dependabot-npm_and_yarn 0.330.0 → 0.332.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ef525a97ffbd94e001f9f618e9dde64d697fb559df016101788694a58ee36fa1
-  data.tar.gz: b33e8268583d2aef788f944a93cc5a824b6bf0b2fa3b06d1250ed852d9d063e6
+  metadata.gz: 752dcfa198d045fc29e5dafd0496d2c796f7c9a8ff4916e0fc5deffe8e3574b8
+  data.tar.gz: ca0c56b6911e85fad52ceae0cbe98764bbd92745333cfb46d7602ee04c22099a
 SHA512:
-  metadata.gz: e8d1e49cc86b899143b64fec0611d0ed383833d58825eaa46d79be92690206027c2789d4a0d8af5d89028edc3005cc9e60919cc090b4e77a49571e1ee261675e
-  data.tar.gz: f160c66603ce809739ad481214c290b58d704861d5bd037177f00bb331f660b6e4c1119d25f1792951ff9da828d39e4eafb3f05e1cc7ea85e30e78fe8fff3d9a
+  metadata.gz: 9ab7e4c83fc107b5b80f38ec024e7a0dbd8b7d9de9ca2973614f2e9a418aad8549f97dcaa47c6ee13c9227d7d664aa3bec610f86488aaaaf895e5f32524ad1b7
+  data.tar.gz: 1d8e6fe55e6a2a0bbd1773806510cc6e35eaba8b2364f52e4f46ead217f0801b264e19159aada801b233bf2d9a3715a6ae4c0f51ba6ff95c3381d8be14f36b80

data/lib/dependabot/npm_and_yarn/file_parser/bun_lock.rb

@@ -40,6 +40,8 @@ module Dependabot
         def dependencies
           dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
+          origin_file = Pathname.new(@dependency_file.directory).join(@dependency_file.name).to_s
+
           # bun.lock v0 format:
           # https://github.com/oven-sh/bun/blob/c130df6c589fdf28f9f3c7f23ed9901140bc9349/src/install/bun.lock.zig#L595-L605
 
@@ -62,7 +64,8 @@ module Dependabot
               name: name,
               version: semver.to_s,
               package_manager: "npm_and_yarn",
-              requirements: []
+              requirements: [],
+              origin_files: [origin_file]
             )
           end
 

data/lib/dependabot/npm_and_yarn/file_parser/json_lock.rb

@@ -15,9 +15,6 @@ module Dependabot
         sig { params(dependency_file: DependencyFile).void }
         def initialize(dependency_file)
           @dependency_file = dependency_file
-          # Set this file to priority 1 to indicate it should override manifests for purposes of a graph
-          dependency_file.priority = 1
-          @direct_dependencies = T.let(fetch_direct_dependencies, T::Array[String])
         end
 
         sig { returns(T::Hash[String, T.untyped]) }
@@ -51,31 +48,6 @@ module Dependabot
 
         private
 
-        # Only V3 lockfiles contain information on the package itself, so we use `npm ls` to generate
-        # a graph we can pluck the direct dependency list from at parse-time for this lockfile.
-        sig { returns(T::Array[String]) }
-        def fetch_direct_dependencies
-          # TODO(brrygrdn): Implement a 'verbose' flag that runs this extra step?
-          #
-          # For now, don't run this extra native command if we aren't using the submission experiment
-          return [] unless Dependabot::Experiments.enabled?(:enable_dependency_submission_poc)
-
-          SharedHelpers.in_a_temporary_repo_directory do |_|
-            write_temporary_dependency_files
-
-            npm_ls_json = Helpers.run_npm_command("ls --all --package-lock-only --json")
-
-            JSON.parse(npm_ls_json).fetch("dependencies", {}).keys
-          end
-        end
-
-        sig { void }
-        def write_temporary_dependency_files
-          path = @dependency_file.name
-          FileUtils.mkdir_p(Pathname.new(path).dirname)
-          File.write(path, @dependency_file.content)
-        end
-
         sig do
           params(object_with_dependencies: T::Hash[String, T.untyped])
             .returns(Dependabot::FileParsers::Base::DependencySet)
@@ -95,15 +67,17 @@ module Dependabot
             package_name = name.split("node_modules/").last
             version = version.to_s
 
+            origin_file = Pathname.new(@dependency_file.directory).join(@dependency_file.name).to_s
+
             dependency_args = {
               name: package_name,
               version: version,
               package_manager: "npm_and_yarn",
               requirements: [],
-              direct_relationship: @direct_dependencies.include?(package_name),
               metadata: {
                 depends_on: details&.fetch("dependencies", {})&.keys || []
-              }
+              },
+              origin_files: [origin_file]
             }
 
             if details["bundled"]
@@ -120,7 +94,6 @@ module Dependabot
             dependency_set += recursively_fetch_dependencies(details)
           end
 
-          @dependency_file.dependencies = dependency_set.dependencies.to_set
           dependency_set
         end
 

data/lib/dependabot/npm_and_yarn/file_parser/pnpm_lock.rb

@@ -75,6 +75,8 @@ module Dependabot
             end
           end
 
+          origin_file = Pathname.new(@dependency_file.directory).join(@dependency_file.name).to_s
+
           # Add prioritized dependencies to the dependency set.
           dependencies_with_specifiers.each do |dependency_args|
             dependency_set << Dependency.new(
@@ -82,7 +84,8 @@ module Dependabot
               version: dependency_args[:version],
               package_manager: dependency_args[:package_manager],
               requirements: dependency_args[:requirements],
-              subdependency_metadata: dependency_args[:subdependency_metadata]
+              subdependency_metadata: dependency_args[:subdependency_metadata],
+              origin_files: [origin_file]
             )
           end
 
@@ -92,7 +95,8 @@ module Dependabot
               version: dependency_args[:version],
               package_manager: dependency_args[:package_manager],
               requirements: dependency_args[:requirements],
-              subdependency_metadata: dependency_args[:subdependency_metadata]
+              subdependency_metadata: dependency_args[:subdependency_metadata],
+              origin_files: [origin_file]
             )
           end
 

data/lib/dependabot/npm_and_yarn/file_parser/yarn_lock.rb

@@ -46,6 +46,8 @@ module Dependabot
         def dependencies
           dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
+          origin_file = Pathname.new(@dependency_file.directory).join(@dependency_file.name).to_s
+
           parsed.each do |reqs, details|
             reqs.split(", ").each do |req|
               version = Version.semver_for(details["version"])
@@ -58,7 +60,8 @@ module Dependabot
                 name: T.must(req.split(/(?<=\w)\@/).first),
                 version: version.to_s,
                 package_manager: "npm_and_yarn",
-                requirements: []
+                requirements: [],
+                origin_files: [origin_file]
               )
             end
           end

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -226,10 +226,7 @@ module Dependabot
             dep = build_dependency(
               file: file, type: type, name: name, requirement: requirement
             )
-            if dep
-              file.dependencies << dep
-              dependency_set << dep
-            end
+            dependency_set << dep if dep
           end
         end
 
@@ -302,6 +299,8 @@ module Dependabot
         # Example: "my-fetch-factory@npm:fetch-factory"
         return if aliased_package_name?(name)
 
+        origin_file = Pathname.new(file.directory).join(file.name).to_s
+
         Dependency.new(
           name: name,
           version: converted_version,
@@ -311,7 +310,8 @@ module Dependabot
             file: file.name,
             groups: [type],
             source: source_for(name, requirement, lockfile_details)
-          }]
+          }],
+          origin_files: [origin_file]
         )
       end
 

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -207,7 +207,8 @@ module Dependabot
               version: d.previous_version,
               previous_version: d.previous_version,
               requirements: T.must(d.previous_requirements),
-              previous_requirements: d.previous_requirements
+              previous_requirements: d.previous_requirements,
+              origin_files: d.origin_files
             )
           end
 
@@ -218,7 +219,8 @@ module Dependabot
               version: d.previous_version,
               previous_version: d.previous_version,
               requirements: [],
-              previous_requirements: []
+              previous_requirements: [],
+              origin_files: d.origin_files
             )
           end
 

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -31,6 +31,7 @@ module Dependabot
           requirements_update_strategy: T.nilable(Dependabot::RequirementsUpdateStrategy),
           dependency_group: T.nilable(Dependabot::DependencyGroup),
           update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
+          exclude_paths: T.nilable(T::Array[String]),
           options: T::Hash[Symbol, T.untyped]
         )
           .void
@@ -39,7 +40,7 @@ module Dependabot
                      repo_contents_path: nil, ignored_versions: [],
                      raise_on_ignored: false, security_advisories: [],
                      requirements_update_strategy: nil, dependency_group: nil,
-                     update_cooldown: nil, options: {})
+                     update_cooldown: nil, exclude_paths: [], options: {})
         @latest_version = T.let(nil, T.nilable(T.any(String, Gem::Version)))
         @latest_resolvable_version = T.let(nil, T.nilable(T.any(String, Dependabot::Version)))
         @updated_requirements = T.let(nil, T.nilable(T::Array[T::Hash[Symbol, T.untyped]]))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.330.0
+  version: 0.332.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.330.0
+        version: 0.332.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.330.0
+        version: 0.332.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -362,7 +362,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.330.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.332.0
 rdoc_options: []
 require_paths:
 - lib