dependabot-npm_and_yarn 0.212.0 → 0.214.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5ff4958e3092d765d3d92a6035f05dee25680d26697649b3adad94b2b876df7b
-  data.tar.gz: 0adce108f8a33fefd73641d55db1730ba0bdfd167d2e0a8b7d674d1074455c87
+  metadata.gz: 6f056274186e20cfd09b6ed8bbf84249b6676461533bb76de51ecf4025e189a6
+  data.tar.gz: 4e30b85987104e3d79fb89d62d51e2dbff8c57337700b6a646633feaae47aadf
 SHA512:
-  metadata.gz: 3eac1860e88136dc0b8ebc851b1fdad2ae27459df2a39937d401372b86cd6c86432d46bfe93d68422098d664ebe776fdaf3f7674f07911525e5c97fce83e0136
-  data.tar.gz: c7c5f918a175e8f8de6cfc8110895f3c13f15cd1af0e342ab2cdd74794c2d383c74e46ea2076b36a3059a75cc5e93a92233a1d08368e5cfdd456fb3a5d89bc34
+  metadata.gz: fa8d78e12bb014909be03e084887d429f9bd2295d69f6cff6df0f9058c4a8e49e19c465470659010917be9c13c7a95a57ad970b2875e0be8fb2b050755b89a84
+  data.tar.gz: 54d9510b40145d16a62453ef2613503fcc87f336c14bd5a0809c71dfa99242cc91c3722504d87d737af3a0213ecc2383081a129a459124dc2079df91009a4ac9

data/helpers/.eslintrc

@@ -6,6 +6,6 @@
     "node": true
   },
   "parserOptions": {
-    "ecmaVersion": 9
+    "ecmaVersion": "latest"
   }
 }

data/helpers/README.md

@@ -24,6 +24,6 @@ yarn test path/to/test.js
 In order to run an interactive debugger:
 
 - `node --inspect-brk node_modules/.bin/jest --runInBand path/to/test/test.js`
-- In Chrome, nativate to chrome://inspect
+- In Chrome, navigate to `chrome://inspect`
 - Click `Open dedicated DevTools for Node`
-- You'll now be able to interactively debug using the chrome dev tools.
+- You'll now be able to interactively debug using the Chrome dev tools.

data/helpers/lib/npm/vulnerability-auditor.js

@@ -139,11 +139,6 @@ async function findVulnerableDependencies(directory, advisories) {
 }
 
 function convertAdvisoriesToRegistryBulkFormat(advisories) {
-  // npm audit differentiates advisories by `id`. In order to prevent
-  // advisories from being clobbered, we maintain a counter so that each
-  // advisory gets a unique `id`.
-  let nextAdvisoryId = 1
-
   return advisories.reduce((formattedAdvisories, advisory) => {
     if (!formattedAdvisories[advisory.dependency_name]) {
       formattedAdvisories[advisory.dependency_name] = []
@@ -151,7 +146,7 @@ function convertAdvisoriesToRegistryBulkFormat(advisories) {
     let formattedVersions =
       advisory.affected_versions.reduce((memo, version) => {
         memo.push({
-          id: nextAdvisoryId++,
+          id: Math.floor(Math.random() * Number.MAX_SAFE_INTEGER),
           vulnerable_versions: version
         })
         return memo
@@ -192,7 +187,12 @@ function buildDependencyChains(auditReport, name) {
     }
     if (auditReport.has(node.name)) {
       const vuln = auditReport.get(node.name)
-      return [{ fixAvailable: vuln.fixAvailable, nodes: [node, ...chain.nodes] }]
+      if (vuln.isVulnerable(node)) {
+        return [{ fixAvailable: vuln.fixAvailable, nodes: [node, ...chain.nodes] }]
+      } else if (node.name == name) {
+        // This is a non-vulnerable version of the advisory dependency; end path.
+        return []
+      }
     }
     if (!node.edgesOut.size) {
       // This is a leaf node that is unaffected by the vuln; end path.