dependabot-npm_and_yarn 0.384.0 → 0.385.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50054abe467b1c8831c9fe1d24a014dc0944fff9b5991fd2b19acb92f05d5253
-  data.tar.gz: 81d4161505d10bfbafb2a6f7bd66d79dcdf70eb03cb56e3bf187cd795b4ba4c4
+  metadata.gz: 4e68f24f2520040b0fb94bb7a0d98af8b36a23bc7a8d27aecf9af8d32830a69d
+  data.tar.gz: 5e81bc9fc5e886d2e1a392899d27443f6d32cafdd08a788eb71052b7abe3266f
 SHA512:
-  metadata.gz: a7641af7236364d01c54cabb30389d3f65a7831b4fcae0484cac7777dd4c5621bdbd144d13ed520f84f5d7d9d759be2bf0770c51e251cbb0f1644ff77364d0f5
-  data.tar.gz: 24ada1ea83d5ca4383168a8e8f9847a3e63c06cfb3c246e1dc1e16cd53688afa1c34fadc22bb27954ff333bfc6f10fc0f25b607e54d6a4c2c3add55bdb91ed5b
+  metadata.gz: 618893dff8d6152043cfeab8c89c716f1cf5998f62a6210236df62c726d7c47e4edca330446c10a93c0e4f0704319c3d1ff6be5ddb1a652f5d67e2f51e3e11f5
+  data.tar.gz: 5a82b1c15fb5eb39f269f1d14a072796157758b9d9272f09fbcc1462296d10556d598dfb44b5f379097466661dcc0724f6d2d016dc850b8b2ab0727a8a611ff9

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -394,7 +394,7 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def dealias_packages?
-        options.fetch(:dealias_packages, false) == true
+        options.fetch(:dealias_packages, false) ? true : false
       end
 
       # Resolves an aliased manifest entry to its real package name and requirement.

data/lib/dependabot/npm_and_yarn/file_updater.rb

@@ -443,7 +443,7 @@ module Dependabot
             dependency_files: dependency_files,
             repo_contents_path: repo_contents_path,
             credentials: credentials,
-            security_updates_only: options.fetch(:security_updates_only, false)
+            security_updates_only: options.fetch(:security_updates_only, false) ? true : false
           ),
           T.nilable(Dependabot::NpmAndYarn::FileUpdater::YarnLockfileUpdater)
         )
@@ -457,7 +457,7 @@ module Dependabot
             dependency_files: dependency_files,
             repo_contents_path: repo_contents_path,
             credentials: credentials,
-            security_updates_only: options.fetch(:security_updates_only, false)
+            security_updates_only: options.fetch(:security_updates_only, false) ? true : false
           ),
           T.nilable(Dependabot::NpmAndYarn::FileUpdater::PnpmLockfileUpdater)
         )
@@ -474,7 +474,7 @@ module Dependabot
           dependencies: dependencies,
           dependency_files: dependency_files,
           credentials: credentials,
-          security_updates_only: options.fetch(:security_updates_only, false)
+          security_updates_only: options.fetch(:security_updates_only, false) ? true : false
         )
       end
 

data/lib/dependabot/npm_and_yarn/metadata_finder.rb

@@ -272,11 +272,14 @@ module Dependabot
         @latest_version_listing = T.let({}, T.nilable(T::Hash[String, T.untyped]))
 
         response = Dependabot::RegistryClient.get(url: "#{dependency_url}/latest", headers: registry_auth_headers)
-        @latest_version_listing = JSON.parse(response.body) if response.status == 200
+        if response.status == 200
+          parsed = JSON.parse(response.body)
+          @latest_version_listing = parsed if parsed.is_a?(Hash)
+        end
 
-        @latest_version_listing
+        T.must(@latest_version_listing)
       rescue JSON::ParserError, Excon::Error::Timeout
-        @latest_version_listing
+        T.must(@latest_version_listing)
       end
 
       sig { returns(T::Array[[String, T::Hash[String, T.untyped]]]) }
@@ -299,14 +302,15 @@ module Dependabot
         return T.must(@npm_listing) if response.status >= 500
 
         begin
-          @npm_listing = JSON.parse(response.body)
+          parsed = JSON.parse(response.body)
+          @npm_listing = parsed if parsed.is_a?(Hash)
         rescue JSON::ParserError
           raise unless non_standard_registry?
         end
 
-        @npm_listing
+        T.must(@npm_listing)
       rescue Excon::Error::Timeout
-        @npm_listing
+        T.must(@npm_listing)
       end
 
       sig { returns(String) }

data/lib/dependabot/npm_and_yarn/package/registry_finder.rb

@@ -428,8 +428,8 @@ module Dependabot
           return unless yarnrc_yml_file_content
           return @parsed_yarnrc_yml if @parsed_yarnrc_yml
 
-          @parsed_yarnrc_yml = YAML.safe_load(yarnrc_yml_file_content)
-          @parsed_yarnrc_yml
+          parsed = YAML.safe_load(yarnrc_yml_file_content)
+          @parsed_yarnrc_yml = parsed.is_a?(Hash) ? parsed : nil
         end
 
         sig { params(url: String).returns(String) }

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -242,7 +242,7 @@ module Dependabot
             .sort_by(&:version).reverse
         end
 
-        sig { returns(T::Array[[Dependabot::Version, T::Hash[String, T.nilable(String)]]]) }
+        sig { returns(T::Array[[Dependabot::Version, T::Hash[String, T.anything]]]) }
         def possible_previous_versions_with_details
           possible_previous_releases.map do |r|
             [r.version, r.details]

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -503,7 +503,7 @@ module Dependabot
         # If there was a semver requirement provided or the dependency was
         # pinned to a version, look for the latest tag
         if semver_req || git_commit_checker.pinned_ref_looks_like_version?
-          latest_tag = git_commit_checker.local_tag_for_latest_version
+          latest_tag = git_commit_checker.local_tag_for_latest_version(update_cooldown)
           return {
             sha: latest_tag&.fetch(:commit_sha),
             version: latest_tag&.fetch(:tag)&.gsub(/^[^\d]*/, "")
@@ -526,8 +526,8 @@ module Dependabot
 
         # Update the git tag if updating a pinned version
         if git_commit_checker.pinned_ref_looks_like_version? &&
-           !git_commit_checker.local_tag_for_latest_version.nil?
-          new_tag = git_commit_checker.local_tag_for_latest_version
+           !git_commit_checker.local_tag_for_latest_version(update_cooldown).nil?
+          new_tag = git_commit_checker.local_tag_for_latest_version(update_cooldown)
           return dependency_source_details&.merge(ref: new_tag&.fetch(:tag))
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.384.0
+  version: 0.385.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.385.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.385.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -377,7 +377,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
 rdoc_options: []
 require_paths:
 - lib