dependabot-npm_and_yarn 0.111.37 → 0.111.38

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f30dbfdf26399c943c9f1b0bb67dd2163ca07becd0daff092d6dee01ff59df72
-  data.tar.gz: e3e8b240bd7d347c6d1d0354ce4b76b840380c6619897df220ed8800d047314a
+  metadata.gz: 6b6ecffa06bdfd737a3431994beb6533dc9c768acc4ea0e19a7c5989da1c2b41
+  data.tar.gz: 654134bf4ee9058b17d5d96a9f782fcd55b311c455758f3e1f80609df5806ff4
 SHA512:
-  metadata.gz: 45cac958df5db965b2eff0a7b7d7483a389a6e37c1d487ff106f9318c5d47f5dd5cc8b5b3a1315994ebdc1a0c8dd8219da75b01b0ff8479f9e8f53437f457bd2
-  data.tar.gz: 7e8b02b9784e7c7b803fa1760b11f322829a72e9db56f514999a63a0b09d73fc7bc42d109dc464a9d386750915b62564ba5c784b4e50001b34f3ffdd9b2e563d
+  metadata.gz: be49cf210cb5bf05d2a20a2e412e51d5e93614fc9893cb1cb240d356566cd5414803143923600f7b40c0e8343c48178328ea0d8069e9da4d06f5850847dc2652
+  data.tar.gz: 8939801d668406c3a8c30e298b503e667510c411c65e23ec297d500a25d8d0d19deb49c00fbb0c58e07a8fc83e36faee1e103a44cfa5c13a5e0dd233c1b9c141

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -177,17 +177,18 @@ module Dependabot
           requirement: requirement,
           manifest_name: manifest_name
         )
-        lock_version = lockfile_details&.fetch("version", nil)
-        lock_res = lockfile_details&.fetch("resolved", nil)
 
-        return lock_version.split("#").last if lock_version&.include?("#")
-        return lock_res.split("#").last if lock_res&.include?("#")
+        [
+          lockfile_details&.fetch("version", nil)&.split("#")&.last,
+          lockfile_details&.fetch("resolved", nil)&.split("#")&.last,
+          lockfile_details&.fetch("resolved", nil)&.split("/")&.last
+        ].find { |str| commit_sha?(str) }
+      end
 
-        if lock_res && lock_res.split("/").last.match?(/^[0-9a-f]{40}$/)
-          return lock_res.split("/").last
-        end
+      def commit_sha?(string)
+        return false unless string.is_a?(String)
 
-        nil
+        string.match?(/^[0-9a-f]{40}$/)
       end
 
       def version_from_git_revision(requirement, git_revision)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.111.37
+  version: 0.111.38
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-07-28 00:00:00.000000000 Z
+date: 2019-07-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.111.37
+        version: 0.111.38
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.111.37
+        version: 0.111.38
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement