dependabot-npm_and_yarn 0.352.0 → 0.354.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c6afca8ada5497325cb00c5ceefe07285166dfceca0be4821277be0afd7e05c
-  data.tar.gz: ed8378f1770b7641f371ffe78e97e9b39a294d83a28abeb5230cb9cb80d88c46
+  metadata.gz: 98ce0e063f5bc785ca708abb36d56bc3e9784a22c6013d9040b84876fb0f2239
+  data.tar.gz: a17b204a222dc640eaa06d2de063aa14990a9465fd2acbc542799c1774383465
 SHA512:
-  metadata.gz: c33c39ec9aaab3e6b589207eb8988e3ffb9e1d836d9c201131af18e9f55e1e618701173f1578a05a220aeb3a2ba31b9009d79907d51756476cec2b98910d8c93
-  data.tar.gz: fa6846be31248911f026adc143fe33abfa84337e95d457b00d541ac73699606d57336e74ad3fd08fe1665c91d5d13e7ab069220b691fc2dc7815edf4eabb9815
+  metadata.gz: 757c17e2b92858a08e460876b4872c67287059e7a847de36255d67decccc86a4912b4d8179fddc9dc97c20cc6c55fbec294fc58ac5627205f573adc62fb597e5
+  data.tar.gz: 6410fef7a8f5bc85ee274ff4ad15210132f995bb015cd6d9621d39fb440c3306511866d80f56a3ec9ec8a10025d3b6723d3dd42228dd012269f796c44cd8f59b

data/helpers/test/npm/vulnerability-auditor.test.js

@@ -69,7 +69,7 @@ describe("findVulnerableDependencies", () => {
         top_level_ancestors: [
             "wireql-client"
           ],
-          target_version: "3.1.2"
+          target_version: "3.1.3"
         }
       ],
       top_level_ancestors: [

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -351,6 +351,7 @@ module Dependabot
       end
 
       # rubocop:disable Metrics/PerceivedComplexity
+      # rubocop:disable Metrics/MethodLength
       sig { params(fetched_files: T::Array[DependencyFile]).returns(T::Array[DependencyFile]) }
       def path_dependencies(fetched_files) # rubocop:disable Metrics/AbcSize
         package_json_files = T.let([], T::Array[DependencyFile])
@@ -381,6 +382,13 @@ module Dependabot
             next
           end
 
+          if dependency_ignored?(name)
+            Dependabot.logger.info(
+              "Ignored local path dependency '#{cleaned_name}' for package '#{name}' as it matches the ignore list."
+            )
+            next
+          end
+
           begin
             file = fetch_file_from_host(filename, fetch_submodules: true)
             package_json_files << file
@@ -400,6 +408,7 @@ module Dependabot
         package_json_files.tap { |fs| fs.each { |f| f.support_file = true } }
       end
       # rubocop:enable Metrics/PerceivedComplexity
+      # rubocop:enable Metrics/MethodLength
 
       sig { params(fetched_files: T::Array[DependencyFile]).returns(T::Array[[String, String]]) }
       def path_dependency_details(fetched_files)
@@ -683,7 +692,19 @@ module Dependabot
       def build_unfetchable_deps(unfetchable_deps)
         return [] unless package_lock || yarn_lock
 
-        unfetchable_deps.map do |name, path|
+        filtered_deps = unfetchable_deps.reject do |name, _path|
+          # Skip ignored dependencies
+          if dependency_ignored?(name)
+            Dependabot.logger.info(
+              "Ignored unfetchable path dependency '#{name}' as it matches the ignore list."
+            )
+            true
+          else
+            false
+          end
+        end
+
+        filtered_deps.map do |name, path|
           PathDependencyBuilder.new(
             dependency_name: name,
             path: path,

data/lib/dependabot/npm_and_yarn/registry_helper.rb

@@ -44,10 +44,10 @@ module Dependabot
           registry = registry_info[:registry]
           registry = "https://#{T.must(registry)}" unless T.must(registry).start_with?("http://", "https://")
           env_variables[COREPACK_NPM_REGISTRY_ENV] = registry
+          env_variables[REGISTRY_KEY] = registry
         end
 
-        # NOTE: We only set the registry, not the token
-        # The token should be configured in .npmrc for security
+        env_variables[COREPACK_NPM_TOKEN_ENV] = registry_info[:auth_token] if registry_info[:auth_token]
 
         env_variables
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.352.0
+  version: 0.354.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.352.0
+        version: 0.354.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.352.0
+        version: 0.354.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -361,7 +361,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.352.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.354.0
 rdoc_options: []
 require_paths:
 - lib