dependabot-npm_and_yarn 0.277.0 → 0.279.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 380c540d4ed17ab150738fc8390ce8bc995135c3c19bea687ebcca74d8f0010d
-  data.tar.gz: 294ba80ed94f2fb0981719516ce3eb44ccd537200c144507aac9903749db0f76
+  metadata.gz: fc1831a7fd0ce199df4dd0a3cf181a9f98a77bc9afdbef011edcf39d6ebabc32
+  data.tar.gz: 2c674ec57330ef559f09cd3f9dff509f326b9da9e48f4af535a19a1e9841e236
 SHA512:
-  metadata.gz: 1525c5afa58bf9db6b4729e2c27c8b7efce4ba96e14fe2aee965e516da6baaee9a42e81a9339124adf307c3e314592b82bad971ab65f2d56b811b9705a018adf
-  data.tar.gz: 77e389af97a5f61b4ff3916826e46fc944c005e45f1485fd94c623e6a94d90a65d84997c4db215aa1262340a21ed0ecac1374faaddb45ea6bd8cad94f8dbdd82
+  metadata.gz: e3658b8c3d8168dcd7728e95b6642bc415c54905bc540fa54ce77c0d6081c90a4236b88dbf05fcf52ffbacc476120ea68a9b99953ca6fb71e8dbdd9176103f1a
+  data.tar.gz: 1d7ce4d6a12e28747b5781c7a87c9396de229da85ff57b3a2af340d495aa396b67de27be1f09eec99452db931d756767cf745202bcf019443f88c6b83e7314f6

data/lib/dependabot/npm_and_yarn/package_manager.rb

@@ -23,31 +23,24 @@ module Dependabot
         # i.e. if { engines : "pnpm" : "6" } and { packageManager: "pnpm@6.0.2" },
         # we go for the specificity mentioned in packageManager (6.0.2)
 
-        if Dependabot::Experiments.enabled?(:enable_pnpm_yarn_dynamic_engine)
+        unless @package_manager&.start_with?("#{name}@") || (@package_manager&.==name.to_s) || @package_manager.nil?
+          return
+        end
 
-          unless @package_manager&.start_with?("#{name}@") || (@package_manager&.==name.to_s) || @package_manager.nil?
-            return
-          end
+        if @engines && @package_manager.nil?
+          # if "packageManager" doesn't exists in manifest file,
+          # we check if we can extract "engines" information
+          version = check_engine_version(name)
 
-          if @engines && @package_manager.nil?
-            # if "packageManager" doesn't exists in manifest file,
-            # we check if we can extract "engines" information
-            Dependabot.logger.info("No \"packageManager\" info found for \"#{name}\"")
-            version = check_engine_version(name)
-
-          elsif @package_manager&.==name.to_s
-            # if "packageManager" is found but no version is specified (i.e. pnpm@1.2.3),
-            # we check if we can get "engines" info to override default version
-            Dependabot.logger.info("Found \"packageManager\" : \"#{@package_manager}\"")
-            version = check_engine_version(name) if @engines
-
-          elsif @package_manager&.start_with?("#{name}@")
-            # if "packageManager" info has version specification i.e. yarn@3.3.1
-            # we go with the version in "packageManager"
-            Dependabot.logger.info("Found \"packageManager\" : \"#{@package_manager}\". Skipped checking \"engines\".")
-          end
-        else
-          return unless @package_manager.nil? || @package_manager&.start_with?("#{name}@")
+        elsif @package_manager&.==name.to_s
+          # if "packageManager" is found but no version is specified (i.e. pnpm@1.2.3),
+          # we check if we can get "engines" info to override default version
+          version = check_engine_version(name) if @engines
+
+        elsif @package_manager&.start_with?("#{name}@")
+          # if "packageManager" info has version specification i.e. yarn@3.3.1
+          # we go with the version in "packageManager"
+          Dependabot.logger.info("Found \"packageManager\" : \"#{@package_manager}\". Skipped checking \"engines\".")
         end
 
         version ||= requested_version(name)
@@ -103,7 +96,6 @@ module Dependabot
         lockfile = @lockfiles[name.to_sym]
         return unless lockfile
 
-        Dependabot.logger.info("Estimating version")
         Helpers.send(:"#{name}_version_numeric", lockfile)
       end
 
@@ -112,10 +104,7 @@ module Dependabot
         version_selector = VersionSelector.new
         engine_versions = version_selector.setup(@package_json, name)
 
-        if engine_versions.empty?
-          Dependabot.logger.info("No relevant (engines) info for \"#{name}\"")
-          return
-        end
+        return if engine_versions.empty?
 
         version = engine_versions[name]
         Dependabot.logger.info("Returned (engines) info \"#{name}\" : \"#{version}\"")

data/lib/dependabot/npm_and_yarn/registry_parser.rb

@@ -46,7 +46,10 @@ module Dependabot
                    end
 
         package_name = url_base.gsub("%2F", "/").match(%r{@.*/})
-        "#{T.must(package_name)}#{T.must(url_base.gsub('%2F', '/').split('/').last)}"
+
+        return T.must(url_base.gsub("%2F", "/").split("/").last) unless package_name
+
+        "#{package_name}#{T.must(url_base.gsub('%2F', '/').split('/').last)}"
       end
 
       private

data/lib/dependabot/npm_and_yarn/version_selector.rb

@@ -17,16 +17,7 @@ module Dependabot
       def setup(manifest_json, name)
         engine_versions = manifest_json["engines"]
 
-        if engine_versions.nil?
-          Dependabot.logger.info("No info (engines) found")
-          return {}
-        end
-
-        # logs entries for analysis purposes
-        log = engine_versions.select do |engine, _value|
-          engine.to_s.match(name)
-        end
-        Dependabot.logger.info("Found engine info #{log}") unless log.empty?
+        return {} if engine_versions.nil?
 
         # Only keep matching specs versions i.e. "20.21.2", "7.1.2",
         # Additional specs can be added later

data/lib/dependabot/npm_and_yarn.rb

@@ -362,7 +362,7 @@ module Dependabot
       {
         patterns: [INVALID_NAME_IN_PACKAGE_JSON],
         handler: lambda { |message, _error, _params|
-          Dependabot::DependencyFileNotParseable.new(message)
+          Dependabot::DependencyFileNotResolvable.new(message)
         },
         in_usage: false,
         matchfn: nil

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.277.0
+  version: 0.279.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-09-23 00:00:00.000000000 Z
+date: 2024-10-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.277.0
+        version: 0.279.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.277.0
+        version: 0.279.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -346,7 +346,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.277.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.279.0
 post_install_message: 
 rdoc_options: []
 require_paths: