dependabot-npm_and_yarn 0.234.0 → 0.236.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a27bb59e6f310774f64895b924bc5742274ceecbb6abe60cab93cac357411756
-  data.tar.gz: da0c736d6e7cea385ae0aae3e1e56706dea413275b81e463835ba13d2bd2546f
+  metadata.gz: bafddbe8b9f7271bfe627a801e033b06e68322bdc779ec03201219695fadc3d3
+  data.tar.gz: 00d80f7d9354519ecffa4eb204ded84b97a504c99dc730f9dcd26b06ed1fbf3a
 SHA512:
-  metadata.gz: 00da9575c0a19c4b498a8b67502524bc2c1f6ea43fcc86b109f6030b88b9f69fa4638347b2200d75975bd6996210e048acf721597a930557f5d2dadff7bb076b
-  data.tar.gz: e554bd4fbe813d7c5cbeebe433b327750e714b92e954b30c48b644a51a9d9550467fe9247a382797d818c855a0a7c94cd3d0bf4beee91694ae7881730c1acab0
+  metadata.gz: 4f4ae8c26775b215b5cafc160cd21997a1dd7cf42281108e6648eab93817c3b804948fdcc3e51906d9167aa84cf0f09aaa8085348bc2ef5db3e3a659057fd61f
+  data.tar.gz: 965c3fab89f25c9117cbfba819fa80db7c3ffb1c72ef0f1f6a24ff9708465a68f43d9574804a9a6abf81040b46db51fa7a83870e3544892a71a9a9f418971507

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -69,6 +69,10 @@ module Dependabot
 
       private
 
+      def recurse_submodules_when_cloning?
+        true
+      end
+
       def fetch_files
         fetched_files = []
         fetched_files << package_json

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -41,11 +41,16 @@ module Dependabot
 
         dependencies = Helpers.dependencies_with_all_versions_metadata(dependency_set)
 
-        # TODO: Currently, Dependabot can't handle dependencies that have both
-        # a git source *and* a non-git source. Fix that!
         dependencies.reject do |dep|
-          git_reqs =
-            dep.requirements.select { |r| r.dig(:source, :type) == "git" }
+          reqs = dep.requirements
+
+          # Ignore dependencies defined in support files, since we don't want PRs for those
+          support_reqs = reqs.select { |r| support_package_files.any? { |f| f.name == r[:file] } }
+          next true if support_reqs.any?
+
+          # TODO: Currently, Dependabot can't handle dependencies that have both
+          # a git source *and* a non-git source. Fix that!
+          git_reqs = reqs.select { |r| r.dig(:source, :type) == "git" }
           next false if git_reqs.none?
           next true if git_reqs.map { |r| r.fetch(:source) }.uniq.count > 1
 
@@ -334,21 +339,23 @@ module Dependabot
         resolved_url.gsub(/#{Regexp.quote(reg)}.*/, "") + reg
       end
 
+      def support_package_files
+        @support_package_files ||= sub_package_files.select(&:support_file?)
+      end
+
+      def sub_package_files
+        @sub_package_files ||=
+          dependency_files.select { |f| f.name.end_with?("package.json") }
+                          .reject { |f| f.name == "package.json" }
+                          .reject { |f| f.name.include?("node_modules/") }
+      end
+
       def package_files
         @package_files ||=
-          begin
-            sub_packages =
-              dependency_files
-              .select { |f| f.name.end_with?("package.json") }
-              .reject { |f| f.name == "package.json" }
-              .reject { |f| f.name.include?("node_modules/") }
-              .reject(&:support_file?)
-
-            [
-              dependency_files.find { |f| f.name == "package.json" },
-              *sub_packages
-            ].compact
-          end
+          [
+            dependency_files.find { |f| f.name == "package.json" },
+            *sub_package_files
+          ].compact
       end
 
       def version_class

data/lib/dependabot/npm_and_yarn.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 # These all need to be required so the various classes can be registered in a

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.234.0
+  version: 0.236.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-10-12 00:00:00.000000000 Z
+date: 2023-10-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.234.0
+        version: 0.236.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.234.0
+        version: 0.236.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -295,7 +295,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.234.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.236.0
 post_install_message: 
 rdoc_options: []
 require_paths: