dependabot-npm_and_yarn 0.95.34 → 0.95.35

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 74643b3d4abfbba5f5d8a78a0f13dae2a65fd190564325c138ae1ee0e9807d02
-  data.tar.gz: ab79d1130f72465c8952001c7e0d7800162ab4710d0a0e59616d60771de8d9d0
+  metadata.gz: 420d0f2935efdd79685512dd3cbee90f7ce1960d98d82553e8da75647a0ece13
+  data.tar.gz: 313ec1dc3add3b2b25a015256d148301ef12d4203c8fbbaed4dcb8eeeeb97af5
 SHA512:
-  metadata.gz: aa6099cb99a700715169c8a04b3b491aa5b416e996338df94a1d0aff365602238cc957a29d2947166617e5182c0ac60185c6cb1879a2ae9825d65cd943d3fb43
-  data.tar.gz: f7dda297d8365ea72edbcb90c64d5b42610acdc397a9755ff43551285894a133bcdd467956b49b4dfeae7d3badf671d2f370e1719db4ab5b90a3f770e8b4f1f3
+  metadata.gz: f48842decfda956264784ed726a3192a4f5f1cbe885bb5b7ba25a5d9c0c060ab398c782dd45601caddb502dd961fd17419b51156d83f5c4291ca0dfa778ce356
+  data.tar.gz: 5ed6c038201025acb36c8fae331f8f6db0cbddb5eabdf65f1b938e67430a2857847ab3a6f9187ddd83a75abcbd53287d925ae5278c0a1bed8f01c25a697b5486

data/lib/dependabot/npm_and_yarn/dependency_files_filterer.rb

@@ -2,15 +2,18 @@
 
 require "dependabot/utils"
 
+# Used in the version resolver and file updater to only run yarn/npm helpers on
+# dependency files that require updates. This is useful for large monorepos with
+# lots of sub-projects that don't all have the same dependencies.
 module Dependabot
   module NpmAndYarn
     class DependencyFilesFilterer
-      def initialize(dependency_files:, dependencies:)
-        @dependencies = dependencies
+      def initialize(dependency_files:, updated_dependencies:)
         @dependency_files = dependency_files
+        @updated_dependencies = updated_dependencies
       end
 
-      def filtered_files
+      def files_requiring_update
         dependency_files.select do |file|
           if manifest?(file)
             package_manifests.include?(file)
@@ -26,21 +29,17 @@ module Dependabot
         end
       end
 
-      def filtered_package_files
-        filtered_files.select { |f| manifest?(f) }
-      end
-
-      def filtered_lockfiles
-        filtered_files.select { |f| lockfile?(f) }
+      def package_files_requiring_update
+        files_requiring_update.select { |file| manifest?(file) }
       end
 
       private
 
-      attr_reader :dependency_files, :dependencies
+      attr_reader :dependency_files, :updated_dependencies
 
       def dependency_manifest_requirements
         @dependency_manifest_requirements ||=
-          dependencies.flat_map do |dep|
+          updated_dependencies.flat_map do |dep|
             dep.requirements.map { |requirement| requirement[:file] }
           end
       end

data/lib/dependabot/npm_and_yarn/file_updater.rb

@@ -3,6 +3,7 @@
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/npm_and_yarn/dependency_files_filterer"
+require "dependabot/npm_and_yarn/sub_dependency_files_filterer"
 
 module Dependabot
   module NpmAndYarn
@@ -59,10 +60,19 @@ module Dependabot
 
       def filtered_dependency_files
         @filtered_dependency_files ||=
-          DependencyFilesFilterer.new(
-            dependency_files: dependency_files,
-            dependencies: dependencies
-          ).filtered_files
+          begin
+            if dependencies.select(&:top_level?).any?
+              DependencyFilesFilterer.new(
+                dependency_files: dependency_files,
+                updated_dependencies: dependencies
+              ).files_requiring_update
+            else
+              SubDependencyFilesFilterer.new(
+                dependency_files: dependency_files,
+                updated_dependencies: dependencies
+              ).files_requiring_update
+            end
+          end
       end
 
       def check_required_files

data/lib/dependabot/npm_and_yarn/sub_dependency_files_filterer.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "dependabot/utils"
+require "dependabot/dependency_file"
+require "dependabot/npm_and_yarn/file_parser"
+require "dependabot/npm_and_yarn/version"
+
+# Used in the sub dependency version resolver and file updater to only run
+# yarn/npm helpers on dependency files that require updates. This is useful for
+# large monorepos with lots of sub-projects that don't all have the same
+# dependencies.
+module Dependabot
+  module NpmAndYarn
+    class SubDependencyFilesFilterer
+      def initialize(dependency_files:, updated_dependencies:)
+        @dependency_files = dependency_files
+        @updated_dependencies = updated_dependencies
+      end
+
+      def files_requiring_update
+        lockfiles.select do |lockfile|
+          sub_dependencies(lockfile).any? do |sub_dep|
+            updated_dependencies.any? do |updated_dep|
+              next false unless sub_dep.name == updated_dep.name
+
+              version_class.new(updated_dep.version) >
+                version_class.new(sub_dep.version)
+            end
+          end
+        end
+      end
+
+      private
+
+      attr_reader :dependency_files, :updated_dependencies
+
+      def sub_dependencies(lockfile)
+        # Add dummy_package_manifest to keep existing validation login in base
+        # file parser
+        NpmAndYarn::FileParser.new(
+          dependency_files: [dummy_package_manifest, lockfile],
+          source: nil,
+          credentials: [] # Credentials are only needed for top level deps
+        ).parse
+      end
+
+      def lockfiles
+        @lockfiles ||= dependency_files.select { |file| lockfile?(file) }
+      end
+
+      def dummy_package_manifest
+        @dummy_package_manifest ||= Dependabot::DependencyFile.new(
+          content: "{}",
+          name: "package.json"
+        )
+      end
+
+      def lockfile?(file)
+        file.name.end_with?(
+          "package-lock.json",
+          "yarn.lock",
+          "npm-shrinkwrap.json"
+        )
+      end
+
+      def version_class
+        NpmAndYarn::Version
+      end
+    end
+  end
+end

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -195,7 +195,8 @@ module Dependabot
             dependency: dependency,
             credentials: credentials,
             dependency_files: dependency_files,
-            ignored_versions: ignored_versions
+            ignored_versions: ignored_versions,
+            latest_allowable_version: latest_version
           )
       end
 

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -1,24 +1,27 @@
 # frozen_string_literal: true
 
+require "dependabot/dependency"
+require "dependabot/shared_helpers"
+require "dependabot/errors"
 require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/npm_and_yarn/file_parser"
 require "dependabot/npm_and_yarn/version"
 require "dependabot/npm_and_yarn/native_helpers"
-require "dependabot/shared_helpers"
-require "dependabot/errors"
 require "dependabot/npm_and_yarn/file_updater/npmrc_builder"
 require "dependabot/npm_and_yarn/file_updater/package_json_preparer"
+require "dependabot/npm_and_yarn/sub_dependency_files_filterer"
 
 module Dependabot
   module NpmAndYarn
     class UpdateChecker
       class SubdependencyVersionResolver
         def initialize(dependency:, credentials:, dependency_files:,
-                       ignored_versions:)
-          @dependency       = dependency
-          @credentials      = credentials
+                       ignored_versions:, latest_allowable_version:)
+          @dependency = dependency
+          @credentials = credentials
           @dependency_files = dependency_files
           @ignored_versions = ignored_versions
+          @latest_allowable_version = latest_allowable_version
         end
 
         def latest_resolvable_version
@@ -27,7 +30,7 @@ module Dependabot
           SharedHelpers.in_a_temporary_directory do
             write_temporary_dependency_files
 
-            updated_lockfiles = lockfiles.map do |lockfile|
+            updated_lockfiles = filtered_lockfiles.map do |lockfile|
               updated_content = update_subdependency_in_lockfile(lockfile)
               updated_lockfile = lockfile.dup
               updated_lockfile.content = updated_content
@@ -46,7 +49,7 @@ module Dependabot
         private
 
         attr_reader :dependency, :credentials, :dependency_files,
-                    :ignored_versions
+                    :ignored_versions, :latest_allowable_version
 
         def update_subdependency_in_lockfile(lockfile)
           lockfile_name = Pathname.new(lockfile.name).basename.to_s
@@ -208,6 +211,24 @@ module Dependabot
           [*package_locks, *shrinkwraps, *yarn_locks]
         end
 
+        def filtered_lockfiles
+          @filtered_lockfiles ||=
+            SubDependencyFilesFilterer.new(
+              dependency_files: dependency_files,
+              updated_dependencies: [updated_dependency]
+            ).files_requiring_update
+        end
+
+        def updated_dependency
+          Dependabot::Dependency.new(
+            name: dependency.name,
+            version: latest_allowable_version,
+            previous_version: dependency.version,
+            requirements: [],
+            package_manager: dependency.package_manager
+          )
+        end
+
         def package_files
           @package_files ||=
             dependency_files.

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -468,8 +468,8 @@ module Dependabot
           @filtered_package_files ||=
             DependencyFilesFilterer.new(
               dependency_files: dependency_files,
-              dependencies: [dependency]
-            ).filtered_package_files
+              updated_dependencies: [dependency]
+            ).package_files_requiring_update
         end
 
         def yarn_helper_path

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.95.34
+  version: 0.95.35
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-02-17 00:00:00.000000000 Z
+date: 2019-02-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.34
+        version: 0.95.35
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.34
+        version: 0.95.35
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -193,6 +193,7 @@ files:
 - lib/dependabot/npm_and_yarn/metadata_finder.rb
 - lib/dependabot/npm_and_yarn/native_helpers.rb
 - lib/dependabot/npm_and_yarn/requirement.rb
+- lib/dependabot/npm_and_yarn/sub_dependency_files_filterer.rb
 - lib/dependabot/npm_and_yarn/update_checker.rb
 - lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb
 - lib/dependabot/npm_and_yarn/update_checker/library_detector.rb