dependabot-npm_and_yarn 0.95.82 → 0.95.83

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6c04fb2ba7f2632dc8159cf2be99f24d4f949a7a8dfbc6738d551cc2c2b6020f
-  data.tar.gz: c04b1c58c497c4b4a28b3de57325d589d73a8be3db5283ce7c2d01945d66822c
+  metadata.gz: a872d462e943cd40480ea3242735c9cc9a95cc833050d30922d7dd5c5b3fe8af
+  data.tar.gz: e37c32ae14918bfd96a7a29d032dcf9e1732f6d2be6dd730554d0bf2f843103f
 SHA512:
-  metadata.gz: 80211607d26b0716d20d8139507facfbcd30dee333b929c3161c9693b58e457b02befdcd551815a51505389b17b7ddbab964d4912715c62ec7026820f0d4880e
-  data.tar.gz: a3140e211477be1ab3e83cd22fec142efc6e5ae4b1182fa621cb6b5751a963c359ee3fb7425a7063f30bc495dc7af19a9c3a60a1fc3f6be8ab5bf0ae149fe0c0
+  metadata.gz: 443f6b6fb7053a54d9a434c4dbfc7d26f4feca3cf0a8e293c66e17a1e81742a3660b4ac3cceeb1194c88ab07fa7546ff15afe82fb9fe67046ff277dd5f1f4c5f
+  data.tar.gz: 60b7d6668ec95bb4dcc40d015ba91c889fa4f0dd6bf742e4b7fe0487627e7acfe499288b3d039fe8a059ee55d03c412340eaf25b3a9b657ee0e6e2b44a5a1277

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -8,6 +8,8 @@ require "dependabot/file_parsers/base"
 require "dependabot/shared_helpers"
 require "dependabot/npm_and_yarn/native_helpers"
 require "dependabot/npm_and_yarn/version"
+require "dependabot/git_metadata_fetcher"
+require "dependabot/git_commit_checker"
 require "dependabot/errors"
 
 module Dependabot
@@ -151,8 +153,11 @@ module Dependabot
 
       def version_for(name, requirement)
         if git_url_with_semver?(requirement)
-          semver_version_for(name, requirement) ||
-            git_revision_for(name, requirement)
+          semver_version = semver_version_for(name, requirement)
+          return semver_version if semver_version
+
+          git_revision = git_revision_for(name, requirement)
+          version_from_git_revision(requirement, git_revision) || git_revision
         elsif git_url?(requirement)
           git_revision_for(name, requirement)
         else
@@ -180,6 +185,29 @@ module Dependabot
         nil
       end
 
+      def version_from_git_revision(requirement, git_revision)
+        tags =
+          Dependabot::GitMetadataFetcher.new(
+            url: git_source_for(requirement).fetch(:url),
+            credentials: credentials
+          ).tags.
+          select { |t| [t.commit_sha, t.tag_sha].include?(git_revision) }
+
+        tags.each do |t|
+          next unless t.name.match?(Dependabot::GitCommitChecker::VERSION_REGEX)
+
+          version = t.name.match(Dependabot::GitCommitChecker::VERSION_REGEX).
+                    named_captures.fetch("version")
+          next unless NpmAndYarn::Version.correct?(version)
+
+          return version
+        end
+
+        nil
+      rescue Dependabot::GitDependenciesNotReachable
+        nil
+      end
+
       def semver_version_for(name, requirement)
         lock_version = lockfile_parser.lockfile_details(
           dependency_name: name,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.95.82
+  version: 0.95.83
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.82
+        version: 0.95.83
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.82
+        version: 0.95.83
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement