dependabot-npm_and_yarn 0.113.3 → 0.113.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7714376f9aaea75c5e7cddade3dc2a558daf84f1c189a53f0ab79814bdba9708
-  data.tar.gz: 325ac6842f0e62fa60cfb940f56ecefa1231549e2132d99f7ed4903fba3a71d7
+  metadata.gz: 8a9017a5f237612771fdf551da5eaed55fa1d4838b4eabf9d4cfcc756d5cd6cf
+  data.tar.gz: e2b2d8751f6afd28fb5c2f81a21db5f2e51d587b0c01de9940858c953b72cdf8
 SHA512:
-  metadata.gz: 4ee264c2cf66455545da8572d913a2e78b28b55ae13dfbd753f1411e484be2ca08e8dcfe0622d26b5997cc77e837313f14291357044af1f39223a3e3841232d7
-  data.tar.gz: c944eac6ec261393f9201408e7ddb7f6a2b61eafa73bb17e28955d4d08b41438824e23e49d4a9899de7f7e0dbe1fbe79138e90f3fb1bade9f83ef8678710f689
+  metadata.gz: e3c82abdf1efa61e7f4841b2a9e8eea221852d376cce2ab4eee146645b700a349a52bc8d6a20335cfbb3b6debe12cb0410cc9a8cb572145dab7c20c9005f3c6e
+  data.tar.gz: dd25f70d2771bbd0f9812a2a4171efbe63a8ba8f84bf1d3176d51a3221d7ba3b0163209b362912bca18929f29ec8cc2c357403b79511d03821908467629a3133

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -216,7 +216,7 @@ module Dependabot
 
           version = t.name.match(Dependabot::GitCommitChecker::VERSION_REGEX).
                     named_captures.fetch("version")
-          next unless NpmAndYarn::Version.correct?(version)
+          next unless version_class.correct?(version)
 
           return version
         end
@@ -233,11 +233,10 @@ module Dependabot
           manifest_name: manifest_name
         )&.fetch("version", nil)
 
-        return unless lock_version
-        return if lock_version.include?("://")
-        return if lock_version.include?("file:")
-        return if lock_version.include?("link:")
-        return if lock_version.include?("#")
+        # This line is to guard against improperly formatted versions in a
+        # lockfile, such as additional characters. NPM/yarn fixes these when
+        # running an update, so we can safely ignore these versions.
+        return unless version_class.correct?(lock_version)
 
         lock_version
       end
@@ -337,6 +336,10 @@ module Dependabot
             ].compact
           end
       end
+
+      def version_class
+        NpmAndYarn::Version
+      end
     end
   end
 end

data/lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb

@@ -153,12 +153,12 @@ module Dependabot
         end
 
         def semver_version_for(version_string)
-          return unless version_string
+          # The next two lines are to guard against improperly formatted
+          # versions in a lockfile, such as an empty string or additional
+          # characters. NPM/yarn fixes these when running an update, so we can
+          # safely ignore these versions.
           return if version_string == ""
-          return if version_string.include?("://")
-          return if version_string.include?("file:")
-          return if version_string.include?("link:")
-          return if version_string.include?("#")
+          return unless version_class.correct?(version_string)
 
           version_string
         end
@@ -216,6 +216,10 @@ module Dependabot
             dependency_files.
             select { |f| f.name.end_with?("npm-shrinkwrap.json") }
         end
+
+        def version_class
+          NpmAndYarn::Version
+        end
       end
     end
   end

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -54,6 +54,10 @@ module Dependabot
         latest_version_finder.latest_version_with_no_unlock
       end
 
+      def latest_resolvable_previous_version
+        version_resolver.latest_resolvable_previous_version
+      end
+
       def updated_requirements
         resolvable_version =
           if preferred_resolvable_version.is_a?(version_class)
@@ -104,17 +108,19 @@ module Dependabot
 
       def build_updated_dependency(update_details)
         original_dep = update_details.fetch(:dependency)
+        version = update_details.fetch(:version).to_s
+        previous_version = update_details.fetch(:previous_version)&.to_s
 
         Dependency.new(
           name: original_dep.name,
-          version: update_details.fetch(:version).to_s,
+          version: version,
           requirements: RequirementsUpdater.new(
             requirements: original_dep.requirements,
             updated_source: original_dep == dependency ? updated_source : nil,
-            latest_resolvable_version: update_details[:version].to_s,
+            latest_resolvable_version: version,
             update_strategy: requirements_update_strategy
           ).updated_requirements,
-          previous_version: original_dep.version,
+          previous_version: previous_version,
           previous_requirements: original_dep.requirements,
           package_manager: original_dep.package_manager
         )

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -73,13 +73,19 @@ module Dependabot
           # our problem, so we quietly return `nil` here.
         end
 
+        def possible_previous_versions_with_details
+          @possible_previous_versions_with_details ||= begin
+            npm_details.fetch("versions", {}).
+              transform_keys { |k| version_class.new(k) }.
+              reject { |v, _| v.prerelease? && !related_to_current_pre?(v) }.
+              sort_by(&:first).reverse
+          end
+        end
+
         def possible_versions_with_details
-          npm_details.fetch("versions", {}).
+          possible_previous_versions_with_details.
             reject { |_, details| details["deprecated"] }.
-            transform_keys { |k| version_class.new(k) }.
-            reject { |k, _| k.prerelease? && !related_to_current_pre?(k) }.
-            reject { |k, _| ignore_reqs.any? { |r| r.satisfied_by?(k) } }.
-            sort_by(&:first).reverse
+            reject { |v, _| ignore_reqs.any? { |r| r.satisfied_by?(v) } }
         end
 
         def possible_versions

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -73,6 +73,10 @@ module Dependabot
           true
         end
 
+        def latest_resolvable_previous_version
+          resolve_latest_previous_version(dependency)
+        end
+
         def dependency_updates_from_full_unlock
           return if git_dependency?(dependency)
           if part_of_tightly_locked_monorepo?
@@ -80,8 +84,11 @@ module Dependabot
           end
           return if newly_broken_peer_reqs_from_dep.any?
 
-          updates =
-            [{ dependency: dependency, version: latest_allowable_version }]
+          updates = [{
+            dependency: dependency,
+            version: latest_allowable_version,
+            previous_version: latest_resolvable_previous_version
+          }]
           newly_broken_peer_reqs_on_dep.each do |peer_req|
             dep_name = peer_req.fetch(:requiring_dep_name)
             dep = top_level_dependencies.find { |d| d.name == dep_name }
@@ -94,7 +101,11 @@ module Dependabot
               latest_version_of_dep_with_satisfied_peer_reqs(dep)
             return nil unless updated_version
 
-            updates << { dependency: dep, version: updated_version }
+            updates << {
+              dependency: dep,
+              version: updated_version,
+              previous_version: resolve_latest_previous_version(dep)
+            }
           end
           updates.uniq
         end
@@ -115,6 +126,31 @@ module Dependabot
             )
         end
 
+        def resolve_latest_previous_version(dep)
+          if dep.version && version_class.correct?(dep.version)
+            return version_class.new(dep.version)
+          end
+
+          @resolve_latest_previous_version ||= {}
+          @resolve_latest_previous_version[dep] ||= begin
+            relevant_versions = latest_version_finder(dependency).
+                                possible_previous_versions_with_details.
+                                map(&:first)
+            reqs = dep.requirements.map { |r| r[:requirement] }.compact.
+                   map { |r| requirement_class.requirements_array(r) }
+
+            # Pick the lowest version from the max possible version from all
+            # requirements. This matches the logic when combining the same
+            # dependency in DependencySet from multiple manifest files where we
+            # pick the lowest version from the duplicates.
+            reqs.flat_map do |req|
+              relevant_versions.select do |version|
+                req.any? { |r| r.satisfied_by?(version) }
+              end.max
+            end.min
+          end
+        end
+
         def part_of_tightly_locked_monorepo?
           monorepo_dep_names =
             TIGHTLY_COUPLED_MONOREPOS.values.
@@ -149,7 +185,11 @@ module Dependabot
               find { |v| v == latest_allowable_version }
             next unless updated_version
 
-            updates << { dependency: dep, version: updated_version }
+            updates << {
+              dependency: dep,
+              version: updated_version,
+              previous_version: resolve_latest_previous_version(dep)
+            }
           end
 
           updates

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.113.3
+  version: 0.113.4
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-09-26 00:00:00.000000000 Z
+date: 2019-09-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.113.3
+        version: 0.113.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.113.3
+        version: 0.113.4
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement