dependabot-npm_and_yarn 0.253.0 → 0.255.0

data/helpers/test/pnpm/lockfile-parser.test.js

@@ -0,0 +1,62 @@
+const {
+    parseLockfile,
+} = require("../../lib/pnpm");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+describe("generates an updated pnpm lock for the original file", () => {
+
+    let tempDir;
+    beforeEach(() => {
+        tempDir = fs.mkdtempSync(os.tmpdir() + path.sep);
+    });
+    afterEach(() => fs.rm(tempDir, { recursive: true }, () => {}));
+
+    function copyDependencies(sourceDir, destDir) {
+        const srcPnpmYaml = path.join(
+            __dirname,
+            `fixtures/parser/${sourceDir}/pnpm-lock.yaml`
+        );
+        fs.copyFileSync(srcPnpmYaml, `${destDir}/pnpm-lock.yaml`);
+    }
+
+    it("that contains duplicate dependencies", async () =>{
+        copyDependencies("no_lockfile_change", tempDir);
+        const result = await parseLockfile(tempDir);
+
+        expect(result.length).toEqual(398);
+    })
+
+    it("that contains only dev dependencies but no (prod) dependencies", async () =>{
+        copyDependencies("only_dev_dependencies", tempDir);
+        const result = await parseLockfile(tempDir);
+
+        expect(result).toEqual([
+            {
+                name: 'etag',
+                version: '1.8.0',
+                resolved: undefined,
+                dev: true,
+                specifiers: [ '^1.0.0' ],
+                aliased: false
+            }
+        ]);
+    })
+
+    it("that contains dependencies which locked to versions with peer disambiguation suffix", async () =>{
+        copyDependencies("peer_disambiguation", tempDir);
+        const result = await parseLockfile(tempDir);
+
+        expect(result.length).toEqual(122);
+    })
+
+    // Should have the version in the lock file.
+    it("that contains dependencies with an empty version", async () =>{
+        copyDependencies("empty_version", tempDir);
+        const result = await parseLockfile(tempDir);
+
+        expect(result.length).toEqual(9);
+    })
+
+})

data/helpers/test/yarn/fixtures/conflicting-dependency-parser/nested/yarn.lock

@@ -48,16 +48,17 @@ d@1, d@^1.0.1:
     es5-ext "^0.10.50"
     type "^1.0.1"
 
-es5-ext@^0.10.35, es5-ext@^0.10.45, es5-ext@^0.10.46, es5-ext@^0.10.50, es5-ext@~0.10.14, es5-ext@~0.10.2, es5-ext@~0.10.46:
-  version "0.10.53"
-  resolved "https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.53.tgz#93c5a3acfdbef275220ad72644ad02ee18368de1"
-  integrity sha512-Xs2Stw6NiNHWypzRTY1MtaG/uJlwCk8kH81920ma8mvN8Xq1gsfhZvpkImLQArw8AHnv8MT2I45J3c0R8slE+Q==
+es5-ext@^0.10.35, es5-ext@^0.10.45, es5-ext@^0.10.46, es5-ext@^0.10.50, es5-ext@^0.10.62, es5-ext@~0.10.14, es5-ext@~0.10.2, es5-ext@~0.10.46:
+  version "0.10.63"
+  resolved "https://registry.yarnpkg.com/es5-ext/-/es5-ext-0.10.63.tgz#9c222a63b6a332ac80b1e373b426af723b895bd6"
+  integrity sha512-hUCZd2Byj/mNKjfP9jXrdVZ62B8KuA/VoK7X8nUh5qT+AxDmcbvZz041oDVZdbIN1qW6XY9VDNwzkvKnZvK2TQ==
   dependencies:
-    es6-iterator "~2.0.3"
-    es6-symbol "~3.1.3"
-    next-tick "~1.0.0"
+    es6-iterator "^2.0.3"
+    es6-symbol "^3.1.3"
+    esniff "^2.0.1"
+    next-tick "^1.1.0"
 
-es6-iterator@^2.0.3, es6-iterator@~2.0.3:
+es6-iterator@^2.0.3:
   version "2.0.3"
   resolved "https://registry.npmjs.org/es6-iterator/-/es6-iterator-2.0.3.tgz#a7de889141a05a94b0854403b2d0a0fbfa98f3b7"
   integrity sha1-p96IkUGgWpSwhUQDstCg+/qY87c=
@@ -66,7 +67,7 @@ es6-iterator@^2.0.3, es6-iterator@~2.0.3:
     es5-ext "^0.10.35"
     es6-symbol "^3.1.1"
 
-es6-symbol@^3.1.1, es6-symbol@~3.1.3:
+es6-symbol@^3.1.1, es6-symbol@^3.1.3:
   version "3.1.3"
   resolved "https://registry.npmjs.org/es6-symbol/-/es6-symbol-3.1.3.tgz#bad5d3c1bcdac28269f4cb331e431c78ac705d18"
   integrity sha512-NJ6Yn3FuDinBaBRWl/q5X/s4koRHBrgKAu+yGI6JCBeiu3qrcbJhwT2GeR/EXVfylRk8dpQVJoLEFhK+Mu31NA==
@@ -84,6 +85,16 @@ es6-weak-map@^2.0.2:
     es6-iterator "^2.0.3"
     es6-symbol "^3.1.1"
 
+esniff@^2.0.1:
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/esniff/-/esniff-2.0.1.tgz#a4d4b43a5c71c7ec51c51098c1d8a29081f9b308"
+  integrity sha512-kTUIGKQ/mDPFoJ0oVfcmyJn4iBDRptjNVIzwIFR7tqWXdVI9xfA2RMwY/gbSpJG3lkdWNEjLap/NqVHZiJsdfg==
+  dependencies:
+    d "^1.0.1"
+    es5-ext "^0.10.62"
+    event-emitter "^0.3.5"
+    type "^2.7.2"
+
 event-emitter@^0.3.5:
   version "0.3.5"
   resolved "https://registry.npmjs.org/event-emitter/-/event-emitter-0.3.5.tgz#df8c69eef1647923c7157b9ce83840610b02cc39"
@@ -135,16 +146,11 @@ memoizee@^0.4.14:
     next-tick "1"
     timers-ext "^0.1.5"
 
-next-tick@1:
+next-tick@1, next-tick@^1.1.0:
   version "1.1.0"
   resolved "https://registry.npmjs.org/next-tick/-/next-tick-1.1.0.tgz#1836ee30ad56d67ef281b22bd199f709449b35eb"
   integrity sha512-CXdUiJembsNjuToQvxayPZF9Vqht7hewsvy2sOWafLvi2awflj9mOC6bHIg50orX8IJvWKY9wYQ/zB2kogPslQ==
 
-next-tick@~1.0.0:
-  version "1.0.0"
-  resolved "https://registry.npmjs.org/next-tick/-/next-tick-1.0.0.tgz#ca86d1fe8828169b0120208e3dc8424b9db8342c"
-  integrity sha1-yobR/ogoFpsBICCOPchCS524NCw=
-
 objnest@^5.0.6:
   version "5.0.10"
   resolved "https://registry.npmjs.org/objnest/-/objnest-5.0.10.tgz#90e43b11870502fcb445e97fcf402499f5f75c75"
@@ -170,3 +176,8 @@ type@^2.0.0:
   version "2.1.0"
   resolved "https://registry.npmjs.org/type/-/type-2.1.0.tgz#9bdc22c648cf8cf86dd23d32336a41cfb6475e3f"
   integrity sha512-G9absDWvhAWCV2gmF1zKud3OyC61nZDwWvBL2DApaVFogI07CprggiQAOOjvp2NRjYWFzPyu7vwtDrQFq8jeSA==
+
+type@^2.7.2:
+  version "2.7.2"
+  resolved "https://registry.yarnpkg.com/type/-/type-2.7.2.tgz#2376a15a3a28b1efa0f5350dcf72d24df6ef98d0"
+  integrity sha512-dzlvlNlt6AXU7EBSfpAscydQ7gXB+pPGsPnfJnZpiNJBDj7IaJzQlBZYGdEi4R9HmPdBv2XmWJ6YUtoTa7lmCw==

data/helpers/test/yarn/fixtures/updater/illegal_character/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "@colend-contract-helpers",
+  "dependencies": {
+    "@commitlint/cli": "^15.0.0",
+    "is-positive": "^3.1.0",
+    "left-pad": "^1.1.3"
+  }
+}

data/helpers/test/yarn/fixtures/updater/illegal_character/yarn.lock

@@ -0,0 +1,14 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+"@commitlint/cli@^15.0.0":
+  version "15.0.0"
+  resolved "https://registry.yarnpkg.com/@commitlint/cli/-/cli-15.0.0.tgz#8e78e86ee2b6955c1a5d140e734a6c171ce367ee"
+
+"is-positive@^3.1.0":
+  version "3.1.0"
+  resolved "https://registry.yarnpkg.com/is-positive/-/is-positive-3.1.0.tgz#857db584a1ba5d1cb2980527fc3b6c435d37b0fd"
+
+"left-pad@^1.0.0":
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/left-pad/-/left-pad-1.0.0.tgz#c84e2417581bbb8eaf2b9e3d7a122e572ab1af37"

data/helpers/test/yarn/updater.test.js

@@ -85,4 +85,33 @@ describe("updater", () => {
       expect(error).not.toBeNull();
     }
   });
+
+  it("with a package.json which contains illegal character '@' in the name", async () => {
+    copyDependencies("illegal_character", tempDir);
+
+    try {
+      await updateDependencyFiles(tempDir, [
+          {
+            name: "@commitlint/cli",
+            version: "19.3.0",
+            requirements: [
+              {
+                requirement: "^19.3.0",
+                file: "package.json",
+                groups: ["devDependencies"],
+                source:
+                  {
+                    type: "registry",
+                    url: "https://registry.yarnpkg.com"
+                  }
+              }
+            ]
+          }
+        ]
+      );
+    } catch (error) {
+      expect(error).not.toBeNull();
+      expect(error.message).toEqual("package.json: Name contains illegal characters")
+    }
+  });
 });

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -291,7 +291,7 @@ module Dependabot
         semver_version_for(lockfile_details&.fetch("version", ""))
       end
 
-      sig { params(version: String).returns(T.nilable(T.any(String, Integer, Gem::Version))) }
+      sig { params(version: T.nilable(String)).returns(T.nilable(T.any(String, Integer, Gem::Version))) }
       def semver_version_for(version)
         version_class.semver_for(version)
       end

data/lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb

@@ -1,6 +1,8 @@
-# typed: false
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/npm_and_yarn/file_updater"
 
 module Dependabot
@@ -10,13 +12,25 @@ module Dependabot
       # committed .npmrc
       # We should refactor this to use UpdateChecker::RegistryFinder
       class NpmrcBuilder
-        CENTRAL_REGISTRIES = %w(
-          registry.npmjs.org
-          registry.yarnpkg.com
-        ).freeze
+        extend T::Sig
+
+        CENTRAL_REGISTRIES = T.let(
+          %w(
+            registry.npmjs.org
+            registry.yarnpkg.com
+          ).freeze,
+          T::Array[String]
+        )
 
         SCOPED_REGISTRY = /^\s*@(?<scope>\S+):registry\s*=\s*(?<registry>\S+)/
 
+        sig do
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            dependencies: T::Array[Dependabot::Dependency]
+          ).void
+        end
         def initialize(dependency_files:, credentials:, dependencies: [])
           @dependency_files = dependency_files
           @credentials = credentials
@@ -24,6 +38,7 @@ module Dependabot
         end
 
         # PROXY WORK
+        sig { returns(String) }
         def npmrc_content
           initial_content =
             if npmrc_file then complete_npmrc_from_credentials
@@ -48,6 +63,7 @@ module Dependabot
         # PROXY WORK
         # Yarn allows registries to be defined either in an .npmrc or .yarnrc
         # so we need to parse both files for registry keys
+        sig { returns(String) }
         def yarnrc_content
           initial_content =
             if npmrc_file then complete_yarnrc_from_credentials
@@ -61,65 +77,83 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
 
+        sig { returns(T.nilable(String)) }
         def build_npmrc_content_from_lockfile
           return unless yarn_lock || package_lock || shrinkwrap
           return unless global_registry
 
-          registry = global_registry["registry"]
-          registry = "https://#{registry}" unless registry.start_with?("http")
+          registry = T.must(global_registry)["registry"]
+          registry = "https://#{registry}" unless registry&.start_with?("http")
           "registry = #{registry}\n" \
             "#{npmrc_global_registry_auth_line}" \
             "always-auth = true"
         end
 
+        sig { returns(T.nilable(String)) }
         def build_yarnrc_content_from_lockfile
           return unless yarn_lock || package_lock
           return unless global_registry
 
-          "registry \"https://#{global_registry['registry']}\"\n" \
+          "registry \"https://#{T.must(global_registry)['registry']}\"\n" \
             "#{yarnrc_global_registry_auth_line}" \
             "npmAlwaysAuth: true"
         end
 
-        def global_registry # rubocop:disable Metrics/PerceivedComplexity
+        # rubocop:disable Metrics/PerceivedComplexity
+        # rubocop:disable Metrics/CyclomaticComplexity
+        # rubocop:disable Metrics/AbcSize
+        sig { returns(T.nilable(Dependabot::Credential)) }
+        def global_registry
           return @global_registry if defined?(@global_registry)
 
-          @global_registry =
+          @global_registry = T.let(
             registry_credentials.find do |cred|
               next false if CENTRAL_REGISTRIES.include?(cred["registry"])
 
               # If all the URLs include this registry, it's global
-              next true if dependency_urls.size.positive? && dependency_urls.all? do |url|
-                             url.include?(cred["registry"])
+              next true if dependency_urls&.size&.positive? && dependency_urls&.all? do |url|
+                             url.include?(T.must(cred["registry"]))
                            end
 
               # Check if this registry has already been defined in .npmrc as a scoped registry
-              next false if npmrc_scoped_registries.any? { |sr| sr.include?(cred["registry"]) }
+              next false if npmrc_scoped_registries&.any? { |sr| sr.include?(T.must(cred["registry"])) }
 
-              next false if yarnrc_scoped_registries.any? { |sr| sr.include?(cred["registry"]) }
+              next false if yarnrc_scoped_registries&.any? { |sr| sr.include?(T.must(cred["registry"])) }
 
               # If any unscoped URLs include this registry, assume it's global
               dependency_urls
-                .reject { |u| u.include?("@") || u.include?("%40") }
-                .any? { |url| url.include?(cred["registry"]) }
-            end
+                &.reject { |u| u.include?("@") || u.include?("%40") }
+                &.any? { |url| url.include?(T.must(cred["registry"])) }
+            end,
+            T.nilable(Dependabot::Credential)
+          )
         end
+        # rubocop:enable Metrics/PerceivedComplexity
+        # rubocop:enable Metrics/CyclomaticComplexity
+        # rubocop:enable Metrics/AbcSize
 
+        sig { returns(String) }
         def npmrc_global_registry_auth_line
           # This token is passed in from the Dependabot Config
           # We write it to the .npmrc file so that it can be used by the VulnerabilityAuditor
-          token = global_registry.fetch("token", nil)
+          token = global_registry&.fetch("token", nil)
           return "" unless token
 
-          auth_line(token, global_registry.fetch("registry")) + "\n"
+          auth_line(token, global_registry&.fetch("registry")) + "\n"
         end
 
+        sig { returns(String) }
         def yarnrc_global_registry_auth_line
-          token = global_registry.fetch("token", nil)
+          token = global_registry&.fetch("token", nil)
           return "" unless token
 
           if token.include?(":")
@@ -133,6 +167,8 @@ module Dependabot
           end
         end
 
+        # rubocop:disable Metrics/AbcSize
+        sig { returns(T.nilable(T::Array[String])) }
         def dependency_urls
           return @dependency_urls if defined?(@dependency_urls)
 
@@ -154,55 +190,62 @@ module Dependabot
           npm_lockfile = package_lock || shrinkwrap
           if npm_lockfile
             @dependency_urls +=
-              npm_lockfile.content.scan(/"resolved"\s*:\s*"(.*)"/)
-                          .flatten
-                          .select { |url| url.is_a?(String) }
-                          .reject { |url| url.start_with?("git") }
+              T.must(npm_lockfile.content).scan(/"resolved"\s*:\s*"(.*)"/)
+               .flatten
+               .select { |url| url.is_a?(String) }
+               .reject { |url| url.start_with?("git") }
           end
           if yarn_lock
             @dependency_urls +=
-              yarn_lock.content.scan(/ resolved "(.*?)"/).flatten
+              T.must(T.must(yarn_lock).content).scan(/ resolved "(.*?)"/).flatten
           end
 
           # The registry URL for Bintray goes into the lockfile in a
           # modified format, so we modify it back before checking against
           # our credentials
-          @dependency_urls =
+          @dependency_urls = T.let(
             @dependency_urls.map do |url|
               url.gsub("dl.bintray.com//", "api.bintray.com/npm/")
-            end
+            end,
+            T.nilable(T::Array[String])
+          )
         end
+        # rubocop:enable Metrics/AbcSize
 
+        sig { returns(String) }
         def complete_npmrc_from_credentials
-          initial_content = npmrc_file.content
-                                      .gsub(/^.*\$\{.*\}.*/, "").strip + "\n"
+          initial_content = T.must(T.must(npmrc_file).content)
+                             .gsub(/^.*\$\{.*\}.*/, "").strip + "\n"
           return initial_content unless yarn_lock || package_lock
           return initial_content unless global_registry
 
-          registry = global_registry["registry"]
-          registry = "https://#{registry}" unless registry.start_with?("http")
+          registry = T.must(global_registry)["registry"]
+          registry = "https://#{registry}" unless registry&.start_with?("http")
           initial_content +
             "registry = #{registry}\n" \
             "#{npmrc_global_registry_auth_line}" \
             "always-auth = true\n"
         end
 
+        sig { returns(String) }
         def complete_yarnrc_from_credentials
-          initial_content = yarnrc_file.content
-                                       .gsub(/^.*\$\{.*\}.*/, "").strip + "\n"
+          initial_content = T.must(T.must(yarnrc_file).content)
+                             .gsub(/^.*\$\{.*\}.*/, "").strip + "\n"
           return initial_content unless yarn_lock || package_lock
           return initial_content unless global_registry
 
           initial_content +
-            "registry: \"https://#{global_registry['registry']}\"\n" \
+            "registry: \"https://#{T.must(global_registry)['registry']}\"\n" \
             "#{yarnrc_global_registry_auth_line}" \
             "npmAlwaysAuth: true\n"
         end
 
+        sig { returns(T.nilable(String)) }
         def build_npmrc_from_yarnrc
           yarnrc_global_registry =
-            yarnrc_file.content
-                       .lines.find { |line| line.match?(/^\s*registry\s/) }
+            yarnrc_file&.content
+                       &.lines
+                       &.find { |line| line.match?(/^\s*registry\s/) }
                        &.match(NpmAndYarn::UpdateChecker::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX)
                        &.named_captures&.fetch("registry")
 
@@ -211,10 +254,12 @@ module Dependabot
           build_npmrc_content_from_lockfile
         end
 
+        sig { returns(T.nilable(String)) }
         def build_yarnrc_from_yarnrc
           yarnrc_global_registry =
-            yarnrc_file.content
-                       .lines.find { |line| line.match?(/^\s*registry\s/) }
+            yarnrc_file&.content
+                       &.lines
+                       &.find { |line| line.match?(/^\s*registry\s/) }
                        &.match(/^\s*registry\s+"(?<registry>[^"]+)"/)
                        &.named_captures&.fetch("registry")
 
@@ -223,12 +268,13 @@ module Dependabot
           build_yarnrc_content_from_lockfile
         end
 
+        sig { returns(T::Array[String]) }
         def credential_lines_for_npmrc
-          lines = []
+          lines = T.let([], T::Array[String])
           registry_credentials.each do |cred|
             registry = cred.fetch("registry")
 
-            lines += registry_scopes(registry) if registry_scopes(registry)
+            lines += T.must(registry_scopes(registry)) if registry_scopes(registry)
 
             token = cred.fetch("token", nil)
             next unless token
@@ -242,6 +288,7 @@ module Dependabot
           ["always-auth = true"] + lines
         end
 
+        sig { params(token: String, registry: T.nilable(String)).returns(String) }
         def auth_line(token, registry = nil)
           auth = if token.include?(":")
                    encoded_token = Base64.encode64(token).delete("\n")
@@ -262,23 +309,30 @@ module Dependabot
           "//#{registry_with_trailing_slash}:#{auth}"
         end
 
+        sig { returns(T.nilable(T::Array[String])) }
         def npmrc_scoped_registries
           return [] unless npmrc_file
 
-          @npmrc_scoped_registries ||=
-            npmrc_file.content.lines.select { |line| line.match?(SCOPED_REGISTRY) }
-                      .filter_map { |line| line.match(SCOPED_REGISTRY)&.named_captures&.fetch("registry") }
+          @npmrc_scoped_registries ||= T.let(
+            T.must(T.must(npmrc_file).content).lines.select { |line| line.match?(SCOPED_REGISTRY) }
+                      .filter_map { |line| line.match(SCOPED_REGISTRY)&.named_captures&.fetch("registry") },
+            T.nilable(T::Array[String])
+          )
         end
 
+        sig { returns(T.nilable(T::Array[String])) }
         def yarnrc_scoped_registries
           return [] unless yarnrc_file
 
-          @yarnrc_scoped_registries ||=
-            yarnrc_file.content.lines.select { |line| line.match?(SCOPED_REGISTRY) }
-                       .filter_map { |line| line.match(SCOPED_REGISTRY)&.named_captures&.fetch("registry") }
+          @yarnrc_scoped_registries ||= T.let(
+            T.must(T.must(yarnrc_file).content).lines.select { |line| line.match?(SCOPED_REGISTRY) }
+                       .filter_map { |line| line.match(SCOPED_REGISTRY)&.named_captures&.fetch("registry") },
+            T.nilable(T::Array[String])
+          )
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(registry: String).returns(T.nilable(T::Array[String])) }
         def registry_scopes(registry)
           # Central registries don't just apply to scopes
           return if CENTRAL_REGISTRIES.include?(registry)
@@ -289,13 +343,13 @@ module Dependabot
             [registry]
           affected_urls =
             dependency_urls
-            .select do |url|
+            &.select do |url|
               next false unless url.include?(registry)
 
               other_regs.none? { |r| r.include?(registry) && url.include?(r) }
             end
 
-          scopes = affected_urls.map do |url|
+          scopes = T.must(affected_urls).map do |url|
             url.split(/\%40|@/)[1]&.split(%r{\%2[fF]|/})&.first
           end.uniq
 
@@ -306,41 +360,65 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { returns(T::Array[Dependabot::Credential]) }
         def registry_credentials
           credentials.select { |cred| cred.fetch("type") == "npm_registry" }
         end
 
+        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
         def parsed_package_lock
-          @parsed_package_lock ||= JSON.parse(package_lock.content)
+          @parsed_package_lock ||= T.let(
+            JSON.parse(T.must(T.must(package_lock).content)),
+            T.nilable(T::Hash[String, T.untyped])
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def npmrc_file
-          @npmrc_file ||= dependency_files
-                          .find { |f| f.name.end_with?(".npmrc") }
+          @npmrc_file ||= T.let(
+            dependency_files.find { |f| f.name.end_with?(".npmrc") },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def yarnrc_file
-          @yarnrc_file ||= dependency_files
-                           .find { |f| f.name.end_with?(".yarnrc") }
+          @yarnrc_file ||= T.let(
+            dependency_files.find { |f| f.name.end_with?(".yarnrc") },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def yarnrc_yml_file
-          @yarnrc_yml_file ||= dependency_files
-                               .find { |f| f.name.end_with?(".yarnrc.yml") }
+          @yarnrc_yml_file ||= T.let(
+            dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def yarn_lock
-          @yarn_lock ||= dependency_files.find { |f| f.name == "yarn.lock" }
+          @yarn_lock ||= T.let(
+            dependency_files.find { |f| f.name == "yarn.lock" },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def package_lock
-          @package_lock ||=
-            dependency_files.find { |f| f.name == "package-lock.json" }
+          @package_lock ||= T.let(
+            dependency_files.find { |f| f.name == "package-lock.json" },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def shrinkwrap
-          @shrinkwrap ||=
-            dependency_files.find { |f| f.name == "npm-shrinkwrap.json" }
+          @shrinkwrap ||= T.let(
+            dependency_files.find { |f| f.name == "npm-shrinkwrap.json" },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
       end
     end

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -128,6 +128,11 @@ module Dependabot
             end
           end
         rescue SharedHelpers::HelperSubprocessFailed => e
+          # package.json name cannot contain characters like empty string or @.
+          if e.message.include?("Name contains illegal characters")
+            raise Dependabot::DependencyFileNotParseable, e.message
+          end
+
           names = dependencies.map(&:name)
           package_missing = names.any? do |name|
             e.message.include?("find package \"#{name}")