dependabot-npm_and_yarn 0.216.2 → 0.218.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2df51373de95ce542233cbb690f059ee015534e3e57d69470031491f9dd89794
-  data.tar.gz: c8e33eea70d6765a96e87248ebc4b5f8cedb49ea03e9c1abf79bdaddfc6cda00
+  metadata.gz: 7206f2db6166afbdb898d6bc710f53255a7ee8426eb820642e56bdd967ddc079
+  data.tar.gz: 6525f3d43debb1e9f09a612ca04589f29a4c14b1c16b27c86fb1140270ab5c18
 SHA512:
-  metadata.gz: 27c3502dd326b7b82738fa402d2e46c6054750af2e029b08f5c97b8f51e946c7090754e0679050116bbb6f572635aea77b77f4951ff19d703ff090e5308a5033
-  data.tar.gz: bdbfbb9f4896a58635cc9eef900f00a6e2ef02c438bb8a072fa83c199d532c9c92742ed805e8e39ddb3a5b746f50a457a7a29c4963870eddb61d0c4b7cc15957
+  metadata.gz: 6f867a7d9a6cdef47a73c6d13b263b02e6622ff97282322c289fb46567548e6f58dd05588e7dd03e915183ed51ecd1532c9dd818452d0672521d1f43ede98d18
+  data.tar.gz: d55ba2258422781d317652cc712a349cbd43391aa9730ea1f1b79f7198c48cba24abb3956199278f796d76bb74e3bfa1c789e62eb5f930c47ff6d95d79282751

data/helpers/lib/pnpm/index.js

@@ -0,0 +1,5 @@
+const lockfileParser = require("./lockfile-parser");
+
+module.exports = {
+  parseLockfile: lockfileParser.parse,
+};

data/helpers/lib/pnpm/lockfile-parser.js

@@ -0,0 +1,77 @@
+/* PNPM-LOCK.YAML PARSER
+ *
+ * Inputs:
+ *  - directory containing a pnpm-lock.yaml file
+ *
+ * Outputs:
+ *  - JSON formatted information of dependencies (name, version, dependency-type)
+ */
+const { readWantedLockfile } = require("@pnpm/lockfile-file");
+const dependencyPath = require("@pnpm/dependency-path");
+
+async function parse(directory) {
+  const lockfile = await readWantedLockfile(directory, {
+    ignoreIncompatible: true
+  });
+
+  return Object.entries(lockfile.packages ?? {})
+    .map(([depPath, pkgSnapshot]) => nameVerDevFromPkgSnapshot(depPath, pkgSnapshot, Object.values(lockfile.importers)))
+}
+
+function nameVerDevFromPkgSnapshot(depPath, pkgSnapshot, projectSnapshots) {
+  let name;
+  let version;
+
+  if (!pkgSnapshot.name) {
+    const pkgInfo = dependencyPath.parse(depPath);
+    name = pkgInfo.name;
+    version = pkgInfo.version;
+  } else {
+    name = pkgSnapshot.name;
+    version = pkgSnapshot.version;
+  }
+
+  let specifiers = [];
+  let aliased = false;
+
+  projectSnapshots.every(projectSnapshot => {
+    const projectSpecifiers = projectSnapshot.specifiers;
+
+    if (Object.values(projectSpecifiers).some(specifier => specifier.startsWith(`npm:${name}@`) || specifier == `npm:${name}`)) {
+      aliased = true;
+      return false;
+    }
+
+    currentSpecifier = projectSpecifiers[name];
+
+    if (!currentSpecifier) {
+      return true;
+    }
+
+    let specifierVersion = currentSpecifier.version;
+
+    if (!currentSpecifier.version) {
+      specifierVersion = projectSnapshot.dependencies?.[name] || projectSnapshot.devDependencies?.[name] || projectSnapshot.optionalDependencies?.[name]
+    }
+
+    if (
+      specifierVersion == version ||
+      specifierVersion.startsWith(`${version}_`) || // lockfileVersion 5.4
+      specifierVersion.startsWith(`${version}(`)    // lockfileVersion 6.0
+    ) {
+      specifiers.push(currentSpecifier.specifier || currentSpecifier);
+    }
+
+    return true;
+  });
+
+  return {
+    name: name,
+    version: version,
+    dev: pkgSnapshot.dev,
+    specifiers: specifiers,
+    aliased: aliased
+  }
+}
+
+module.exports = { parse };