dependabot-npm_and_yarn 0.106.11 → 0.106.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85d8a45c296270dfd6a16c4a14fe5a09cd376756de47e9152ba47d0522af0127
-  data.tar.gz: 2c20c23fc98f9f35370858e64c4d580b4c045d4f19778120ebfb5fe7729e46d6
+  metadata.gz: 55ec3e50f880e9fd8418ee0c28227cbbaac30f284b2bb9419bc93d43b0311c28
+  data.tar.gz: 99b56d17d46b68e6720d41872ff9644b05cd283e211e00564ebfed9892642d27
 SHA512:
-  metadata.gz: 570efb140c89d16a4e8cc61d34a47d9928ca834476879798ccc959cf4550f6cc9471ddfa7ebfe736a0ba1b1ba837a1b87dec6ee65f59f0d0b298140dba736491
-  data.tar.gz: e19d3a945a48a975587edd837a94e994b4691991fd51e71dd67a8d64efa384a9594e3b3a10bb1cc62a776b2527e1526932bb0081eeb54e059776cd486c44d394
+  metadata.gz: 7e251ae8b92c566859c05e6f17f9f43ca0c3cb4db9126c83aa83c023fb88e17f349b59a6ba066e831c230967d262bc42ad15cdf0e0b7f3d5a8137bd8f95f69f0
+  data.tar.gz: '0881387d0b65214d87ad2b335a5c3aa164777741c59cd6957427cf432a116bd24e8b599ecb7a02c47cde3a23c69ab15c23bf7f36207c1dbfe7f96fd149cb05e7'

data/helpers/lib/npm/remove-dependencies-from-lockfile.js

@@ -0,0 +1,22 @@
+// Recursively removes all dependencies matching on name
+function removeDependenciesFromLockfile(lockfile, dependencyNames) {
+  if (!lockfile.dependencies) return lockfile;
+
+  const dependencies = Object.entries(lockfile.dependencies).reduce(
+    (acc, [depName, packageValue]) => {
+      if (!dependencyNames.includes(depName)) {
+        acc[depName] = removeDependenciesFromLockfile(
+          packageValue,
+          dependencyNames
+        );
+      }
+
+      return acc;
+    },
+    {}
+  );
+
+  return Object.assign({}, lockfile, { dependencies });
+}
+
+module.exports = removeDependenciesFromLockfile;

data/helpers/lib/npm/subdependency-updater.js

@@ -2,13 +2,29 @@ const fs = require("fs");
 const path = require("path");
 const npm = require("npm");
 const installer = require("npm/lib/install");
+const detectIndent = require("detect-indent");
+const removeDependenciesFromLockfile = require("./remove-dependencies-from-lockfile");
 
 const { muteStderr, runAsync } = require("./helpers.js");
 
-async function updateDependencyFile(directory, lockfileName) {
+async function updateDependencyFile(directory, lockfileName, dependencies) {
   const readFile = fileName =>
     fs.readFileSync(path.join(directory, fileName)).toString();
 
+  const lockfile = readFile(lockfileName);
+  const indent = detectIndent(lockfile).indent || "  ";
+  const lockfileObject = JSON.parse(lockfile);
+  // Remove the dependency we want to update from the lockfile and let
+  // npm find the latest resolvable version and fix the lockfile
+  const updatedLockfileObject = removeDependenciesFromLockfile(
+    lockfileObject,
+    dependencies.map(dep => dep.name)
+  );
+  fs.writeFileSync(
+    path.join(directory, lockfileName),
+    JSON.stringify(updatedLockfileObject, null, indent)
+  );
+
   // `force: true` ignores checks for platform (os, cpu) and engines
   // in npm/lib/install/validate-args.js
   // Platform is checked and raised from (EBADPLATFORM):

data/helpers/lib/npm/updater.js

@@ -18,9 +18,10 @@ const fs = require("fs");
 const path = require("path");
 const npm = require("npm");
 const installer = require("npm/lib/install");
+const detectIndent = require("detect-indent");
 const { muteStderr, runAsync } = require("./helpers.js");
 
-async function updateDependencyFiles(directory, dependencies, lockfileName) {
+async function updateDependencyFiles(directory, lockfileName, dependencies) {
   const readFile = fileName =>
     fs.readFileSync(path.join(directory, fileName)).toString();
 
@@ -76,9 +77,23 @@ async function updateDependencyFiles(directory, dependencies, lockfileName) {
   try {
     // Fix already present git sub-dependency with invalid "from" and "requires"
     updateLockfileWithValidGitUrls(path.join(directory, lockfileName));
+
     await runAsync(initialInstaller, initialInstaller.run, []);
+
     // Fix npm5 lockfiles where invalid "from" is introduced after first install
     updateLockfileWithValidGitUrls(path.join(directory, lockfileName));
+
+    const lockfile = readFile(lockfileName);
+    const indent = detectIndent(lockfile).indent || "  ";
+    const intermediaryLockfile = JSON.parse(lockfile);
+    const updatedIntermediaryLockfile = removeInvalidGitUrls(
+      intermediaryLockfile
+    );
+    fs.writeFileSync(
+      path.join(directory, lockfileName),
+      JSON.stringify(updatedIntermediaryLockfile, null, indent)
+    );
+
     await runAsync(cleanupInstaller, cleanupInstaller.run, []);
   } finally {
     unmute();
@@ -91,10 +106,11 @@ async function updateDependencyFiles(directory, dependencies, lockfileName) {
 
 function updateLockfileWithValidGitUrls(lockfilePath) {
   const lockfile = fs.readFileSync(lockfilePath).toString();
+  const indent = detectIndent(lockfile).indent || "  ";
   const updatedLockfileObject = removeInvalidGitUrls(JSON.parse(lockfile));
   fs.writeFileSync(
     lockfilePath,
-    JSON.stringify(updatedLockfileObject, null, 2)
+    JSON.stringify(updatedLockfileObject, null, indent)
   );
 }
 

data/helpers/package.json

@@ -10,6 +10,7 @@
   },
   "dependencies": {
     "@dependabot/yarn-lib": "^1.15.2",
+    "detect-indent": "^5.0.0",
     "npm": "^6.9.0",
     "semver": "^6.0.0"
   },

data/helpers/test/npm/updater.test.js

@@ -36,17 +36,13 @@ describe("updater", () => {
   it("generates an updated package-lock.json", async () => {
     await copyDependencies("original", tempDir);
 
-    const result = await updateDependencyFiles(
-      tempDir,
-      [
-        {
-          name: "left-pad",
-          version: "1.1.3",
-          requirements: [{ file: "package.json", groups: ["dependencies"] }]
-        }
-      ],
-      "package-lock.json"
-    );
+    const result = await updateDependencyFiles(tempDir, "package-lock.json", [
+      {
+        name: "left-pad",
+        version: "1.1.3",
+        requirements: [{ file: "package.json", groups: ["dependencies"] }]
+      }
+    ]);
     expect(result).toEqual({
       "package-lock.json": helpers.loadFixture(
         "updater/updated/package-lock.json"

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -153,8 +153,8 @@ module Dependabot
             function: "npm:update",
             args: [
               Dir.pwd,
-              top_level_dependency_updates,
-              lockfile_name
+              lockfile_name,
+              top_level_dependency_updates
             ]
           )
         end
@@ -163,7 +163,7 @@ module Dependabot
           SharedHelpers.run_helper_subprocess(
             command: NativeHelpers.helper_path,
             function: "npm:updateSubdependency",
-            args: [Dir.pwd, lockfile_name]
+            args: [Dir.pwd, lockfile_name, sub_dependencies.map(&:to_h)]
           )
         end
 
@@ -396,7 +396,7 @@ module Dependabot
 
             FileUtils.mkdir_p(Pathname.new(f.name).dirname)
 
-            File.write(f.name, prepared_npm_lockfile_content(f.content))
+            File.write(f.name, f.content)
           end
         end
 
@@ -471,25 +471,6 @@ module Dependabot
           @git_ssh_requirements_to_swap
         end
 
-        def prepared_npm_lockfile_content(content)
-          JSON.dump(remove_dependency_from_npm_lockfile(JSON.parse(content)))
-        end
-
-        # Duplicated in SubdependencyVersionResolver
-        # Remove the dependency we want to update from the lockfile and let
-        # npm find the latest resolvable version and fix the lockfile
-        def remove_dependency_from_npm_lockfile(npm_lockfile)
-          return npm_lockfile unless npm_lockfile.key?("dependencies")
-
-          sub_dependency_names = sub_dependencies.map(&:name)
-          dependencies =
-            npm_lockfile["dependencies"].
-            reject { |key, _| sub_dependency_names.include?(key) }.
-            map { |k, v| [k, remove_dependency_from_npm_lockfile(v)] }.
-            to_h
-          npm_lockfile.merge("dependencies" => dependencies)
-        end
-
         def post_process_npm_lockfile(original_content, updated_content)
           updated_content =
             replace_project_metadata(updated_content, original_content)

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -115,7 +115,7 @@ module Dependabot
               SharedHelpers.run_helper_subprocess(
                 command: NativeHelpers.helper_path,
                 function: "npm:updateSubdependency",
-                args: [Dir.pwd, lockfile_name]
+                args: [Dir.pwd, lockfile_name, [dependency.to_h]]
               )
             end
           end
@@ -141,7 +141,7 @@ module Dependabot
 
           [*package_locks, *shrinkwraps].each do |f|
             FileUtils.mkdir_p(Pathname.new(f.name).dirname)
-            File.write(f.name, prepared_npm_lockfile_content(f.content))
+            File.write(f.name, f.content)
           end
         end
 
@@ -152,26 +152,6 @@ module Dependabot
           content.gsub(/^#{Regexp.quote(dependency.name)}\@.*?\n\n/m, "")
         end
 
-        def prepared_npm_lockfile_content(content)
-          JSON.dump(
-            remove_dependency_from_npm_lockfile(JSON.parse(content))
-          )
-        end
-
-        # Duplicated in NpmLockfileUpdater
-        # Remove the dependency we want to update from the lockfile and let
-        # npm find the latest resolvable version and fix the lockfile
-        def remove_dependency_from_npm_lockfile(npm_lockfile)
-          return npm_lockfile unless npm_lockfile.key?("dependencies")
-
-          dependencies =
-            npm_lockfile["dependencies"].
-            reject { |key, _| key == dependency.name }.
-            map { |k, v| [k, remove_dependency_from_npm_lockfile(v)] }.
-            to_h
-          npm_lockfile.merge("dependencies" => dependencies)
-        end
-
         def prepared_package_json_content(file)
           NpmAndYarn::FileUpdater::PackageJsonPreparer.new(
             package_json_content: file.content

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.106.11
+  version: 0.106.12
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.106.11
+        version: 0.106.12
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.106.11
+        version: 0.106.12
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -148,6 +148,7 @@ files:
 - helpers/lib/npm/helpers.js
 - helpers/lib/npm/index.js
 - helpers/lib/npm/peer-dependency-checker.js
+- helpers/lib/npm/remove-dependencies-from-lockfile.js
 - helpers/lib/npm/subdependency-updater.js
 - helpers/lib/npm/updater.js
 - helpers/lib/yarn/fix-duplicates.js