dependabot-npm_and_yarn 0.248.0 → 0.249.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (21) hide show
  1. checksums.yaml +4 -4
  2. data/lib/dependabot/npm_and_yarn/dependency_files_filterer.rb +2 -1
  3. data/lib/dependabot/npm_and_yarn/file_fetcher/path_dependency_builder.rb +5 -2
  4. data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb +4 -1
  5. data/lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb +3 -1
  6. data/lib/dependabot/npm_and_yarn/file_updater/package_json_updater.rb +2 -1
  7. data/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb +4 -1
  8. data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb +12 -3
  9. data/lib/dependabot/npm_and_yarn/helpers.rb +9 -0
  10. data/lib/dependabot/npm_and_yarn/registry_parser.rb +2 -1
  11. data/lib/dependabot/npm_and_yarn/sub_dependency_files_filterer.rb +2 -1
  12. data/lib/dependabot/npm_and_yarn/update_checker/conflicting_dependency_resolver.rb +2 -1
  13. data/lib/dependabot/npm_and_yarn/update_checker/dependency_files_builder.rb +3 -1
  14. data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb +5 -2
  15. data/lib/dependabot/npm_and_yarn/update_checker/library_detector.rb +3 -1
  16. data/lib/dependabot/npm_and_yarn/update_checker/registry_finder.rb +5 -1
  17. data/lib/dependabot/npm_and_yarn/update_checker/requirements_updater.rb +4 -2
  18. data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb +6 -2
  19. data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb +6 -2
  20. data/lib/dependabot/npm_and_yarn/update_checker/vulnerability_auditor.rb +2 -1
  21. metadata +5 -5
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 4d8c37418b227c06a52aa5052c75b0b072595db577f6d8d8b815bed1f883dc0c
4
- data.tar.gz: 96d4246790357bdc08b1d4dbbbd7a883421fe401717bd2ae43dc2093270c81f7
3
+ metadata.gz: d151652a4b121a997ad0d4bc33f9a7c8ea85be7b80243caff0b206fe98546c10
4
+ data.tar.gz: 5855c2d02fd81e6e83c603a1cc2ef6a096a8ce4d16f821e75d31aef2aa8f37b3
5
5
  SHA512:
6
- metadata.gz: 40d06b38c0e9d6bb5ad257536af005567b6b51d632228e0e4605e7dd8850ed38922d2adfb9ac28ca8b54707e18c21a0822faf07378bb6f3e2a332e2df12968a4
7
- data.tar.gz: d8d19df3a8ea9ab1f7cb665d37db2f995c954668cb7f6b02d401dd62451e30d67e12bd0f2365ac8b58159bc48f83f8c7fd7930b79096aab827253366f7ca35ab
6
+ metadata.gz: b0cb6772b69527887eb0a55c4c7e315b772c9290fa19f0e744ffd75c4c8fc3b736e035049a6049c8c4c16638f3c5b79a6206c66476b43e1b4a9778a2ba52c849
7
+ data.tar.gz: fbe325addd40ac04e91c0582167b6704e9f990e6df936faa441319e948e5e58c8917fdfe0b2346f5712571eef883c2baced7d840abca176428e66012d5667a43
data/lib/dependabot/npm_and_yarn/dependency_files_filterer.rb CHANGED
@@ -37,7 +37,8 @@ module Dependabot
37
37
 
38
38
  private
39
39
 
40
- attr_reader :dependency_files, :updated_dependencies
40
+ attr_reader :dependency_files
41
+ attr_reader :updated_dependencies
41
42
 
42
43
  def fetch_paths_requiring_update_check
43
44
  # if only a root lockfile exists, it tracks all dependencies
data/lib/dependabot/npm_and_yarn/file_fetcher/path_dependency_builder.rb CHANGED
@@ -32,8 +32,11 @@ module Dependabot
32
32
 
33
33
  private
34
34
 
35
- attr_reader :dependency_name, :path, :package_lock, :yarn_lock,
36
- :directory
35
+ attr_reader :dependency_name
36
+ attr_reader :path
37
+ attr_reader :package_lock
38
+ attr_reader :yarn_lock
39
+ attr_reader :directory
37
40
 
38
41
  def details_from_yarn_lock
39
42
  path_starts = FileFetcher::PATH_DEPENDENCY_STARTS
data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb CHANGED
@@ -33,7 +33,10 @@ module Dependabot
33
33
 
34
34
  private
35
35
 
36
- attr_reader :lockfile, :dependencies, :dependency_files, :credentials
36
+ attr_reader :lockfile
37
+ attr_reader :dependencies
38
+ attr_reader :dependency_files
39
+ attr_reader :credentials
37
40
 
38
41
  UNREACHABLE_GIT = /fatal: repository '(?<url>.*)' not found/
39
42
  FORBIDDEN_GIT = /fatal: Authentication failed for '(?<url>.*)'/
data/lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb CHANGED
@@ -61,7 +61,9 @@ module Dependabot
61
61
 
62
62
  private
63
63
 
64
- attr_reader :dependency_files, :credentials, :dependencies
64
+ attr_reader :dependency_files
65
+ attr_reader :credentials
66
+ attr_reader :dependencies
65
67
 
66
68
  def build_npmrc_content_from_lockfile
67
69
  return unless yarn_lock || package_lock || shrinkwrap
data/lib/dependabot/npm_and_yarn/file_updater/package_json_updater.rb CHANGED
@@ -20,7 +20,8 @@ module Dependabot
20
20
 
21
21
  private
22
22
 
23
- attr_reader :package_json, :dependencies
23
+ attr_reader :package_json
24
+ attr_reader :dependencies
24
25
 
25
26
  def updated_package_json_content
26
27
  dependencies.reduce(package_json.content.dup) do |content, dep|
data/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb CHANGED
@@ -32,7 +32,10 @@ module Dependabot
32
32
 
33
33
  private
34
34
 
35
- attr_reader :dependencies, :dependency_files, :repo_contents_path, :credentials
35
+ attr_reader :dependencies
36
+ attr_reader :dependency_files
37
+ attr_reader :repo_contents_path
38
+ attr_reader :credentials
36
39
 
37
40
  IRRESOLVABLE_PACKAGE = "ERR_PNPM_NO_MATCHING_VERSION"
38
41
  INVALID_REQUIREMENT = "ERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER"
data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb CHANGED
@@ -39,7 +39,10 @@ module Dependabot
39
39
 
40
40
  private
41
41
 
42
- attr_reader :dependencies, :dependency_files, :repo_contents_path, :credentials
42
+ attr_reader :dependencies
43
+ attr_reader :dependency_files
44
+ attr_reader :repo_contents_path
45
+ attr_reader :credentials
43
46
 
44
47
  UNREACHABLE_GIT = /ls-remote --tags --heads (?<url>.*)/
45
48
  TIMEOUT_FETCHING_PACKAGE = %r{(?<url>.+)/(?<package>[^/]+): ETIMEDOUT}
@@ -342,8 +345,9 @@ module Dependabot
342
345
  def write_temporary_dependency_files(yarn_lock, update_package_json: true)
343
346
  write_lockfiles
344
347
 
345
- if Helpers.yarn_berry?(yarn_lock)
346
- File.write(".yarnrc.yml", yarnrc_yml_content) if yarnrc_yml_file
348
+ if Helpers.yarn_berry?(yarn_lock) && yarnrc_yml_file
349
+ yarnrc_yml_sanitize_content = sanitize_yarnrc_content(yarnrc_yml_content)
350
+ File.write(".yarnrc.yml", yarnrc_yml_sanitize_content)
347
351
  else
348
352
  File.write(".npmrc", npmrc_content)
349
353
  File.write(".yarnrc", yarnrc_content) if yarnrc_specifies_private_reg?
@@ -367,6 +371,11 @@ module Dependabot
367
371
  clean_npmrc_in_path(yarn_lock)
368
372
  end
369
373
 
374
+ def sanitize_yarnrc_content(content)
375
+ # Replace all "${...}" and ${...} occurrences with empty strings
376
+ content.gsub(/\"\$\{.*?\}\"/, '""').gsub(/\$\{.*?\}/, '""')
377
+ end
378
+
370
379
  def clean_npmrc_in_path(yarn_lock)
371
380
  # Berry does not read npmrc files.
372
381
  return if Helpers.yarn_berry?(yarn_lock)
data/lib/dependabot/npm_and_yarn/helpers.rb CHANGED
@@ -79,11 +79,20 @@ module Dependabot
79
79
  retry
80
80
  end
81
81
 
82
+ handle_subprocess_failure(e)
83
+ end
84
+
85
+ def self.handle_subprocess_failure(error)
86
+ message = error.message
82
87
  if YARN_PATH_NOT_FOUND.match?(message)
83
88
  error = T.must(T.must(YARN_PATH_NOT_FOUND.match(message))[:error]).sub(Dir.pwd, ".")
84
89
  raise MisconfiguredTooling.new("Yarn", error)
85
90
  end
86
91
 
92
+ if message.include?("Internal Error") && message.include?(".yarnrc.yml")
93
+ raise MisconfiguredTooling.new("Invalid .yarnrc.yml file", message)
94
+ end
95
+
87
96
  raise
88
97
  end
89
98
 
data/lib/dependabot/npm_and_yarn/registry_parser.rb CHANGED
@@ -43,7 +43,8 @@ module Dependabot
43
43
 
44
44
  private
45
45
 
46
- attr_reader :resolved_url, :credentials
46
+ attr_reader :resolved_url
47
+ attr_reader :credentials
47
48
 
48
49
  # rubocop:disable Metrics/PerceivedComplexity
49
50
  def url_for_relevant_cred
data/lib/dependabot/npm_and_yarn/sub_dependency_files_filterer.rb CHANGED
@@ -33,7 +33,8 @@ module Dependabot
33
33
 
34
34
  private
35
35
 
36
- attr_reader :dependency_files, :updated_dependencies
36
+ attr_reader :dependency_files
37
+ attr_reader :updated_dependencies
37
38
 
38
39
  def lockfile_dependencies(lockfile)
39
40
  @lockfile_dependencies ||= {}
data/lib/dependabot/npm_and_yarn/update_checker/conflicting_dependency_resolver.rb CHANGED
@@ -65,7 +65,8 @@ module Dependabot
65
65
 
66
66
  private
67
67
 
68
- attr_reader :dependency_files, :credentials
68
+ attr_reader :dependency_files
69
+ attr_reader :credentials
69
70
  end
70
71
  end
71
72
  end
data/lib/dependabot/npm_and_yarn/update_checker/dependency_files_builder.rb CHANGED
@@ -79,7 +79,9 @@ module Dependabot
79
79
 
80
80
  private
81
81
 
82
- attr_reader :dependency, :dependency_files, :credentials
82
+ attr_reader :dependency
83
+ attr_reader :dependency_files
84
+ attr_reader :credentials
83
85
 
84
86
  def write_lockfiles
85
87
  yarn_locks.each do |f|
data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb CHANGED
@@ -108,8 +108,11 @@ module Dependabot
108
108
 
109
109
  private
110
110
 
111
- attr_reader :dependency, :credentials, :dependency_files,
112
- :ignored_versions, :security_advisories
111
+ attr_reader :dependency
112
+ attr_reader :credentials
113
+ attr_reader :dependency_files
114
+ attr_reader :ignored_versions
115
+ attr_reader :security_advisories
113
116
 
114
117
  def valid_npm_details?
115
118
  !npm_details&.fetch("dist-tags", nil).nil?
data/lib/dependabot/npm_and_yarn/update_checker/library_detector.rb CHANGED
@@ -23,7 +23,9 @@ module Dependabot
23
23
 
24
24
  private
25
25
 
26
- attr_reader :package_json_file, :credentials, :dependency_files
26
+ attr_reader :package_json_file
27
+ attr_reader :credentials
28
+ attr_reader :dependency_files
27
29
 
28
30
  def package_json_may_be_for_library?
29
31
  return false unless project_name
data/lib/dependabot/npm_and_yarn/update_checker/registry_finder.rb CHANGED
@@ -61,7 +61,11 @@ module Dependabot
61
61
 
62
62
  private
63
63
 
64
- attr_reader :dependency, :credentials, :npmrc_file, :yarnrc_file, :yarnrc_yml_file
64
+ attr_reader :dependency
65
+ attr_reader :credentials
66
+ attr_reader :npmrc_file
67
+ attr_reader :yarnrc_file
68
+ attr_reader :yarnrc_yml_file
65
69
 
66
70
  def explicit_registry_from_rc(dependency_name)
67
71
  if dependency_name.start_with?("@") && dependency_name.include?("/")
data/lib/dependabot/npm_and_yarn/update_checker/requirements_updater.rb CHANGED
@@ -62,8 +62,10 @@ module Dependabot
62
62
 
63
63
  private
64
64
 
65
- attr_reader :requirements, :updated_source, :update_strategy,
66
- :latest_resolvable_version
65
+ attr_reader :requirements
66
+ attr_reader :updated_source
67
+ attr_reader :update_strategy
68
+ attr_reader :latest_resolvable_version
67
69
 
68
70
  def check_update_strategy
69
71
  return if ALLOWED_UPDATE_STRATEGIES.include?(update_strategy)
data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb CHANGED
@@ -53,8 +53,12 @@ module Dependabot
53
53
 
54
54
  private
55
55
 
56
- attr_reader :dependency, :credentials, :dependency_files,
57
- :ignored_versions, :latest_allowable_version, :repo_contents_path
56
+ attr_reader :dependency
57
+ attr_reader :credentials
58
+ attr_reader :dependency_files
59
+ attr_reader :ignored_versions
60
+ attr_reader :latest_allowable_version
61
+ attr_reader :repo_contents_path
58
62
 
59
63
  def update_subdependency_in_lockfile(lockfile)
60
64
  lockfile_name = Pathname.new(lockfile.name).basename.to_s
data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb CHANGED
@@ -154,8 +154,12 @@ module Dependabot
154
154
 
155
155
  private
156
156
 
157
- attr_reader :dependency, :credentials, :dependency_files,
158
- :latest_allowable_version, :repo_contents_path, :dependency_group
157
+ attr_reader :dependency
158
+ attr_reader :credentials
159
+ attr_reader :dependency_files
160
+ attr_reader :latest_allowable_version
161
+ attr_reader :repo_contents_path
162
+ attr_reader :dependency_group
159
163
 
160
164
  def latest_version_finder(dep)
161
165
  @latest_version_finder[dep] ||=
data/lib/dependabot/npm_and_yarn/update_checker/vulnerability_auditor.rb CHANGED
@@ -100,7 +100,8 @@ module Dependabot
100
100
 
101
101
  private
102
102
 
103
- attr_reader :dependency_files, :credentials
103
+ attr_reader :dependency_files
104
+ attr_reader :credentials
104
105
 
105
106
  def explain_fix_unavailable(validation_result, dependency)
106
107
  case validation_result
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: dependabot-npm_and_yarn
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.248.0
4
+ version: 0.249.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Dependabot
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2024-03-21 00:00:00.000000000 Z
11
+ date: 2024-03-28 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 0.248.0
19
+ version: 0.249.0
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 0.248.0
26
+ version: 0.249.0
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: debug
29
29
  requirement: !ruby/object:Gem::Requirement
@@ -338,7 +338,7 @@ licenses:
338
338
  - Nonstandard
339
339
  metadata:
340
340
  bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
341
- changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.248.0
341
+ changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.249.0
342
342
  post_install_message:
343
343
  rdoc_options: []
344
344
  require_paths: