dependabot-npm_and_yarn 0.216.1 → 0.216.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 239ea74bfa12a1156995f658945575829fd543be7c7db2986fe00ad6124b111d
-  data.tar.gz: 9f65a09fc63f0579d77ce551c1e1929edfe347598741d311112a27f44d020252
+  metadata.gz: 2df51373de95ce542233cbb690f059ee015534e3e57d69470031491f9dd89794
+  data.tar.gz: c8e33eea70d6765a96e87248ebc4b5f8cedb49ea03e9c1abf79bdaddfc6cda00
 SHA512:
-  metadata.gz: 3d81beca1ebbdc44ced78f2f375dc9f1ef39558021dba7c1982fea116bce47a906926d429c38787354439b8828efa12516d165e3781f215cb83a30c99c375ea9
-  data.tar.gz: 200a5946ddd36daa5b687a634f79cb5c84718f94b771c1b6e5a04d6ab8654d82362d6b4c6c8c1016e313dd12a633452116dfe9329c5dc8248fdecd47d25dc735
+  metadata.gz: 27c3502dd326b7b82738fa402d2e46c6054750af2e029b08f5c97b8f51e946c7090754e0679050116bbb6f572635aea77b77f4951ff19d703ff090e5308a5033
+  data.tar.gz: bdbfbb9f4896a58635cc9eef900f00a6e2ef02c438bb8a072fa83c199d532c9c92742ed805e8e39ddb3a5b746f50a457a7a29c4963870eddb61d0c4b7cc15957

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -10,7 +10,7 @@ require "dependabot/npm_and_yarn/file_parser/lockfile_parser"
 
 module Dependabot
   module NpmAndYarn
-    class FileFetcher < Dependabot::FileFetchers::Base
+    class FileFetcher < Dependabot::FileFetchers::Base # rubocop:disable Metrics/ClassLength
       require_relative "file_fetcher/path_dependency_builder"
 
       # Npm always prefixes file paths in the lockfile "version" with "file:"
@@ -22,6 +22,7 @@ module Dependabot
       # "yarn link", e.g. "link:react"
       PATH_DEPENDENCY_STARTS = %w(file: link:. link:/ link:~/ / ./ ../ ~/).freeze
       PATH_DEPENDENCY_CLEAN_REGEX = /^file:|^link:/
+      DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org"
 
       def self.required_files_in?(filenames)
         filenames.include?("package.json")
@@ -55,6 +56,7 @@ module Dependabot
         package_managers["npm"] = Helpers.npm_version_numeric(package_lock.content) if package_lock
         package_managers["yarn"] = yarn_version if yarn_version
         package_managers["shrinkwrap"] = 1 if shrinkwrap
+        package_managers["unknown"] = 1 if package_managers.empty?
 
         {
           ecosystem: "npm",
@@ -85,25 +87,41 @@ module Dependabot
 
       # If every entry in the lockfile uses the same registry, we can infer
       # that there is a global .npmrc file, so add it here as if it were in the repo.
-      def inferred_npmrc
+
+      def inferred_npmrc # rubocop:disable Metrics/PerceivedComplexity
         return @inferred_npmrc if defined?(@inferred_npmrc)
         return @inferred_npmrc = nil unless npmrc.nil? && package_lock
 
         known_registries = []
-        JSON.parse(package_lock.content).fetch("dependencies", {}).each do |_name, details|
-          resolved = details.fetch("resolved", "https://registry.npmjs.org")
+        JSON.parse(package_lock.content).fetch("dependencies", {}).each do |dependency_name, details|
+          resolved = details.fetch("resolved", DEFAULT_NPM_REGISTRY)
+
           begin
             uri = URI.parse(resolved)
           rescue URI::InvalidURIError
             # Ignoring non-URIs since they're not registries.
-            # This can happen if resolved is false, for instance.
+            # This can happen if resolved is `false`, for instance
+            # npm6 bug https://github.com/npm/cli/issues/1138
             next
           end
-          # Check for scheme since path dependencies will not have one
-          known_registries << "#{uri.scheme}://#{uri.host}" if uri.scheme && uri.host
+
+          next unless uri.scheme && uri.host
+
+          known_registry = "#{uri.scheme}://#{uri.host}"
+          path = uri.path
+
+          next unless path
+
+          index = path.index(dependency_name)
+          if index
+            registry_base_path = path[0...index].delete_suffix("/")
+            known_registry << registry_base_path
+          end
+
+          known_registries << known_registry
         end
 
-        if known_registries.uniq.length == 1 && known_registries.first != "https://registry.npmjs.org"
+        if known_registries.uniq.length == 1 && known_registries.first != DEFAULT_NPM_REGISTRY
           Dependabot.logger.info("Inferred global NPM registry is: #{known_registries.first}")
           return @inferred_npmrc = Dependabot::DependencyFile.new(
             name: ".npmrc",
@@ -121,7 +139,7 @@ module Dependabot
         if (package_manager = package.fetch("packageManager", nil))
           get_yarn_version_from_package_json(package_manager)
         elsif yarn_lock
-          1
+          Helpers.yarn_version_numeric(yarn_lock)
         end
       end
 

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -16,6 +16,14 @@ module Dependabot
         6
       end
 
+      def self.yarn_version_numeric(yarn_lock)
+        if yarn_berry?(yarn_lock)
+          3
+        else
+          1
+        end
+      end
+
       def self.fetch_yarnrc_yml_value(key, default_value)
         if File.exist?(".yarnrc.yml") && (yarnrc = YAML.load_file(".yarnrc.yml"))
           yarnrc.fetch(key, default_value)

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -375,11 +375,11 @@ module Dependabot
         end
 
         def version_class
-          NpmAndYarn::Version
+          dependency.version_class
         end
 
         def requirement_class
-          NpmAndYarn::Requirement
+          dependency.requirement_class
         end
 
         def npmrc_file

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -145,7 +145,7 @@ module Dependabot
         end
 
         def version_class
-          NpmAndYarn::Version
+          dependency.version_class
         end
 
         def updated_dependency

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -642,11 +642,11 @@ module Dependabot
         end
 
         def version_class
-          NpmAndYarn::Version
+          dependency.version_class
         end
 
         def requirement_class
-          NpmAndYarn::Requirement
+          dependency.requirement_class
         end
 
         def version_regex

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.216.1
+  version: 0.216.2
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-04-14 00:00:00.000000000 Z
+date: 2023-04-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.216.1
+        version: 0.216.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.216.1
+        version: 0.216.2
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement