dependabot-npm_and_yarn 0.111.10 → 0.111.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 930753aeafdf37fcadf92d65ea055a5108fdac701c7386f3a2965533ad7defd6
-  data.tar.gz: '08d9fbec1dfd2f0d491e7f0177d4c0f2033f4206c88fdcf68d2d956a32dbba27'
+  metadata.gz: 9b694006465da091f8f16f2a4405be227dc6b165598ef646c7ce463dec0ba6c8
+  data.tar.gz: 4ed1cc40a97c3905d8d76eb30013378f42593db3cf18d5c7e9acec284e814fdf
 SHA512:
-  metadata.gz: f7eafd19e3f36ae4beb44ea3dc73a33fded179a6f5982a114de53c7597161c9d67ed14459e9d94f2b9b6233aa37b9d7c0812a21207f70d32e306e7993d7789a3
-  data.tar.gz: c75fe724c3d80fd13d9b64d19169a552aa3d1ad0c6753763bff1f1355013bcd8000595a0777932bf3a9675243b1463f7d8dd33e6f870f514f2d46b382c0d34b2
+  metadata.gz: 9bbd695712ed10c8786126e59ed97fd33f108972b04d8c687e4f1edf8bffa9ae2680ff8c673305882c825378bd3284d0e4a94136059cbf391a9d679cff2f8112
+  data.tar.gz: 19f56e1bee9bef643b3522d354d483f5825892a7719fb4e6d490a89d27c47a1f1a64236abd7e43ee4589222b89ab9da7d3d93191cd901bb5aefedb10da96f53d

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -11,6 +11,17 @@ module Dependabot
     class FileFetcher < Dependabot::FileFetchers::Base
       require_relative "file_fetcher/path_dependency_builder"
 
+      # Npm always prefixes file paths in the lockfile "version" with "file:"
+      # even when a naked path is used (e.g. "../dep")
+      NPM_PATH_DEPENDENCY_STARTS = %w(file:).freeze
+      # "link:" is only supported by Yarn but is interchangeable with "file:"
+      # when it specifies a path. Only include Yarn "link:"'s that start with a
+      # path and ignore symlinked package names that have been registered with
+      # "yarn link", e.g. "link:react"
+      PATH_DEPENDENCY_STARTS =
+        %w(file: link:. link:/ link:~/ / ./ ../ ~/).freeze
+      PATH_DEPENDENCY_CLEAN_REGEX = /^file:|^link:/.freeze
+
       def self.required_files_in?(filenames)
         filenames.include?("package.json")
       end
@@ -113,7 +124,7 @@ module Dependabot
         unfetchable_deps = []
 
         path_dependency_details(fetched_files).each do |name, path|
-          path = path.sub(/^file:/, "").sub(/^link:/, "")
+          path = path.gsub(PATH_DEPENDENCY_CLEAN_REGEX, "")
           filename = File.join(path, "package.json")
           cleaned_name = Pathname.new(filename).cleanpath.to_path
           next if fetched_files.map(&:name).include?(cleaned_name)
@@ -144,19 +155,12 @@ module Dependabot
             path_dependency_details_from_manifest(file)
         end
 
-        path_starts = %w(file: link:.)
-
-        package_lock_path_deps =
-          parsed_package_lock.fetch("dependencies", []).to_a.
-          select { |_, v| v.is_a?(Hash) }.
-          select { |_, v| v.fetch("version", "").start_with?(*path_starts) }.
-          map { |k, v| [k, v.fetch("version")] }
-
-        shrinkwrap_path_deps =
-          parsed_shrinkwrap.fetch("dependencies", []).to_a.
-          select { |_, v| v.is_a?(Hash) }.
-          select { |_, v| v.fetch("version", "").start_with?(*path_starts) }.
-          map { |k, v| [k, v.fetch("version")] }
+        package_lock_path_deps = path_dependency_details_from_npm_lockfile(
+          parsed_package_lock
+        )
+        shrinkwrap_path_deps = path_dependency_details_from_npm_lockfile(
+          parsed_shrinkwrap
+        )
 
         [
           *package_json_path_deps,
@@ -171,7 +175,6 @@ module Dependabot
 
         current_dir = file.name.rpartition("/").first
         current_dir = nil if current_dir == ""
-        path_dep_starts = %w(file: / ./ ../ ~/ link:.)
 
         dep_types = NpmAndYarn::FileParser::DEPENDENCY_TYPES
         parsed_manifest = JSON.parse(file.content)
@@ -189,10 +192,11 @@ module Dependabot
                             convert_dependency_path_to_name(path, value)
                           end
 
+        path_starts = PATH_DEPENDENCY_STARTS
         (dependency_objects.flat_map(&:to_a) + resolution_deps).
-          select { |_, v| v.is_a?(String) && v.start_with?(*path_dep_starts) }.
+          select { |_, v| v.is_a?(String) && v.start_with?(*path_starts) }.
           map do |name, path|
-            path = path.sub(/^file:/, "").sub(/^link:/, "")
+            path = path.gsub(PATH_DEPENDENCY_CLEAN_REGEX, "")
             path = File.join(current_dir, path) unless current_dir.nil?
             [name, Pathname.new(path).cleanpath.to_path]
           end
@@ -201,6 +205,14 @@ module Dependabot
       end
       # rubocop:enable Metrics/AbcSize
 
+      def path_dependency_details_from_npm_lockfile(parsed_lockfile)
+        path_starts = NPM_PATH_DEPENDENCY_STARTS
+        parsed_lockfile.fetch("dependencies", []).to_a.
+          select { |_, v| v.is_a?(Hash) }.
+          select { |_, v| v.fetch("version", "").start_with?(*path_starts) }.
+          map { |k, v| [k, v.fetch("version")] }
+      end
+
       # Re-write the glob name to the targeted dependency name (which is used
       # in the lockfile), for example "parent-pacakge/**/sub-dep/target-dep" >
       # "target-dep"

data/lib/dependabot/npm_and_yarn/file_fetcher/path_dependency_builder.rb

@@ -36,19 +36,22 @@ module Dependabot
                     :directory
 
         def details_from_yarn_lock
+          path_starts = FileFetcher::PATH_DEPENDENCY_STARTS
           parsed_yarn_lock.to_a.
             find do |n, _|
               next false unless n.split(/(?<=\w)\@/).first == dependency_name
 
-              n.split(/(?<=\w)\@/).last.start_with?("file:")
+              n.split(/(?<=\w)\@/).last.start_with?(*path_starts)
             end&.last
         end
 
         def details_from_npm_lock
-          parsed_package_lock.fetch("dependencies", []).to_a.
-            select { |_, v| v.fetch("version", "").start_with?("file:") }.
-            find { |n, _| n == dependency_name }&.
-            last
+          path_starts = FileFetcher::NPM_PATH_DEPENDENCY_STARTS
+          path_deps = parsed_package_lock.fetch("dependencies", []).to_a.
+                      select do |_, v|
+                        v.fetch("version", "").start_with?(*path_starts)
+                      end
+          path_deps.find { |n, _| n == dependency_name }&.last
         end
 
         def build_path_dep_content(dependency_name)
@@ -86,21 +89,24 @@ module Dependabot
         def replace_yarn_lock_file_paths(dependencies_hash)
           return unless dependencies_hash
 
-          dependencies_hash.each_with_object({}) do |(k, v), obj|
-            obj[k] = v
-            next unless v.start_with?("file:")
+          dependencies_hash.each_with_object({}) do |(name, value), obj|
+            obj[name] = value
+            next unless value.start_with?(*FileFetcher::PATH_DEPENDENCY_STARTS)
 
             path_from_base =
               parsed_yarn_lock.to_a.
               find do |n, _|
-                next false unless n.split(/(?<=\w)\@/).first == k
+                next false unless n.split(/(?<=\w)\@/).first == name
 
-                n.split(/(?<=\w)\@/).last.start_with?("file:")
-              end&.first&.split(/(?<=\w)\@/)&.last&.gsub("file:", "")
+                n.split(/(?<=\w)\@/).last.
+                  start_with?(*FileFetcher::PATH_DEPENDENCY_STARTS)
+              end&.first&.split(/(?<=\w)\@/)&.last
 
             next unless path_from_base
 
-            obj[k] = "file:" + File.join(inverted_path, path_from_base)
+            cleaned_path = path_from_base.
+                           gsub(FileFetcher::PATH_DEPENDENCY_CLEAN_REGEX, "")
+            obj[name] = "file:" + File.join(inverted_path, cleaned_path)
           end
         end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.111.10
+  version: 0.111.11
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-07-15 00:00:00.000000000 Z
+date: 2019-07-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.111.10
+        version: 0.111.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.111.10
+        version: 0.111.11
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.72.0
+        version: 0.73.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.72.0
+        version: 0.73.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement