz: b810fe67227d6e74132b20d8722265ec434a238b22700f32d351d992c3fd77d43e060575f2e0309e69d651671eb70a962b34b8c905a16ecb3413b982e7646878

data/helpers/lib/npm/vulnerability-auditor.js

@@ -28,7 +28,7 @@
 
 const Arborist = require('@npmcli/arborist')
 const nock = require('nock')
-const { inspect, promisify } = require('util');
+const { promisify } = require('util');
 const exec = promisify(require('child_process').exec)
 
 async function findVulnerableDependencies(directory, advisories) {
@@ -59,16 +59,25 @@ async function findVulnerableDependencies(directory, advisories) {
 
   try {
     const name = advisories[0].dependency_name
-    const auditReport = await arb.audit()
-    const vuln = auditReport.get(name)
-    const version = [...vuln.nodes][0].version
-    const fixAvailable = vuln.fixAvailable
     const response = {
       dependency_name: name,
-      current_version: version,
-      fix_available: Boolean(fixAvailable),
       fix_updates: [],
+      top_level_ancestors: [],
+    }
+    const auditReport = await arb.audit()
+    if (!auditReport.has(name)) {
+      if (auditReport.tree.children.has(name)) {
+        response.current_version = auditReport.tree.children.get(name).version
+      }
+      response.fix_available = false
+      return response
     }
+    const vuln = auditReport.get(name)
+    const version = [...vuln.nodes][0].version
+    const fixAvailable = vuln.fixAvailable
+
+    response.current_version = version
+    response.fix_available = Boolean(fixAvailable)
 
     if (!Boolean(fixAvailable)) {
       return response
@@ -76,24 +85,41 @@ async function findVulnerableDependencies(directory, advisories) {
 
     const chains = buildDependencyChains(auditReport, name)
 
-    // In order to consider the vuln dependency in question fixable,
+    // In order for the vuln dependency in question to be considered fixable,
     // all dependency chains originating from it must be fixable.
     if (chains.some((chain) => !Boolean(chain.fixAvailable))) {
       response.fix_available = false
       return response
     }
 
-    for (const chain of chains) {
-      const topMost = chain.items[0]
-      if (topMost.name === name) {
-        continue
-      }
+    const groupedFixUpdateChains = groupBy(chains, (chain) => chain.nodes[0].pkgid)
+    let topLevelAncestors = new Set()
+
+    for (const group of groupedFixUpdateChains.values()) {
+      const fixUpdateNode = group[0].nodes[0]
+      const groupTopLevelAncestors = group.reduce((anc, chain) => {
+        const topLevelNode = chain.nodes[chain.nodes.length - 1]
+        return anc.add(topLevelNode.name)
+      }, new Set())
+
+      // Add group's top-level ancestors to the set of all top-level ancestors of
+      // the vuln dependency in question.
+      topLevelAncestors = new Set([...topLevelAncestors, ...groupTopLevelAncestors])
+
+      // If a chain consists of only one node, chain.nodes[0].name == chain.nodes[chain.nodes.length-1].name.
+      // In such cases, don't include the fix update node as an ancestor of itself.
+      const fixUpdateNodeTopLevelAncestors =
+        [...groupTopLevelAncestors].filter((nodeName) => nodeName !== fixUpdateNode.name).sort()
+
       response.fix_updates.push({
-        dependency_name: topMost.name,
-        current_version: topMost.version,
+        dependency_name: fixUpdateNode.name,
+        current_version: fixUpdateNode.version,
+        top_level_ancestors: fixUpdateNodeTopLevelAncestors,
       })
     }
 
+    response.top_level_ancestors = [...topLevelAncestors].sort()
+
     const fixTree = await arb.audit({
       fix: true,
     })
@@ -135,75 +161,60 @@ function convertAdvisoriesToRegistryBulkFormat(advisories) {
   }, {})
 }
 
-/* Traverses all effects originating from the named dependency in the
- * audit report and returns an array of dependency chains rooted in the named
- * dependency,
+/* Returns an array of dependency chains rooted in the named dependency,
  *   [
  *    {
  *      fixAvailable: true | false | object,
- *      items: [
- *        { name: 'foo', version: '1.0.0' },
+ *      nodes: [
+ *        ArboristNode {
+ *          name: 'foo',
+ *          version: '1.0.0',
+ *          ...
+ *        },
  *        ...
  *      ]
  *    },
  *    ...
  *   ]
  *
- * The first item in the chain is always the top-most dependency affected by
- * the vulnerable dependency in question. The `fixAvailable` field
- * applies to the first item in the chain (if that item is fixable, then
- * every item after it must be fixable, too).
+ * The first node in each chain is the innermost dependency affected by the vuln;
+ * the `fixAvailable` field applies to this dependency. The last node in each
+ * chain is always a top-level dependency.
  */
 function buildDependencyChains(auditReport, name) {
-  const helper = (name, chain, visited) => {
-    // The vuln for this dependency.
-    const vuln = auditReport.get(name)
-
-    // The current version of this dependency.
-    const version = [...vuln.nodes][0].version
-
-    // The item that will represent this dependency in this chain.
-    const item = { name, version }
-
-    // Array of effects, excluding cycles.
-    const effects = [...vuln.effects]
-
-    if (visited.has(name)) {
-      // We've already visited this dependency in this chain, so we've detected a cycle.
-      // We currently throw when this happens. Ultimately we want to gracefully handle
-      // cycles and still return the recommended fix updates.
-      const source = chain.items[chain.items.length-1]
-      const message = `Cycle detected while traversing effects from ` +
-        `${source.name}@${source.version}: ` +
-        inspect([name, ...visited], {
-          breakLength: Infinity,
-          depth: 1,
-          maxStringLength: 255,
-        })
-      throw new Error(message)
+  const helper = (node, chain, visited) => {
+    if (!node) {
+      return []
     }
-
-    if (!effects.length) {
-      // If the current vuln has no effects, we've reached the end of this chain.
-      return [{ fixAvailable: vuln.fixAvailable, items: [item, ...chain.items] }]
+    if (visited.has(node.name)) {
+      // We've already seen this node; end path.
+      return []
     }
-
-    return effects.reduce((chains, effect) => {
-      return chains.concat(
-        helper(effect.name, { items: [item, ...chain.items] }, new Set([name, ...visited])))
+    if (auditReport.has(node.name)) {
+      const vuln = auditReport.get(node.name)
+      return [{ fixAvailable: vuln.fixAvailable, nodes: [node, ...chain.nodes] }]
+    }
+    if (!node.edgesOut.size) {
+      // This is a leaf node that is unaffected by the vuln; end path.
+      return []
+    }
+    return [...node.edgesOut.values()].reduce((chains, { to }) => {
+      // Only prepend current node to chain/visited if it's not the project root.
+      const newChain = node.isProjectRoot ? chain : { nodes: [node, ...chain.nodes] }
+      const newVisited = node.isProjectRoot ? visited : new Set([node.name, ...visited])
+      return chains.concat(helper(to, newChain, newVisited))
     }, [])
   }
+  return helper(auditReport.tree, { nodes: [] }, new Set())
+}
 
-  const chains = helper(name, { items: [] }, new Set())
-  const seen = new Set()
-  return chains.filter(chain => {
-    const head = chain.items[0]
-    if (seen.has(head.name)) {
-      return false
-    }
-    seen.add(head.name)
-    return true
-  })
+function groupBy(elems, fn) {
+  const groups = new Map()
+  for (const [index, elem] of [...elems].entries()) {
+    const key = fn(elem, index, elems)
+    groups.set(key, (groups.get(key) || []).concat([elem]))
+  }
+  return groups
 }
 
 async function loadNpmConfig() {

data/helpers/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "@dependabot/helper",
       "dependencies": {
-        "@dependabot/yarn-lib": "^1.21.1",
+        "@dependabot/yarn-lib": "^1.22.19",
         "@npmcli/arborist": "^5.3.1",
         "detect-indent": "^6.1.0",
         "nock": "^13.2.8",
@@ -580,9 +580,9 @@
       "dev": true
     },
     "node_modules/@dependabot/yarn-lib": {
-      "version": "1.21.1",
-      "resolved": "https://registry.npmjs.org/@dependabot/yarn-lib/-/yarn-lib-1.21.1.tgz",
-      "integrity": "sha512-wroyXO/e0h077IkPxLGJRIdMYzQWGIiLiYrhx2y6pwDfh6I492Saof5G80si21ltU3fHpCpGlB9cenr9b7Ak3Q==",
+      "version": "1.22.19",
+      "resolved": "https://registry.npmjs.org/@dependabot/yarn-lib/-/yarn-lib-1.22.19.tgz",
+      "integrity": "sha512-+ayu/53xZOUpRvQrzlhkHPogTNnmu+UIxd2S+IfQDLfBhyhrLqPB8F3kjIkGZRyNXPed2MyxEljyEVBSljPmxw==",
       "dependencies": {
         "@zkochan/cmd-shim": "^3.1.0",
         "babel-runtime": "^6.26.0",
@@ -14648,9 +14648,9 @@
       "dev": true
     },
     "@dependabot/yarn-lib": {
-      "version": "1.21.1",
-      "resolved": "https://registry.npmjs.org/@dependabot/yarn-lib/-/yarn-lib-1.21.1.tgz",
-      "integrity": "sha512-wroyXO/e0h077IkPxLGJRIdMYzQWGIiLiYrhx2y6pwDfh6I492Saof5G80si21ltU3fHpCpGlB9cenr9b7Ak3Q==",
+      "version": "1.22.19",
+      "resolved": "https://registry.npmjs.org/@dependabot/yarn-lib/-/yarn-lib-1.22.19.tgz",
+      "integrity": "sha512-+ayu/53xZOUpRvQrzlhkHPogTNnmu+UIxd2S+IfQDLfBhyhrLqPB8F3kjIkGZRyNXPed2MyxEljyEVBSljPmxw==",
       "requires": {
         "@zkochan/cmd-shim": "^3.1.0",
         "babel-runtime": "^6.26.0",

data/helpers/package.json

@@ -9,7 +9,7 @@
     "test": "jest"
   },
   "dependencies": {
-    "@dependabot/yarn-lib": "^1.21.1",
+    "@dependabot/yarn-lib": "^1.22.19",
     "@npmcli/arborist": "^5.3.1",
     "detect-indent": "^6.1.0",
     "nock": "^13.2.8",

data/lib/dependabot/npm_and_yarn/update_checker/vulnerability_auditor.rb

@@ -36,11 +36,16 @@ module Dependabot
         #     * :dependency_name [String] the name of the blocking dependency
         #     * :current_version [String] the current version of the blocking dependency
         #     * :target_version [String] the target version of the blocking dependency
+        #     * :top_level_ancestors [Array<String>] the names of top-level dependencies with a transitive
+        #       dependency on the blocking dependency
+        #   * :top_level_ancestors [Array<String>] the names of all top-level dependencies with a transitive
+        #     dependency on the dependency
         def audit(dependency:, security_advisories:)
           fix_unavailable = {
             "dependency_name" => dependency.name,
             "fix_available" => false,
-            "fix_updates" => []
+            "fix_updates" => [],
+            "top_level_ancestors" => []
           }
 
           SharedHelpers.in_a_temporary_directory do
@@ -68,7 +73,7 @@ module Dependabot
               function: "npm:vulnerabilityAuditor",
               args: [Dir.pwd, vuln_versions]
             )
-            return fix_unavailable unless valid_audit_result?(audit_result, security_advisories)
+            return fix_unavailable unless viable_audit_result?(audit_result, security_advisories)
 
             audit_result
           end
@@ -81,15 +86,21 @@ module Dependabot
 
         attr_reader :dependency_files, :credentials
 
-        def valid_audit_result?(audit_result, security_advisories)
-          # we only need to check results that indicate a fix is available
-          return true unless audit_result["fix_available"]
+        def viable_audit_result?(audit_result, security_advisories)
+          validation_result = validate_audit_result(audit_result, security_advisories)
+          return true if validation_result == :viable
 
-          return false if vulnerable_dependency_removed?(audit_result)
-          return false if dependency_still_vulnerable?(audit_result, security_advisories)
-          return false if downgrades_dependencies?(audit_result)
+          Dependabot.logger.info("VulnerabilityAuditor: audit result not viable: #{validation_result}")
+          false
+        end
+
+        def validate_audit_result(audit_result, security_advisories)
+          return :fix_unavailable unless audit_result["fix_available"]
+          return :vulnerable_dependency_removed if vulnerable_dependency_removed?(audit_result)
+          return :dependency_still_vulnerable if dependency_still_vulnerable?(audit_result, security_advisories)
+          return :downgrades_dependencies if downgrades_dependencies?(audit_result)
 
-          true
+          :viable
         end
 
         def vulnerable_dependency_removed?(audit_result)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.205.1
+  version: 0.208.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-08 00:00:00.000000000 Z
+date: 2022-08-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.205.1
+        version: 0.208.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.205.1
+        version: 0.208.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.31.2
+        version: 1.33.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.31.2
+        version: 1.33.0
 - !ruby/object:Gem::Dependency
   name: ruby-debug-ide
   requirement: !ruby/object:Gem::Requirement