dependabot-npm_and_yarn 0.278.0 → 0.280.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 60b649d3a84bb124014b8aa86163c59837eb3898c90cad22b261ea0174e226b9
-  data.tar.gz: 1fbd3de6f3d9f097c1fe4ed1e70530e42dd0d489fa30db685c103a3b6321c3f2
+  metadata.gz: 2dc7fad7c10b170c7ca02d8804da5cd8871731f7e86910b4ef1c05d887c9d123
+  data.tar.gz: 8eda392b48cbd506847c2d2044297a65411849062e707280c0372e231d5d1c82
 SHA512:
-  metadata.gz: 8113aa1183c527768427e25d0c4eca5d05734959d3f0e3c88e9560e7f7735e98bb9ae47b1ba8674398d23fe91ddeffae6cda88ac2ddca2a27b1411651b15c686
-  data.tar.gz: 30d6064f7b950659ab01ef1ecc8dae54be57db49bebf560f7ce8c5cda65772e0289b40ba31a58368305853481e1e2f9cb0b235a838b0614a87abc12a9b509697
+  metadata.gz: 70a2f7c669ca3ff3c41e885146186c5f54af7940313570a0117b98024aa49c822a0deeb375d098cabac930d6f4fb209388ab85f665dd7ccdc95fe62916f87e27
+  data.tar.gz: da9fe3afc5f0c388fd2ba83d41b2e932c239ff7c652861f50abb6d3d53f545bc702aa5d756ed1fd9da96eb7e1c1b23491c381008de8b214c1fe84422f7d79f62

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -500,7 +500,7 @@ module Dependabot
           return false unless yarnrc_global_registry
 
           UpdateChecker::RegistryFinder::CENTRAL_REGISTRIES.any? do |r|
-            r.include?(URI(yarnrc_global_registry).host)
+            r.include?(T.must(URI(yarnrc_global_registry).host))
           end
         end
 

data/lib/dependabot/npm_and_yarn/file_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/file_updaters"
@@ -20,11 +20,15 @@ module Dependabot
       require_relative "file_updater/pnpm_lockfile_updater"
 
       class NoChangeError < StandardError
+        extend T::Sig
+
+        sig { params(message: String, error_context: T::Hash[Symbol, T.untyped]).void }
         def initialize(message:, error_context:)
           super(message)
           @error_context = error_context
         end
 
+        sig { returns(T::Hash[Symbol, T.untyped]) }
         def sentry_context
           { extra: @error_context }
         end
@@ -70,8 +74,9 @@ module Dependabot
 
       private
 
+      sig { params(updated_files: T::Array[Dependabot::DependencyFile]).returns(T::Array[Dependabot::DependencyFile]) }
       def vendor_updated_files(updated_files)
-        base_dir = updated_files.first.directory
+        base_dir = T.must(updated_files.first).directory
         pnp_updater.updated_files(base_directory: base_dir, only_paths: [".pnp.cjs", ".pnp.data.json"]).each do |file|
           updated_files << file
         end
@@ -86,16 +91,20 @@ module Dependabot
       end
 
       # Dynamically fetch the vendor cache folder from yarn
+      sig { returns(String) }
       def vendor_cache_dir
-        return @vendor_cache_dir if defined?(@vendor_cache_dir)
-
-        @vendor_cache_dir = Helpers.fetch_yarnrc_yml_value("cacheFolder", "./.yarn/cache")
+        @vendor_cache_dir ||= T.let(
+          Helpers.fetch_yarnrc_yml_value("cacheFolder", "./.yarn/cache"),
+          T.nilable(String)
+        )
       end
 
+      sig { returns(String) }
       def install_state_path
-        return @install_state_path if defined?(@install_state_path)
-
-        @install_state_path = Helpers.fetch_yarnrc_yml_value("installStatePath", "./.yarn/install-state.gz")
+        @install_state_path ||= T.let(
+          Helpers.fetch_yarnrc_yml_value("installStatePath", "./.yarn/install-state.gz"),
+          T.nilable(String)
+        )
       end
 
       sig { returns(Dependabot::FileUpdaters::VendorUpdater) }
@@ -153,28 +162,40 @@ module Dependabot
         }
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def package_locks
-        @package_locks ||=
+        @package_locks ||= T.let(
           filtered_dependency_files
-          .select { |f| f.name.end_with?("package-lock.json") }
+          .select { |f| f.name.end_with?("package-lock.json") },
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def yarn_locks
-        @yarn_locks ||=
+        @yarn_locks ||= T.let(
           filtered_dependency_files
-          .select { |f| f.name.end_with?("yarn.lock") }
+          .select { |f| f.name.end_with?("yarn.lock") },
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def pnpm_locks
-        @pnpm_locks ||=
+        @pnpm_locks ||= T.let(
           filtered_dependency_files
-          .select { |f| f.name.end_with?("pnpm-lock.yaml") }
+          .select { |f| f.name.end_with?("pnpm-lock.yaml") },
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def shrinkwraps
-        @shrinkwraps ||=
+        @shrinkwraps ||= T.let(
           filtered_dependency_files
-          .select { |f| f.name.end_with?("npm-shrinkwrap.json") }
+          .select { |f| f.name.end_with?("npm-shrinkwrap.json") },
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
       end
 
       sig { returns(T::Array[Dependabot::DependencyFile]) }
@@ -186,18 +207,22 @@ module Dependabot
         )
       end
 
+      sig { params(yarn_lock: Dependabot::DependencyFile).returns(T::Boolean) }
       def yarn_lock_changed?(yarn_lock)
         yarn_lock.content != updated_yarn_lock_content(yarn_lock)
       end
 
+      sig { params(pnpm_lock: Dependabot::DependencyFile).returns(T::Boolean) }
       def pnpm_lock_changed?(pnpm_lock)
         pnpm_lock.content != updated_pnpm_lock_content(pnpm_lock)
       end
 
+      sig { params(package_lock: Dependabot::DependencyFile).returns(T::Boolean) }
       def package_lock_changed?(package_lock)
         package_lock.content != updated_lockfile_content(package_lock)
       end
 
+      sig { params(shrinkwrap: Dependabot::DependencyFile).returns(T::Boolean) }
       def shrinkwrap_changed?(shrinkwrap)
         shrinkwrap.content != updated_lockfile_content(shrinkwrap)
       end
@@ -208,10 +233,11 @@ module Dependabot
           updated_content = updated_package_json_content(file)
           next if updated_content == file.content
 
-          updated_file(file: file, content: updated_content)
+          updated_file(file: file, content: T.must(updated_content))
         end
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def updated_lockfiles
         updated_files = []
 
@@ -238,7 +264,7 @@ module Dependabot
 
           updated_files << updated_file(
             file: package_lock,
-            content: updated_lockfile_content(package_lock)
+            content: T.must(updated_lockfile_content(package_lock))
           )
         end
 
@@ -247,47 +273,56 @@ module Dependabot
 
           updated_files << updated_file(
             file: shrinkwrap,
-            content: updated_lockfile_content(shrinkwrap)
+            content: T.must(updated_lockfile_content(shrinkwrap))
           )
         end
 
         updated_files
       end
 
+      sig { params(yarn_lock: Dependabot::DependencyFile).returns(String) }
       def updated_yarn_lock_content(yarn_lock)
-        @updated_yarn_lock_content ||= {}
+        @updated_yarn_lock_content ||= T.let({}, T.nilable(T::Hash[String, T.nilable(String)]))
         @updated_yarn_lock_content[yarn_lock.name] ||=
           yarn_lockfile_updater.updated_yarn_lock_content(yarn_lock)
       end
 
+      sig { params(pnpm_lock: Dependabot::DependencyFile).returns(String) }
       def updated_pnpm_lock_content(pnpm_lock)
-        @updated_pnpm_lock_content ||= {}
+        @updated_pnpm_lock_content ||= T.let({}, T.nilable(T::Hash[String, T.nilable(String)]))
         @updated_pnpm_lock_content[pnpm_lock.name] ||=
           pnpm_lockfile_updater.updated_pnpm_lock_content(pnpm_lock)
       end
 
+      sig { returns(Dependabot::NpmAndYarn::FileUpdater::YarnLockfileUpdater) }
       def yarn_lockfile_updater
-        @yarn_lockfile_updater ||=
+        @yarn_lockfile_updater ||= T.let(
           YarnLockfileUpdater.new(
             dependencies: dependencies,
             dependency_files: dependency_files,
             repo_contents_path: repo_contents_path,
             credentials: credentials
-          )
+          ),
+          T.nilable(Dependabot::NpmAndYarn::FileUpdater::YarnLockfileUpdater)
+        )
       end
 
+      sig { returns(Dependabot::NpmAndYarn::FileUpdater::PnpmLockfileUpdater) }
       def pnpm_lockfile_updater
-        @pnpm_lockfile_updater ||=
+        @pnpm_lockfile_updater ||= T.let(
           PnpmLockfileUpdater.new(
             dependencies: dependencies,
             dependency_files: dependency_files,
             repo_contents_path: repo_contents_path,
             credentials: credentials
-          )
+          ),
+          T.nilable(Dependabot::NpmAndYarn::FileUpdater::PnpmLockfileUpdater)
+        )
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(String)) }
       def updated_lockfile_content(file)
-        @updated_lockfile_content ||= {}
+        @updated_lockfile_content ||= T.let({}, T.nilable(T::Hash[String, T.nilable(String)]))
         @updated_lockfile_content[file.name] ||=
           NpmLockfileUpdater.new(
             lockfile: file,
@@ -297,8 +332,9 @@ module Dependabot
           ).updated_lockfile.content
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(String)) }
       def updated_package_json_content(file)
-        @updated_package_json_content ||= {}
+        @updated_package_json_content ||= T.let({}, T.nilable(T::Hash[String, T.nilable(String)]))
         @updated_package_json_content[file.name] ||=
           PackageJsonUpdater.new(
             package_json: file,

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -14,22 +14,83 @@ module Dependabot
       YARN_PATH_NOT_FOUND =
         /^.*(?<error>The "yarn-path" option has been set \(in [^)]+\), but the specified location doesn't exist)/
 
+      # NPM Version Constants
+      NPM_V8 = 8
+      NPM_V6 = 6
+      NPM_DEFAULT_VERSION = NPM_V8
+
+      # PNPM Version Constants
+      PNPM_V9 = 9
+      PNPM_V8 = 8
+      PNPM_V7 = 7
+      PNPM_V6 = 6
+      PNPM_DEFAULT_VERSION = PNPM_V9
+      PNPM_FALLBACK_VERSION = PNPM_V6
+
+      # YARN Version Constants
+      YARN_V3 = 3
+      YARN_V2 = 2
+      YARN_V1 = 1
+      YARN_DEFAULT_VERSION = YARN_V3
+      YARN_FALLBACK_VERSION = YARN_V1
+
+      # Determines the npm version depends to the feature flag
+      # If the feature flag is enabled, we are going to use the minimum version npm 8
+      # Otherwise, we are going to use old versionining npm 6
       sig { params(lockfile: DependencyFile).returns(Integer) }
       def self.npm_version_numeric(lockfile)
+        fallback_version_npm8 = Dependabot::Experiments.enabled?(:npm_fallback_version_above_v6)
+
+        return npm_version_numeric_npm8_or_higher(lockfile) if fallback_version_npm8
+
+        npm_version_numeric_npm6_or_higher(lockfile)
+      end
+
+      sig { params(lockfile: DependencyFile).returns(Integer) }
+      def self.npm_version_numeric_npm6_or_higher(lockfile)
         lockfile_content = T.must(lockfile.content)
-        return 8 if JSON.parse(lockfile_content)["lockfileVersion"].to_i >= 2
+        return NPM_V8 if JSON.parse(lockfile_content)["lockfileVersion"].to_i >= 2
 
-        6
+        NPM_V6
       rescue JSON::ParserError
-        6
+        NPM_V6
+      end
+
+      # Determines the npm version based on the lockfile version
+      # - NPM 7 uses lockfileVersion 2
+      # - NPM 8 uses lockfileVersion 2
+      # - NPM 9 uses lockfileVersion 3
+      sig { params(lockfile: DependencyFile).returns(Integer) }
+      def self.npm_version_numeric_npm8_or_higher(lockfile)
+        lockfile_content = lockfile.content
+
+        # Return default NPM version if there's no lockfile or it's empty
+        return NPM_DEFAULT_VERSION if lockfile_content.nil? || lockfile_content.strip.empty?
+
+        parsed_lockfile = JSON.parse(lockfile_content)
+
+        lockfile_version_str = parsed_lockfile["lockfileVersion"]
+
+        # Default to npm default version if lockfileVersion is missing or empty
+        return NPM_DEFAULT_VERSION if lockfile_version_str.nil? || lockfile_version_str.to_s.strip.empty?
+
+        lockfile_version = lockfile_version_str.to_i
+
+        # Using npm 8 as the default for lockfile_version > 2.
+        # Update needed to support npm 9+ based on lockfile version.
+        return NPM_V8 if lockfile_version >= 2
+
+        NPM_DEFAULT_VERSION
+      rescue JSON::ParserError
+        NPM_DEFAULT_VERSION # Fallback to default npm version if parsing fails
       end
 
       sig { params(yarn_lock: DependencyFile).returns(Integer) }
       def self.yarn_version_numeric(yarn_lock)
         if yarn_berry?(yarn_lock)
-          3
+          YARN_DEFAULT_VERSION
         else
-          1
+          YARN_FALLBACK_VERSION
         end
       end
 
@@ -38,15 +99,12 @@ module Dependabot
 
       sig { params(pnpm_lock: DependencyFile).returns(Integer) }
       def self.pnpm_version_numeric(pnpm_lock)
-        if pnpm_lockfile_version(pnpm_lock).to_f >= 9.0
-          9
-        elsif pnpm_lockfile_version(pnpm_lock).to_f >= 6.0
-          8
-        elsif pnpm_lockfile_version(pnpm_lock).to_f >= 5.4
-          7
-        else
-          6
-        end
+        pnpm_lockfile_version = pnpm_lockfile_version(pnpm_lock).to_f
+        return PNPM_V9 if pnpm_lockfile_version >= 9.0
+        return PNPM_V8 if pnpm_lockfile_version >= 6.0
+        return PNPM_V7 if pnpm_lockfile_version >= 5.4
+
+        PNPM_FALLBACK_VERSION
       end
 
       def self.fetch_yarnrc_yml_value(key, default_value)
@@ -61,7 +119,7 @@ module Dependabot
       def self.npm8?(package_lock)
         return true unless package_lock
 
-        npm_version_numeric(package_lock) == 8
+        npm_version_numeric(package_lock) == NPM_V8
       end
 
       sig { params(yarn_lock: T.nilable(DependencyFile)).returns(T::Boolean) }
@@ -140,12 +198,12 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def self.yarn_berry_skip_build?
-        yarn_major_version >= 3 && (yarn_zero_install? || yarn_offline_cache?)
+        yarn_major_version >= YARN_V3 && (yarn_zero_install? || yarn_offline_cache?)
       end
 
       sig { returns(T::Boolean) }
       def self.yarn_berry_disable_scripts?
-        yarn_major_version == 2 || !yarn_zero_install?
+        yarn_major_version == YARN_V2 || !yarn_zero_install?
       end
 
       sig { returns(T::Boolean) }

data/lib/dependabot/npm_and_yarn/package_manager.rb

@@ -23,31 +23,24 @@ module Dependabot
         # i.e. if { engines : "pnpm" : "6" } and { packageManager: "pnpm@6.0.2" },
         # we go for the specificity mentioned in packageManager (6.0.2)
 
-        if Dependabot::Experiments.enabled?(:enable_pnpm_yarn_dynamic_engine)
+        unless @package_manager&.start_with?("#{name}@") || (@package_manager&.==name.to_s) || @package_manager.nil?
+          return
+        end
 
-          unless @package_manager&.start_with?("#{name}@") || (@package_manager&.==name.to_s) || @package_manager.nil?
-            return
-          end
+        if @engines && @package_manager.nil?
+          # if "packageManager" doesn't exists in manifest file,
+          # we check if we can extract "engines" information
+          version = check_engine_version(name)
 
-          if @engines && @package_manager.nil?
-            # if "packageManager" doesn't exists in manifest file,
-            # we check if we can extract "engines" information
-            Dependabot.logger.info("No \"packageManager\" info found for \"#{name}\"")
-            version = check_engine_version(name)
-
-          elsif @package_manager&.==name.to_s
-            # if "packageManager" is found but no version is specified (i.e. pnpm@1.2.3),
-            # we check if we can get "engines" info to override default version
-            Dependabot.logger.info("Found \"packageManager\" : \"#{@package_manager}\"")
-            version = check_engine_version(name) if @engines
-
-          elsif @package_manager&.start_with?("#{name}@")
-            # if "packageManager" info has version specification i.e. yarn@3.3.1
-            # we go with the version in "packageManager"
-            Dependabot.logger.info("Found \"packageManager\" : \"#{@package_manager}\". Skipped checking \"engines\".")
-          end
-        else
-          return unless @package_manager.nil? || @package_manager&.start_with?("#{name}@")
+        elsif @package_manager&.==name.to_s
+          # if "packageManager" is found but no version is specified (i.e. pnpm@1.2.3),
+          # we check if we can get "engines" info to override default version
+          version = check_engine_version(name) if @engines
+
+        elsif @package_manager&.start_with?("#{name}@")
+          # if "packageManager" info has version specification i.e. yarn@3.3.1
+          # we go with the version in "packageManager"
+          Dependabot.logger.info("Found \"packageManager\" : \"#{@package_manager}\". Skipped checking \"engines\".")
         end
 
         version ||= requested_version(name)
@@ -103,8 +96,11 @@ module Dependabot
         lockfile = @lockfiles[name.to_sym]
         return unless lockfile
 
-        Dependabot.logger.info("Estimating version")
-        Helpers.send(:"#{name}_version_numeric", lockfile)
+        version = Helpers.send(:"#{name}_version_numeric", lockfile)
+
+        Dependabot.logger.info("Guessed version info \"#{name}\" : \"#{version}\"")
+
+        version
       end
 
       sig { params(name: T.untyped).returns(T.nilable(String)) }
@@ -112,10 +108,7 @@ module Dependabot
         version_selector = VersionSelector.new
         engine_versions = version_selector.setup(@package_json, name)
 
-        if engine_versions.empty?
-          Dependabot.logger.info("No relevant (engines) info for \"#{name}\"")
-          return
-        end
+        return if engine_versions.empty?
 
         version = engine_versions[name]
         Dependabot.logger.info("Returned (engines) info \"#{name}\" : \"#{version}\"")

data/lib/dependabot/npm_and_yarn/update_checker/dependency_files_builder.rb

@@ -114,7 +114,7 @@ module Dependabot
           return false unless yarnrc_global_registry
 
           UpdateChecker::RegistryFinder::CENTRAL_REGISTRIES.none? do |r|
-            r.include?(URI(yarnrc_global_registry).host)
+            r.include?(T.must(URI(yarnrc_global_registry).host))
           end
         end
 

data/lib/dependabot/npm_and_yarn/version_selector.rb

@@ -17,16 +17,7 @@ module Dependabot
       def setup(manifest_json, name)
         engine_versions = manifest_json["engines"]
 
-        if engine_versions.nil?
-          Dependabot.logger.info("No info (engines) found")
-          return {}
-        end
-
-        # logs entries for analysis purposes
-        log = engine_versions.select do |engine, _value|
-          engine.to_s.match(name)
-        end
-        Dependabot.logger.info("Found engine info #{log}") unless log.empty?
+        return {} if engine_versions.nil?
 
         # Only keep matching specs versions i.e. "20.21.2", "7.1.2",
         # Additional specs can be added later

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.278.0
+  version: 0.280.0
 platform: ruby
 authors:
 - Dependabot
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-09-26 00:00:00.000000000 Z
+date: 2024-10-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.278.0
+        version: 0.280.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.278.0
+        version: 0.280.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -156,14 +156,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.1
+        version: 0.8.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.1
+        version: 0.8.5
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -346,8 +346,8 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.278.0
-post_install_message: 
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.280.0
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -363,7 +363,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 3.1.0
 requirements: []
 rubygems_version: 3.5.9
-signing_key: 
+signing_key:
 specification_version: 4
 summary: Provides Dependabot support for Javascript (npm and yarn)
 test_files: []