dependabot-npm_and_yarn 0.302.0 → 0.303.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '09eb2aa26710f8625ed217129433fea3e65bf1a57e20af246b5fcb0e0042545f'
-  data.tar.gz: c7043f64922f0014183a33435f85106e753ff348a9b6ae0feab26774d5e13444
+  metadata.gz: ad45cf35ecbd2646efac000b10b1e75788d1b14717df839f7cecbdd8b0f528da
+  data.tar.gz: a5263324b67553166c24f348da59a0845fec2d9c97562fc4db80474fd936feaf
 SHA512:
-  metadata.gz: 0a9d15e4ebbc11d8ea146eedb4b1ef9cf5ab5ecae3d68e0fe4102427df39abb910cb328ba5cb73497117264f5e36fc768d2bad686f7c69e122c565035bb971ba
-  data.tar.gz: 70b005db601e0871f213eb0ced05b2932796e3673201cf5b4d2f1d9a2682b7c9bbe5b314997efe6515fb441a75ede6d7ac21d969fef130666f68c3f21bfc370b
+  metadata.gz: f7e9fc7913ca0366e0eb18b31ab9add1e7007d575993b1e85f10401b66ffcd003a5d517de9c31ab0e39628d3f00aad1a904076fe0ca1de297c3b3985c4071734
+  data.tar.gz: 04e7fa3cc8372cd13778b191bd68e5e9aecd5cf33989f8e2c7e10bbb1b98f3daa10b3da59d5b4bbf6d2c6cb04d7a63a0e665712bbf623822d68cf7f755f1e0c5

data/lib/dependabot/npm_and_yarn/file_updater/bun_lockfile_updater.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require "dependabot/npm_and_yarn/helpers"
-require "dependabot/npm_and_yarn/update_checker/registry_finder"
+require "dependabot/npm_and_yarn/package/registry_finder"
 require "dependabot/npm_and_yarn/registry_parser"
 require "dependabot/shared_helpers"
 

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -10,7 +10,7 @@ require "dependabot/npm_and_yarn/file_parser"
 require "dependabot/npm_and_yarn/file_updater"
 require "dependabot/npm_and_yarn/helpers"
 require "dependabot/npm_and_yarn/native_helpers"
-require "dependabot/npm_and_yarn/update_checker/registry_finder"
+require "dependabot/npm_and_yarn/package/registry_finder"
 require "dependabot/shared_helpers"
 
 # rubocop:disable Metrics/ClassLength
@@ -669,7 +669,7 @@ module Dependabot
 
           raise_resolvability_error(error_message) unless missing_dep
 
-          reg = NpmAndYarn::UpdateChecker::RegistryFinder.new(
+          reg = Package::RegistryFinder.new(
             dependency: missing_dep,
             credentials: credentials,
             npmrc_file: dependency_files. find { |f| f.name.end_with?(".npmrc") },
@@ -677,7 +677,7 @@ module Dependabot
             yarnrc_yml_file: dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") }
           ).registry
 
-          return if UpdateChecker::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")
+          return if Package::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")
 
           raise Dependabot::PrivateSourceAuthenticationFailure, reg
         end

data/lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb

@@ -10,7 +10,7 @@ module Dependabot
     class FileUpdater < Dependabot::FileUpdaters::Base
       # Build a .npmrc file from the lockfile content, credentials, and any
       # committed .npmrc
-      # We should refactor this to use UpdateChecker::RegistryFinder
+      # We should refactor this to use Package::RegistryFinder
       class NpmrcBuilder
         extend T::Sig
 
@@ -176,7 +176,7 @@ module Dependabot
 
           if dependencies.any?
             @dependency_urls = dependencies.map do |dependency|
-              UpdateChecker::RegistryFinder.new(
+              Package::RegistryFinder.new(
                 dependency: dependency,
                 credentials: credentials,
                 npmrc_file: npmrc_file,
@@ -249,7 +249,7 @@ module Dependabot
             yarnrc_file&.content
                        &.lines
                        &.find { |line| line.match?(/^\s*registry\s/) }
-                       &.match(NpmAndYarn::UpdateChecker::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX)
+                       &.match(Package::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX)
                        &.named_captures&.fetch("registry")
 
           return "registry = #{yarnrc_global_registry}\n" if yarnrc_global_registry

data/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require "dependabot/npm_and_yarn/helpers"
-require "dependabot/npm_and_yarn/update_checker/registry_finder"
+require "dependabot/npm_and_yarn/package/registry_finder"
 require "dependabot/npm_and_yarn/registry_parser"
 require "dependabot/shared_helpers"
 
@@ -309,7 +309,7 @@ module Dependabot
                         .find { |dep| dep.name == package_name }
           raise DependencyNotFound, package_name unless missing_dep
 
-          reg = NpmAndYarn::UpdateChecker::RegistryFinder.new(
+          reg = Package::RegistryFinder.new(
             dependency: missing_dep,
             credentials: credentials,
             npmrc_file: npmrc_file

data/lib/dependabot/npm_and_yarn/file_updater/pnpm_workspace_updater.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require "dependabot/npm_and_yarn/helpers"
-require "dependabot/npm_and_yarn/update_checker/registry_finder"
+require "dependabot/npm_and_yarn/package/registry_finder"
 require "dependabot/npm_and_yarn/registry_parser"
 require "dependabot/shared_helpers"
 

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -7,7 +7,7 @@ require "dependabot/npm_and_yarn"
 require "dependabot/npm_and_yarn/file_updater"
 require "dependabot/npm_and_yarn/file_parser"
 require "dependabot/npm_and_yarn/helpers"
-require "dependabot/npm_and_yarn/update_checker/registry_finder"
+require "dependabot/npm_and_yarn/package/registry_finder"
 require "dependabot/npm_and_yarn/native_helpers"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
@@ -429,7 +429,7 @@ module Dependabot
 
           error_handler.raise_resolvability_error(error_message, yarn_lock) unless missing_dep
 
-          reg = NpmAndYarn::UpdateChecker::RegistryFinder.new(
+          reg = Package::RegistryFinder.new(
             dependency: missing_dep,
             credentials: credentials,
             npmrc_file: npmrc_file,
@@ -437,7 +437,7 @@ module Dependabot
             yarnrc_yml_file: yarnrc_yml_file
           ).registry
 
-          return if UpdateChecker::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")
+          return if Package::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")
 
           raise PrivateSourceAuthenticationFailure, reg
         end
@@ -489,7 +489,7 @@ module Dependabot
         def yarnrc_specifies_private_reg?
           return false unless yarnrc_file
 
-          regex = UpdateChecker::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX
+          regex = Package::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX
           yarnrc_global_registry =
             yarnrc_file.content
                        .lines.find { |line| line.match?(regex) }
@@ -499,7 +499,7 @@ module Dependabot
 
           return false unless yarnrc_global_registry
 
-          UpdateChecker::RegistryFinder::CENTRAL_REGISTRIES.any? do |r|
+          Package::RegistryFinder::CENTRAL_REGISTRIES.any? do |r|
             r.include?(T.must(URI(yarnrc_global_registry).host))
           end
         end

data/lib/dependabot/npm_and_yarn/metadata_finder.rb

@@ -7,7 +7,7 @@ require "time"
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/registry_client"
-require "dependabot/npm_and_yarn/update_checker/registry_finder"
+require "dependabot/npm_and_yarn/package/registry_finder"
 require "dependabot/npm_and_yarn/version"
 
 module Dependabot
@@ -95,7 +95,7 @@ module Dependabot
       def new_source
         sources = dependency.requirements
                             .map { |r| r.fetch(:source) }.uniq.compact
-                            .sort_by { |source| UpdateChecker::RegistryFinder.central_registry?(source[:url]) ? 1 : 0 }
+                            .sort_by { |source| Package::RegistryFinder.central_registry?(source[:url]) ? 1 : 0 }
 
         sources.first
       end

data/lib/dependabot/npm_and_yarn/package/package_details_fetcher.rb

@@ -0,0 +1,315 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+require "excon"
+require "time"
+require "dependabot/package/package_release"
+require "dependabot/package/package_details"
+require "dependabot/npm_and_yarn/package/registry_finder"
+
+module Dependabot
+  module NpmAndYarn
+    module Package
+      class PackageDetailsFetcher
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential]
+          ).void
+        end
+        def initialize(
+          dependency:,
+          dependency_files:,
+          credentials:
+        )
+          @dependency = T.let(dependency, Dependabot::Dependency)
+          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
+          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
+
+          @npm_details = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+          @dist_tags = T.let(nil, T.nilable(T::Hash[String, String]))
+          @registry_finder = T.let(nil, T.nilable(Package::RegistryFinder))
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :dependency_files
+
+        sig { returns(T.nilable(Dependabot::Package::PackageDetails)) }
+        def fetch
+          package_data = fetch_npm_details
+          Dependabot::Package::PackageDetails.new(
+            dependency: @dependency,
+            releases: package_data ? parse_versions(package_data) : [],
+            dist_tags: dist_tags
+          )
+        end
+
+        sig { returns(T::Boolean) }
+        def valid_npm_details?
+          !dist_tags.nil?
+        end
+
+        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+        def npm_details
+          @npm_details ||= fetch_npm_details
+        end
+
+        private
+
+        sig do
+          params(
+            npm_data: T::Hash[String, T.untyped]
+          ).returns(T::Array[Dependabot::Package::PackageRelease])
+        end
+        def parse_versions(npm_data)
+          time_data = npm_data["time"] || {}
+          versions_data = npm_data["versions"] || {}
+
+          latest_version = npm_data.dig("dist-tags", "latest")
+
+          versions_data.filter_map do |version, details|
+            next unless Dependabot::NpmAndYarn::Version.correct?(version)
+
+            package_type = details.dig("repository", "type")
+
+            deprecated = details["deprecated"]
+
+            puts "version: #{version}, #{latest_version}"
+
+            Dependabot::Package::PackageRelease.new(
+              version: Version.new(version),
+              released_at: time_data[version] ? Time.parse(time_data[version]) : nil,
+              yanked: deprecated ? true : false,
+              yanked_reason: deprecated.is_a?(String) ? deprecated : nil,
+              downloads: nil,
+              latest: latest_version.to_s == version,
+              url: package_version_url(version),
+              package_type: package_type,
+              language: package_language(details)
+            )
+          end.sort_by(&:version).reverse
+        end
+
+        sig { params(version: String).returns(String) }
+        def package_version_url(version)
+          "#{dependency_registry}/#{@dependency.name}/v/#{version}"
+        end
+
+        sig do
+          params(version_details: T::Hash[String, T.untyped])
+            .returns(T.nilable(Dependabot::Package::PackageLanguage))
+        end
+        def package_language(version_details)
+          node_requirement = version_details.dig("engines", "node")
+
+          return nil unless node_requirement
+
+          if node_requirement
+            Dependabot::Package::PackageLanguage.new(
+              name: "node",
+              version: nil,
+              requirement: Requirement.new(node_requirement)
+            )
+          end
+        rescue Gem::Requirement::BadRequirementError
+          nil
+        end
+
+        sig { returns(T.nilable(T::Hash[String, String])) }
+        def dist_tags
+          @dist_tags ||= npm_details&.fetch("dist-tags", nil)
+        end
+
+        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+        def fetch_npm_details
+          npm_response = fetch_npm_response
+          check_npm_response(npm_response) if npm_response
+          JSON.parse(npm_response.body)
+        rescue JSON::ParserError, Excon::Error::Timeout, Excon::Error::Socket, RegistryError => e
+          return nil if git_dependency?
+
+          raise_npm_details_error(e)
+        end
+
+        sig { returns(Excon::Response) }
+        def fetch_npm_response
+          response = Dependabot::RegistryClient.get(
+            url: dependency_url,
+            headers: registry_auth_headers
+          )
+
+          # If response is successful, return it
+          return response if response.status.to_s.start_with?("2")
+
+          # If the registry is public (not explicitly private) and the request fails, return the response as is
+          return response if dependency_registry == "registry.npmjs.org"
+
+          # If a private registry returns a 500 error, check authentication
+          return response unless response.status == 500
+          return response unless registry_auth_headers["Authorization"]
+
+          auth = registry_auth_headers["Authorization"]
+          return response unless auth&.start_with?("Basic")
+
+          decoded_token = Base64.decode64(auth.gsub("Basic ", "")).strip
+
+          # Ensure decoded token is not empty and contains a colon
+          if decoded_token.empty? || !decoded_token.include?(":")
+            raise PrivateSourceAuthenticationFailure, "Malformed basic auth credentials for #{dependency_registry}"
+          end
+
+          username, password = decoded_token.split(":")
+
+          Dependabot::RegistryClient.get(
+            url: dependency_url,
+            options: {
+              user: username,
+              password: password
+            }
+          )
+        rescue URI::InvalidURIError => e
+          raise DependencyFileNotResolvable, e.message
+        end
+
+        sig { params(npm_response: Excon::Response).void }
+        def check_npm_response(npm_response)
+          return if git_dependency?
+
+          if private_dependency_not_reachable?(npm_response)
+            raise PrivateSourceAuthenticationFailure, dependency_registry
+          end
+
+          # handles scenario when private registry returns a server error 5xx
+          if private_dependency_server_error?(npm_response)
+            msg = "Server error #{npm_response.status} returned while accessing registry" \
+                  " #{dependency_registry}."
+            raise DependencyFileNotResolvable, msg
+          end
+
+          status = npm_response.status
+
+          # handles issue when status 200 is returned from registry but with an invalid JSON object
+          if status.to_s.start_with?("2") && response_invalid_json?(npm_response)
+            msg = "Invalid JSON object returned from registry #{dependency_registry}."
+            Dependabot.logger.warn("#{msg} Response body (truncated) : #{npm_response.body[0..500]}...")
+            raise DependencyFileNotResolvable, msg
+          end
+
+          return if status.to_s.start_with?("2")
+
+          # Ignore 404s from the registry for updates where a lockfile doesn't
+          # need to be generated. The 404 won't cause problems later.
+          return if status == 404 && dependency.version.nil?
+
+          msg = "Got #{status} response with body #{npm_response.body}"
+          raise RegistryError.new(status, msg)
+        end
+
+        sig { params(error: StandardError).void }
+        def raise_npm_details_error(error)
+          raise if dependency_registry == "registry.npmjs.org"
+          raise unless error.is_a?(Excon::Error::Timeout)
+
+          raise PrivateSourceTimedOut, dependency_registry
+        end
+
+        sig { params(npm_response: Excon::Response).returns(T::Boolean) }
+        def private_dependency_not_reachable?(npm_response)
+          return true if npm_response.body.start_with?(/user ".*?" is not a /)
+          return false unless [401, 402, 403, 404].include?(npm_response.status)
+
+          # Check whether this dependency is (likely to be) private
+          if dependency_registry == "registry.npmjs.org"
+            return false unless dependency.name.start_with?("@")
+
+            web_response = Dependabot::RegistryClient.get(url: "https://www.npmjs.com/package/#{dependency.name}")
+            # NOTE: returns 429 when the login page is rate limited
+            return web_response.body.include?("Forgot password?") ||
+                   web_response.status == 429
+          end
+
+          true
+        end
+
+        sig { params(npm_response: Excon::Response).returns(T::Boolean) }
+        def private_dependency_server_error?(npm_response)
+          if [500, 501, 502, 503].include?(npm_response.status)
+            Dependabot.logger.warn("#{dependency_registry} returned code #{npm_response.status} with " \
+                                   "body #{npm_response.body}.")
+            return true
+          end
+          false
+        end
+
+        sig { params(npm_response: Excon::Response).returns(T::Boolean) }
+        def response_invalid_json?(npm_response)
+          result = JSON.parse(npm_response.body)
+          result.is_a?(Hash) || result.is_a?(Array)
+          false
+        rescue JSON::ParserError, TypeError
+          true
+        end
+
+        sig { returns(String) }
+        def dependency_url
+          registry_finder.dependency_url
+        end
+
+        sig { returns(T::Hash[String, String]) }
+        def registry_auth_headers
+          registry_finder.auth_headers
+        end
+
+        sig { returns(String) }
+        def dependency_registry
+          registry_finder.registry
+        end
+
+        sig { returns(Package::RegistryFinder) }
+        def registry_finder
+          @registry_finder ||= Package::RegistryFinder.new(
+            dependency: dependency,
+            credentials: credentials,
+            npmrc_file: npmrc_file,
+            yarnrc_file: yarnrc_file,
+            yarnrc_yml_file: yarnrc_yml_file
+          )
+        end
+
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
+        def npmrc_file
+          dependency_files.find { |f| f.name.end_with?(".npmrc") }
+        end
+
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
+        def yarnrc_file
+          dependency_files.find { |f| f.name.end_with?(".yarnrc") }
+        end
+
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
+        def yarnrc_yml_file
+          dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") }
+        end
+
+        sig { returns(T::Boolean) }
+        def git_dependency?
+          # ignored_version/raise_on_ignored are irrelevant.
+          GitCommitChecker.new(
+            dependency: dependency,
+            credentials: credentials
+          ).git_dependency?
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/npm_and_yarn/{update_checker → package}/registry_finder.rb

@@ -7,8 +7,10 @@ require "dependabot/registry_client"
 
 module Dependabot
   module NpmAndYarn
-    class UpdateChecker
+    module Package
       class RegistryFinder
+        extend T::Sig
+
         CENTRAL_REGISTRIES = %w(
           https://registry.npmjs.org
           http://registry.npmjs.org

data/lib/dependabot/npm_and_yarn/update_checker/dependency_files_builder.rb

@@ -110,7 +110,7 @@ module Dependabot
         def yarnrc_specifies_private_reg?
           return false unless yarnrc_file
 
-          regex = UpdateChecker::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX
+          regex = Package::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX
           yarnrc_global_registry =
             yarnrc_file.content
                        .lines.find { |line| line.match?(regex) }
@@ -120,7 +120,7 @@ module Dependabot
 
           return false unless yarnrc_global_registry
 
-          UpdateChecker::RegistryFinder::CENTRAL_REGISTRIES.none? do |r|
+          Package::RegistryFinder::CENTRAL_REGISTRIES.none? do |r|
             r.include?(T.must(URI(yarnrc_global_registry).host))
           end
         end

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -4,7 +4,7 @@
 require "excon"
 require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/update_checkers/version_filters"
-require "dependabot/npm_and_yarn/update_checker/registry_finder"
+require "dependabot/npm_and_yarn/package/registry_finder"
 require "dependabot/npm_and_yarn/version"
 require "dependabot/npm_and_yarn/requirement"
 require "dependabot/shared_helpers"
@@ -411,7 +411,7 @@ module Dependabot
         end
 
         def registry_finder
-          @registry_finder ||= RegistryFinder.new(
+          @registry_finder ||= Package::RegistryFinder.new(
             dependency: dependency,
             credentials: credentials,
             npmrc_file: npmrc_file,

data/lib/dependabot/npm_and_yarn/update_checker/library_detector.rb

@@ -64,7 +64,7 @@ module Dependabot
         end
 
         def registry
-          NpmAndYarn::UpdateChecker::RegistryFinder.new(
+          Package::RegistryFinder.new(
             dependency: nil,
             credentials: credentials,
             npmrc_file: dependency_files.find { |f| f.name.end_with?(".npmrc") },

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -427,8 +427,12 @@ module Dependabot
 
       def original_source(updated_dependency)
         sources =
-          updated_dependency.requirements.map { |r| r.fetch(:source) }.uniq.compact
-                            .sort_by { |source| RegistryFinder.central_registry?(source[:url]) ? 1 : 0 }
+          updated_dependency
+          .requirements.map { |r| r.fetch(:source) }
+          .uniq.compact
+          .sort_by do |source|
+            Package::RegistryFinder.central_registry?(source[:url]) ? 1 : 0
+          end
 
         sources.first
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.302.0
+  version: 0.303.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-20 00:00:00.000000000 Z
+date: 2025-03-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.302.0
+        version: 0.303.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.302.0
+        version: 0.303.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -156,14 +156,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.5
+        version: 0.8.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.5
+        version: 0.8.7
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -331,6 +331,8 @@ files:
 - lib/dependabot/npm_and_yarn/metadata_finder.rb
 - lib/dependabot/npm_and_yarn/native_helpers.rb
 - lib/dependabot/npm_and_yarn/npm_package_manager.rb
+- lib/dependabot/npm_and_yarn/package/package_details_fetcher.rb
+- lib/dependabot/npm_and_yarn/package/registry_finder.rb
 - lib/dependabot/npm_and_yarn/package_manager.rb
 - lib/dependabot/npm_and_yarn/package_name.rb
 - lib/dependabot/npm_and_yarn/pnpm_package_manager.rb
@@ -343,7 +345,6 @@ files:
 - lib/dependabot/npm_and_yarn/update_checker/dependency_files_builder.rb
 - lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb
 - lib/dependabot/npm_and_yarn/update_checker/library_detector.rb
-- lib/dependabot/npm_and_yarn/update_checker/registry_finder.rb
 - lib/dependabot/npm_and_yarn/update_checker/requirements_updater.rb
 - lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb
 - lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb
@@ -356,7 +357,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.302.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.303.0
 post_install_message:
 rdoc_options: []
 require_paths: