dependabot-npm_and_yarn 0.238.0 → 0.239.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2c0db164e5243272120c361db0a1225b2e972b42646f2c0a9b472bbab1b786f
-  data.tar.gz: 9333c5f3367afae8b6838fd8e538f194b49a47b28fd4d9426fd298e729c935ac
+  metadata.gz: 4a56edd19122fd01bf494ccd5c3e4f9641f32289ebabf6bb08915d869ee58f2b
+  data.tar.gz: 0c9883cde9e28dc7a60056db9766eb1ada8a8b5f3890bba671423571d2164697
 SHA512:
-  metadata.gz: dfda845d386da030ff4264f4a2640fa51719e14884b898b0f46239416ce13a2f53d78662231a5ca094cc53c448d46b47a26faf9c5d7b1b2cb003c1b30c915059
-  data.tar.gz: 6edce2ecfd1ff4fd52f2944956869730f31e2d6754ef9dbf8f29a6723f187a8e4f245cb563faf908151a84d62dfcf443b9e74ff1e861e33c44b67ece804aba28
+  metadata.gz: d74b8568ea273f503b4168667f33fade47048e3364236560a409a9399676b4ed3e5c344435b982f1112ca8340deecb0141d60ca842c080fc0a054c4b49d0b5b0
+  data.tar.gz: 02af05f027efc8e1e5e429e4485d36d29f1bf636cfb05ae61025e3ce2ef8a77e09292c09e279bf9ab457da0a6533f4faa7c7e7219c2256094cdb28a81fc71ab8

data/helpers/build

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 

data/lib/dependabot/npm_and_yarn/file_fetcher/path_dependency_builder.rb

@@ -64,11 +64,11 @@ module Dependabot
               name: dependency_name,
               version: details_from_yarn_lock["version"] || "0.0.1",
               dependencies:
-                replace_yarn_lock_file_paths(
+                replace_yarn_lockfile_paths(
                   details_from_yarn_lock["dependencies"]
                 ),
               optionalDependencies:
-                replace_yarn_lock_file_paths(
+                replace_yarn_lockfile_paths(
                   details_from_yarn_lock["optionalDependencies"]
                 )
             }.compact.to_json
@@ -86,7 +86,7 @@ module Dependabot
         # relative. Worse, they may point to the user's local cache.
         # We work around this by constructing a relative path to the
         # (second-level) path dependencies.
-        def replace_yarn_lock_file_paths(dependencies_hash)
+        def replace_yarn_lockfile_paths(dependencies_hash)
           return unless dependencies_hash
 
           dependencies_hash.each_with_object({}) do |(name, value), obj|

data/lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb

@@ -64,7 +64,7 @@ module Dependabot
         attr_reader :dependency_files, :credentials, :dependencies
 
         def build_npmrc_content_from_lockfile
-          return unless yarn_lock || package_lock
+          return unless yarn_lock || package_lock || shrinkwrap
           return unless global_registry
 
           registry = global_registry["registry"]
@@ -149,9 +149,10 @@ module Dependabot
             return @dependency_urls
           end
 
-          if package_lock
+          npm_lockfile = package_lock || shrinkwrap
+          if npm_lockfile
             @dependency_urls +=
-              package_lock.content.scan(/"resolved"\s*:\s*"(.*)"/)
+              npm_lockfile.content.scan(/"resolved"\s*:\s*"(.*)"/)
                           .flatten
                           .select { |url| url.is_a?(String) }
                           .reject { |url| url.start_with?("git") }
@@ -334,6 +335,11 @@ module Dependabot
           @package_lock ||=
             dependency_files.find { |f| f.name == "package-lock.json" }
         end
+
+        def shrinkwrap
+          @shrinkwrap ||=
+            dependency_files.find { |f| f.name == "npm-shrinkwrap.json" }
+        end
       end
     end
   end

data/lib/dependabot/npm_and_yarn/file_updater/package_json_preparer.rb

@@ -56,7 +56,7 @@ module Dependabot
           content
             .gsub(/\{\{[^\}]*?\}\}/, "something") # {{ nm }} syntax not allowed
             .gsub(/(?<!\\)\\ /, " ") # escaped whitespace not allowed
-            .gsub(%r{^\s*//.*}, " ")           # comments are not allowed
+            .gsub(%r{^\s*//.*}, " ") # comments are not allowed
         end
 
         def swapped_ssh_requirements

data/lib/dependabot/npm_and_yarn/requirement.rb

@@ -1,12 +1,17 @@
 # typed: true
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
+require "dependabot/requirement"
 require "dependabot/utils"
 require "dependabot/npm_and_yarn/version"
 
 module Dependabot
   module NpmAndYarn
-    class Requirement < Gem::Requirement
+    class Requirement < Dependabot::Requirement
+      extend T::Sig
+
       AND_SEPARATOR = /(?<=[a-zA-Z0-9*])\s+(?:&+\s+)?(?!\s*[|-])/
       OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|+/
       LATEST_REQUIREMENT = "latest"
@@ -34,6 +39,7 @@ module Dependabot
 
       # Returns an array of requirements. At least one requirement from the
       # returned array must be satisfied for a version to be valid.
+      sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Requirement]) }
       def self.requirements_array(requirement_string)
         return [new(nil)] if requirement_string.nil?
 

data/lib/dependabot/npm_and_yarn/update_checker/dependency_files_builder.rb

@@ -15,7 +15,7 @@ module Dependabot
         end
 
         def write_temporary_dependency_files
-          write_lock_files
+          write_lockfiles
 
           if Helpers.yarn_berry?(yarn_locks.first)
             File.write(".yarnrc.yml", yarnrc_yml_content) if yarnrc_yml_file
@@ -81,7 +81,7 @@ module Dependabot
 
         attr_reader :dependency, :dependency_files, :credentials
 
-        def write_lock_files
+        def write_lockfiles
           yarn_locks.each do |f|
             FileUtils.mkdir_p(Pathname.new(f.name).dirname)
             File.write(f.name, prepared_yarn_lockfile_content(f.content))

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.238.0
+  version: 0.239.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-12-07 00:00:00.000000000 Z
+date: 2023-12-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.238.0
+        version: 0.239.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.238.0
+        version: 0.239.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -114,14 +114,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.57.2
+        version: 1.58.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.57.2
+        version: 1.58.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -310,7 +310,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.238.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.239.0
 post_install_message: 
 rdoc_options: []
 require_paths: