dependabot-npm_and_yarn 0.99.7 → 0.100.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 255e19328cb7b5b82a02a88155cf53826acf94492b31d45346f92b5061b5be3f
-  data.tar.gz: bc7ea6386c309f631bb33b2000290d247637390bdb534c8372d8e9ba1e41ee54
+  metadata.gz: cfb8071b3a5a216d144e90e681a3ee636059d5d84246a9edb576f03916323f52
+  data.tar.gz: ee9c9bc5598b783dafd7d791ec1d6f5607f28cfc7c856b10648f67dc7c141e26
 SHA512:
-  metadata.gz: 565e5b647c70b12d31dba605fa0b9d4099fa0c4ea4c363662e552d5f4358d530a485c2675a070e5d191af96cb9d17b0a1fe6ba4d2f6c652a97617210005344dd
-  data.tar.gz: 2fc3ebf07b933be705fa259fc396d5cf6a7f76aa07cbd5a558f89083a66ab994b57e94ff70a08dac31abb2c7897decbd8515d1637368a0e56c4d08e567974fc4
+  metadata.gz: d90e5642fb69f2aff90e036b087d7a2a4ca9bdca0c6b884207037c93d52bc098d174f6b67032a704f4f9378b9caa6ce7b046898a8f09f7ae30ff465750b34a2c
+  data.tar.gz: 19f0dea2fa8155a9dedf12810efe660f5ca0a5e28dbfe862eeab8f82396954ad63d254bf3685248e50eddfd23095104a8c5232e3d36123c49ea0de5739ca7486

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -36,6 +36,13 @@ module Dependabot
           end
       end
 
+      def lowest_resolvable_security_fix_version
+        raise "Dependency not vulnerable!" unless vulnerable?
+
+        # TODO: Implement this properly!
+        latest_resolvable_version
+      end
+
       def latest_resolvable_version_with_no_unlock
         return latest_resolvable_version unless dependency.top_level?
 
@@ -48,11 +55,12 @@ module Dependabot
 
       def updated_requirements
         resolvable_version =
-          if latest_resolvable_version.is_a?(version_class)
-            latest_resolvable_version.to_s
-          elsif latest_resolvable_version.nil?
-            nil
+          if [version_class, NilClass].include?(preferred_resolvable_version)
+            preferred_resolvable_version&.to_s
           else
+            # If the preferred_resolvable_version came back as anything other
+            # than a version class or `nil` it must be because this is a git
+            # dependency, for which we don't check resolvability.
             latest_version_details&.fetch(:version, nil)&.to_s
           end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.99.7
+  version: 0.100.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-10 00:00:00.000000000 Z
+date: 2019-04-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.99.7
+        version: 0.100.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.99.7
+        version: 0.100.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement