dependabot-npm_and_yarn 0.212.0 → 0.214.0

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -4,6 +4,7 @@ require "uri"
 
 require "dependabot/npm_and_yarn/file_updater"
 require "dependabot/npm_and_yarn/file_parser"
+require "dependabot/npm_and_yarn/helpers"
 require "dependabot/npm_and_yarn/update_checker/registry_finder"
 require "dependabot/npm_and_yarn/native_helpers"
 require "dependabot/shared_helpers"
@@ -17,9 +18,10 @@ module Dependabot
         require_relative "npmrc_builder"
         require_relative "package_json_updater"
 
-        def initialize(dependencies:, dependency_files:, credentials:)
+        def initialize(dependencies:, dependency_files:, repo_contents_path:, credentials:)
           @dependencies = dependencies
           @dependency_files = dependency_files
+          @repo_contents_path = repo_contents_path
           @credentials = credentials
         end
 
@@ -35,12 +37,11 @@ module Dependabot
 
         private
 
-        attr_reader :dependencies, :dependency_files, :credentials
+        attr_reader :dependencies, :dependency_files, :repo_contents_path, :credentials
 
-        UNREACHABLE_GIT = /ls-remote --tags --heads (?<url>.*)/.freeze
-        TIMEOUT_FETCHING_PACKAGE =
-          %r{(?<url>.+)/(?<package>[^/]+): ETIMEDOUT}.freeze
-        INVALID_PACKAGE = /Can't add "(?<package_req>.*)": invalid/.freeze
+        UNREACHABLE_GIT = /ls-remote --tags --heads (?<url>.*)/
+        TIMEOUT_FETCHING_PACKAGE = %r{(?<url>.+)/(?<package>[^/]+): ETIMEDOUT}
+        INVALID_PACKAGE = /Can't add "(?<package_req>.*)": invalid/
 
         def top_level_dependencies
           dependencies.select(&:top_level?)
@@ -51,13 +52,14 @@ module Dependabot
         end
 
         def updated_yarn_lock(yarn_lock)
-          SharedHelpers.in_a_temporary_directory do
-            write_temporary_dependency_files
+          base_dir = dependency_files.first.directory
+          SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
+            write_temporary_dependency_files(yarn_lock)
             lockfile_name = Pathname.new(yarn_lock.name).basename.to_s
             path = Pathname.new(yarn_lock.name).dirname.to_s
             updated_files = run_current_yarn_update(
               path: path,
-              lockfile_name: lockfile_name
+              yarn_lock: yarn_lock
             )
             updated_files.fetch(lockfile_name)
           end
@@ -65,7 +67,7 @@ module Dependabot
           handle_yarn_lock_updater_error(e, yarn_lock)
         end
 
-        def run_current_yarn_update(path:, lockfile_name:)
+        def run_current_yarn_update(path:, yarn_lock:)
           top_level_dependency_updates = top_level_dependencies.map do |d|
             {
               name: d.name,
@@ -76,12 +78,12 @@ module Dependabot
 
           run_yarn_updater(
             path: path,
-            lockfile_name: lockfile_name,
+            yarn_lock: yarn_lock,
             top_level_dependency_updates: top_level_dependency_updates
           )
         end
 
-        def run_previous_yarn_update(path:, lockfile_name:)
+        def run_previous_yarn_update(path:, yarn_lock:)
           previous_top_level_dependencies = top_level_dependencies.map do |d|
             {
               name: d.name,
@@ -94,22 +96,29 @@ module Dependabot
 
           run_yarn_updater(
             path: path,
-            lockfile_name: lockfile_name,
+            yarn_lock: yarn_lock,
             top_level_dependency_updates: previous_top_level_dependencies
           )
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
-        def run_yarn_updater(path:, lockfile_name:,
-                             top_level_dependency_updates:)
+        def run_yarn_updater(path:, yarn_lock:, top_level_dependency_updates:)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
               if top_level_dependency_updates.any?
-                run_yarn_top_level_updater(
-                  top_level_dependency_updates: top_level_dependency_updates
-                )
+                if Helpers.yarn_berry?(yarn_lock)
+                  run_yarn_berry_top_level_updater(top_level_dependency_updates: top_level_dependency_updates,
+                                                   yarn_lock: yarn_lock)
+                else
+
+                  run_yarn_top_level_updater(
+                    top_level_dependency_updates: top_level_dependency_updates
+                  )
+                end
+              elsif Helpers.yarn_berry?(yarn_lock)
+                run_yarn_berry_subdependency_updater(yarn_lock: yarn_lock)
               else
-                run_yarn_subdependency_updater(lockfile_name: lockfile_name)
+                run_yarn_subdependency_updater(yarn_lock: yarn_lock)
               end
             end
           end
@@ -133,6 +142,43 @@ module Dependabot
 
         # rubocop:enable Metrics/PerceivedComplexity
 
+        def run_yarn_berry_top_level_updater(top_level_dependency_updates:, yarn_lock:)
+          write_temporary_dependency_files(yarn_lock)
+          # If the requirements have changed, it means we've updated the
+          # package.json file(s), and we can just run yarn install to get the
+          # lockfile in the right state. Otherwise we'll need to manually update
+          # the lockfile.
+
+          command = if top_level_dependency_updates.all? { |dep| requirements_changed?(dep[:name]) }
+                      "yarn install #{Helpers.yarn_berry_args}".strip
+                    else
+                      updates = top_level_dependency_updates.collect do |dep|
+                        dep[:name]
+                      end
+
+                      "yarn up -R #{updates.join(' ')} #{Helpers.yarn_berry_args}".strip
+                    end
+          Helpers.run_yarn_commands(command)
+          { yarn_lock.name => File.read(yarn_lock.name) }
+        end
+
+        def requirements_changed?(dependency_name)
+          dep = top_level_dependencies.first { |d| d.name == dependency_name }
+          dep.requirements != dep.previous_requirements
+        end
+
+        def run_yarn_berry_subdependency_updater(yarn_lock:)
+          dep = sub_dependencies.first
+          update = "#{dep.name}@#{dep.version}"
+
+          Helpers.run_yarn_commands(
+            "yarn add #{update} #{Helpers.yarn_berry_args}".strip,
+            "yarn dedupe #{dep.name} #{Helpers.yarn_berry_args}".strip,
+            "yarn remove #{dep.name} #{Helpers.yarn_berry_args}".strip
+          )
+          { yarn_lock.name => File.read(yarn_lock.name) }
+        end
+
         def run_yarn_top_level_updater(top_level_dependency_updates:)
           SharedHelpers.run_helper_subprocess(
             command: NativeHelpers.helper_path,
@@ -144,7 +190,8 @@ module Dependabot
           )
         end
 
-        def run_yarn_subdependency_updater(lockfile_name:)
+        def run_yarn_subdependency_updater(yarn_lock:)
+          lockfile_name = Pathname.new(yarn_lock.name).basename.to_s
           SharedHelpers.run_helper_subprocess(
             command: NativeHelpers.helper_path,
             function: "yarn:updateSubdependency",
@@ -259,12 +306,11 @@ module Dependabot
 
           @resolvable_before_update[yarn_lock.name] =
             begin
-              SharedHelpers.in_a_temporary_directory do
-                write_temporary_dependency_files(update_package_json: false)
-                lockfile_name = Pathname.new(yarn_lock.name).basename.to_s
+              base_dir = dependency_files.first.directory
+              SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
+                write_temporary_dependency_files(yarn_lock, update_package_json: false)
                 path = Pathname.new(yarn_lock.name).dirname.to_s
-                run_previous_yarn_update(path: path,
-                                         lockfile_name: lockfile_name)
+                run_previous_yarn_update(path: path, yarn_lock: yarn_lock)
               end
 
               true
@@ -282,11 +328,15 @@ module Dependabot
           end
         end
 
-        def write_temporary_dependency_files(update_package_json: true)
+        def write_temporary_dependency_files(yarn_lock, update_package_json: true)
           write_lockfiles
 
-          File.write(".npmrc", npmrc_content)
-          File.write(".yarnrc", yarnrc_content) if yarnrc_specifies_npm_reg?
+          if Helpers.yarn_berry?(yarn_lock)
+            File.write(".yarnrc.yml", yarnrc_yml_content) if yarnrc_yml_file
+          else
+            File.write(".npmrc", npmrc_content) unless Helpers.yarn_berry?(yarn_lock)
+            File.write(".yarnrc", yarnrc_content) if yarnrc_specifies_private_reg?
+          end
 
           package_files.each do |file|
             path = file.name
@@ -420,7 +470,8 @@ module Dependabot
             dependency: missing_dep,
             credentials: credentials,
             npmrc_file: npmrc_file,
-            yarnrc_file: yarnrc_file
+            yarnrc_file: yarnrc_file,
+            yarnrc_yml_file: yarnrc_yml_file
           ).registry
 
           return if UpdateChecker::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")
@@ -471,7 +522,7 @@ module Dependabot
           npmrc_content.match?(/^package-lock\s*=\s*false/)
         end
 
-        def yarnrc_specifies_npm_reg?
+        def yarnrc_specifies_private_reg?
           return false unless yarnrc_file
 
           regex = UpdateChecker::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX
@@ -484,11 +535,16 @@ module Dependabot
 
           return false unless yarnrc_global_registry
 
-          URI(yarnrc_global_registry).host == "registry.npmjs.org"
+          UpdateChecker::RegistryFinder::CENTRAL_REGISTRIES.any? do |r|
+            r.include?(URI(yarnrc_global_registry).host)
+          end
         end
 
         def yarnrc_content
-          'registry "https://registry.npmjs.org"'
+          NpmrcBuilder.new(
+            credentials: credentials,
+            dependency_files: dependency_files
+          ).yarnrc_content
         end
 
         def sanitized_package_json_content(content)
@@ -524,6 +580,14 @@ module Dependabot
         def npmrc_file
           dependency_files.find { |f| f.name == ".npmrc" }
         end
+
+        def yarnrc_yml_file
+          dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") }
+        end
+
+        def yarnrc_yml_content
+          yarnrc_yml_file.content
+        end
       end
     end
   end

data/lib/dependabot/npm_and_yarn/file_updater.rb

@@ -2,6 +2,7 @@
 
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
+require "dependabot/file_updaters/vendor_updater"
 require "dependabot/npm_and_yarn/dependency_files_filterer"
 require "dependabot/npm_and_yarn/sub_dependency_files_filterer"
 
@@ -53,11 +54,61 @@ module Dependabot
           )
         end
 
-        updated_files
+        vendor_updated_files(updated_files)
       end
 
       private
 
+      def vendor_updated_files(updated_files)
+        base_dir = updated_files.first.directory
+        pnp_updater.updated_vendor_cache_files(base_directory: base_dir).each do |file|
+          updated_files << file if file.name == ".pnp.cjs" || file.name == ".pnp.data.json"
+        end
+        # updated .pnp.cjs means zero install, include cache
+        if updated_files.find { |f| f.name == ".pnp.cjs" }
+          vendor_updater.updated_vendor_cache_files(base_directory: base_dir).each { |file| updated_files << file }
+        end
+        install_state_updater.updated_vendor_cache_files(base_directory: base_dir).each do |file|
+          updated_files << file
+        end
+
+        updated_files
+      end
+
+      # Dynamically fetch the vendor cache folder from yarn
+      def vendor_cache_dir
+        return @vendor_cache_dir if defined?(@vendor_cache_dir)
+
+        @vendor_cache_dir = Helpers.fetch_yarnrc_yml_value("cacheFolder", "./.yarn/cache")
+      end
+
+      def install_state_path
+        return @install_state_path if defined?(@install_state_path)
+
+        @install_state_path = Helpers.fetch_yarnrc_yml_value("installStatePath", "./.yarn/install-state.gz")
+      end
+
+      def vendor_updater
+        Dependabot::FileUpdaters::VendorUpdater.new(
+          repo_contents_path: repo_contents_path,
+          vendor_dir: vendor_cache_dir
+        )
+      end
+
+      def install_state_updater
+        Dependabot::FileUpdaters::VendorUpdater.new(
+          repo_contents_path: repo_contents_path,
+          vendor_dir: install_state_path
+        )
+      end
+
+      def pnp_updater
+        Dependabot::FileUpdaters::VendorUpdater.new(
+          repo_contents_path: repo_contents_path,
+          vendor_dir: "./"
+        )
+      end
+
       def filtered_dependency_files
         @filtered_dependency_files ||=
           if dependencies.select(&:top_level?).any?
@@ -175,6 +226,7 @@ module Dependabot
           YarnLockfileUpdater.new(
             dependencies: dependencies,
             dependency_files: dependency_files,
+            repo_contents_path: repo_contents_path,
             credentials: credentials
           )
       end

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -15,6 +15,100 @@ module Dependabot
       rescue JSON::ParserError
         6
       end
+
+      def self.fetch_yarnrc_yml_value(key, default_value)
+        if File.exist?(".yarnrc.yml") && (yarnrc = YAML.load_file(".yarnrc.yml"))
+          yarnrc.fetch(key, default_value)
+        else
+          default_value
+        end
+      end
+
+      def self.yarn_berry?(yarn_lock)
+        yaml = YAML.safe_load(yarn_lock.content)
+        yaml.key?("__metadata")
+      rescue StandardError
+        false
+      end
+
+      def self.yarn_major_version
+        output = SharedHelpers.run_shell_command("yarn --version")
+        Version.new(output).major
+      end
+
+      def self.yarn_zero_install?
+        File.exist?(".pnp.cjs")
+      end
+
+      def self.yarn_berry_args
+        if yarn_major_version == 2
+          ""
+        elsif yarn_major_version >= 3 && yarn_zero_install?
+          "--mode=skip-build"
+        else
+          "--mode=update-lockfile"
+        end
+      end
+
+      def self.setup_yarn_berry
+        # Always disable immutable installs so yarn's CI detection doesn't prevent updates.
+        SharedHelpers.run_shell_command("yarn config set enableImmutableInstalls false")
+        # We never want to execute postinstall scripts, either set this config or mode=skip-build must be set
+        if yarn_major_version == 2 || !yarn_zero_install?
+          SharedHelpers.run_shell_command("yarn config set enableScripts false")
+        end
+        if (http_proxy = ENV.fetch("HTTP_PROXY", false))
+          SharedHelpers.run_shell_command("yarn config set httpProxy #{http_proxy}")
+        end
+        if (https_proxy = ENV.fetch("HTTPS_PROXY", false))
+          SharedHelpers.run_shell_command("yarn config set httpsProxy #{https_proxy}")
+        end
+        return unless (ca_file_path = ENV.fetch("NODE_EXTRA_CA_CERTS", false))
+
+        if yarn_major_version >= 4
+          SharedHelpers.run_shell_command("yarn config set httpsCaFilePath #{ca_file_path}")
+        else
+          SharedHelpers.run_shell_command("yarn config set caFilePath #{ca_file_path}")
+        end
+      end
+
+      # Run any number of yarn commands while ensuring that `enableScripts` is
+      # set to false. Yarn commands should _not_ be ran outside of this helper
+      # to ensure that postinstall scripts are never executed, as they could
+      # contain malicious code.
+      def self.run_yarn_commands(*commands)
+        setup_yarn_berry
+        commands.each { |cmd| SharedHelpers.run_shell_command(cmd) }
+      end
+
+      # Run a single yarn command returning stdout/stderr
+      def self.run_yarn_command(command)
+        setup_yarn_berry
+        SharedHelpers.run_shell_command(command)
+      end
+
+      def self.dependencies_with_all_versions_metadata(dependency_set)
+        working_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
+        dependencies = []
+
+        names = dependency_set.dependencies.map(&:name)
+        names.each do |name|
+          all_versions = dependency_set.all_versions_for_name(name)
+          all_versions.each do |dep|
+            metadata_versions = dep.metadata.fetch(:all_versions, [])
+            if metadata_versions.any?
+              metadata_versions.each { |a| working_set << a }
+            else
+              working_set << dep
+            end
+          end
+          dependency = working_set.dependency_for_name(name)
+          dependency.metadata[:all_versions] = working_set.all_versions_for_name(name)
+          dependencies << dependency
+        end
+
+        dependencies
+      end
     end
   end
 end

data/lib/dependabot/npm_and_yarn/package_name.rb

@@ -18,7 +18,7 @@ module Dependabot
             [a-z0-9\-\_\.\!\~\*\'\(\)]+               # URL-safe characters
           )
           \z                                          # end of string
-      }xi.freeze                                      # multi-line/case-insensitive
+      }xi                                             # multi-line/case-insensitive
 
       TYPES_PACKAGE_NAME_REGEX = %r{
           \A                                          # beginning of string
@@ -26,7 +26,7 @@ module Dependabot
           ((?<scope>.+)__)?                           # capture scope
           (?<name>.+)                                 # capture name
           \z                                          # end of string
-      }xi.freeze                                      # multi-line/case-insensitive
+      }xi                                             # multi-line/case-insensitive
 
       class InvalidPackageName < StandardError; end
 

data/lib/dependabot/npm_and_yarn/requirement.rb

@@ -6,8 +6,8 @@ require "dependabot/npm_and_yarn/version"
 module Dependabot
   module NpmAndYarn
     class Requirement < Gem::Requirement
-      AND_SEPARATOR = /(?<=[a-zA-Z0-9*])\s+(?:&+\s+)?(?!\s*[|-])/.freeze
-      OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|+/.freeze
+      AND_SEPARATOR = /(?<=[a-zA-Z0-9*])\s+(?:&+\s+)?(?!\s*[|-])/
+      OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|+/
       LATEST_REQUIREMENT = "latest"
 
       # Override the version pattern to allow a 'v' prefix
@@ -15,7 +15,7 @@ module Dependabot
       version_pattern = "v?#{NpmAndYarn::Version::VERSION_PATTERN}"
 
       PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{version_pattern})\\s*"
-      PATTERN = /\A#{PATTERN_RAW}\z/.freeze
+      PATTERN = /\A#{PATTERN_RAW}\z/
 
       def self.parse(obj)
         return ["=", nil] if obj.is_a?(String) && obj.strip == LATEST_REQUIREMENT

data/lib/dependabot/npm_and_yarn/update_checker/dependency_files_builder.rb

@@ -16,7 +16,12 @@ module Dependabot
         def write_temporary_dependency_files
           write_lock_files
 
-          File.write(".npmrc", npmrc_content)
+          if Helpers.yarn_berry?(yarn_locks.first)
+            File.write(".yarnrc.yml", yarnrc_yml_content) if yarnrc_yml_file
+          else
+            File.write(".npmrc", npmrc_content) unless Helpers.yarn_berry?(yarn_locks.first)
+            File.write(".yarnrc", yarnrc_content) if yarnrc_specifies_private_reg?
+          end
 
           package_files.each do |file|
             path = file.name
@@ -69,6 +74,24 @@ module Dependabot
           end
         end
 
+        def yarnrc_specifies_private_reg?
+          return false unless yarnrc_file
+
+          regex = UpdateChecker::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX
+          yarnrc_global_registry =
+            yarnrc_file.content.
+            lines.find { |line| line.match?(regex) }&.
+            match(regex)&.
+            named_captures&.
+            fetch("registry")
+
+          return false unless yarnrc_global_registry
+
+          UpdateChecker::RegistryFinder::CENTRAL_REGISTRIES.none? do |r|
+            r.include?(URI(yarnrc_global_registry).host)
+          end
+        end
+
         # Duplicated in NpmLockfileUpdater
         # Remove the dependency we want to update from the lockfile and let
         # yarn find the latest resolvable version and fix the lockfile
@@ -88,6 +111,25 @@ module Dependabot
             dependency_files: dependency_files
           ).npmrc_content
         end
+
+        def yarnrc_file
+          dependency_files.find { |f| f.name == ".yarnrc" }
+        end
+
+        def yarnrc_content
+          NpmAndYarn::FileUpdater::NpmrcBuilder.new(
+            credentials: credentials,
+            dependency_files: dependency_files
+          ).yarnrc_content
+        end
+
+        def yarnrc_yml_file
+          dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") }
+        end
+
+        def yarnrc_yml_content
+          yarnrc_yml_file.content
+        end
       end
     end
   end

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -130,10 +130,10 @@ module Dependabot
         end
 
         def filter_lower_versions(versions_array)
-          return versions_array unless dependency.version && version_class.correct?(dependency.version)
+          return versions_array unless dependency.numeric_version
 
           versions_array.
-            select { |version, _| version > version_class.new(dependency.version) }
+            select { |version, _| version > dependency.numeric_version }
         end
 
         def version_from_dist_tags
@@ -159,13 +159,10 @@ module Dependabot
           wants_latest_dist_tag?(latest) ? latest : nil
         end
 
-        # rubocop:disable Metrics/PerceivedComplexity
         def related_to_current_pre?(version)
-          current_version = dependency.version
-          if current_version &&
-             version_class.correct?(current_version) &&
-             version_class.new(current_version).prerelease? &&
-             version_class.new(current_version).release == version.release
+          current_version = dependency.numeric_version
+          if current_version&.prerelease? &&
+             current_version&.release == version.release
             return true
           end
 
@@ -181,7 +178,6 @@ module Dependabot
             false
           end
         end
-        # rubocop:enable Metrics/PerceivedComplexity
 
         def specified_dist_tag_requirement?
           dependency.requirements.any? do |req|
@@ -204,10 +200,9 @@ module Dependabot
         end
 
         def current_version_greater_than?(version)
-          return false unless dependency.version
-          return false unless version_class.correct?(dependency.version)
+          return false unless dependency.numeric_version
 
-          version_class.new(dependency.version) > version
+          dependency.numeric_version > version
         end
 
         def current_requirement_greater_than?(version)
@@ -292,7 +287,6 @@ module Dependabot
             url: dependency_url,
             headers: registry_auth_headers
           )
-
           return response unless response.status == 500
           return response unless registry_auth_headers["Authorization"]
 
@@ -371,7 +365,8 @@ module Dependabot
             dependency: dependency,
             credentials: credentials,
             npmrc_file: npmrc_file,
-            yarnrc_file: yarnrc_file
+            yarnrc_file: yarnrc_file,
+            yarnrc_yml_file: yarnrc_yml_file
           )
         end
 
@@ -395,6 +390,10 @@ module Dependabot
           dependency_files.find { |f| f.name.end_with?(".yarnrc") }
         end
 
+        def yarnrc_yml_file
+          dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") }
+        end
+
         # TODO: Remove need for me
         def git_dependency?
           # ignored_version/raise_on_ignored are irrelevant.

data/lib/dependabot/npm_and_yarn/update_checker/library_detector.rb

@@ -8,8 +8,10 @@ module Dependabot
   module NpmAndYarn
     class UpdateChecker
       class LibraryDetector
-        def initialize(package_json_file:)
+        def initialize(package_json_file:, credentials:, dependency_files:)
           @package_json_file = package_json_file
+          @credentials = credentials
+          @dependency_files = dependency_files
         end
 
         def library?
@@ -20,7 +22,7 @@ module Dependabot
 
         private
 
-        attr_reader :package_json_file
+        attr_reader :package_json_file, :credentials, :dependency_files
 
         def package_json_may_be_for_library?
           return false unless project_name
@@ -36,7 +38,8 @@ module Dependabot
           return false unless project_description
 
           # Check if the project is listed on npm. If it is, it's a library
-          @project_npm_response ||= Dependabot::RegistryClient.get(url: "https://registry.npmjs.org/#{escaped_project_name}")
+          url = "#{registry.chomp('/')}/#{escaped_project_name}"
+          @project_npm_response ||= Dependabot::RegistryClient.get(url: url)
           return false unless @project_npm_response.status == 200
 
           @project_npm_response.body.force_encoding("UTF-8").encode.
@@ -56,6 +59,16 @@ module Dependabot
         def parsed_package_json
           @parsed_package_json ||= JSON.parse(package_json_file.content)
         end
+
+        def registry
+          NpmAndYarn::UpdateChecker::RegistryFinder.new(
+            dependency: nil,
+            credentials: credentials,
+            npmrc_file: dependency_files.find { |f| f.name.end_with?(".npmrc") },
+            yarnrc_file: dependency_files.find { |f| f.name.end_with?(".yarnrc") },
+            yarnrc_yml_file: dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") }
+          ).registry_from_rc(project_name)
+        end
       end
     end
   end