dependabot-npm_and_yarn 0.257.0 → 0.259.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a10db478a4eafc2c3e30baa99cc49711909d74050b4542229571002b531b7b80
-  data.tar.gz: dce9891ffe941db7a5e86660225ce78184b2c365a03d5cb09540f540d749caed
+  metadata.gz: 024b19beaf0d762bc2fe8cad90bff1e09aebca6a52bafea7b7b26c88dbd2fe1c
+  data.tar.gz: 4adb0bca67c832c849fb1f6b19ed5c82c3e416034b8380212e7bf53fcd6b4657
 SHA512:
-  metadata.gz: 41708d07cee57271971ce0b022bbb23bf31a30cf2e9627c96d6e8a74e1536833c1b5fdec0d6df3265da6d0ec66fb08dea7941e64f4022727f5b7166d87bde646
-  data.tar.gz: 6023f75e14318dcb082e08df9bb50968fb90d93539ddcc27cc9a5d9411e58da2d1ff2f1c9ccafeb73d2bdc8800f45668cd12f168625a6c5046d6481c5ca64362
+  metadata.gz: 3d3b0cef0359420c836f30f4ce67bd167e409bbc03a837e1da347c9c1d7ae5d95c4042b5c38bdf1170b6cc7b2be484337e1eda7d8fc5652a7c694d4deb595cb9
+  data.tar.gz: 6819198a70bdae964d3791d7ed39c2ecc97b9fae8fe831de79a33baccb7b643ba2292c7fc3ea1896981334033081b7695065f2e3752eb81d7c0914e5d9ae27ac

data/helpers/package-lock.json

@@ -15,7 +15,7 @@
         "nock": "^13.5.4",
         "npm": "6.14.18",
         "patch-package": "^8.0.0",
-        "semver": "^7.6.0"
+        "semver": "^7.6.2"
       },
       "bin": {
         "helper": "run.js"
@@ -14738,12 +14738,9 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
     },
     "node_modules/semver": {
-      "version": "7.6.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.0.tgz",
-      "integrity": "sha512-EnwXhrlwXMk9gKu5/flx5sv/an57AkRplG3hTK68W7FRDN+k+OWBj65M7719OkA82XLBxrcX0KSHj+X5COhOVg==",
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
+      "version": "7.6.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.2.tgz",
+      "integrity": "sha512-FNAIBWCx9qcRhoHcgcJ0gvU7SN1lYU2ZXuSfl04bSC5OpvDHFyJCjdNHomPXxjQlCBU67YW64PzY7/VIEH7F2w==",
       "bin": {
         "semver": "bin/semver.js"
       },
@@ -14751,17 +14748,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/semver/node_modules/lru-cache": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
-      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/shebang-command": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
@@ -26883,22 +26869,9 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
     },
     "semver": {
-      "version": "7.6.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.0.tgz",
-      "integrity": "sha512-EnwXhrlwXMk9gKu5/flx5sv/an57AkRplG3hTK68W7FRDN+k+OWBj65M7719OkA82XLBxrcX0KSHj+X5COhOVg==",
-      "requires": {
-        "lru-cache": "^6.0.0"
-      },
-      "dependencies": {
-        "lru-cache": {
-          "version": "6.0.0",
-          "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
-          "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
-          "requires": {
-            "yallist": "^4.0.0"
-          }
-        }
-      }
+      "version": "7.6.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.2.tgz",
+      "integrity": "sha512-FNAIBWCx9qcRhoHcgcJ0gvU7SN1lYU2ZXuSfl04bSC5OpvDHFyJCjdNHomPXxjQlCBU67YW64PzY7/VIEH7F2w=="
     },
     "shebang-command": {
       "version": "2.0.0",

data/helpers/package.json

@@ -17,7 +17,7 @@
     "npm": "6.14.18",
     "@pnpm/lockfile-file": "^9.0.5",
     "@pnpm/dependency-path": "^4.0.0",
-    "semver": "^7.6.0",
+    "semver": "^7.6.2",
     "patch-package": "^8.0.0"
   },
   "devDependencies": {

data/lib/dependabot/npm_and_yarn/file_updater/package_json_updater.rb

@@ -1,17 +1,28 @@
-# typed: false
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/npm_and_yarn/file_updater"
 
 module Dependabot
   module NpmAndYarn
     class FileUpdater < Dependabot::FileUpdaters::Base
       class PackageJsonUpdater
+        extend T::Sig
+
+        sig do
+          params(
+            package_json: Dependabot::DependencyFile,
+            dependencies: T::Array[Dependabot::Dependency]
+          ) .void
+        end
         def initialize(package_json:, dependencies:)
           @package_json = package_json
           @dependencies = dependencies
         end
 
+        sig { returns(Dependabot::DependencyFile) }
         def updated_package_json
           updated_file = package_json.dup
           updated_file.content = updated_package_json_content
@@ -20,16 +31,20 @@ module Dependabot
 
         private
 
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :package_json
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
 
+        sig { returns(T.nilable(String)) }
         def updated_package_json_content
           dependencies.reduce(package_json.content.dup) do |content, dep|
-            updated_requirements(dep).each do |new_req|
+            updated_requirements(dep)&.each do |new_req|
               old_req = old_requirement(dep, new_req)
 
               new_content = update_package_json_declaration(
-                package_json_content: content,
+                package_json_content: T.must(content),
                 dependency_name: dep.name,
                 old_req: old_req,
                 new_req: new_req
@@ -44,7 +59,7 @@ module Dependabot
               old_req = old_requirement(dep, new_req)
 
               content = update_package_json_resolutions(
-                package_json_content: content,
+                package_json_content: T.must(content),
                 new_req: new_req,
                 dependency: dep,
                 old_req: old_req
@@ -55,24 +70,35 @@ module Dependabot
           end
         end
 
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            new_requirement: T::Hash[Symbol, T.untyped]
+          )
+            .returns(T.nilable(T::Hash[Symbol, T.untyped]))
+        end
         def old_requirement(dependency, new_requirement)
-          dependency.previous_requirements
-                    .select { |r| r[:file] == package_json.name }
-                    .find { |r| r[:groups] == new_requirement[:groups] }
+          T.must(dependency.previous_requirements)
+           .select { |r| r[:file] == package_json.name }
+           .find { |r| r[:groups] == new_requirement[:groups] }
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def new_requirements(dependency)
           dependency.requirements.select { |r| r[:file] == package_json.name }
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T.nilable(T::Array[T::Hash[Symbol, T.untyped]])) }
         def updated_requirements(dependency)
+          return unless dependency.previous_requirements
+
           updated_requirement_pairs =
-            dependency.requirements.zip(dependency.previous_requirements)
+            dependency.requirements.zip(T.must(dependency.previous_requirements))
                       .reject do |new_req, old_req|
               next true if new_req == old_req
-              next false unless old_req[:source].nil?
+              next false unless old_req&.fetch(:source).nil?
 
-              new_req[:requirement] == old_req[:requirement]
+              new_req[:requirement] == old_req&.fetch(:requirement)
             end
 
           updated_requirement_pairs
@@ -80,8 +106,16 @@ module Dependabot
             .select { |r| r[:file] == package_json.name }
         end
 
-        def update_package_json_declaration(package_json_content:, new_req:,
-                                            dependency_name:, old_req:)
+        sig do
+          params(
+            package_json_content: String,
+            new_req: T::Hash[Symbol, T.untyped],
+            dependency_name: String,
+            old_req: T.nilable(T::Hash[Symbol, T.untyped])
+          )
+            .returns(String)
+        end
+        def update_package_json_declaration(package_json_content:, new_req:, dependency_name:, old_req:)
           original_line = declaration_line(
             dependency_name: dependency_name,
             dependency_req: old_req,
@@ -107,8 +141,16 @@ module Dependabot
         # For full details on how Yarn resolutions work, see
         # https://github.com/yarnpkg/rfcs/blob/master/implemented/
         # 0000-selective-versions-resolutions.md
-        def update_package_json_resolutions(package_json_content:, new_req:,
-                                            dependency:, old_req:)
+        sig do
+          params(
+            package_json_content: String,
+            new_req: T::Hash[Symbol, T.untyped],
+            dependency: Dependabot::Dependency,
+            old_req: T.nilable(T::Hash[Symbol, T.untyped])
+          )
+            .returns(String)
+        end
+        def update_package_json_resolutions(package_json_content:, new_req:, dependency:, old_req:)
           dep = dependency
           parsed_json_content = JSON.parse(package_json_content)
           resolutions =
@@ -141,17 +183,25 @@ module Dependabot
           content
         end
 
+        sig do
+          params(
+            dependency_name: String,
+            dependency_req: T.nilable(T::Hash[Symbol, T.untyped]),
+            content: String
+          )
+            .returns(String)
+        end
         def declaration_line(dependency_name:, dependency_req:, content:)
-          git_dependency = dependency_req.dig(:source, :type) == "git"
+          git_dependency = dependency_req&.dig(:source, :type) == "git"
 
           unless git_dependency
-            requirement = dependency_req.fetch(:requirement)
+            requirement = dependency_req&.fetch(:requirement)
             return content.match(/"#{Regexp.escape(dependency_name)}"\s*:\s*
                                   "#{Regexp.escape(requirement)}"/x).to_s
           end
 
           username, repo =
-            dependency_req.dig(:source, :url).split("/").last(2)
+            dependency_req&.dig(:source, :url)&.split("/")&.last(2)
 
           content.match(
             %r{"#{Regexp.escape(dependency_name)}"\s*:\s*
@@ -159,13 +209,21 @@ module Dependabot
           ).to_s
         end
 
+        sig do
+          params(
+            original_line: String,
+            old_req: T.nilable(T::Hash[Symbol, T.untyped]),
+            new_req: T::Hash[Symbol, T.untyped]
+          )
+            .returns(String)
+        end
         def replacement_declaration_line(original_line:, old_req:, new_req:)
-          was_git_dependency = old_req.dig(:source, :type) == "git"
+          was_git_dependency = old_req&.dig(:source, :type) == "git"
           now_git_dependency = new_req.dig(:source, :type) == "git"
 
           unless was_git_dependency
             return original_line.gsub(
-              %("#{old_req.fetch(:requirement)}"),
+              %("#{old_req&.fetch(:requirement)}"),
               %("#{new_req.fetch(:requirement)}")
             )
           end
@@ -186,15 +244,23 @@ module Dependabot
           end
 
           original_line.gsub(
-            %(##{old_req.dig(:source, :ref)}"),
+            %(##{old_req&.dig(:source, :ref)}"),
             %(##{new_req.dig(:source, :ref)}")
           )
         end
 
+        sig do
+          params(
+            original_line: String,
+            old_req: T.nilable(T::Hash[Symbol, String]),
+            new_req: T::Hash[Symbol, String]
+          )
+            .returns(String)
+        end
         def update_git_semver_requirement(original_line:, old_req:, new_req:)
           if original_line.include?("semver:")
             return original_line.gsub(
-              %(semver:#{old_req.fetch(:requirement)}"),
+              %(semver:#{old_req&.fetch(:requirement)}"),
               %(semver:#{new_req.fetch(:requirement)}")
             )
           end
@@ -202,13 +268,21 @@ module Dependabot
           raise "Not a semver req!" unless original_line.match?(/#[\^~=<>]/)
 
           original_line.gsub(
-            %(##{old_req.fetch(:requirement)}"),
+            %(##{old_req&.fetch(:requirement)}"),
             %(##{new_req.fetch(:requirement)}")
           )
         end
 
-        def update_package_json_sections(sections, content, old_line,
-                                         new_line)
+        sig do
+          params(
+            sections: T::Array[String],
+            content: String,
+            old_line: String,
+            new_line: String
+          )
+            .returns(String)
+        end
+        def update_package_json_sections(sections, content, old_line, new_line)
           # Currently, Dependabot doesn't update peerDependencies. However,
           # if a development dependency is being updated and its requirement
           # matches the requirement on a peer dependency we probably want to
@@ -218,21 +292,21 @@ module Dependabot
           sections += ["peerDependencies"]
           sections_regex = /#{sections.join('|')}/
 
-          declaration_blocks = []
+          declaration_blocks = T.let([], T::Array[String])
 
           content.scan(/['"]#{sections_regex}['"]\s*:\s*\{/m) do
-            mtch = Regexp.last_match
+            mtch = T.must(Regexp.last_match)
             declaration_blocks <<
-              (mtch.to_s +
-              mtch.post_match[0..closing_bracket_index(mtch.post_match)])
+              (mtch.to_s + T.must(mtch.post_match[0..closing_bracket_index(mtch.post_match)]))
           end
 
           declaration_blocks.reduce(content.dup) do |new_content, block|
             updated_block = block.sub(old_line, new_line)
-            new_content.sub!(block, updated_block)
+            new_content.sub(block, updated_block)
           end
         end
 
+        sig { params(string: String).returns(Integer) }
         def closing_bracket_index(string)
           closes_required = 1
 

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "uri"
@@ -147,7 +147,8 @@ module Dependabot
           retry_count += 1
           raise if retry_count > 2
 
-          sleep(rand(3.0..10.0)) && retry
+          sleep(rand(3.0..10.0))
+          retry
         end
 
         # rubocop:enable Metrics/PerceivedComplexity

data/lib/dependabot/npm_and_yarn/update_checker/registry_finder.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "excon"
@@ -174,14 +174,14 @@ module Dependabot
 
           registries = []
           npmrc_file.content.scan(NPM_AUTH_TOKEN_REGEX) do
-            next if Regexp.last_match[:registry].include?("${")
+            next if Regexp.last_match&.[](:registry)&.include?("${")
 
-            registry = Regexp.last_match[:registry]
-            token = Regexp.last_match[:token]&.strip
+            registry = T.must(Regexp.last_match)[:registry]
+            token = T.must(Regexp.last_match)[:token]&.strip
 
             registries << {
               "type" => "npm_registry",
-              "registry" => registry.gsub(/\s+/, "%20"),
+              "registry" => registry&.gsub(/\s+/, "%20"),
               "token" => token
             }
           end
@@ -260,9 +260,9 @@ module Dependabot
           registries = []
 
           file.content.scan(syntax) do
-            next if Regexp.last_match[:registry].include?("${")
+            next if Regexp.last_match&.[](:registry)&.include?("${")
 
-            url = Regexp.last_match[:registry].strip
+            url = T.must(T.must(Regexp.last_match)[:registry]).strip
             registry = normalize_configured_registry(url)
             registries << {
               "type" => "npm_registry",
@@ -277,9 +277,9 @@ module Dependabot
 
         def scoped_rc_registry(file, syntax:, scope:)
           file&.content.to_s.scan(syntax) do
-            next if Regexp.last_match[:registry].include?("${") || Regexp.last_match[:scope] != scope
+            next if Regexp.last_match&.[](:registry)&.include?("${") || Regexp.last_match&.[](:scope) != scope
 
-            return Regexp.last_match[:registry].strip
+            return T.must(T.must(Regexp.last_match)[:registry]).strip
           end
 
           nil

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "dependabot/dependency"
@@ -115,7 +115,8 @@ module Dependabot
           retry_count += 1
           raise if retry_count > 2
 
-          sleep(rand(3.0..10.0)) && retry
+          sleep(rand(3.0..10.0))
+          retry
         end
 
         def run_yarn_berry_updater(path, lockfile_name)

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -1,6 +1,8 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/errors"
 require "dependabot/git_commit_checker"
 require "dependabot/logger"
@@ -21,6 +23,8 @@ module Dependabot
   module NpmAndYarn
     class UpdateChecker
       class VersionResolver
+        extend T::Sig
+
         require_relative "latest_version_finder"
 
         TIGHTLY_COUPLED_MONOREPOS = {
@@ -162,6 +166,7 @@ module Dependabot
 
         private
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
         attr_reader :credentials
         attr_reader :dependency_files
@@ -356,32 +361,34 @@ module Dependabot
           []
         end
 
+        # rubocop:disable Metrics/AbcSize
+        sig { params(message: String).returns(T::Array[T::Hash[String, T.nilable(String)]]) }
         def handle_peer_dependency_errors(message)
           errors = []
           if message.match?(NPM6_PEER_DEP_ERROR_REGEX)
             message.scan(NPM6_PEER_DEP_ERROR_REGEX) do
-              errors << Regexp.last_match.named_captures
+              errors << Regexp.last_match&.named_captures
             end
           elsif message.match?(NPM8_PEER_DEP_ERROR_REGEX)
             message.scan(NPM8_PEER_DEP_ERROR_REGEX) do
-              errors << Regexp.last_match.named_captures
+              errors << T.must(Regexp.last_match).named_captures
             end
           elsif message.match?(YARN_PEER_DEP_ERROR_REGEX)
             message.scan(YARN_PEER_DEP_ERROR_REGEX) do
-              errors << Regexp.last_match.named_captures
+              errors << T.must(Regexp.last_match).named_captures
             end
           elsif message.match?(YARN_BERRY_PEER_DEP_ERROR_REGEX)
             message.scan(YARN_BERRY_PEER_DEP_ERROR_REGEX) do
-              errors << Regexp.last_match.named_captures
+              errors << T.must(Regexp.last_match).named_captures
             end
           elsif message.match?(YARN_BERRY_V4_PEER_DEP_ERROR_REGEX)
             message.scan(YARN_BERRY_V4_PEER_DEP_ERROR_REGEX) do
-              errors << Regexp.last_match.named_captures
+              errors << T.must(Regexp.last_match).named_captures
             end
           elsif message.match?(PNPM_PEER_DEP_ERROR_REGEX)
             message.scan(PNPM_PEER_DEP_ERROR_REGEX) do
-              captures = Regexp.last_match.named_captures
-              captures["requiring_dep"].tr!(" ", "@")
+              captures = T.must(Regexp.last_match).named_captures
+              T.must(captures["requiring_dep"]).tr!(" ", "@")
               errors << captures
             end
           else
@@ -389,6 +396,7 @@ module Dependabot
           end
           errors
         end
+        # rubocop:enable Metrics/AbcSize
 
         def unmet_peer_dependencies
           peer_dependency_errors
@@ -650,7 +658,7 @@ module Dependabot
           git_source = dependency.requirements.find { |req| req[:source] && req[:source][:type] == "git" }
 
           if git_source
-            "#{dependency.name}@#{git_req[:source][:url]}##{version}"
+            "#{dependency.name}@#{git_source[:source][:url]}##{version}"
           else
             "#{dependency.name}@#{version}"
           end
@@ -715,7 +723,7 @@ module Dependabot
         end
 
         def version_regex
-          version_class::VERSION_PATTERN
+          Dependabot::NpmAndYarn::Version::VERSION_PATTERN
         end
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.257.0
+  version: 0.259.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-05-13 00:00:00.000000000 Z
+date: 2024-05-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.257.0
+        version: 0.259.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.257.0
+        version: 0.259.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -345,7 +345,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.257.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.259.0
 post_install_message: 
 rdoc_options: []
 require_paths: