dependabot-npm_and_yarn 0.330.0 → 0.331.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ef525a97ffbd94e001f9f618e9dde64d697fb559df016101788694a58ee36fa1
-  data.tar.gz: b33e8268583d2aef788f944a93cc5a824b6bf0b2fa3b06d1250ed852d9d063e6
+  metadata.gz: 3ead6dbe56920db49b2451679cdb66303af4c2968b7d61d37faf04ac9b0623a4
+  data.tar.gz: fe8c3c14c55c99ad445105f89f54b5b6a8bd322661ba2bf64c36567d992fa4a0
 SHA512:
-  metadata.gz: e8d1e49cc86b899143b64fec0611d0ed383833d58825eaa46d79be92690206027c2789d4a0d8af5d89028edc3005cc9e60919cc090b4e77a49571e1ee261675e
-  data.tar.gz: f160c66603ce809739ad481214c290b58d704861d5bd037177f00bb331f660b6e4c1119d25f1792951ff9da828d39e4eafb3f05e1cc7ea85e30e78fe8fff3d9a
+  metadata.gz: a4e7fae1ef42c26ba9327815a93d1850e27dd17ef9d8a26eb85ac932ec817b6f14ce8312456cd024a07c63770fdfd4465e4eeae9628c7b167211c7fa7d65d778
+  data.tar.gz: b92350117f5b5059b36a2a96c0da36e2e0d4d45c5ebaa8fe3698b69b17007ad4968a71e0f87a79eff1251b1ee80dc80836c97a7c71ee93c11aa0c0fd5004fee3

data/lib/dependabot/npm_and_yarn/file_parser/bun_lock.rb

@@ -40,6 +40,8 @@ module Dependabot
         def dependencies
           dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
+          origin_file = Pathname.new(@dependency_file.directory).join(@dependency_file.name).to_s
+
           # bun.lock v0 format:
           # https://github.com/oven-sh/bun/blob/c130df6c589fdf28f9f3c7f23ed9901140bc9349/src/install/bun.lock.zig#L595-L605
 
@@ -62,7 +64,8 @@ module Dependabot
               name: name,
               version: semver.to_s,
               package_manager: "npm_and_yarn",
-              requirements: []
+              requirements: [],
+              origin_files: [origin_file]
             )
           end
 

data/lib/dependabot/npm_and_yarn/file_parser/json_lock.rb

@@ -80,7 +80,7 @@ module Dependabot
           params(object_with_dependencies: T::Hash[String, T.untyped])
             .returns(Dependabot::FileParsers::Base::DependencySet)
         end
-        def recursively_fetch_dependencies(object_with_dependencies)
+        def recursively_fetch_dependencies(object_with_dependencies) # rubocop:disable Metrics/AbcSize
           dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
           dependencies = object_with_dependencies["dependencies"]
@@ -95,6 +95,8 @@ module Dependabot
             package_name = name.split("node_modules/").last
             version = version.to_s
 
+            origin_file = Pathname.new(@dependency_file.directory).join(@dependency_file.name).to_s
+
             dependency_args = {
               name: package_name,
               version: version,
@@ -103,7 +105,8 @@ module Dependabot
               direct_relationship: @direct_dependencies.include?(package_name),
               metadata: {
                 depends_on: details&.fetch("dependencies", {})&.keys || []
-              }
+              },
+              origin_files: [origin_file]
             }
 
             if details["bundled"]

data/lib/dependabot/npm_and_yarn/file_parser/pnpm_lock.rb

@@ -75,6 +75,8 @@ module Dependabot
             end
           end
 
+          origin_file = Pathname.new(@dependency_file.directory).join(@dependency_file.name).to_s
+
           # Add prioritized dependencies to the dependency set.
           dependencies_with_specifiers.each do |dependency_args|
             dependency_set << Dependency.new(
@@ -82,7 +84,8 @@ module Dependabot
               version: dependency_args[:version],
               package_manager: dependency_args[:package_manager],
               requirements: dependency_args[:requirements],
-              subdependency_metadata: dependency_args[:subdependency_metadata]
+              subdependency_metadata: dependency_args[:subdependency_metadata],
+              origin_files: [origin_file]
             )
           end
 
@@ -92,7 +95,8 @@ module Dependabot
               version: dependency_args[:version],
               package_manager: dependency_args[:package_manager],
               requirements: dependency_args[:requirements],
-              subdependency_metadata: dependency_args[:subdependency_metadata]
+              subdependency_metadata: dependency_args[:subdependency_metadata],
+              origin_files: [origin_file]
             )
           end
 

data/lib/dependabot/npm_and_yarn/file_parser/yarn_lock.rb

@@ -46,6 +46,8 @@ module Dependabot
         def dependencies
           dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
+          origin_file = Pathname.new(@dependency_file.directory).join(@dependency_file.name).to_s
+
           parsed.each do |reqs, details|
             reqs.split(", ").each do |req|
               version = Version.semver_for(details["version"])
@@ -58,7 +60,8 @@ module Dependabot
                 name: T.must(req.split(/(?<=\w)\@/).first),
                 version: version.to_s,
                 package_manager: "npm_and_yarn",
-                requirements: []
+                requirements: [],
+                origin_files: [origin_file]
               )
             end
           end

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -302,6 +302,8 @@ module Dependabot
         # Example: "my-fetch-factory@npm:fetch-factory"
         return if aliased_package_name?(name)
 
+        origin_file = Pathname.new(file.directory).join(file.name).to_s
+
         Dependency.new(
           name: name,
           version: converted_version,
@@ -311,7 +313,8 @@ module Dependabot
             file: file.name,
             groups: [type],
             source: source_for(name, requirement, lockfile_details)
-          }]
+          }],
+          origin_files: [origin_file]
         )
       end
 

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -207,7 +207,8 @@ module Dependabot
               version: d.previous_version,
               previous_version: d.previous_version,
               requirements: T.must(d.previous_requirements),
-              previous_requirements: d.previous_requirements
+              previous_requirements: d.previous_requirements,
+              origin_files: d.origin_files
             )
           end
 
@@ -218,7 +219,8 @@ module Dependabot
               version: d.previous_version,
               previous_version: d.previous_version,
               requirements: [],
-              previous_requirements: []
+              previous_requirements: [],
+              origin_files: d.origin_files
             )
           end
 

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -31,6 +31,7 @@ module Dependabot
           requirements_update_strategy: T.nilable(Dependabot::RequirementsUpdateStrategy),
           dependency_group: T.nilable(Dependabot::DependencyGroup),
           update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
+          exclude_paths: T.nilable(T::Array[String]),
           options: T::Hash[Symbol, T.untyped]
         )
           .void
@@ -39,7 +40,7 @@ module Dependabot
                      repo_contents_path: nil, ignored_versions: [],
                      raise_on_ignored: false, security_advisories: [],
                      requirements_update_strategy: nil, dependency_group: nil,
-                     update_cooldown: nil, options: {})
+                     update_cooldown: nil, exclude_paths: [], options: {})
         @latest_version = T.let(nil, T.nilable(T.any(String, Gem::Version)))
         @latest_resolvable_version = T.let(nil, T.nilable(T.any(String, Dependabot::Version)))
         @updated_requirements = T.let(nil, T.nilable(T::Array[T::Hash[Symbol, T.untyped]]))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.330.0
+  version: 0.331.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.330.0
+        version: 0.331.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.330.0
+        version: 0.331.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -362,7 +362,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.330.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.331.0
 rdoc_options: []
 require_paths:
 - lib