dependabot-npm_and_yarn 0.284.0 → 0.285.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9c1223098b68d19c916ca4dbc2afa1aad4dd821156d85050f04502dcd41f5b03
-  data.tar.gz: f74ab5771e2cfcdeb1ce271b0d27d9ecf5625c698996b9d7d3889b2948f4cea8
+  metadata.gz: bf3271285f39bf1e7f91fad3995676126cf0b580184e741e1fe10b5d295a5f4e
+  data.tar.gz: 91d70c4bb5a9454ffb50e38fdcb92957649a8211a1a27349b023d9a2a104ac26
 SHA512:
-  metadata.gz: 169c3e68774b3bbe08744bf244a29a6be8ef3948279297ce176b9995703ba2906b19765170c246ad298a6fe785d601ee36a3704e45c7a52535b447b0a149b9f9
-  data.tar.gz: 38506739cd632c0473892270620882da79a1368cc5c5e1df0de49de5483590c4cd43b602d4b50becdc613d25e3b4cda547dbadb05df6ecd2a4b2e5322a7bfe0d
+  metadata.gz: c3f3efeb4f22bfaad116b86ec6dcede6dfd378c2e669e9293f521ff9d285b54b7a072ce888c2eb0d44ef64605f144d9deb5f5ce9b723ee44c00366147f065474
+  data.tar.gz: 9426fe3a37b2b6af1c86dc79e7f596406a59329a0bc0429065387d7fe3a6cff987b69865f49c21df3bf90c8e46687dd291fc2a1a12f65fe8621487c7e8e56433

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -182,71 +182,93 @@ module Dependabot
 
       sig { returns(T.nilable(T.any(Integer, String))) }
       def npm_version
-        @npm_version ||= T.let(package_manager.setup("npm"), T.nilable(T.any(Integer, String)))
+        @npm_version ||= T.let(package_manager_helper.setup(NpmPackageManager::NAME), T.nilable(T.any(Integer, String)))
       end
 
       sig { returns(T.nilable(T.any(Integer, String))) }
       def yarn_version
-        @yarn_version ||= T.let(package_manager.setup("yarn"), T.nilable(T.any(Integer, String)))
+        @yarn_version ||= T.let(
+          package_manager_helper.setup(YarnPackageManager::NAME),
+          T.nilable(T.any(Integer, String))
+        )
       end
 
       sig { returns(T.nilable(T.any(Integer, String))) }
       def pnpm_version
-        @pnpm_version ||= T.let(package_manager.setup("pnpm"), T.nilable(T.any(Integer, String)))
+        @pnpm_version ||= T.let(
+          package_manager_helper.setup(PNPMPackageManager::NAME),
+          T.nilable(T.any(Integer, String))
+        )
       end
 
-      sig { returns(PackageManager) }
-      def package_manager
-        @package_manager ||= T.let(PackageManager.new(
-                                     parsed_package_json,
-                                     lockfiles: { npm: package_lock || shrinkwrap, yarn: yarn_lock, pnpm: pnpm_lock }
-                                   ), T.nilable(PackageManager))
+      sig { returns(PackageManagerHelper) }
+      def package_manager_helper
+        @package_manager_helper ||= T.let(
+          PackageManagerHelper.new(
+            parsed_package_json,
+            lockfiles: lockfiles
+          ), T.nilable(PackageManagerHelper)
+        )
+      end
+
+      sig { returns(T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)]) }
+      def lockfiles
+        {
+          npm: package_lock || shrinkwrap,
+          yarn: yarn_lock,
+          pnpm: pnpm_lock
+        }
       end
 
       sig { returns(DependencyFile) }
       def package_json
-        @package_json ||= T.let(fetch_file_from_host("package.json"), T.nilable(DependencyFile))
+        @package_json ||= T.let(fetch_file_from_host(MANIFEST_FILENAME), T.nilable(DependencyFile))
       end
 
       sig { returns(T.nilable(DependencyFile)) }
       def package_lock
         return @package_lock if defined?(@package_lock)
 
-        @package_lock ||= T.let(fetch_file_if_present("package-lock.json"), T.nilable(DependencyFile))
+        @package_lock ||= T.let(fetch_file_if_present(NpmPackageManager::LOCKFILE_NAME), T.nilable(DependencyFile))
       end
 
       sig { returns(T.nilable(DependencyFile)) }
       def yarn_lock
         return @yarn_lock if defined?(@yarn_lock)
 
-        @yarn_lock ||= T.let(fetch_file_if_present("yarn.lock"), T.nilable(DependencyFile))
+        @yarn_lock ||= T.let(fetch_file_if_present(YarnPackageManager::LOCKFILE_NAME), T.nilable(DependencyFile))
       end
 
       sig { returns(T.nilable(DependencyFile)) }
       def pnpm_lock
         return @pnpm_lock if defined?(@pnpm_lock)
 
-        @pnpm_lock ||= T.let(fetch_file_if_present("pnpm-lock.yaml"), T.nilable(DependencyFile))
+        @pnpm_lock ||= T.let(fetch_file_if_present(PNPMPackageManager::LOCKFILE_NAME), T.nilable(DependencyFile))
       end
 
       sig { returns(T.nilable(DependencyFile)) }
       def shrinkwrap
         return @shrinkwrap if defined?(@shrinkwrap)
 
-        @shrinkwrap ||= T.let(fetch_file_if_present("npm-shrinkwrap.json"), T.nilable(DependencyFile))
+        @shrinkwrap ||= T.let(
+          fetch_file_if_present(
+            NpmPackageManager::SHRINKWRAP_LOCKFILE_NAME
+          ),
+          T.nilable(DependencyFile)
+        )
       end
 
       sig { returns(T.nilable(DependencyFile)) }
       def npmrc
         return @npmrc if defined?(@npmrc)
 
-        @npmrc ||= T.let(fetch_support_file(".npmrc"), T.nilable(DependencyFile))
+        @npmrc ||= T.let(fetch_support_file(NpmPackageManager::RC_FILENAME), T.nilable(DependencyFile))
 
         return @npmrc if @npmrc || directory == "/"
 
         # Loop through parent directories looking for an npmrc
         (1..directory.split("/").count).each do |i|
-          @npmrc = fetch_file_from_host(("../" * i) + ".npmrc")
+          @npmrc = fetch_file_from_host(("../" * i) + NpmPackageManager::RC_FILENAME)
                    .tap { |f| f.support_file = true }
           break if @npmrc
         rescue Dependabot::DependencyFileNotFound
@@ -261,13 +283,13 @@ module Dependabot
       def yarnrc
         return @yarnrc if defined?(@yarnrc)
 
-        @yarnrc ||= T.let(fetch_support_file(".yarnrc"), T.nilable(DependencyFile))
+        @yarnrc ||= T.let(fetch_support_file(YarnPackageManager::RC_FILENAME), T.nilable(DependencyFile))
 
         return @yarnrc if @yarnrc || directory == "/"
 
         # Loop through parent directories looking for an yarnrc
         (1..directory.split("/").count).each do |i|
-          @yarnrc = fetch_file_from_host(("../" * i) + ".yarnrc")
+          @yarnrc = fetch_file_from_host(("../" * i) + YarnPackageManager::RC_FILENAME)
                     .tap { |f| f.support_file = true }
           break if @yarnrc
         rescue Dependabot::DependencyFileNotFound
@@ -280,21 +302,24 @@ module Dependabot
 
       sig { returns(T.nilable(DependencyFile)) }
       def yarnrc_yml
-        @yarnrc_yml ||= T.let(fetch_support_file(".yarnrc.yml"), T.nilable(DependencyFile))
+        @yarnrc_yml ||= T.let(fetch_support_file(YarnPackageManager::RC_YML_FILENAME), T.nilable(DependencyFile))
       end
 
       sig { returns(T.nilable(DependencyFile)) }
       def pnpm_workspace_yaml
         return @pnpm_workspace_yaml if defined?(@pnpm_workspace_yaml)
 
-        @pnpm_workspace_yaml = T.let(fetch_support_file("pnpm-workspace.yaml"), T.nilable(DependencyFile))
+        @pnpm_workspace_yaml = T.let(
+          fetch_support_file(PNPMPackageManager::PNPM_WS_YML_FILENAME),
+          T.nilable(DependencyFile)
+        )
       end
 
       sig { returns(T.nilable(DependencyFile)) }
       def lerna_json
         return @lerna_json if defined?(@lerna_json)
 
-        @lerna_json = T.let(fetch_support_file("lerna.json"), T.nilable(DependencyFile))
+        @lerna_json = T.let(fetch_support_file(LERNA_JSON_FILENAME), T.nilable(DependencyFile))
       end
 
       sig { returns(T::Array[DependencyFile]) }
@@ -329,7 +354,7 @@ module Dependabot
           filename = path
           # NPM/Yarn support loading path dependencies from tarballs:
           # https://docs.npmjs.com/cli/pack.html
-          filename = File.join(filename, "package.json") unless filename.end_with?(".tgz", ".tar", ".tar.gz")
+          filename = File.join(filename, MANIFEST_FILENAME) unless filename.end_with?(".tgz", ".tar", ".tar.gz")
           cleaned_name = Pathname.new(filename).cleanpath.to_path
           next if fetched_files.map(&:name).include?(cleaned_name)
 
@@ -380,7 +405,7 @@ module Dependabot
       # rubocop:disable Metrics/AbcSize
       sig { params(file: DependencyFile).returns(T::Array[[String, String]]) }
       def path_dependency_details_from_manifest(file)
-        return [] unless file.name.end_with?("package.json")
+        return [] unless file.name.end_with?(MANIFEST_FILENAME)
 
         current_dir = file.name.rpartition("/").first
         current_dir = nil if current_dir == ""
@@ -471,9 +496,9 @@ module Dependabot
         return [] unless package_json
 
         [package_json] + [
-          fetch_file_if_present(File.join(path, "package-lock.json")),
-          fetch_file_if_present(File.join(path, "yarn.lock")),
-          fetch_file_if_present(File.join(path, "npm-shrinkwrap.json"))
+          fetch_file_if_present(File.join(path, NpmPackageManager::LOCKFILE_NAME)),
+          fetch_file_if_present(File.join(path, YarnPackageManager::LOCKFILE_NAME)),
+          fetch_file_if_present(File.join(path, NpmPackageManager::SHRINKWRAP_LOCKFILE_NAME))
         ]
       end
 
@@ -542,7 +567,7 @@ module Dependabot
 
       sig { params(workspace: String).returns(T.nilable(DependencyFile)) }
       def fetch_package_json_if_present(workspace)
-        file = File.join(workspace, "package.json")
+        file = File.join(workspace, MANIFEST_FILENAME)
 
         begin
           fetch_file_from_host(file)
@@ -635,4 +660,4 @@ module Dependabot
 end
 
 Dependabot::FileFetchers
-  .register("npm_and_yarn", Dependabot::NpmAndYarn::FileFetcher)
+  .register(Dependabot::NpmAndYarn::ECOSYSTEM, Dependabot::NpmAndYarn::FileFetcher)

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -19,7 +19,7 @@ require "sorbet-runtime"
 
 module Dependabot
   module NpmAndYarn
-    class FileParser < Dependabot::FileParsers::Base
+    class FileParser < Dependabot::FileParsers::Base # rubocop:disable Metrics/ClassLength
       extend T::Sig
 
       require "dependabot/file_parsers/base/dependency_set"
@@ -78,8 +78,82 @@ module Dependabot
         end
       end
 
+      sig { returns(Ecosystem) }
+      def ecosystem
+        @ecosystem ||= T.let(
+          Ecosystem.new(
+            name: ECOSYSTEM,
+            package_manager: package_manager_helper.package_manager
+          ),
+          T.nilable(Ecosystem)
+        )
+      end
+
       private
 
+      sig { returns(PackageManagerHelper) }
+      def package_manager_helper
+        @package_manager_helper ||= T.let(
+          PackageManagerHelper.new(
+            parsed_package_json,
+            lockfiles: lockfiles
+          ), T.nilable(PackageManagerHelper)
+        )
+      end
+
+      sig { returns(T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)]) }
+      def lockfiles
+        {
+          npm: package_lock || shrinkwrap,
+          yarn: yarn_lock,
+          pnpm: pnpm_lock
+        }
+      end
+
+      sig { returns(T.untyped) }
+      def parsed_package_json
+        JSON.parse(T.must(package_json.content))
+      rescue JSON::ParserError
+        raise Dependabot::DependencyFileNotParseable, package_json.path
+      end
+
+      sig { returns(Dependabot::DependencyFile) }
+      def package_json
+        # Declare the instance variable with T.let and the correct type
+        @package_json ||= T.let(
+          T.must(dependency_files.find { |f| f.name == MANIFEST_FILENAME }),
+          T.nilable(Dependabot::DependencyFile)
+        )
+      end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def shrinkwrap
+        @shrinkwrap ||= T.let(dependency_files.find do |f|
+          f.name == NpmPackageManager::SHRINKWRAP_LOCKFILE_NAME
+        end, T.nilable(Dependabot::DependencyFile))
+      end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def package_lock
+        @package_lock ||= T.let(dependency_files.find do |f|
+          f.name == NpmPackageManager::LOCKFILE_NAME
+        end, T.nilable(Dependabot::DependencyFile))
+      end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def yarn_lock
+        @yarn_lock ||= T.let(dependency_files.find do |f|
+          f.name == YarnPackageManager::LOCKFILE_NAME
+        end, T.nilable(Dependabot::DependencyFile))
+      end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def pnpm_lock
+        @pnpm_lock ||= T.let(dependency_files.find do |f|
+          f.name == PNPMPackageManager::LOCKFILE_NAME
+        end, T.nilable(Dependabot::DependencyFile))
+      end
+
       sig { returns(Dependabot::FileParsers::Base::DependencySet) }
       def manifest_dependencies
         dependency_set = DependencySet.new
@@ -154,7 +228,7 @@ module Dependabot
         Dependency.new(
           name: name,
           version: converted_version,
-          package_manager: "npm_and_yarn",
+          package_manager: ECOSYSTEM,
           requirements: [{
             requirement: requirement_for(requirement),
             file: file.name,
@@ -166,7 +240,10 @@ module Dependabot
 
       sig { override.void }
       def check_required_files
-        raise DependencyFileNotFound.new(nil, "package.json not found.") unless get_original_file("package.json")
+        return if get_original_file(MANIFEST_FILENAME)
+
+        raise DependencyFileNotFound.new(nil,
+                                         "#{MANIFEST_FILENAME} not found.")
       end
 
       sig { params(requirement: String).returns(T::Boolean) }
@@ -186,7 +263,7 @@ module Dependabot
 
       sig { params(requirement: String).returns(T::Boolean) }
       def alias_package?(requirement)
-        requirement.start_with?("npm:")
+        requirement.start_with?("#{NpmPackageManager::NAME}:")
       end
 
       sig { params(requirement: String).returns(T::Boolean) }
@@ -208,7 +285,7 @@ module Dependabot
 
       sig { params(name: String).returns(T::Boolean) }
       def aliased_package_name?(name)
-        name.include?("@npm:")
+        name.include?("@#{NpmPackageManager::NAME}:")
       end
 
       sig { returns(T::Array[String]) }
@@ -370,8 +447,8 @@ module Dependabot
       def sub_package_files
         return T.must(@sub_package_files) if defined?(@sub_package_files)
 
-        files = dependency_files.select { |f| f.name.end_with?("package.json") }
-                                .reject { |f| f.name == "package.json" }
+        files = dependency_files.select { |f| f.name.end_with?(MANIFEST_FILENAME) }
+                                .reject { |f| f.name == MANIFEST_FILENAME }
                                 .reject { |f| f.name.include?("node_modules/") }
         @sub_package_files ||= T.let(files, T.nilable(T::Array[Dependabot::DependencyFile]))
       end
@@ -380,7 +457,7 @@ module Dependabot
       def package_files
         @package_files ||= T.let(
           [
-            dependency_files.find { |f| f.name == "package.json" },
+            dependency_files.find { |f| f.name == MANIFEST_FILENAME },
             *sub_package_files
           ].compact, T.nilable(T::Array[DependencyFile])
         )

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -37,7 +37,7 @@ module Dependabot
       # Determines the npm version depends to the feature flag
       # If the feature flag is enabled, we are going to use the minimum version npm 8
       # Otherwise, we are going to use old versionining npm 6
-      sig { params(lockfile: DependencyFile).returns(Integer) }
+      sig { params(lockfile: T.nilable(DependencyFile)).returns(Integer) }
       def self.npm_version_numeric(lockfile)
         fallback_version_npm8 = Dependabot::Experiments.enabled?(:npm_fallback_version_above_v6)
 
@@ -46,10 +46,15 @@ module Dependabot
         npm_version_numeric_npm6_or_higher(lockfile)
       end
 
-      sig { params(lockfile: DependencyFile).returns(Integer) }
+      sig { params(lockfile: T.nilable(DependencyFile)).returns(Integer) }
       def self.npm_version_numeric_npm6_or_higher(lockfile)
-        lockfile_content = T.must(lockfile.content)
-        return NPM_V8 if JSON.parse(lockfile_content)["lockfileVersion"].to_i >= 2
+        lockfile_content = lockfile&.content
+
+        if lockfile_content.nil? ||
+           lockfile_content.strip.empty? ||
+           JSON.parse(lockfile_content)["lockfileVersion"].to_i >= 2
+          return NPM_V8
+        end
 
         NPM_V6
       rescue JSON::ParserError
@@ -60,9 +65,9 @@ module Dependabot
       # - NPM 7 uses lockfileVersion 2
       # - NPM 8 uses lockfileVersion 2
       # - NPM 9 uses lockfileVersion 3
-      sig { params(lockfile: DependencyFile).returns(Integer) }
+      sig { params(lockfile: T.nilable(DependencyFile)).returns(Integer) }
       def self.npm_version_numeric_npm8_or_higher(lockfile)
-        lockfile_content = lockfile.content
+        lockfile_content = lockfile&.content
 
         # Return default NPM version if there's no lockfile or it's empty
         return NPM_DEFAULT_VERSION if lockfile_content.nil? || lockfile_content.strip.empty?
@@ -85,8 +90,12 @@ module Dependabot
         NPM_DEFAULT_VERSION # Fallback to default npm version if parsing fails
       end
 
-      sig { params(yarn_lock: DependencyFile).returns(Integer) }
+      sig { params(yarn_lock: T.nilable(DependencyFile)).returns(Integer) }
       def self.yarn_version_numeric(yarn_lock)
+        lockfile_content = yarn_lock&.content
+
+        return YARN_DEFAULT_VERSION if lockfile_content.nil? || lockfile_content.strip.empty?
+
         if yarn_berry?(yarn_lock)
           YARN_DEFAULT_VERSION
         else
@@ -97,8 +106,12 @@ module Dependabot
       # Mapping from lockfile versions to PNPM versions is at
       # https://github.com/pnpm/spec/tree/274ff02de23376ad59773a9f25ecfedd03a41f64/lockfile, but simplify it for now.
 
-      sig { params(pnpm_lock: DependencyFile).returns(Integer) }
+      sig { params(pnpm_lock: T.nilable(DependencyFile)).returns(Integer) }
       def self.pnpm_version_numeric(pnpm_lock)
+        lockfile_content = pnpm_lock&.content
+
+        return PNPM_DEFAULT_VERSION if lockfile_content.nil? || lockfile_content.strip.empty?
+
         pnpm_lockfile_version = pnpm_lockfile_version(pnpm_lock).to_f
         return PNPM_V9 if pnpm_lockfile_version >= 9.0
         return PNPM_V8 if pnpm_lockfile_version >= 6.0
@@ -117,7 +130,7 @@ module Dependabot
 
       sig { params(package_lock: T.nilable(DependencyFile)).returns(T::Boolean) }
       def self.npm8?(package_lock)
-        return true unless package_lock
+        return true unless package_lock&.content
 
         npm_version_numeric(package_lock) == NPM_V8
       end

data/lib/dependabot/npm_and_yarn/package_manager.rb

@@ -2,18 +2,225 @@
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"
+require "dependabot/ecosystem"
 require "dependabot/npm_and_yarn/version_selector"
 
 module Dependabot
   module NpmAndYarn
-    class PackageManager
+    ECOSYSTEM = "npm_and_yarn"
+    MANIFEST_FILENAME = "package.json"
+    LERNA_JSON_FILENAME = "lerna.json"
+
+    MANIFEST_PACKAGE_MANAGER_KEY = "packageManager"
+    MANIFEST_ENGINES_KEY = "engines"
+
+    class NpmPackageManager < Ecosystem::VersionManager
+      extend T::Sig
+      NAME = "npm"
+      RC_FILENAME = ".npmrc"
+      LOCKFILE_NAME = "package-lock.json"
+      SHRINKWRAP_LOCKFILE_NAME = "npm-shrinkwrap.json"
+
+      NPM_V6 = "6"
+      NPM_V7 = "7"
+      NPM_V8 = "8"
+      NPM_V9 = "9"
+
+      # Keep versions in ascending order
+      SUPPORTED_VERSIONS = T.let([
+        Version.new(NPM_V6),
+        Version.new(NPM_V7),
+        Version.new(NPM_V8),
+        Version.new(NPM_V9)
+      ].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig { params(raw_version: String).void }
+      def initialize(raw_version)
+        super(
+          NAME,
+          Version.new(raw_version),
+          DEPRECATED_VERSIONS,
+          SUPPORTED_VERSIONS
+        )
+      end
+
+      sig { override.returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { override.returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+
+    class YarnPackageManager < Ecosystem::VersionManager
+      extend T::Sig
+      NAME = "yarn"
+      RC_FILENAME = ".yarnrc"
+      RC_YML_FILENAME = ".yarnrc.yml"
+      LOCKFILE_NAME = "yarn.lock"
+
+      YARN_V1 = "1"
+      YARN_V2 = "2"
+      YARN_V3 = "3"
+
+      SUPPORTED_VERSIONS = T.let([
+        Version.new(YARN_V1),
+        Version.new(YARN_V2),
+        Version.new(YARN_V3)
+      ].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig { params(raw_version: String).void }
+      def initialize(raw_version)
+        super(
+          NAME,
+          Version.new(raw_version),
+          DEPRECATED_VERSIONS,
+          SUPPORTED_VERSIONS
+        )
+      end
+
+      sig { override.returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { override.returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+
+    class PNPMPackageManager < Ecosystem::VersionManager
+      extend T::Sig
+      NAME = "pnpm"
+      LOCKFILE_NAME = "pnpm-lock.yaml"
+      PNPM_WS_YML_FILENAME = "pnpm-workspace.yaml"
+
+      PNPM_V7 = "7"
+      PNPM_V8 = "8"
+      PNPM_V9 = "9"
+
+      SUPPORTED_VERSIONS = T.let([
+        Version.new(PNPM_V7),
+        Version.new(PNPM_V8),
+        Version.new(PNPM_V9)
+      ].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig { params(raw_version: String).void }
+      def initialize(raw_version)
+        super(
+          NAME,
+          Version.new(raw_version),
+          DEPRECATED_VERSIONS,
+          SUPPORTED_VERSIONS
+        )
+      end
+
+      sig { override.returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { override.returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+
+    DEFAULT_PACKAGE_MANAGER = NpmPackageManager::NAME
+
+    PACKAGE_MANAGER_CLASSES = {
+      NpmPackageManager::NAME => NpmPackageManager,
+      YarnPackageManager::NAME => YarnPackageManager,
+      PNPMPackageManager::NAME => PNPMPackageManager
+    }.freeze
+
+    class PackageManagerDetector
+      extend T::Sig
+      extend T::Helpers
+
+      sig do
+        params(
+          lockfiles: T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)],
+          package_json: T::Hash[String, T.untyped]
+        ).void
+      end
+      def initialize(lockfiles, package_json)
+        @lockfiles = lockfiles
+        @package_json = package_json
+        @manifest_package_manager = package_json["packageManager"]
+        @engines = package_json.fetch(MANIFEST_ENGINES_KEY, nil)
+      end
+
+      # Returns npm, yarn, or pnpm based on the lockfiles, package.json, and engines
+      # Defaults to npm if no package manager is detected
+      sig { returns(String) }
+      def detect_package_manager
+        name_from_lockfiles || name_from_package_manager_attr || name_from_engines || DEFAULT_PACKAGE_MANAGER
+      end
+
+      private
+
+      sig { returns(T.nilable(String)) }
+      def name_from_lockfiles
+        PACKAGE_MANAGER_CLASSES.each_key do |manager_name| # iterates keys in order as defined in the hash
+          return manager_name.to_s if @lockfiles[manager_name.to_sym]
+        end
+        nil
+      end
+
+      sig { returns(T.nilable(String)) }
+      def name_from_package_manager_attr
+        return unless @manifest_package_manager
+
+        PACKAGE_MANAGER_CLASSES.each_key do |manager_name| # iterates keys in order as defined in the hash
+          return manager_name.to_s if @manifest_package_manager.start_with?("#{manager_name}@")
+        end
+      end
+
+      sig { returns(T.nilable(String)) }
+      def name_from_engines
+        return unless @engines.is_a?(Hash)
+
+        PACKAGE_MANAGER_CLASSES.each_key do |manager_name|
+          return manager_name if @engines[manager_name]
+        end
+        nil
+      end
+    end
+
+    class PackageManagerHelper
       extend T::Sig
       extend T::Helpers
+
+      sig do
+        params(
+          package_json: T::Hash[String, T.untyped],
+          lockfiles: T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)]
+        ).void
+      end
       def initialize(package_json, lockfiles:)
         @package_json = package_json
         @lockfiles = lockfiles
-        @package_manager = package_json.fetch("packageManager", nil)
-        @engines = package_json.fetch("engines", nil)
+        @manifest_package_manager = package_json[MANIFEST_PACKAGE_MANAGER_KEY]
+        @engines = package_json.fetch(MANIFEST_ENGINES_KEY, nil)
+        @package_manager_detector = PackageManagerDetector.new(@lockfiles, @package_json)
+      end
+
+      sig { returns(Ecosystem::VersionManager) }
+      def package_manager
+        package_manager_by_name(
+          @package_manager_detector.detect_package_manager
+        )
       end
 
       # rubocop:disable Metrics/CyclomaticComplexity
@@ -23,24 +230,29 @@ module Dependabot
         # i.e. if { engines : "pnpm" : "6" } and { packageManager: "pnpm@6.0.2" },
         # we go for the specificity mentioned in packageManager (6.0.2)
 
-        unless @package_manager&.start_with?("#{name}@") || (@package_manager&.==name.to_s) || @package_manager.nil?
+        unless @manifest_package_manager&.start_with?("#{name}@") ||
+               (@manifest_package_manager&.==name.to_s) ||
+               @manifest_package_manager.nil?
           return
         end
 
-        if @engines && @package_manager.nil?
+        if @engines && @manifest_package_manager.nil?
           # if "packageManager" doesn't exists in manifest file,
           # we check if we can extract "engines" information
           version = check_engine_version(name)
 
-        elsif @package_manager&.==name.to_s
+        elsif @manifest_package_manager&.==name.to_s
           # if "packageManager" is found but no version is specified (i.e. pnpm@1.2.3),
           # we check if we can get "engines" info to override default version
           version = check_engine_version(name) if @engines
 
-        elsif @package_manager&.start_with?("#{name}@")
+        elsif @manifest_package_manager&.start_with?("#{name}@")
           # if "packageManager" info has version specification i.e. yarn@3.3.1
           # we go with the version in "packageManager"
-          Dependabot.logger.info("Found \"packageManager\" : \"#{@package_manager}\". Skipped checking \"engines\".")
+          Dependabot.logger.info(
+            "Found \"#{MANIFEST_PACKAGE_MANAGER_KEY}\" : \"#{@manifest_package_manager}\". " \
+            "Skipped checking \"#{MANIFEST_ENGINES_KEY}\"."
+          )
         end
 
         version ||= requested_version(name)
@@ -55,7 +267,7 @@ module Dependabot
           if version
             raise_if_unsupported!(name, version.to_s)
 
-            install(name, version) if name == "pnpm"
+            install(name, version) if name == PNPMPackageManager::NAME
           end
         end
 
@@ -66,11 +278,22 @@ module Dependabot
 
       private
 
+      sig { params(name: String).returns(Ecosystem::VersionManager) }
+      def package_manager_by_name(name)
+        package_manager_class = PACKAGE_MANAGER_CLASSES[name]
+
+        package_manager_class ||= PACKAGE_MANAGER_CLASSES[DEFAULT_PACKAGE_MANAGER]
+
+        version = Helpers.send(:"#{name}_version_numeric", @lockfiles[name.to_sym])
+
+        package_manager_class.new(version.to_s)
+      end
+
       def raise_if_unsupported!(name, version)
-        return unless name == "pnpm"
+        return unless name == PNPMPackageManager::NAME
         return unless Version.new(version) < Version.new("7")
 
-        raise ToolVersionNotSupported.new("PNPM", version, "7.*, 8.*")
+        raise ToolVersionNotSupported.new(PNPMPackageManager::NAME.upcase, version, "7.*, 8.*")
       end
 
       def install(name, version)
@@ -83,9 +306,9 @@ module Dependabot
       end
 
       def requested_version(name)
-        return unless @package_manager
+        return unless @manifest_package_manager
 
-        match = @package_manager.match(/^#{name}@(?<version>\d+.\d+.\d+)/)
+        match = @manifest_package_manager.match(/^#{name}@(?<version>\d+.\d+.\d+)/)
         return unless match
 
         Dependabot.logger.info("Requested version #{match['version']}")
@@ -111,7 +334,7 @@ module Dependabot
         return if engine_versions.empty?
 
         version = engine_versions[name]
-        Dependabot.logger.info("Returned (engines) info \"#{name}\" : \"#{version}\"")
+        Dependabot.logger.info("Returned (#{MANIFEST_ENGINES_KEY}) info \"#{name}\" : \"#{version}\"")
         version
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.284.0
+  version: 0.285.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-11-05 00:00:00.000000000 Z
+date: 2024-11-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.284.0
+        version: 0.285.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.284.0
+        version: 0.285.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -346,7 +346,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.284.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.285.0
 post_install_message: 
 rdoc_options: []
 require_paths: