dependabot-npm_and_yarn 0.98.61 → 0.98.62

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ebd4e88c3ed82eb65a28fb5222583261d2d6150270fd53bb3c3dd1c56a848173
-  data.tar.gz: 9210e21fc41ced4b1e8f1dbdaf7bd01c1bc9ac48ea24e24f355b18104e11009f
+  metadata.gz: 35656968fb496f5e4b9ec72d78970c3d0a8addb4d6624547f8ec6a89b4ae0734
+  data.tar.gz: f1189c0cbd576af29732e5615ebbaed52930002f459856751e3f05c53885a7b3
 SHA512:
-  metadata.gz: b924d8067690782654fd8f9c5c978fa579df8d325eaad9558b365c953e2e6dec87d7b2db53aa7a91f03a29f789e4023f2a130c0e5a7fcbc4bb7c5c9be8a4b221
-  data.tar.gz: 66f13051d2e774e381f44ac36529aa006cb94ce4d1999992653a48f9b2e0851abfea9d9810ab252c44995b4ae8830fabd88388ea753f85c850ee0522249f8c1a
+  metadata.gz: 03c31a5046a551135cf9e56306e67c220314fb6f92a6551c242ded15f64b929618e963c33bb17762f35538eb417ca573631556c054912364438ba3920802ea34
+  data.tar.gz: 6649977e4451edf84fb55afdb8f427c5807b7a17aeab841a09af53855360de743f9053fc74c92e234a6e22a4d2277800e0f0435513bba5c669e8117538d42f9f

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -93,21 +93,23 @@ module Dependabot
       def build_dependency(file:, type:, name:, requirement:)
         lockfile_details = lockfile_parser.lockfile_details(
           dependency_name: name,
-          requirement: requirement
+          requirement: requirement,
+          manifest_name: file.name
         )
-        return if lockfile_details && !version_for(name, requirement)
+        version = version_for(name, requirement, file.name)
+        return if lockfile_details && !version
         return if ignore_requirement?(requirement)
         return if workspace_package_names.include?(name)
 
         Dependency.new(
           name: name,
-          version: version_for(name, requirement),
+          version: version,
           package_manager: "npm_and_yarn",
           requirements: [{
             requirement: requirement_for(requirement),
             file: file.name,
             groups: [type],
-            source: source_for(name, requirement)
+            source: source_for(name, requirement, file.name)
           }]
         )
       end
@@ -151,26 +153,27 @@ module Dependabot
           package_files.map { |f| JSON.parse(f.content)["name"] }.compact
       end
 
-      def version_for(name, requirement)
+      def version_for(name, requirement, manifest_name)
         if git_url_with_semver?(requirement)
-          semver_version = semver_version_for(name, requirement)
+          semver_version = semver_version_for(name, requirement, manifest_name)
           return semver_version if semver_version
 
-          git_revision = git_revision_for(name, requirement)
+          git_revision = git_revision_for(name, requirement, manifest_name)
           version_from_git_revision(requirement, git_revision) || git_revision
         elsif git_url?(requirement)
-          git_revision_for(name, requirement)
+          git_revision_for(name, requirement, manifest_name)
         else
-          semver_version_for(name, requirement)
+          semver_version_for(name, requirement, manifest_name)
         end
       end
 
-      def git_revision_for(name, requirement)
+      def git_revision_for(name, requirement, manifest_name)
         return unless git_url?(requirement)
 
         lockfile_details = lockfile_parser.lockfile_details(
           dependency_name: name,
-          requirement: requirement
+          requirement: requirement,
+          manifest_name: manifest_name
         )
         lock_version = lockfile_details&.fetch("version", nil)
         lock_res = lockfile_details&.fetch("resolved", nil)
@@ -208,10 +211,11 @@ module Dependabot
         nil
       end
 
-      def semver_version_for(name, requirement)
+      def semver_version_for(name, requirement, manifest_name)
         lock_version = lockfile_parser.lockfile_details(
           dependency_name: name,
-          requirement: requirement
+          requirement: requirement,
+          manifest_name: manifest_name
         )&.fetch("version", nil)
 
         return unless lock_version
@@ -223,12 +227,13 @@ module Dependabot
         lock_version
       end
 
-      def source_for(name, requirement)
+      def source_for(name, requirement, manifest_name)
         return git_source_for(requirement) if git_url?(requirement)
 
         resolved_url = lockfile_parser.lockfile_details(
           dependency_name: name,
-          requirement: requirement
+          requirement: requirement,
+          manifest_name: manifest_name
         )&.fetch("resolved", nil)
 
         return unless resolved_url

data/lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb

@@ -19,32 +19,28 @@ module Dependabot
           dependency_set.dependencies
         end
 
-        def lockfile_details(dependency_name:, requirement:)
-          [*package_locks, *shrinkwraps].each do |package_lock|
-            parsed_package_lock_json = parse_package_lock(package_lock)
-            next unless parsed_package_lock_json.dig("dependencies",
-                                                     dependency_name)
-
-            return parsed_package_lock_json.dig("dependencies", dependency_name)
-          end
-
-          yarn_locks.each do |yarn_lock|
-            parsed_yarn_lock = parse_yarn_lock(yarn_lock)
-
-            details_candidates =
-              parsed_yarn_lock.
-              select { |k, _| k.split(/(?<=\w)\@/).first == dependency_name }
-
-            # If there's only one entry for this dependency, use it, even if
-            # the requirement in the lockfile doesn't match
-            details = details_candidates.first.last if details_candidates.one?
-
-            details ||=
-              details_candidates.
-              find do |k, _|
-                k.split(/(?<=\w)\@/)[1..-1].join("@") == requirement
-              end&.
-              last
+        def lockfile_details(dependency_name:, requirement:, manifest_name:)
+          potential_lockfiles_for_manifest(manifest_name).each do |lockfile|
+            details =
+              if [*package_locks, *shrinkwraps].include?(lockfile)
+                parsed_lockfile = parse_package_lock(lockfile)
+                parsed_lockfile.dig("dependencies", dependency_name)
+              else
+                parsed_yarn_lock = parse_yarn_lock(lockfile)
+                details_candidates =
+                  parsed_yarn_lock.
+                  select { |k, _| k.split(/(?<=\w)\@/)[0] == dependency_name }
+
+                # If there's only one entry for this dependency, use it, even if
+                # the requirement in the lockfile doesn't match
+                if details_candidates.one?
+                  details_candidates.first.last
+                else
+                  details_candidates.find do |k, _|
+                    k.split(/(?<=\w)\@/)[1..-1].join("@") == requirement
+                  end&.last
+                end
+              end
 
             return details if details
           end
@@ -56,6 +52,19 @@ module Dependabot
 
         attr_reader :dependency_files
 
+        def potential_lockfiles_for_manifest(manifest_filename)
+          dir_name = File.dirname(manifest_filename)
+          possible_lockfile_names =
+            %w(package-lock.json npm-shrinkwrap.json yarn.lock).map do |f|
+              Pathname.new(File.join(dir_name, f)).cleanpath.to_path
+            end +
+            %w(yarn.lock package-lock.json npm-shrinkwrap.json)
+
+          possible_lockfile_names.uniq.
+            map { |nm| dependency_files.find { |f| f.name == nm } }.
+            compact
+        end
+
         def yarn_lock_dependencies
           dependency_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.98.61
+  version: 0.98.62
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.61
+        version: 0.98.62
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.61
+        version: 0.98.62
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement