dependabot-npm_and_yarn 0.112.3 → 0.112.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d9e491e063f1931c600351217233cbebab381310b4f67a656ffb98066e715d65
-  data.tar.gz: 7aa0d8ce2889ef4ac2e5146a250ba8e0b92ce352911f882a7bf2aab0dd2126c3
+  metadata.gz: 1541f937bcd8a69e491b218bc5ad4bd8ed3fcd1e942b751594d4459010d1745c
+  data.tar.gz: cb7163c127617a4799e0eab97fd3db30168aa4393fca8bc6d87ddfe68cd06c4a
 SHA512:
-  metadata.gz: e2ccd6ed91917fc9cf1b2a2c5d31e9dc4a6ba631773712775a47cfb5d350b4ad317be2c0966ccb375387db0cbffef9031c9155e9cdbe5cdb597cd1120f8b8feb
-  data.tar.gz: 29a793318150a188960be72be45c7c96228f10524c6ab32c48199f769209c47c992f3d57bc572e0636b7c84912b0f921778bf4e35d5737dc82f13b9cec22aa18
+  metadata.gz: ab7abf69f410be40daac4eceaf7424960e3b12aac0f6660e11f0fb170f0f9845a6997506e1877ec2e235be15f5c94ed7300f4e580703148106ab52c32122eea1
+  data.tar.gz: 50be852418ded3014b1119257c3745db509adeea1b02da8bea77e40b4d6743feb8cf9c7559d00cd76abbbd858e300355071fd4dffcf1018d4a81ef78124937cb

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -382,6 +382,7 @@ module Dependabot
             # git dependencies, otherwise npm will (unhelpfully) update them
             updated_content = lock_git_deps(updated_content)
             updated_content = replace_ssh_sources(updated_content)
+            updated_content = lock_deps_with_latest_reqs(updated_content)
 
             updated_content = sanitized_package_json_content(updated_content)
             File.write(file.name, updated_content)
@@ -442,6 +443,24 @@ module Dependabot
           @git_dependencies_to_lock
         end
 
+        # When a package.json version requirement is set to `latest`, npm will
+        # always try to update these dependencies when doing an `npm install`,
+        # regardless of lockfile version. Prevent any unrelated updates by
+        # changing the version requirement to `*` while updating the lockfile.
+        def lock_deps_with_latest_reqs(content)
+          json = JSON.parse(content)
+
+          NpmAndYarn::FileParser::DEPENDENCY_TYPES.each do |type|
+            json.fetch(type, {}).each do |nm, requirement|
+              next unless requirement == "latest"
+
+              json[type][nm] = "*"
+            end
+          end
+
+          json.to_json
+        end
+
         def replace_ssh_sources(content)
           updated_content = content
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.112.3
+  version: 0.112.4
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.3
+        version: 0.112.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.3
+        version: 0.112.4
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement