dependabot-npm_and_yarn 0.93.1 → 0.93.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/helpers/npm/lib/updater.js +57 -0
- data/helpers/package.json +1 -1
- data/helpers/yarn.lock +729 -705
- data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb +1 -29
- metadata +4 -4
|
@@ -403,30 +403,6 @@ module Dependabot
|
|
|
403
403
|
@git_dependencies_to_lock
|
|
404
404
|
end
|
|
405
405
|
|
|
406
|
-
# Note: NPM 6.6.0 started failing when a sub-dependency has a "from"
|
|
407
|
-
# field that includes the dependency name
|
|
408
|
-
#
|
|
409
|
-
# Example invalid from: "from": "bignumber.js@git+https://gi...
|
|
410
|
-
def remove_invalid_from_lines(npm_lockfile)
|
|
411
|
-
return npm_lockfile unless npm_lockfile.key?("dependencies")
|
|
412
|
-
|
|
413
|
-
dependencies =
|
|
414
|
-
npm_lockfile["dependencies"].
|
|
415
|
-
map do |k, v|
|
|
416
|
-
value =
|
|
417
|
-
if v["from"].to_s.start_with?("#{k}@")
|
|
418
|
-
v.dup.tap do |hash|
|
|
419
|
-
hash["from"] = hash["from"].gsub(/^#{Regexp.quote(k)}@/, "")
|
|
420
|
-
end
|
|
421
|
-
else v
|
|
422
|
-
end
|
|
423
|
-
|
|
424
|
-
[k, remove_invalid_from_lines(value)]
|
|
425
|
-
end.to_h
|
|
426
|
-
|
|
427
|
-
npm_lockfile.merge("dependencies" => dependencies)
|
|
428
|
-
end
|
|
429
|
-
|
|
430
406
|
def replace_ssh_sources(content)
|
|
431
407
|
updated_content = content
|
|
432
408
|
|
|
@@ -458,11 +434,7 @@ module Dependabot
|
|
|
458
434
|
end
|
|
459
435
|
|
|
460
436
|
def prepared_npm_lockfile_content(content)
|
|
461
|
-
|
|
462
|
-
JSON.dump(remove_dependency_from_npm_lockfile(JSON.parse(content)))
|
|
463
|
-
updated_content =
|
|
464
|
-
JSON.dump(remove_invalid_from_lines(JSON.parse(updated_content)))
|
|
465
|
-
updated_content
|
|
437
|
+
JSON.dump(remove_dependency_from_npm_lockfile(JSON.parse(content)))
|
|
466
438
|
end
|
|
467
439
|
|
|
468
440
|
# Duplicated in SubdependencyVersionResolver
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: dependabot-npm_and_yarn
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.93.
|
|
4
|
+
version: 0.93.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Dependabot
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2019-01-
|
|
11
|
+
date: 2019-01-26 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: dependabot-core
|
|
@@ -16,14 +16,14 @@ dependencies:
|
|
|
16
16
|
requirements:
|
|
17
17
|
- - '='
|
|
18
18
|
- !ruby/object:Gem::Version
|
|
19
|
-
version: 0.93.
|
|
19
|
+
version: 0.93.2
|
|
20
20
|
type: :runtime
|
|
21
21
|
prerelease: false
|
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
|
23
23
|
requirements:
|
|
24
24
|
- - '='
|
|
25
25
|
- !ruby/object:Gem::Version
|
|
26
|
-
version: 0.93.
|
|
26
|
+
version: 0.93.2
|
|
27
27
|
- !ruby/object:Gem::Dependency
|
|
28
28
|
name: byebug
|
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|