dependabot-npm_and_yarn 0.305.0 → 0.308.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29f8a6417f34cb02e78ced5b82afc2a542a47544d5aa37d363e588567c843b23
-  data.tar.gz: ff7f7d7c8715850f1a65e2ca66c81e03dca0e9ed741f5908dc6e0a2e951f9140
+  metadata.gz: 38e3ede894c344c07233f9f1e893ef8f9d497944c8311302ded6f1c096460fe4
+  data.tar.gz: fb4fc3782548f557b7b7567c6a2d427cd681963277a8e42bc237eac6bdaea9da
 SHA512:
-  metadata.gz: d17166b9cb9fd4e320dbf0d70ad3c134d5b2872a7600eabc38c64db6f78284a1b6ad60fe799ad33f09073f8d0aa1e5186ce8e88cad89759ef666b02cd7f05247
-  data.tar.gz: e10961478b7b3e7e45b06f8f8f1238cea5f7a2775a655b270a0e489fa2d1cf1ad5cf121c2c9e0a5e77a874d167217f17d32623f9fcd643e3554178b417d98511
+  metadata.gz: 54d52371f3ef36d9bf09438f60eac3ccb69bba24d71fd4768f7b265f99c761d3d468ab67d4373d8339646425c2d82e01634ae9bad104ebd24eceb8038b60f315
+  data.tar.gz: b06bda3f35dc5a3eb9dccd1651b6ff2cb54b2bce11f84220a5085923fa21f1a96eeb90756b56a2eba6f1f029bd8a8b2037e35a0b7e3dfbd3e990a432b3a7a827

data/helpers/package-lock.json

@@ -22,7 +22,7 @@
       },
       "devDependencies": {
         "eslint": "^9.22.0",
-        "eslint-config-prettier": "^9.1.0",
+        "eslint-config-prettier": "^10.1.1",
         "jest": "^29.7.0",
         "prettier": "^3.5.3"
       }
@@ -4675,10 +4675,11 @@
       }
     },
     "node_modules/eslint-config-prettier": {
-      "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-9.1.0.tgz",
-      "integrity": "sha512-NSWl5BFQWEPi1j4TjVNItzYV7dZXZ+wP6I6ZhrBGpChQhZRUaElihE9uRRkcbRnNb76UMKDF3r+WTmNcGPKsqw==",
+      "version": "10.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-10.1.1.tgz",
+      "integrity": "sha512-4EQQr6wXwS+ZJSzaR5ZCrYgLxqvUjdXctaEtBqHcbkW944B1NQyO4qpdHQbXBONfwxXdkAY81HH4+LUfrg+zPw==",
       "dev": true,
+      "license": "MIT",
       "bin": {
         "eslint-config-prettier": "bin/cli.js"
       },
@@ -19960,9 +19961,9 @@
       }
     },
     "eslint-config-prettier": {
-      "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-9.1.0.tgz",
-      "integrity": "sha512-NSWl5BFQWEPi1j4TjVNItzYV7dZXZ+wP6I6ZhrBGpChQhZRUaElihE9uRRkcbRnNb76UMKDF3r+WTmNcGPKsqw==",
+      "version": "10.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-10.1.1.tgz",
+      "integrity": "sha512-4EQQr6wXwS+ZJSzaR5ZCrYgLxqvUjdXctaEtBqHcbkW944B1NQyO4qpdHQbXBONfwxXdkAY81HH4+LUfrg+zPw==",
       "dev": true,
       "requires": {}
     },

data/helpers/package.json

@@ -22,7 +22,7 @@
   },
   "devDependencies": {
     "eslint": "^9.22.0",
-    "eslint-config-prettier": "^9.1.0",
+    "eslint-config-prettier": "^10.1.1",
     "jest": "^29.7.0",
     "prettier": "^3.5.3"
   }

data/lib/dependabot/npm_and_yarn/package/registry_finder.rb

@@ -221,7 +221,12 @@ module Dependabot
               registries = []
               registries += credentials
                             .select { |cred| cred["type"] == "npm_registry" && cred["registry"] }
-                            .tap { |arr| arr.each { |c| c["token"] ||= nil } }
+                            .tap do |arr|
+                              arr.each do |c|
+                                c["registry"] = prepare_registry_url(c["registry"])
+                                c["token"] ||= nil
+                              end
+                            end
               registries += npmrc_registries
               registries += yarnrc_registries
 
@@ -238,12 +243,12 @@ module Dependabot
           npmrc_file&.content&.scan(NPM_AUTH_TOKEN_REGEX) do
             next if Regexp.last_match&.[](:registry)&.include?("${")
 
-            registry = T.must(Regexp.last_match)[:registry]
+            registry = prepare_registry_url(T.must(Regexp.last_match)[:registry])
             token = T.must(Regexp.last_match)[:token]&.strip
 
             registries << {
               "type" => "npm_registry",
-              "registry" => registry&.gsub(/\s+/, "%20"),
+              "registry" => registry,
               "token" => token
             }
           end
@@ -291,14 +296,14 @@ module Dependabot
           return @configured_global_registry if @configured_global_registry
 
           if parsed_yarnrc_yml&.key?("npmRegistryServer")
-            return @configured_global_registry = T.must(parsed_yarnrc_yml)["npmRegistryServer"]
+            return @configured_global_registry = prepare_registry_url(T.must(parsed_yarnrc_yml)["npmRegistryServer"])
           end
 
           replaces_base = credentials.find { |cred| cred["type"] == "npm_registry" && cred.replaces_base? }
           if replaces_base
             registry = replaces_base["registry"]
             registry = "https://#{registry}" unless registry&.start_with?("http")
-            return @configured_global_registry = registry
+            return @configured_global_registry = prepare_registry_url(registry)
           end
 
           @configured_global_registry = nil
@@ -323,7 +328,7 @@ module Dependabot
 
           if parsed_yarnrc_yml
             yarn_berry_registry = parsed_yarnrc_yml&.dig("npmScopes", scope.delete_prefix("@"), "npmRegistryServer")
-            return yarn_berry_registry if yarn_berry_registry
+            return prepare_registry_url(yarn_berry_registry) if yarn_berry_registry
           end
 
           nil
@@ -341,7 +346,7 @@ module Dependabot
           file&.content&.scan(syntax) do
             next if Regexp.last_match&.[](:registry)&.include?("${")
 
-            url = T.must(T.must(Regexp.last_match)[:registry]).strip
+            url = T.must(prepare_registry_url(T.must(T.must(Regexp.last_match)[:registry])))
             registry = normalize_configured_registry(url)
             registries << {
               "type" => "npm_registry",
@@ -365,7 +370,7 @@ module Dependabot
           file&.content.to_s.scan(syntax) do
             next if Regexp.last_match&.[](:registry)&.include?("${") || Regexp.last_match&.[](:scope) != scope
 
-            return T.must(T.must(Regexp.last_match)[:registry]).strip
+            return prepare_registry_url(T.must(T.must(Regexp.last_match)[:registry]))
           end
 
           nil
@@ -388,7 +393,9 @@ module Dependabot
                               &.map { |r| r.fetch(:source) }&.uniq&.compact
                               &.sort_by { |source| self.class.central_registry?(source[:url]) ? 1 : 0 }
 
-          sources&.find { |s| s[:type] == "registry" }&.fetch(:url)
+          sources&.find { |s| s[:type] == "registry" }
+                 &.fetch(:url)
+                 &.then { |url| prepare_registry_url(url) }
         end
 
         sig { returns(T.nilable(T::Hash[String, T.untyped])) }
@@ -405,7 +412,12 @@ module Dependabot
         def normalize_configured_registry(url)
           url.sub(%r{/+$}, "")
              .sub(%r{^.*?//}, "")
-             .gsub(/\s+/, "%20")
+        end
+
+        sig { params(url: T.nilable(String)).returns(T.nilable(String)) }
+        def prepare_registry_url(url)
+          url&.strip
+             &.gsub(/\s+/, "%20")
         end
       end
     end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.305.0
+  version: 0.308.0
 platform: ruby
 authors:
 - Dependabot
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-04-06 00:00:00.000000000 Z
+date: 2025-04-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.305.0
+        version: 0.308.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.305.0
+        version: 0.308.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -357,8 +356,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.305.0
-post_install_message:
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.308.0
 rdoc_options: []
 require_paths:
 - lib
@@ -373,8 +371,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.1.0
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 3.6.3
 specification_version: 4
 summary: Provides Dependabot support for Javascript (npm and yarn)
 test_files: []