dependabot-npm_and_yarn 0.381.0 → 0.382.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a70ee3c0913d6a9622b867d20d898019ad3453701dd1a18e1c01b62887d52351
-  data.tar.gz: 80f0ce022e8e6a30f4f72bb7928f0a865abbe05f8868b873d3a84077ab139e02
+  metadata.gz: f6b62776c4e4f4808215eb847c97e755f49062eda411ee412828ed1d29569378
+  data.tar.gz: 96ce53758c58b319deba6b6611cdff40a9a5673c66b6a0b066eb11410fd5a83d
 SHA512:
-  metadata.gz: c56af922ead64141beb7c8fefea2b706d84e90007fd33620f9892fb80d11fcc6e9eb239fa0d0220d0d93b92177de0c780048ccb17dd9ef4ae2409886beb7cda8
-  data.tar.gz: f3d511e27a4e5ca500c869e0de11729544f4323ea4776c275df99f750b947936b17dad15166571d5515c0e5d524b57eb5c7079876923cebb019a5bf288690612
+  metadata.gz: faa9c39442466c97715c626036b1a711217b8e6c4b5dcd1b9438fc63e4009c20acab40a924c52bccf62d56656b3e7f5d3ed79c83e7ebb6a5053407865bd0d883
+  data.tar.gz: 3be31e18189e2e9a541fd884cbc91cf4a83e732a887da56b033785539b4f9e0f332f62774548c62487a1b0ac487060f377c9a9cb3138d232fdb33dfff3f15667

data/lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb

@@ -4,6 +4,7 @@
 require "sorbet-runtime"
 
 require "dependabot/npm_and_yarn/file_updater"
+require "dependabot/npm_and_yarn/helpers"
 
 module Dependabot
   module NpmAndYarn
@@ -44,7 +45,7 @@ module Dependabot
             if npmrc_file then complete_npmrc_from_credentials
             elsif yarnrc_file then build_npmrc_from_yarnrc
             else
-              build_npmrc_content_from_lockfile
+              build_npmrc_content_from_lockfile || build_npmrc_content_from_credential_scopes
             end
 
           final_content = initial_content || ""
@@ -98,6 +99,23 @@ module Dependabot
             "always-auth = true"
         end
 
+        sig { returns(T.nilable(String)) }
+        def build_npmrc_content_from_credential_scopes
+          scoped_credentials = registry_credentials.select { |cred| cred.scope && cred["registry"] }
+          return if scoped_credentials.empty?
+
+          lines = T.let([], T::Array[String])
+          scoped_credentials.each do |cred|
+            registry = cred.fetch("registry")
+            registry_url = registry.start_with?("http") ? registry : "https://#{registry}"
+            T.must(cred.scope).each do |s|
+              lines << "#{Helpers.normalize_npm_scope(s)}:registry=#{registry_url}"
+            end
+          end
+
+          lines.join("\n")
+        end
+
         sig { returns(T.nilable(String)) }
         def build_yarnrc_content_from_lockfile
           return unless yarn_lock || package_lock
@@ -334,11 +352,25 @@ module Dependabot
           )
         end
 
+        sig { params(registry: String).returns(T.nilable(T::Array[String])) }
+        def credential_scopes_for(registry)
+          cred = registry_credentials.find { |c| c["registry"] == registry }
+          return unless cred&.scope
+
+          registry_url = registry.start_with?("http") ? registry : "https://#{registry}"
+          T.must(cred.scope).map { |s| "#{Helpers.normalize_npm_scope(s)}:registry=#{registry_url}" }
+        end
+
         # rubocop:disable Metrics/PerceivedComplexity
         sig { params(registry: String).returns(T.nilable(T::Array[String])) }
         def registry_scopes(registry)
           # Central registries don't just apply to scopes
           return if CENTRAL_REGISTRIES.include?(registry)
+
+          # Use explicit scope from credential if available
+          explicit = credential_scopes_for(registry)
+          return explicit if explicit
+
           return unless dependency_urls
 
           other_regs =

data/lib/dependabot/npm_and_yarn/file_updater/pnpm_workspace_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/npm_and_yarn/helpers"
@@ -6,13 +6,6 @@ require "dependabot/npm_and_yarn/package/registry_finder"
 require "dependabot/npm_and_yarn/registry_parser"
 require "dependabot/shared_helpers"
 
-class DependencyRequirement < T::Struct
-  const :file, String
-  const :requirement, String
-  const :groups, T::Array[String]
-  const :source, T.nilable(T::Hash[Symbol, T.untyped])
-end
-
 module Dependabot
   module NpmAndYarn
     class FileUpdater
@@ -73,13 +66,13 @@ module Dependabot
           params(
             content: String,
             dependency: Dependabot::Dependency,
-            old_requirement: DependencyRequirement,
-            new_requirement: DependencyRequirement
+            old_requirement: Dependabot::DependencyRequirement,
+            new_requirement: Dependabot::DependencyRequirement
           ).returns(String)
         end
         def replace_version_in_content(content:, dependency:, old_requirement:, new_requirement:)
-          old_version = old_requirement.requirement
-          new_version = new_requirement.requirement
+          old_version = T.must(old_requirement.requirement)
+          new_version = T.must(new_requirement.requirement)
 
           pattern = build_replacement_pattern(
             dependency_name: dependency.name,
@@ -104,37 +97,19 @@ module Dependabot
           "\\1#{dependency_name}\\1: \\2#{version}\\2"
         end
 
-        sig { params(dependency: Dependabot::Dependency).returns(T::Array[DependencyRequirement]) }
+        sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::DependencyRequirement]) }
         def new_requirements(dependency)
-          dependency.requirements
-                    .select { |r| r[:file] == workspace_file.name }
-                    .map do |r|
-            DependencyRequirement.new(
-              file: r[:file],
-              requirement: r[:requirement],
-              groups: r[:groups],
-              source: r[:source]
-            )
-          end
+          dependency.requirements.select { |r| r.file == workspace_file.name }
         end
 
         sig do
           params(
             dependency: Dependabot::Dependency,
-            new_requirement: DependencyRequirement
-          ).returns(T.nilable(DependencyRequirement))
+            new_requirement: Dependabot::DependencyRequirement
+          ).returns(T.nilable(Dependabot::DependencyRequirement))
         end
         def old_requirement(dependency, new_requirement)
-          matching_req = T.must(dependency.previous_requirements).find { |r| r[:groups] == new_requirement.groups }
-
-          return nil if matching_req.nil?
-
-          DependencyRequirement.new(
-            file: matching_req[:file],
-            requirement: matching_req[:requirement],
-            groups: matching_req[:groups],
-            source: matching_req[:source]
-          )
+          T.must(dependency.previous_requirements).find { |r| r.groups == new_requirement.groups }
         end
       end
     end

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -634,6 +634,11 @@ module Dependabot
       def self.corepack_supported_package_manager?(name)
         SUPPORTED_COREPACK_PACKAGE_MANAGERS.include?(name)
       end
+
+      sig { params(scope: String).returns(String) }
+      def self.normalize_npm_scope(scope)
+        scope.start_with?("@") ? scope : "@#{scope}"
+      end
     end
   end
 end

data/lib/dependabot/npm_and_yarn/metadata_finder.rb

@@ -9,12 +9,14 @@ require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/registry_client"
 require "dependabot/npm_and_yarn/package/registry_finder"
+require "dependabot/npm_and_yarn/package/registry_credential_helpers"
 require "dependabot/npm_and_yarn/version"
 
 module Dependabot
   module NpmAndYarn
     class MetadataFinder < Dependabot::MetadataFinders::Base
       extend T::Sig
+      include Package::RegistryCredentialHelpers
 
       # Lifecycle scripts that run automatically during package installation.
       # These are security-relevant because they execute with user privileges.
@@ -310,9 +312,11 @@ module Dependabot
       sig { returns(String) }
       def dependency_url
         registry_url =
-          if new_source.nil?
-            # Check credentials for a configured registry before falling back to public registry
-            configured_registry_from_credentials || "https://registry.npmjs.org"
+          if (configured_registry = configured_registry_from_credentials)
+            # Prioritize replaces-base credential over lockfile source
+            configured_registry
+          elsif new_source.nil?
+            "https://registry.npmjs.org"
           else
             new_source&.fetch(:url)
           end
@@ -332,25 +336,13 @@ module Dependabot
         { "Authorization" => "Bearer #{auth_token}" }
       end
 
-      sig { returns(T.nilable(String)) }
-      def configured_registry_from_credentials
-        # Look for a credential that replaces the base registry (global registry replacement)
-        replaces_base_cred = credentials.find { |cred| cred["type"] == "npm_registry" && cred.replaces_base? }
-        return normalize_registry_url(replaces_base_cred["registry"]) if replaces_base_cred
-
-        nil
-      end
-
-      sig { params(registry: T.nilable(String)).returns(T.nilable(String)) }
-      def normalize_registry_url(registry)
-        return nil unless registry
-        return registry if registry.start_with?("http")
-
-        "https://#{registry}"
-      end
-
       sig { returns(String) }
       def dependency_registry
+        # Prioritize replaces-base credential over lockfile source
+        if (configured_registry = configured_registry_from_credentials)
+          return configured_registry.sub(%r{^https?://}, "")
+        end
+
         if new_source.nil? then "registry.npmjs.org"
         else
           new_source&.fetch(:url)&.gsub("https://", "")&.gsub("http://", "")

data/lib/dependabot/npm_and_yarn/package/package_details_fetcher.rb

@@ -7,12 +7,14 @@ require "time"
 require "dependabot/package/package_release"
 require "dependabot/package/package_details"
 require "dependabot/npm_and_yarn/package/registry_finder"
+require "dependabot/npm_and_yarn/package/registry_credential_helpers"
 
 module Dependabot
   module NpmAndYarn
     module Package
       class PackageDetailsFetcher
         extend T::Sig
+        include RegistryCredentialHelpers
 
         GLOBAL_REGISTRY = "registry.npmjs.org"
         NPM_OFFICIAL_WEBSITE = "https://www.npmjs.com"
@@ -63,7 +65,7 @@ module Dependabot
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
-        sig { returns(T::Array[Dependabot::Credential]) }
+        sig { override.returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
         sig { returns(T::Array[Dependabot::DependencyFile]) }
@@ -96,6 +98,11 @@ module Dependabot
 
         sig { returns(String) }
         def dependency_url
+          if (configured_registry = configured_registry_from_credentials)
+            escaped_dependency_name = dependency.name.gsub("/", "%2F")
+            return "#{configured_registry}/#{escaped_dependency_name}"
+          end
+
           registry_finder.dependency_url
         end
 
@@ -381,11 +388,19 @@ module Dependabot
 
         sig { returns(T::Hash[String, String]) }
         def registry_auth_headers
+          if (configured_registry = configured_registry_from_credentials)
+            return auth_headers_for_registry(configured_registry)
+          end
+
           registry_finder.auth_headers
         end
 
         sig { returns(String) }
         def dependency_registry
+          if (configured_registry = configured_registry_from_credentials)
+            return configured_registry.sub(%r{^https?://}, "")
+          end
+
           registry_finder.registry
         end
 

data/lib/dependabot/npm_and_yarn/package/registry_credential_helpers.rb

@@ -0,0 +1,64 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "base64"
+require "uri"
+
+module Dependabot
+  module NpmAndYarn
+    module Package
+      module RegistryCredentialHelpers
+        extend T::Sig
+        extend T::Helpers
+
+        abstract!
+
+        sig { abstract.returns(T::Array[Dependabot::Credential]) }
+        def credentials; end
+
+        private
+
+        sig { returns(T.nilable(String)) }
+        def configured_registry_from_credentials
+          replaces_base_cred = credentials.find { |cred| cred["type"] == "npm_registry" && cred.replaces_base? }
+          return unless replaces_base_cred&.fetch("registry", nil)
+
+          normalize_registry_url(replaces_base_cred["registry"])
+        end
+
+        sig { params(registry: T.nilable(String)).returns(T.nilable(String)) }
+        def normalize_registry_url(registry)
+          return nil unless registry
+
+          normalized_registry = registry.start_with?("http") ? registry : "https://#{registry}"
+          URI::DEFAULT_PARSER.escape(normalized_registry)&.gsub(%r{/+$}, "")
+        end
+
+        sig { params(registry: String).returns(T::Hash[String, String]) }
+        def auth_headers_for_registry(registry)
+          token = credentials
+                  .select { |cred| cred["type"] == "npm_registry" }
+                  .find { |cred| normalize_registry_url(cred["registry"]) == registry }
+                  &.fetch("token", nil)
+
+          return {} unless token
+
+          auth_header_for(token)
+        end
+
+        sig { params(token: String).returns(T::Hash[String, String]) }
+        def auth_header_for(token)
+          if token.include?(":")
+            encoded_token = Base64.encode64(token).delete("\n")
+            { "Authorization" => "Basic #{encoded_token}" }
+          elsif Base64.decode64(token).ascii_only? &&
+                Base64.decode64(token).include?(":")
+            { "Authorization" => "Basic #{token.delete("\n")}" }
+          else
+            { "Authorization" => "Bearer #{token}" }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/npm_and_yarn/package/registry_finder.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "excon"
+require "dependabot/npm_and_yarn/helpers"
 require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/registry_client"
 require "sorbet-runtime"
@@ -60,7 +61,8 @@ module Dependabot
         def registry
           return @registry if @registry
 
-          @registry = configured_registry || locked_registry || first_registry_with_dependency_details
+          @registry = configured_registry || locked_registry || scoped_credential_registry_for_dependency ||
+                      first_registry_with_dependency_details
           T.must(@registry)
         end
 
@@ -197,19 +199,12 @@ module Dependabot
         def locked_registry
           return unless registry_source_url
 
-          lockfile_registry =
-            registry_source_url
-            &.gsub("https://", "")
-            &.gsub("http://", "")
+          lockfile_registry = registry_source_url&.gsub("https://", "")&.gsub("http://", "")
+          return unless lockfile_registry
 
-          if lockfile_registry
-            detailed_registry =
-              known_registries
-              .find { |h| h["registry"]&.include?(lockfile_registry) }
-              &.fetch("registry")
-          end
-
-          detailed_registry || lockfile_registry
+          known_registries
+            .find { |h| h["registry"]&.include?(lockfile_registry) }
+            &.fetch("registry") || lockfile_registry
         end
 
         sig { returns(T.nilable(String)) }
@@ -288,10 +283,7 @@ module Dependabot
 
         sig { returns(String) }
         def global_registry
-          return @global_registry if @global_registry
-
-          @global_registry = configured_global_registry || GLOBAL_NPM_REGISTRY
-          @global_registry
+          @global_registry ||= configured_global_registry || GLOBAL_NPM_REGISTRY
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
@@ -342,6 +334,30 @@ module Dependabot
           nil
         end
 
+        sig { returns(T.nilable(String)) }
+        def scoped_credential_registry_for_dependency
+          dep_name = dependency&.name
+          return unless dep_name&.start_with?("@") && dep_name.include?("/")
+
+          scope = T.must(dep_name.split("/").first)
+          registry = scoped_credential_registry(scope)
+          normalize_configured_registry(registry) if registry
+        end
+
+        sig { params(scope: String).returns(T.nilable(String)) }
+        def scoped_credential_registry(scope)
+          cred = credentials.find do |c|
+            c["type"] == "npm_registry" && c["registry"] && c.scope&.any? do |s|
+              Helpers.normalize_npm_scope(s) == scope
+            end
+          end
+          return unless cred
+
+          reg = T.must(cred["registry"])
+          registry = reg.start_with?("http") ? reg : "https://#{reg}"
+          prepare_registry_url(registry)
+        end
+
         sig do
           params(
             file: T.nilable(Dependabot::DependencyFile),

data/lib/dependabot/npm_and_yarn/registry_parser.rb

@@ -6,6 +6,8 @@ require "sorbet-runtime"
 module Dependabot
   module NpmAndYarn
     class RegistryParser
+      # NOTE: Bun has an equivalent implementation in bun/registry_parser.rb.
+      # Keep credential-matching behavior in sync across both ecosystems.
       extend T::Sig
 
       sig { params(resolved_url: String, credentials: T::Array[Dependabot::Credential]).void }
@@ -14,7 +16,7 @@ module Dependabot
         @credentials = credentials
       end
 
-      sig { params(name: String).returns(T::Hash[Symbol, T.untyped]) }
+      sig { params(name: String).returns(T::Hash[Symbol, T.nilable(String)]) }
       def registry_source_for(name)
         url =
           if resolved_url.include?("/~/")
@@ -60,34 +62,68 @@ module Dependabot
       sig { returns(T::Array[Dependabot::Credential]) }
       attr_reader :credentials
 
-      # rubocop:disable Metrics/PerceivedComplexity
       sig { returns(T.nilable(String)) }
       def url_for_relevant_cred
-        resolved_url_host = URI(resolved_url).host
+        resolved_uri = URI(resolved_url)
 
         credential_matching_url =
           credentials
           .select { |cred| cred["type"] == "npm_registry" && cred["registry"] }
           .sort_by { |cred| cred.fetch("registry").length }
-          .find do |details|
-            next true if resolved_url_host == details["registry"]
-
-            uri = if details["registry"]&.include?("://")
-                    URI(details.fetch("registry"))
-                  else
-                    URI("https://#{details['registry']}")
-                  end
-            resolved_url_host == uri.host && resolved_url.include?(details.fetch("registry"))
-          end
+          .find { |details| credential_matches?(details, resolved_uri: resolved_uri) }
 
         return unless credential_matching_url
 
-        # Trim the resolved URL so that it ends at the same point as the
-        # credential registry
         reg = credential_matching_url.fetch("registry")
-        resolved_url.gsub(/#{Regexp.quote(reg)}.*/, "") + reg
+        # When the credential registry already includes an explicit scheme, return
+        # it directly — the gsub pattern would not match and would produce a
+        # malformed string if it ran.
+        return reg if reg.include?("://")
+
+        build_registry_url(registry: reg, resolved_uri: resolved_uri)
+      end
+
+      sig { params(registry: String, resolved_uri: URI::Generic).returns(String) }
+      def build_registry_url(registry:, resolved_uri:)
+        credential_uri = URI("https://#{registry}")
+        normalized_path = credential_uri.path.to_s.chomp("/")
+
+        "#{resolved_uri.scheme}://#{resolved_uri.authority}#{normalized_path}"
+      end
+
+      # Enforce npm registry credential boundaries by matching on host, optional
+      # explicit scheme, and full path segments so sibling paths on the same host
+      # cannot inherit credentials configured for a different registry scope.
+      sig { params(details: Dependabot::Credential, resolved_uri: URI::Generic).returns(T::Boolean) }
+      def credential_matches?(details, resolved_uri:)
+        resolved_url_host = resolved_uri.host
+        return true if resolved_url_host == details["registry"]
+
+        registry_has_scheme = details["registry"]&.include?("://")
+        uri = if registry_has_scheme
+                URI(details.fetch("registry"))
+              else
+                URI("https://#{details['registry']}")
+              end
+        return false unless resolved_url_host == uri.host
+        # When the credential includes an explicit scheme, require scheme
+        # equality so we do not attribute a URL to credentials configured for
+        # a different transport protocol.
+        return false if registry_has_scheme && resolved_uri.scheme != uri.scheme
+
+        # Use path-segment-aware matching to prevent credentials configured
+        # for one path-scoped registry from being applied to sibling paths
+        # on the same host (e.g., /victim-npm should not match /victim-npm-evil).
+        credential_path_match?(uri: uri, resolved_url_path: resolved_uri.path.to_s)
+      end
+
+      sig { params(uri: URI::Generic, resolved_url_path: String).returns(T::Boolean) }
+      def credential_path_match?(uri:, resolved_url_path:)
+        registry_path = uri.path.to_s.chomp("/")
+        registry_path.empty? ||
+          resolved_url_path.start_with?("#{registry_path}/") ||
+          resolved_url_path == registry_path
       end
-      # rubocop:enable Metrics/PerceivedComplexity
     end
   end
 end

data/lib/dependabot/npm_and_yarn/requirement.rb

@@ -68,7 +68,7 @@ module Dependabot
         end
       end
 
-      sig { params(dep_string: String).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { params(dep_string: String).returns(T.nilable(T::Hash[Symbol, T.nilable(String)])) }
       def self.parse_dep_string(dep_string)
         stripped = dep_string.strip
         return nil if stripped.empty?

data/lib/dependabot/npm_and_yarn/update_checker/vulnerability_auditor.rb

@@ -106,7 +106,7 @@ module Dependabot
             validation_result = validate_audit_result(audit_result, security_advisories)
             if validation_result != :viable
               Dependabot.logger.info("VulnerabilityAuditor: audit result not viable: #{validation_result}")
-              fix_unavailable["explanation"] = explain_fix_unavailable(validation_result, dependency)
+              fix_unavailable["explanation"] = explain_fix_unavailable(validation_result, dependency, audit_result)
               return fix_unavailable
             end
 
@@ -127,11 +127,27 @@ module Dependabot
         sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
-        sig { params(validation_result: Symbol, dependency: Dependabot::Dependency).returns(String) }
-        def explain_fix_unavailable(validation_result, dependency)
+        sig do
+          params(
+            validation_result: Symbol,
+            dependency: Dependabot::Dependency,
+            audit_result: T::Hash[String, T.untyped]
+          ).returns(String)
+        end
+        def explain_fix_unavailable(validation_result, dependency, audit_result)
           case validation_result
-          when :fix_unavailable, :dependency_still_vulnerable, :downgrades_dependencies
-            "No patched version available for #{dependency.name}"
+          when :fix_unavailable
+            fix_unavailable_message(dependency)
+          when :dependency_still_vulnerable
+            dependency_still_vulnerable_message(dependency, audit_result)
+          when :downgrades_dependencies
+            downgraded_dependency = audit_result["fix_updates"].find do |update|
+              downgrades_version?(update["current_version"], update["target_version"])
+            end
+
+            return downgrades_dependency_message(dependency) unless downgraded_dependency
+
+            downgraded_dependency_message(dependency, downgraded_dependency)
           when :fix_incomplete
             "The lockfile might be out of sync?"
           else
@@ -193,6 +209,42 @@ module Dependabot
           current > target
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(String) }
+        def fix_unavailable_message(dependency)
+          "Dependabot could not find a lockfile update that resolves " \
+            "#{dependency.name} to a non-vulnerable version."
+        end
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            audit_result: T::Hash[String, T.untyped]
+          ).returns(String)
+        end
+        def dependency_still_vulnerable_message(dependency, audit_result)
+          "A patched version exists for #{dependency.name}, but the available " \
+            "update path still resolves it to #{audit_result['target_version']}"
+        end
+
+        sig { params(dependency: Dependabot::Dependency).returns(String) }
+        def downgrades_dependency_message(dependency)
+          "A patched version exists for #{dependency.name}, but the available " \
+            "update path requires downgrading another dependency"
+        end
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            downgraded_dependency: T::Hash[String, T.untyped]
+          ).returns(String)
+        end
+        def downgraded_dependency_message(dependency, downgraded_dependency)
+          "A patched version exists for #{dependency.name}, but the available " \
+            "update path would downgrade #{downgraded_dependency['dependency_name']} " \
+            "from #{downgraded_dependency['current_version']} to " \
+            "#{downgraded_dependency['target_version']}"
+        end
+
         sig { params(audit_result: T::Hash[String, T.untyped]).returns(T::Boolean) }
         def fix_incomplete?(audit_result)
           audit_result["fix_updates"].any? { |update| !update.key?("target_version") } ||

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -51,7 +51,7 @@ module Dependabot
       )
         @latest_version = T.let(nil, T.nilable(T.any(String, Gem::Version)))
         @latest_resolvable_version = T.let(nil, T.nilable(T.any(String, Dependabot::Version)))
-        @updated_requirements = T.let(nil, T.nilable(T::Array[T::Hash[Symbol, T.untyped]]))
+        @updated_requirements = T.let(nil, T.nilable(T::Array[Dependabot::DependencyRequirement]))
         @vulnerability_audit = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
         @vulnerable_versions = T.let(nil, T.nilable(T::Array[T.any(String, Gem::Version)]))
 
@@ -162,7 +162,7 @@ module Dependabot
         T.unsafe(version_resolver.latest_resolvable_previous_version(updated_version))
       end
 
-      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
         resolvable_version =
           if preferred_resolvable_version.is_a?(version_class)
@@ -177,12 +177,14 @@ module Dependabot
           end
 
         @updated_requirements ||=
-          RequirementsUpdater.new(
-            requirements: dependency.requirements,
-            updated_source: updated_source,
-            latest_resolvable_version: resolvable_version,
-            update_strategy: T.must(requirements_update_strategy)
-          ).updated_requirements
+          wrap_requirements(
+            RequirementsUpdater.new(
+              requirements: dependency.requirements,
+              updated_source: updated_source,
+              latest_resolvable_version: resolvable_version,
+              update_strategy: T.must(requirements_update_strategy)
+            ).updated_requirements
+          )
       end
 
       sig { returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.381.0
+  version: 0.382.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.382.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.382.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -349,6 +349,7 @@ files:
 - lib/dependabot/npm_and_yarn/native_helpers.rb
 - lib/dependabot/npm_and_yarn/npm_package_manager.rb
 - lib/dependabot/npm_and_yarn/package/package_details_fetcher.rb
+- lib/dependabot/npm_and_yarn/package/registry_credential_helpers.rb
 - lib/dependabot/npm_and_yarn/package/registry_finder.rb
 - lib/dependabot/npm_and_yarn/package_manager.rb
 - lib/dependabot/npm_and_yarn/package_name.rb
@@ -374,7 +375,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.381.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0
 rdoc_options: []
 require_paths:
 - lib