dependabot-npm_and_yarn 0.214.0 → 0.215.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f056274186e20cfd09b6ed8bbf84249b6676461533bb76de51ecf4025e189a6
-  data.tar.gz: 4e30b85987104e3d79fb89d62d51e2dbff8c57337700b6a646633feaae47aadf
+  metadata.gz: ab218ae4b2f9134c67ada69180e938eae5fae986f8fe340347b1e8bac37395cd
+  data.tar.gz: 1ccf4e04ea21683fb92133dd8491dc005e06b57c8d00d7922704cd7749208378
 SHA512:
-  metadata.gz: fa8d78e12bb014909be03e084887d429f9bd2295d69f6cff6df0f9058c4a8e49e19c465470659010917be9c13c7a95a57ad970b2875e0be8fb2b050755b89a84
-  data.tar.gz: 54d9510b40145d16a62453ef2613503fcc87f336c14bd5a0809c71dfa99242cc91c3722504d87d737af3a0213ecc2383081a129a459124dc2079df91009a4ac9
+  metadata.gz: 572b409e78fd0ee17ab23164240ba4ac6364c73237011f7d799abad39d9c1acc47710094bac6c13afc6d7be4a4851b77fe546d4aa35974b2ad44e6c0494a0d71
+  data.tar.gz: ae73b9b051c07d6d58d310087865020a4888155ac3464ffc3a9f2565d4e02f3af6e48f0c5ffb11ef9ce38d5a871c0e0d25316f5bc8952aa36edf199e494fea39

data/helpers/package-lock.json

@@ -7,7 +7,7 @@
       "name": "@dependabot/helper",
       "dependencies": {
         "@dependabot/yarn-lib": "^1.22.19",
-        "@npmcli/arborist": "^6.1.3",
+        "@npmcli/arborist": "^6.1.4",
         "detect-indent": "^6.1.0",
         "nock": "^13.2.9",
         "npm": "6.14.17",
@@ -17,7 +17,7 @@
         "helper": "run.js"
       },
       "devDependencies": {
-        "eslint": "^8.28.0",
+        "eslint": "^8.29.0",
         "eslint-config-prettier": "^8.5.0",
         "jest": "^29.3.1",
         "prettier": "^2.8.0",
@@ -1709,9 +1709,9 @@
       }
     },
     "node_modules/@npmcli/arborist": {
-      "version": "6.1.3",
-      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-6.1.3.tgz",
-      "integrity": "sha512-oPYO8WO21aB9ojhREzCbzdNnR+SNuloOtxqQ0Q4Mj8tZuUPdTS5SuatSIpPGKpdtpLi5642hr2sirrikqj33Vg==",
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-6.1.4.tgz",
+      "integrity": "sha512-lEYtEydnF+N5kkGa6wdjH80js//DcCT4lovuaXMRSPthhXv8sqYAzRGljboF3p+MlcoTOQVS7wzfhUbbUf57nA==",
       "dependencies": {
         "@isaacs/string-locale-compare": "^1.1.0",
         "@npmcli/fs": "^3.1.0",
@@ -3324,9 +3324,9 @@
       }
     },
     "node_modules/decode-uri-component": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz",
-      "integrity": "sha1-6zkTMzRYd1y4TNGh+uBiEGu4dUU=",
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.2.tgz",
+      "integrity": "sha512-FqUYQ+8o158GyGTrMFJms9qh3CqTKvAqgqsTnkLI8sKu0028orqBhxNMFkFen0zGyg6epACD32pjVk58ngIErQ==",
       "engines": {
         "node": ">=0.10"
       }
@@ -3567,9 +3567,9 @@
       }
     },
     "node_modules/eslint": {
-      "version": "8.28.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.28.0.tgz",
-      "integrity": "sha512-S27Di+EVyMxcHiwDrFzk8dJYAaD+/5SoWKxL1ri/71CRHsnJnRDPNt2Kzj24+MT9FDupf4aqqyqPrvI8MvQ4VQ==",
+      "version": "8.29.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.29.0.tgz",
+      "integrity": "sha512-isQ4EEiyUjZFbEKvEGJKKGBwXtvXX+zJbkVKCgTuB9t/+jUBcy8avhkEwWJecI15BkRkOYmvIM5ynbhRjEkoeg==",
       "dev": true,
       "dependencies": {
         "@eslint/eslintrc": "^1.3.3",
@@ -15739,9 +15739,9 @@
       }
     },
     "@npmcli/arborist": {
-      "version": "6.1.3",
-      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-6.1.3.tgz",
-      "integrity": "sha512-oPYO8WO21aB9ojhREzCbzdNnR+SNuloOtxqQ0Q4Mj8tZuUPdTS5SuatSIpPGKpdtpLi5642hr2sirrikqj33Vg==",
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-6.1.4.tgz",
+      "integrity": "sha512-lEYtEydnF+N5kkGa6wdjH80js//DcCT4lovuaXMRSPthhXv8sqYAzRGljboF3p+MlcoTOQVS7wzfhUbbUf57nA==",
       "requires": {
         "@isaacs/string-locale-compare": "^1.1.0",
         "@npmcli/fs": "^3.1.0",
@@ -17002,9 +17002,9 @@
       }
     },
     "decode-uri-component": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz",
-      "integrity": "sha1-6zkTMzRYd1y4TNGh+uBiEGu4dUU="
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.2.tgz",
+      "integrity": "sha512-FqUYQ+8o158GyGTrMFJms9qh3CqTKvAqgqsTnkLI8sKu0028orqBhxNMFkFen0zGyg6epACD32pjVk58ngIErQ=="
     },
     "dedent": {
       "version": "0.7.0",
@@ -17196,9 +17196,9 @@
       "integrity": "sha1-G2HAViGQqN/2rjuyzwIAyhMLhtQ="
     },
     "eslint": {
-      "version": "8.28.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.28.0.tgz",
-      "integrity": "sha512-S27Di+EVyMxcHiwDrFzk8dJYAaD+/5SoWKxL1ri/71CRHsnJnRDPNt2Kzj24+MT9FDupf4aqqyqPrvI8MvQ4VQ==",
+      "version": "8.29.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.29.0.tgz",
+      "integrity": "sha512-isQ4EEiyUjZFbEKvEGJKKGBwXtvXX+zJbkVKCgTuB9t/+jUBcy8avhkEwWJecI15BkRkOYmvIM5ynbhRjEkoeg==",
       "dev": true,
       "requires": {
         "@eslint/eslintrc": "^1.3.3",

data/helpers/package.json

@@ -10,14 +10,14 @@
   },
   "dependencies": {
     "@dependabot/yarn-lib": "^1.22.19",
-    "@npmcli/arborist": "^6.1.3",
+    "@npmcli/arborist": "^6.1.4",
     "detect-indent": "^6.1.0",
     "nock": "^13.2.9",
     "npm": "6.14.17",
     "semver": "^7.3.8"
   },
   "devDependencies": {
-    "eslint": "^8.28.0",
+    "eslint": "^8.29.0",
     "eslint-config-prettier": "^8.5.0",
     "jest": "^29.3.1",
     "prettier": "^2.8.0",

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -205,7 +205,19 @@ module Dependabot
             "--ignore-scripts",
             "--package-lock-only"
           ].join(" ")
-          SharedHelpers.run_shell_command(command)
+
+          fingerprint = [
+            "npm",
+            "install",
+            "<install_args>",
+            "--force",
+            "--dry-run",
+            "false",
+            "--ignore-scripts",
+            "--package-lock-only"
+          ].join(" ")
+
+          SharedHelpers.run_shell_command(command, fingerprint: fingerprint)
           { lockfile_basename => File.read(lockfile_basename) }
         end
 
@@ -223,7 +235,7 @@ module Dependabot
 
         def run_npm8_subdependency_updater(sub_dependencies:)
           dependency_names = sub_dependencies.map(&:name)
-          SharedHelpers.run_shell_command(NativeHelpers.npm8_subdependency_update_command(dependency_names))
+          NativeHelpers.run_npm8_subdependency_update_command(dependency_names)
           { lockfile_basename => File.read(lockfile_basename) }
         end
 

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -149,16 +149,18 @@ module Dependabot
           # lockfile in the right state. Otherwise we'll need to manually update
           # the lockfile.
 
-          command = if top_level_dependency_updates.all? { |dep| requirements_changed?(dep[:name]) }
-                      "yarn install #{Helpers.yarn_berry_args}".strip
-                    else
-                      updates = top_level_dependency_updates.collect do |dep|
-                        dep[:name]
-                      end
-
-                      "yarn up -R #{updates.join(' ')} #{Helpers.yarn_berry_args}".strip
-                    end
-          Helpers.run_yarn_commands(command)
+          if top_level_dependency_updates.all? { |dep| requirements_changed?(dep[:name]) }
+            Helpers.run_yarn_command("yarn install #{yarn_berry_args}".strip)
+          else
+            updates = top_level_dependency_updates.collect do |dep|
+              dep[:name]
+            end
+
+            Helpers.run_yarn_command(
+              "yarn up -R #{updates.join(' ')} #{yarn_berry_args}".strip,
+              fingerprint: "yarn up -R <dependency_names> #{yarn_berry_args}".strip
+            )
+          end
           { yarn_lock.name => File.read(yarn_lock.name) }
         end
 
@@ -171,14 +173,20 @@ module Dependabot
           dep = sub_dependencies.first
           update = "#{dep.name}@#{dep.version}"
 
-          Helpers.run_yarn_commands(
-            "yarn add #{update} #{Helpers.yarn_berry_args}".strip,
-            "yarn dedupe #{dep.name} #{Helpers.yarn_berry_args}".strip,
-            "yarn remove #{dep.name} #{Helpers.yarn_berry_args}".strip
-          )
+          commands = [
+            ["yarn add #{update} #{yarn_berry_args}".strip, "yarn add <update> #{yarn_berry_args}".strip],
+            ["yarn dedupe #{dep.name} #{yarn_berry_args}".strip, "yarn dedupe <dep_name> #{yarn_berry_args}".strip],
+            ["yarn remove #{dep.name} #{yarn_berry_args}".strip, "yarn remove <dep_name> #{yarn_berry_args}".strip]
+          ]
+
+          Helpers.run_yarn_commands(*commands)
           { yarn_lock.name => File.read(yarn_lock.name) }
         end
 
+        def yarn_berry_args
+          Helpers.yarn_berry_args
+        end
+
         def run_yarn_top_level_updater(top_level_dependency_updates:)
           SharedHelpers.run_helper_subprocess(
             command: NativeHelpers.helper_path,

data/lib/dependabot/npm_and_yarn/file_updater.rb

@@ -64,10 +64,7 @@ module Dependabot
         pnp_updater.updated_vendor_cache_files(base_directory: base_dir).each do |file|
           updated_files << file if file.name == ".pnp.cjs" || file.name == ".pnp.data.json"
         end
-        # updated .pnp.cjs means zero install, include cache
-        if updated_files.find { |f| f.name == ".pnp.cjs" }
-          vendor_updater.updated_vendor_cache_files(base_directory: base_dir).each { |file| updated_files << file }
-        end
+        vendor_updater.updated_vendor_cache_files(base_directory: base_dir).each { |file| updated_files << file }
         install_state_updater.updated_vendor_cache_files(base_directory: base_dir).each do |file|
           updated_files << file
         end

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -40,12 +40,19 @@ module Dependabot
         File.exist?(".pnp.cjs")
       end
 
+      def self.yarn_offline_cache?
+        yarn_cache_dir = fetch_yarnrc_yml_value("cacheFolder", ".yarn/cache")
+        File.exist?(yarn_cache_dir) && (fetch_yarnrc_yml_value("nodeLinker", "") == "node-modules")
+      end
+
       def self.yarn_berry_args
         if yarn_major_version == 2
           ""
-        elsif yarn_major_version >= 3 && yarn_zero_install?
+        elsif yarn_major_version >= 3 && (yarn_zero_install? || yarn_offline_cache?)
           "--mode=skip-build"
         else
+          # We only want this mode if the cache is not being updated/managed
+          # as this improperly leaves old versions in the cache
           "--mode=update-lockfile"
         end
       end
@@ -78,13 +85,13 @@ module Dependabot
       # contain malicious code.
       def self.run_yarn_commands(*commands)
         setup_yarn_berry
-        commands.each { |cmd| SharedHelpers.run_shell_command(cmd) }
+        commands.each { |cmd, fingerprint| SharedHelpers.run_shell_command(cmd, fingerprint: fingerprint) }
       end
 
       # Run a single yarn command returning stdout/stderr
-      def self.run_yarn_command(command)
+      def self.run_yarn_command(command, fingerprint: nil)
         setup_yarn_berry
-        SharedHelpers.run_shell_command(command)
+        SharedHelpers.run_shell_command(command, fingerprint: fingerprint)
       end
 
       def self.dependencies_with_all_versions_metadata(dependency_set)

data/lib/dependabot/npm_and_yarn/native_helpers.rb

@@ -14,14 +14,14 @@ module Dependabot
         File.join(__dir__, "../../../helpers")
       end
 
-      def self.npm8_subdependency_update_command(dependency_names)
+      def self.run_npm8_subdependency_update_command(dependency_names)
         # NOTE: npm options
         # - `--force` ignores checks for platform (os, cpu) and engines
         # - `--dry-run=false` the updater sets a global .npmrc with dry-run: true to
         #   work around an issue in npm 6, we don't want that here
         # - `--ignore-scripts` disables prepare and prepack scripts which are run
         #   when installing git dependencies
-        [
+        command = [
           "npm",
           "update",
           *dependency_names,
@@ -31,6 +31,19 @@ module Dependabot
           "--ignore-scripts",
           "--package-lock-only"
         ].join(" ")
+
+        fingerprint = [
+          "npm",
+          "update",
+          "<dependency_names>",
+          "--force",
+          "--dry-run",
+          "false",
+          "--ignore-scripts",
+          "--package-lock-only"
+        ].join(" ")
+
+        SharedHelpers.run_shell_command(command, fingerprint: fingerprint)
       end
     end
   end

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -116,8 +116,9 @@ module Dependabot
         def run_yarn_berry_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
-              Helpers.run_yarn_commands(
-                "yarn up -R #{dependency.name} #{Helpers.yarn_berry_args}".strip
+              Helpers.run_yarn_command(
+                "yarn up -R #{dependency.name} #{Helpers.yarn_berry_args}".strip,
+                fingerprint: "yarn up -R <dependency_name> #{Helpers.yarn_berry_args}".strip
               )
               { lockfile_name => File.read(lockfile_name) }
             end
@@ -130,7 +131,7 @@ module Dependabot
               npm_version = Dependabot::NpmAndYarn::Helpers.npm_version(lockfile_content)
 
               if npm_version == "npm8"
-                SharedHelpers.run_shell_command(NativeHelpers.npm8_subdependency_update_command([dependency.name]))
+                NativeHelpers.run_npm8_subdependency_update_command([dependency.name])
                 { lockfile_name => File.read(lockfile_name) }
               else
                 SharedHelpers.run_helper_subprocess(

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -279,9 +279,7 @@ module Dependabot
 
       def latest_version_for_git_dependency
         @latest_version_for_git_dependency ||=
-          if git_branch_or_ref_in_latest_release?
-            latest_released_version
-          elsif version_class.correct?(dependency.version)
+          if version_class.correct?(dependency.version)
             latest_git_version_details[:version] &&
               version_class.new(latest_git_version_details[:version])
           else
@@ -294,26 +292,9 @@ module Dependabot
           latest_version_finder.latest_version_from_registry
       end
 
-      def should_switch_source_from_git_to_registry?
-        return false unless git_dependency?
-        return false unless git_branch_or_ref_in_latest_release?
-        return false if latest_version_for_git_dependency.nil?
-
-        version_class.correct?(latest_version_for_git_dependency)
-      end
-
-      def git_branch_or_ref_in_latest_release?
-        return false unless latest_released_version
-
-        return @git_branch_or_ref_in_latest_release if defined?(@git_branch_or_ref_in_latest_release)
-
-        @git_branch_or_ref_in_latest_release ||=
-          git_commit_checker.branch_or_ref_in_release?(latest_released_version)
-      end
-
       def latest_version_details
         @latest_version_details ||=
-          if git_dependency? && !should_switch_source_from_git_to_registry?
+          if git_dependency?
             latest_git_version_details
           else
             { version: latest_released_version }
@@ -389,9 +370,6 @@ module Dependabot
         # Never need to update source, unless a git_dependency
         return dependency_source_details unless git_dependency?
 
-        # Source becomes `nil` if switching to default rubygems
-        return nil if should_switch_source_from_git_to_registry?
-
         # Update the git tag if updating a pinned version
         if git_commit_checker.pinned_ref_looks_like_version? &&
            !git_commit_checker.local_tag_for_latest_version.nil?

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.214.0
+  version: 0.215.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-12-01 00:00:00.000000000 Z
+date: 2022-12-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.214.0
+        version: 0.215.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.214.0
+        version: 0.215.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement