dependabot-npm_and_yarn 0.245.0 → 0.247.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '08ca440632dcb31fd069029c93a25b992b9ebb03b082bf82871d802438c76e26'
-  data.tar.gz: bff2c5aa5a3de69d5f9e3dddb15e108bbb9e6e56c414ee920be390fae74e88e2
+  metadata.gz: c4a5d0e2b8378c9540d4094bb5cc01c1d41be121ea9b7ad495267c9ace61c029
+  data.tar.gz: e9a81c3bec5d7eb432cf78b25e8695f7beddd0432e86c67afc7b5111c2c73808
 SHA512:
-  metadata.gz: 1c0fe93b09e1f6a991ab67961ab6447380b4062941b439ba4191baea11840754ee3ecd797690f3c463133fd2c2aba61312d97af9c7e3064e1cd03bcf40fa52d4
-  data.tar.gz: 849d54d8c0e7056f608f457b0f4f63e9146aff22605f16bb88a08ca1833c58f185bc3dfa2e62fe0ee86e3a923521787c7932152b39f6aa7b5e6e606fca07c6eb
+  metadata.gz: 83105432cc7b80df01084418d0429bb788a03f23bb2eaf33ea68d4370db76e70b735c4aec2b0ebbeda3949084f7bbc9f61a5f3338edcf36fd2cd0263981b2605
+  data.tar.gz: b48188962c0d5779cfef7a473173824945b371fd09a7a72f52c13f60fcf28b4593d2bacce52b1bca42bae2cfb514e1ecfe9fc67d349379aa5af1bfc89be14cc7

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -87,10 +87,6 @@ module Dependabot
 
       private
 
-      def recurse_submodules_when_cloning?
-        true
-      end
-
       def npm_files
         fetched_npm_files = []
         fetched_npm_files << package_lock if package_lock && !skip_package_lock?
@@ -550,7 +546,7 @@ module Dependabot
         return {} unless pnpm_workspace_yaml
 
         YAML.safe_load(pnpm_workspace_yaml.content)
-      rescue Pysch::SyntaxError
+      rescue Psych::SyntaxError
         raise Dependabot::DependencyFileNotParseable, pnpm_workspace_yaml.path
       end
 

data/lib/dependabot/npm_and_yarn/file_parser/json_lock.rb

@@ -38,7 +38,7 @@ module Dependabot
         private
 
         def recursively_fetch_dependencies(object_with_dependencies)
-          dependency_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
+          dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
           dependencies = object_with_dependencies["dependencies"]
           dependencies ||= object_with_dependencies.fetch("packages", {})

data/lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "dependabot/dependency_file"
@@ -18,7 +18,7 @@ module Dependabot
         end
 
         def parse_set
-          dependency_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
+          dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
           # NOTE: The DependencySet will de-dupe our dependencies, so they
           # end up unique by name. That's not a perfect representation of

data/lib/dependabot/npm_and_yarn/file_parser/pnpm_lock.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "dependabot/errors"
@@ -26,7 +26,7 @@ module Dependabot
         end
 
         def dependencies
-          dependency_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
+          dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
           parsed.each do |details|
             next if details["aliased"]

data/lib/dependabot/npm_and_yarn/file_parser/yarn_lock.rb

@@ -32,7 +32,7 @@ module Dependabot
         end
 
         def dependencies
-          dependency_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
+          dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
           parsed.each do |reqs, details|
             reqs.split(", ").each do |req|

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -9,10 +9,14 @@ require "dependabot/npm_and_yarn/version"
 require "dependabot/npm_and_yarn/requirement"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
+require "sorbet-runtime"
+
 module Dependabot
   module NpmAndYarn
     class UpdateChecker
       class LatestVersionFinder
+        extend T::Sig
+
         class RegistryError < StandardError
           attr_reader :status
 
@@ -111,6 +115,7 @@ module Dependabot
           !npm_details&.fetch("dist-tags", nil).nil?
         end
 
+        sig { params(versions_array: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
         def filter_ignored_versions(versions_array)
           filtered = versions_array.reject do |v, _|
             ignore_requirements.any? { |r| r.satisfied_by?(v) }
@@ -120,9 +125,15 @@ module Dependabot
             raise AllVersionsIgnored
           end
 
+          if versions_array.count > filtered.count
+            diff = versions_array.count - filtered.count
+            Dependabot.logger.info("Filtered out #{diff} ignored versions")
+          end
+
           filtered
         end
 
+        sig { params(versions_array: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
         def filter_out_of_range_versions(versions_array)
           reqs = dependency.requirements.filter_map do |r|
             NpmAndYarn::Requirement.requirements_array(r.fetch(:requirement))
@@ -132,6 +143,7 @@ module Dependabot
             .select { |v| reqs.all? { |r| r.any? { |o| o.satisfied_by?(v) } } }
         end
 
+        sig { params(versions_array: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
         def filter_lower_versions(versions_array)
           return versions_array unless dependency.numeric_version
 

data/lib/dependabot/npm_and_yarn/update_checker/registry_finder.rb

@@ -156,7 +156,7 @@ module Dependabot
             begin
               registries = []
               registries += credentials
-                            .select { |cred| cred["type"] == "npm_registry" }
+                            .select { |cred| cred["type"] == "npm_registry" && cred["registry"] }
                             .tap { |arr| arr.each { |c| c["token"] ||= nil } }
               registries += npmrc_registries
               registries += yarnrc_registries

data/lib/dependabot/npm_and_yarn/update_checker/requirements_updater.rb

@@ -6,9 +6,10 @@
 # https://docs.npmjs.com/misc/semver                                           #
 ################################################################################
 
+require "dependabot/npm_and_yarn/requirement"
 require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/npm_and_yarn/version"
-require "dependabot/npm_and_yarn/requirement"
+require "dependabot/requirements_update_strategy"
 
 module Dependabot
   module NpmAndYarn
@@ -16,7 +17,15 @@ module Dependabot
       class RequirementsUpdater
         VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/
         SEPARATOR = /(?<=[a-zA-Z0-9*])[\s|]+(?![\s|-])/
-        ALLOWED_UPDATE_STRATEGIES = %i(lockfile_only widen_ranges bump_versions bump_versions_if_necessary).freeze
+        ALLOWED_UPDATE_STRATEGIES = T.let(
+          [
+            RequirementsUpdateStrategy::LockfileOnly,
+            RequirementsUpdateStrategy::WidenRanges,
+            RequirementsUpdateStrategy::BumpVersions,
+            RequirementsUpdateStrategy::BumpVersionsIfNecessary
+          ].freeze,
+          T::Array[Dependabot::RequirementsUpdateStrategy]
+        )
 
         def initialize(requirements:, updated_source:, update_strategy:,
                        latest_resolvable_version:)
@@ -33,7 +42,7 @@ module Dependabot
         end
 
         def updated_requirements
-          return requirements if update_strategy == :lockfile_only
+          return requirements if update_strategy == RequirementsUpdateStrategy::LockfileOnly
 
           requirements.map do |req|
             req = req.merge(source: updated_source)
@@ -42,9 +51,9 @@ module Dependabot
             next req if req[:requirement].match?(/^([A-Za-uw-z]|v[^\d])/)
 
             case update_strategy
-            when :widen_ranges then widen_requirement(req)
-            when :bump_versions then update_version_requirement(req)
-            when :bump_versions_if_necessary
+            when RequirementsUpdateStrategy::WidenRanges then widen_requirement(req)
+            when RequirementsUpdateStrategy::BumpVersions then update_version_requirement(req)
+            when RequirementsUpdateStrategy::BumpVersionsIfNecessary
               update_version_requirement_if_needed(req)
             else raise "Unexpected update strategy: #{update_strategy}"
             end

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -270,6 +270,8 @@ module Dependabot
         def types_update_available?
           return false if types_package.nil?
 
+          return false if latest_types_package_version.nil?
+
           return false unless latest_allowable_version.backwards_compatible_with?(latest_types_package_version)
 
           return false unless version_class.correct?(types_package.version)

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -1,11 +1,13 @@
 # typed: true
 # frozen_string_literal: true
 
+require "set"
+
 require "dependabot/git_commit_checker"
+require "dependabot/requirements_update_strategy"
+require "dependabot/shared_helpers"
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
-require "dependabot/shared_helpers"
-require "set"
 
 module Dependabot
   module NpmAndYarn
@@ -104,15 +106,15 @@ module Dependabot
       end
 
       def requirements_unlocked_or_can_be?
-        requirements_update_strategy != :lockfile_only
+        requirements_update_strategy != RequirementsUpdateStrategy::LockfileOnly
       end
 
       def requirements_update_strategy
         # If passed in as an option (in the base class) honour that option
-        return @requirements_update_strategy.to_sym if @requirements_update_strategy
+        return @requirements_update_strategy if @requirements_update_strategy
 
         # Otherwise, widen ranges for libraries and bump versions for apps
-        library? ? :widen_ranges : :bump_versions
+        library? ? RequirementsUpdateStrategy::WidenRanges : RequirementsUpdateStrategy::BumpVersions
       end
 
       def conflicting_dependencies

data/lib/dependabot/npm_and_yarn/version.rb

@@ -21,20 +21,7 @@ module Dependabot
       VERSION_PATTERN = T.let(Gem::Version::VERSION_PATTERN + '(\+[0-9a-zA-Z\-.]+)?', String)
       ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
 
-      sig do
-        override
-          .overridable
-          .params(
-            version: T.any(
-              String,
-              Integer,
-              Float,
-              Gem::Version,
-              NilClass
-            )
-          )
-          .returns(T::Boolean)
-      end
+      sig { override.params(version: VersionParameter).returns(T::Boolean) }
       def self.correct?(version)
         version = version.gsub(/^v/, "") if version.is_a?(String)
 
@@ -43,7 +30,7 @@ module Dependabot
         version.to_s.match?(ANCHORED_VERSION_PATTERN)
       end
 
-      sig { params(version: T.nilable(T.any(String, Gem::Version))).returns(T.nilable(T.any(String, Gem::Version))) }
+      sig { params(version: VersionParameter).returns(VersionParameter) }
       def self.semver_for(version)
         # The next two lines are to guard against improperly formatted
         # versions in a lockfile, such as an empty string or additional
@@ -55,19 +42,7 @@ module Dependabot
         version
       end
 
-      sig do
-        override
-          .params(
-            version: T.any(
-              String,
-              Integer,
-              Float,
-              Gem::Version,
-              NilClass
-            )
-          )
-          .void
-      end
+      sig { override.params(version: VersionParameter).void }
       def initialize(version)
         @version_string = T.let(version.to_s, String)
         version = version.gsub(/^v/, "") if version.is_a?(String)
@@ -77,19 +52,7 @@ module Dependabot
         super(T.must(version))
       end
 
-      sig do
-        override
-          .params(
-            version: T.any(
-              String,
-              Integer,
-              Float,
-              Gem::Version,
-              NilClass
-            )
-          )
-          .returns(Dependabot::NpmAndYarn::Version)
-      end
+      sig { override.params(version: VersionParameter).returns(Dependabot::NpmAndYarn::Version) }
       def self.new(version)
         T.cast(super, Dependabot::NpmAndYarn::Version)
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.245.0
+  version: 0.247.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-02-22 00:00:00.000000000 Z
+date: 2024-03-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.245.0
+        version: 0.247.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.245.0
+        version: 0.247.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -136,6 +136,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 1.19.0
+- !ruby/object:Gem::Dependency
+  name: rubocop-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.27.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.27.1
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
@@ -324,7 +338,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.245.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.247.0
 post_install_message: 
 rdoc_options: []
 require_paths: