dependabot-npm_and_yarn 0.226.0 → 0.228.0

data/helpers/package.json

@@ -6,7 +6,8 @@
   },
   "scripts": {
     "lint": "eslint .",
-    "test": "jest"
+    "test": "jest",
+    "postinstall": "patch-package"
   },
   "dependencies": {
     "@dependabot/yarn-lib": "^1.22.19",
@@ -16,12 +17,13 @@
     "npm": "6.14.18",
     "@pnpm/lockfile-file": "^8.1.2",
     "@pnpm/dependency-path": "^2.1.1",
-    "semver": "^7.4.0"
+    "semver": "^7.4.0",
+    "patch-package": "^8.0.0"
   },
   "devDependencies": {
-    "eslint": "^8.46.0",
+    "eslint": "^8.47.0",
     "eslint-config-prettier": "^9.0.0",
-    "jest": "^29.6.2",
-    "prettier": "^3.0.1"
+    "jest": "^29.6.3",
+    "prettier": "^3.0.2"
   }
 }

data/helpers/patches/npm++pacote+9.5.12.patch

@@ -0,0 +1,14 @@
+diff --git a/node_modules/npm/node_modules/pacote/lib/util/git.js b/node_modules/npm/node_modules/pacote/lib/util/git.js
+index 7642eb2..7bb3324 100644
+--- a/node_modules/npm/node_modules/pacote/lib/util/git.js
++++ b/node_modules/npm/node_modules/pacote/lib/util/git.js
+@@ -25,7 +25,8 @@ const GOOD_ENV_VARS = new Set([
+   'GIT_SSH',
+   'GIT_SSH_COMMAND',
+   'GIT_SSL_CAINFO',
+-  'GIT_SSL_NO_VERIFY'
++  'GIT_SSL_NO_VERIFY',
++  'GIT_CONFIG_GLOBAL'
+ ])
+ 
+ const GIT_TRANSIENT_ERRORS = [

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -9,6 +9,7 @@ require "dependabot/shared_helpers"
 require "dependabot/npm_and_yarn/helpers"
 require "dependabot/npm_and_yarn/native_helpers"
 require "dependabot/npm_and_yarn/version"
+require "dependabot/npm_and_yarn/requirement"
 require "dependabot/git_metadata_fetcher"
 require "dependabot/git_commit_checker"
 require "dependabot/errors"
@@ -167,15 +168,20 @@ module Dependabot
 
       def version_for(requirement, lockfile_details)
         if git_url_with_semver?(requirement)
-          semver_version = semver_version_for(lockfile_details)
+          semver_version = lockfile_version_for(lockfile_details)
           return semver_version if semver_version
 
           git_revision = git_revision_for(lockfile_details)
           version_from_git_revision(requirement, git_revision) || git_revision
         elsif git_url?(requirement)
           git_revision_for(lockfile_details)
+        elsif lockfile_details
+          lockfile_version_for(lockfile_details)
         else
-          semver_version_for(lockfile_details)
+          exact_version = exact_version_for(requirement)
+          return unless exact_version
+
+          semver_version_for(exact_version)
         end
       end
 
@@ -216,8 +222,21 @@ module Dependabot
         nil
       end
 
-      def semver_version_for(lockfile_details)
-        version_class.semver_for(lockfile_details&.fetch("version", ""))
+      def lockfile_version_for(lockfile_details)
+        semver_version_for(lockfile_details&.fetch("version", ""))
+      end
+
+      def semver_version_for(version)
+        version_class.semver_for(version)
+      end
+
+      def exact_version_for(requirement)
+        req = requirement_class.new(requirement)
+        return unless req.exact?
+
+        req.requirements.first.last.to_s
+      rescue Gem::Requirement::BadRequirementError
+        # If it doesn't parse, it's definitely not exact
       end
 
       def source_for(name, requirement, lockfile_details)
@@ -334,6 +353,10 @@ module Dependabot
       def version_class
         NpmAndYarn::Version
       end
+
+      def requirement_class
+        NpmAndYarn::Requirement
+      end
     end
   end
 end

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -552,7 +552,7 @@ module Dependabot
           return "" if indentation.nil? # let npm set the default if we can't detect any indentation
 
           indentation_size = indentation.length
-          indentation_type = indentation.scan(/\t/).any? ? "\t" : " "
+          indentation_type = indentation.scan("\t").any? ? "\t" : " "
 
           indentation_type * indentation_size
         end

data/lib/dependabot/npm_and_yarn/file_updater/package_json_updater.rb

@@ -214,7 +214,7 @@ module Dependabot
           #
           # TODO: Move this logic to the UpdateChecker (and parse peer deps)
           sections += ["peerDependencies"]
-          sections_regex = /#{sections.join("|")}/
+          sections_regex = /#{sections.join('|')}/
 
           declaration_blocks = []
 

data/lib/dependabot/npm_and_yarn/file_updater.rb

@@ -111,7 +111,7 @@ module Dependabot
 
       def filtered_dependency_files
         @filtered_dependency_files ||=
-          if dependencies.select(&:top_level?).any?
+          if dependencies.any?(&:top_level?)
             DependencyFilesFilterer.new(
               dependency_files: dependency_files,
               updated_dependencies: dependencies

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -122,26 +122,10 @@ module Dependabot
       end
 
       def self.dependencies_with_all_versions_metadata(dependency_set)
-        working_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
-        dependencies = []
-
-        names = dependency_set.dependencies.map(&:name)
-        names.each do |name|
-          all_versions = dependency_set.all_versions_for_name(name)
-          all_versions.each do |dep|
-            metadata_versions = dep.metadata.fetch(:all_versions, [])
-            if metadata_versions.any?
-              metadata_versions.each { |a| working_set << a }
-            else
-              working_set << dep
-            end
-          end
-          dependency = working_set.dependency_for_name(name)
-          dependency.metadata[:all_versions] = working_set.all_versions_for_name(name)
-          dependencies << dependency
+        dependency_set.dependencies.map do |dependency|
+          dependency.metadata[:all_versions] = dependency_set.all_versions_for_name(dependency.name)
+          dependency
         end
-
-        dependencies
       end
     end
   end

data/lib/dependabot/npm_and_yarn.rb

@@ -25,4 +25,5 @@ Dependabot::Dependency.register_production_check(
   end
 )
 
+require "dependabot/utils"
 Dependabot::Utils.register_always_clone("npm_and_yarn")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.226.0
+  version: 0.228.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-08-11 00:00:00.000000000 Z
+date: 2023-08-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.226.0
+        version: 0.228.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.226.0
+        version: 0.228.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -114,28 +114,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.50.0
+        version: 1.56.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.50.0
+        version: 1.56.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.18.0
+        version: 1.19.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.18.0
+        version: 1.19.0
 - !ruby/object:Gem::Dependency
   name: stackprof
   requirement: !ruby/object:Gem::Requirement
@@ -212,6 +212,7 @@ files:
 - helpers/lib/yarn/updater.js
 - helpers/package-lock.json
 - helpers/package.json
+- helpers/patches/npm++pacote+9.5.12.patch
 - helpers/run.js
 - helpers/test/npm6/conflicting-dependency-parser.test.js
 - helpers/test/npm6/fixtures/conflicting-dependency-parser/deeply-nested/package-lock.json
@@ -280,7 +281,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.226.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.228.0
 post_install_message: 
 rdoc_options: []
 require_paths: