dependabot-npm_and_yarn 0.247.0 → 0.249.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/dependabot/npm_and_yarn/dependency_files_filterer.rb +2 -1
- data/lib/dependabot/npm_and_yarn/file_fetcher/path_dependency_builder.rb +5 -2
- data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb +4 -1
- data/lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb +3 -1
- data/lib/dependabot/npm_and_yarn/file_updater/package_json_updater.rb +2 -1
- data/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb +4 -1
- data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb +12 -3
- data/lib/dependabot/npm_and_yarn/helpers.rb +9 -0
- data/lib/dependabot/npm_and_yarn/registry_parser.rb +2 -1
- data/lib/dependabot/npm_and_yarn/sub_dependency_files_filterer.rb +2 -1
- data/lib/dependabot/npm_and_yarn/update_checker/conflicting_dependency_resolver.rb +2 -1
- data/lib/dependabot/npm_and_yarn/update_checker/dependency_files_builder.rb +3 -1
- data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb +5 -2
- data/lib/dependabot/npm_and_yarn/update_checker/library_detector.rb +3 -1
- data/lib/dependabot/npm_and_yarn/update_checker/registry_finder.rb +5 -1
- data/lib/dependabot/npm_and_yarn/update_checker/requirements_updater.rb +4 -2
- data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb +6 -2
- data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb +6 -2
- data/lib/dependabot/npm_and_yarn/update_checker/vulnerability_auditor.rb +2 -1
- metadata +5 -5
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: d151652a4b121a997ad0d4bc33f9a7c8ea85be7b80243caff0b206fe98546c10
|
4
|
+
data.tar.gz: 5855c2d02fd81e6e83c603a1cc2ef6a096a8ce4d16f821e75d31aef2aa8f37b3
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: b0cb6772b69527887eb0a55c4c7e315b772c9290fa19f0e744ffd75c4c8fc3b736e035049a6049c8c4c16638f3c5b79a6206c66476b43e1b4a9778a2ba52c849
|
7
|
+
data.tar.gz: fbe325addd40ac04e91c0582167b6704e9f990e6df936faa441319e948e5e58c8917fdfe0b2346f5712571eef883c2baced7d840abca176428e66012d5667a43
|
@@ -37,7 +37,8 @@ module Dependabot
|
|
37
37
|
|
38
38
|
private
|
39
39
|
|
40
|
-
attr_reader :dependency_files
|
40
|
+
attr_reader :dependency_files
|
41
|
+
attr_reader :updated_dependencies
|
41
42
|
|
42
43
|
def fetch_paths_requiring_update_check
|
43
44
|
# if only a root lockfile exists, it tracks all dependencies
|
@@ -32,8 +32,11 @@ module Dependabot
|
|
32
32
|
|
33
33
|
private
|
34
34
|
|
35
|
-
attr_reader :dependency_name
|
36
|
-
|
35
|
+
attr_reader :dependency_name
|
36
|
+
attr_reader :path
|
37
|
+
attr_reader :package_lock
|
38
|
+
attr_reader :yarn_lock
|
39
|
+
attr_reader :directory
|
37
40
|
|
38
41
|
def details_from_yarn_lock
|
39
42
|
path_starts = FileFetcher::PATH_DEPENDENCY_STARTS
|
@@ -33,7 +33,10 @@ module Dependabot
|
|
33
33
|
|
34
34
|
private
|
35
35
|
|
36
|
-
attr_reader :lockfile
|
36
|
+
attr_reader :lockfile
|
37
|
+
attr_reader :dependencies
|
38
|
+
attr_reader :dependency_files
|
39
|
+
attr_reader :credentials
|
37
40
|
|
38
41
|
UNREACHABLE_GIT = /fatal: repository '(?<url>.*)' not found/
|
39
42
|
FORBIDDEN_GIT = /fatal: Authentication failed for '(?<url>.*)'/
|
@@ -61,7 +61,9 @@ module Dependabot
|
|
61
61
|
|
62
62
|
private
|
63
63
|
|
64
|
-
attr_reader :dependency_files
|
64
|
+
attr_reader :dependency_files
|
65
|
+
attr_reader :credentials
|
66
|
+
attr_reader :dependencies
|
65
67
|
|
66
68
|
def build_npmrc_content_from_lockfile
|
67
69
|
return unless yarn_lock || package_lock || shrinkwrap
|
@@ -32,7 +32,10 @@ module Dependabot
|
|
32
32
|
|
33
33
|
private
|
34
34
|
|
35
|
-
attr_reader :dependencies
|
35
|
+
attr_reader :dependencies
|
36
|
+
attr_reader :dependency_files
|
37
|
+
attr_reader :repo_contents_path
|
38
|
+
attr_reader :credentials
|
36
39
|
|
37
40
|
IRRESOLVABLE_PACKAGE = "ERR_PNPM_NO_MATCHING_VERSION"
|
38
41
|
INVALID_REQUIREMENT = "ERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER"
|
@@ -39,7 +39,10 @@ module Dependabot
|
|
39
39
|
|
40
40
|
private
|
41
41
|
|
42
|
-
attr_reader :dependencies
|
42
|
+
attr_reader :dependencies
|
43
|
+
attr_reader :dependency_files
|
44
|
+
attr_reader :repo_contents_path
|
45
|
+
attr_reader :credentials
|
43
46
|
|
44
47
|
UNREACHABLE_GIT = /ls-remote --tags --heads (?<url>.*)/
|
45
48
|
TIMEOUT_FETCHING_PACKAGE = %r{(?<url>.+)/(?<package>[^/]+): ETIMEDOUT}
|
@@ -342,8 +345,9 @@ module Dependabot
|
|
342
345
|
def write_temporary_dependency_files(yarn_lock, update_package_json: true)
|
343
346
|
write_lockfiles
|
344
347
|
|
345
|
-
if Helpers.yarn_berry?(yarn_lock)
|
346
|
-
|
348
|
+
if Helpers.yarn_berry?(yarn_lock) && yarnrc_yml_file
|
349
|
+
yarnrc_yml_sanitize_content = sanitize_yarnrc_content(yarnrc_yml_content)
|
350
|
+
File.write(".yarnrc.yml", yarnrc_yml_sanitize_content)
|
347
351
|
else
|
348
352
|
File.write(".npmrc", npmrc_content)
|
349
353
|
File.write(".yarnrc", yarnrc_content) if yarnrc_specifies_private_reg?
|
@@ -367,6 +371,11 @@ module Dependabot
|
|
367
371
|
clean_npmrc_in_path(yarn_lock)
|
368
372
|
end
|
369
373
|
|
374
|
+
def sanitize_yarnrc_content(content)
|
375
|
+
# Replace all "${...}" and ${...} occurrences with empty strings
|
376
|
+
content.gsub(/\"\$\{.*?\}\"/, '""').gsub(/\$\{.*?\}/, '""')
|
377
|
+
end
|
378
|
+
|
370
379
|
def clean_npmrc_in_path(yarn_lock)
|
371
380
|
# Berry does not read npmrc files.
|
372
381
|
return if Helpers.yarn_berry?(yarn_lock)
|
@@ -79,11 +79,20 @@ module Dependabot
|
|
79
79
|
retry
|
80
80
|
end
|
81
81
|
|
82
|
+
handle_subprocess_failure(e)
|
83
|
+
end
|
84
|
+
|
85
|
+
def self.handle_subprocess_failure(error)
|
86
|
+
message = error.message
|
82
87
|
if YARN_PATH_NOT_FOUND.match?(message)
|
83
88
|
error = T.must(T.must(YARN_PATH_NOT_FOUND.match(message))[:error]).sub(Dir.pwd, ".")
|
84
89
|
raise MisconfiguredTooling.new("Yarn", error)
|
85
90
|
end
|
86
91
|
|
92
|
+
if message.include?("Internal Error") && message.include?(".yarnrc.yml")
|
93
|
+
raise MisconfiguredTooling.new("Invalid .yarnrc.yml file", message)
|
94
|
+
end
|
95
|
+
|
87
96
|
raise
|
88
97
|
end
|
89
98
|
|
@@ -108,8 +108,11 @@ module Dependabot
|
|
108
108
|
|
109
109
|
private
|
110
110
|
|
111
|
-
attr_reader :dependency
|
112
|
-
|
111
|
+
attr_reader :dependency
|
112
|
+
attr_reader :credentials
|
113
|
+
attr_reader :dependency_files
|
114
|
+
attr_reader :ignored_versions
|
115
|
+
attr_reader :security_advisories
|
113
116
|
|
114
117
|
def valid_npm_details?
|
115
118
|
!npm_details&.fetch("dist-tags", nil).nil?
|
@@ -23,7 +23,9 @@ module Dependabot
|
|
23
23
|
|
24
24
|
private
|
25
25
|
|
26
|
-
attr_reader :package_json_file
|
26
|
+
attr_reader :package_json_file
|
27
|
+
attr_reader :credentials
|
28
|
+
attr_reader :dependency_files
|
27
29
|
|
28
30
|
def package_json_may_be_for_library?
|
29
31
|
return false unless project_name
|
@@ -61,7 +61,11 @@ module Dependabot
|
|
61
61
|
|
62
62
|
private
|
63
63
|
|
64
|
-
attr_reader :dependency
|
64
|
+
attr_reader :dependency
|
65
|
+
attr_reader :credentials
|
66
|
+
attr_reader :npmrc_file
|
67
|
+
attr_reader :yarnrc_file
|
68
|
+
attr_reader :yarnrc_yml_file
|
65
69
|
|
66
70
|
def explicit_registry_from_rc(dependency_name)
|
67
71
|
if dependency_name.start_with?("@") && dependency_name.include?("/")
|
@@ -62,8 +62,10 @@ module Dependabot
|
|
62
62
|
|
63
63
|
private
|
64
64
|
|
65
|
-
attr_reader :requirements
|
66
|
-
|
65
|
+
attr_reader :requirements
|
66
|
+
attr_reader :updated_source
|
67
|
+
attr_reader :update_strategy
|
68
|
+
attr_reader :latest_resolvable_version
|
67
69
|
|
68
70
|
def check_update_strategy
|
69
71
|
return if ALLOWED_UPDATE_STRATEGIES.include?(update_strategy)
|
@@ -53,8 +53,12 @@ module Dependabot
|
|
53
53
|
|
54
54
|
private
|
55
55
|
|
56
|
-
attr_reader :dependency
|
57
|
-
|
56
|
+
attr_reader :dependency
|
57
|
+
attr_reader :credentials
|
58
|
+
attr_reader :dependency_files
|
59
|
+
attr_reader :ignored_versions
|
60
|
+
attr_reader :latest_allowable_version
|
61
|
+
attr_reader :repo_contents_path
|
58
62
|
|
59
63
|
def update_subdependency_in_lockfile(lockfile)
|
60
64
|
lockfile_name = Pathname.new(lockfile.name).basename.to_s
|
@@ -154,8 +154,12 @@ module Dependabot
|
|
154
154
|
|
155
155
|
private
|
156
156
|
|
157
|
-
attr_reader :dependency
|
158
|
-
|
157
|
+
attr_reader :dependency
|
158
|
+
attr_reader :credentials
|
159
|
+
attr_reader :dependency_files
|
160
|
+
attr_reader :latest_allowable_version
|
161
|
+
attr_reader :repo_contents_path
|
162
|
+
attr_reader :dependency_group
|
159
163
|
|
160
164
|
def latest_version_finder(dep)
|
161
165
|
@latest_version_finder[dep] ||=
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: dependabot-npm_and_yarn
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.
|
4
|
+
version: 0.249.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Dependabot
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2024-03-
|
11
|
+
date: 2024-03-28 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: dependabot-common
|
@@ -16,14 +16,14 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - '='
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version: 0.
|
19
|
+
version: 0.249.0
|
20
20
|
type: :runtime
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - '='
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: 0.
|
26
|
+
version: 0.249.0
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
name: debug
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
@@ -338,7 +338,7 @@ licenses:
|
|
338
338
|
- Nonstandard
|
339
339
|
metadata:
|
340
340
|
bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
|
341
|
-
changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.
|
341
|
+
changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.249.0
|
342
342
|
post_install_message:
|
343
343
|
rdoc_options: []
|
344
344
|
require_paths:
|