dependabot-npm_and_yarn 0.108.16 → 0.108.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff37cd8281094a2e68db0536ff6aa9cb832aac58f051f7c1a36c220d5ce0e86e
-  data.tar.gz: 2c0372b95fa6a26bf466b35e4787df2771979dc5fba412c6c75ef066249ddd7f
+  metadata.gz: e525d81bf0de3ab994798a2b25d30afe6f6d7cb4465118d8520b4f3071025fe1
+  data.tar.gz: 8f362917f008bed4459024b5ed7d503b190503d6315e936babbd935ccb3aacd7
 SHA512:
-  metadata.gz: 46131febd74a912e9c935c175413b6d6db41e5ebd9c22e18780fbae255507e9661502d38b6ddd1d04918171bb92e1beb6deed409fb0bee47dbc307d7f392902b
-  data.tar.gz: 34b67f53f785ae23b26abe3a2222de8622f646139af6a0dd577d6ec5b0062438af2de4f1bf5bb618cc0b63fbab7b7976c65ded3617b88f834010051cadeff5dd
+  metadata.gz: 0af34c73b4f6a6afac2013549bf158ae2261b9a44d37a0218cc52b163b0e8769498b6062cd55f25cb9c070bbc841db3f0a203642ece5449ac995a97d7f696362
+  data.tar.gz: bcc87e805f58d4054fe33e33b3cc232ff51d7d8def12f57e9966841ad56b786a6260970e6b6aebc988d1adac451e618d0832226b80d741509341b3885f2259ab

data/lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb

@@ -128,13 +128,20 @@ module Dependabot
             fetch("dependencies", {}).each do |name, details|
               next unless semver_version_for(details["version"])
 
-              dependency_set << Dependency.new(
+              dependency_args = {
                 name: name,
                 version: semver_version_for(details["version"]),
                 package_manager: "npm_and_yarn",
                 requirements: []
-              )
+              }
+
+              if details["bundled"]
+                dependency_args[:subdependency_metadata] = {
+                  npm_bundled: details["bundled"]
+                }
+              end
 
+              dependency_set << Dependency.new(dependency_args)
               dependency_set += recursively_fetch_npm_lock_dependencies(details)
             end
 

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -26,6 +26,7 @@ module Dependabot
 
         def latest_resolvable_version
           raise "Not a subdependency!" if dependency.requirements.any?
+          return if bundled_dependency?
 
           SharedHelpers.in_a_temporary_directory do
             write_temporary_dependency_files
@@ -214,6 +215,26 @@ module Dependabot
             dependency_files.
             select { |f| f.name.end_with?("package.json") }
         end
+
+        # TODO: We should try and fix this by updating the parent that's not
+        # bundled. For this case: `chokidar > fsevents > node-pre-gyp > tar` we
+        # would need to update `fsevents`
+        #
+        # We shouldn't update bundled sub-dependencies as they have been bundled
+        # into the release at an exact version by a parent using
+        # `bundledDependencies`.
+        #
+        # For example, fsevents < 2 bundles node-pre-gyp meaning all it's
+        # sub-dependnecies get bundled into the release tarball at publish time
+        # so you always get the same sub-dependency versions if you re-install a
+        # specific version of fsevents.
+        #
+        # Updating the sub-dependency by deleting the entry works but it gets
+        # removed from the bundled set of dependencies and moved top level
+        # resulting in a bunch of package duplication which is pretty confusing.
+        def bundled_dependency?
+          dependency.subdependency_metadata&.fetch(:npm_bundled, false) || false
+        end
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.108.16
+  version: 0.108.17
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.108.16
+        version: 0.108.17
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.108.16
+        version: 0.108.17
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement