dependabot-npm_and_yarn 0.394.0 → 0.395.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3d36a6e6eb18ebce010518361fb49966de62ff78dd9da7a13f14c59aaedf5e7a
-  data.tar.gz: 7ed614ce2517bd8a198deb502ab46635a5019a810224ec0bbaed0066fc9e51c9
+  metadata.gz: 814f7f9eb89a5c4996711bb1ec4c541d2d7bbf0c7b3ec3767735fd859f3ea686
+  data.tar.gz: 7be4b8ad726b88f8fb3491326a6cd32b27c3b30e71009aabdc58657156f7f4a9
 SHA512:
-  metadata.gz: 58cf8b10de32b220cd9d72785b267d4f2d1a4d629d24cbe5c718c42b88354b1e42d75ecce54ed339394427ff9be8a99c3302db44aabd21f09df21a73c1b7158a
-  data.tar.gz: f4a98484a049955ae19f3db664bb7a760e345a14c7db2452f179dedbd242e1925afe6efdc2b1bc51607442e571d06f245644a78eca68fbc9772b244fbbacde1f
+  metadata.gz: '09a6318dab7354fa6bc0ba314ad763e6bfb2dd347a009fe13f957064a07d50fd25dd827d6a4ad414796133025a8705e78e1cdf9a975a7205e24f8abad9e57cec'
+  data.tar.gz: 8b2ec8e2da37e4597cfc91ad544f52ea5a5f126ba3676f4bd0107abb076bceaff608b75fa898cd56ae8843511f209178130c0ad23889703d582abce0ae48b10d

data/helpers/lib/npm/vulnerability-auditor.ts

@@ -313,7 +313,12 @@ function convertAdvisoriesToRegistryBulkFormat(
       >((memo, version) => {
         memo.push({
           id: Math.floor(Math.random() * Number.MAX_SAFE_INTEGER),
-          vulnerable_versions: version,
+          // Dependabot advisories join comparators with ", " but npm semver
+          // uses spaces. Loose semver parsing silently drops the comparator
+          // before a comma (">= 3.0.0, < 3.1.2" parses as "<3.1.2"), turning
+          // a range for one major into one that also covers every lower
+          // version, so strip the commas before Arborist sees the range.
+          vulnerable_versions: version.replace(/,/g, " "),
         });
         return memo;
       }, []);

data/helpers/package-lock.json

@@ -14934,9 +14934,10 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.1.tgz",
-      "integrity": "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==",
+      "version": "7.1.5",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.5.tgz",
+      "integrity": "sha512-KvvtD7SrlBP7dlgkBghEE3r84CABm5SmV2aNcG4oCA+qDnJ/tvKonFVvwWAyyWUEwxuNawdfEAZKP9zM3oZ2Uw==",
+      "license": "MIT",
       "dependencies": {
         "cssesc": "^3.0.0",
         "util-deprecate": "^1.0.2"
@@ -27786,9 +27787,9 @@
       }
     },
     "postcss-selector-parser": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.1.tgz",
-      "integrity": "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==",
+      "version": "7.1.5",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.5.tgz",
+      "integrity": "sha512-KvvtD7SrlBP7dlgkBghEE3r84CABm5SmV2aNcG4oCA+qDnJ/tvKonFVvwWAyyWUEwxuNawdfEAZKP9zM3oZ2Uw==",
       "requires": {
         "cssesc": "^3.0.0",
         "util-deprecate": "^1.0.2"

data/helpers/test/npm/fixtures/vulnerability-auditor/range-order-lower-major-only/package-lock.json

@@ -0,0 +1,24 @@
+{
+  "name": "test-vulnerability-range-order-lower-major-only",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "test-vulnerability-range-order-lower-major-only",
+      "version": "1.0.0",
+      "dependencies": {
+        "@msgpack/msgpack": "^2.7.2"
+      }
+    },
+    "node_modules/@msgpack/msgpack": {
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/@msgpack/msgpack/-/msgpack-2.7.2.tgz",
+      "integrity": "sha512-rYEi46+gIzufyYUAoHDnRzkWGxajpD9vVXFQ3g1vbjrBm6P7MBmm+s/fqPa46sxa+8FOUdEuRQKaugo5a4JWpw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">= 10"
+      }
+    }
+  }
+}

data/helpers/test/npm/fixtures/vulnerability-auditor/range-order-lower-major-only/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "test-vulnerability-range-order-lower-major-only",
+  "version": "1.0.0",
+  "private": true,
+  "description": "",
+  "dependencies": {
+    "@msgpack/msgpack": "^2.7.2"
+  }
+}

data/helpers/test/npm/vulnerability-auditor.test.ts

@@ -348,4 +348,80 @@ describe("findVulnerableDependencies", () => {
       ])
     );
   });
+
+  // Regression tests for https://github.com/dependabot/dependabot-core/issues/13644:
+  // the audit outcome must not depend on the order of affected_versions ranges.
+  // GitHub's API emits multi-major advisories in descending-major order (the
+  // higher-major ranges first), which is the order that triggers the bug.
+
+  it("reports the same fix when affected_versions lists the higher major first", async () => {
+    helpers.copyDependencies(
+      "vulnerability-auditor/update-needed-across-two-versions",
+      tempDir
+    );
+
+    // Identical to "finds vulnerable dependencies when multiple versions of the
+    // same package are affected", except the two ranges are swapped.
+    const advisories = [
+      {
+        dependency_name: "@msgpack/msgpack",
+        affected_versions: [">= 3.0.0, < 3.1.2", ">= 2.0.0, < 2.8.0"],
+      },
+    ];
+    const actual = await findVulnerableDependencies(tempDir, advisories);
+
+    expect(actual.dependency_name).toBe("@msgpack/msgpack");
+    expect(actual.current_version).toBe("2.7.2");
+    expect(actual.fix_available).toBe(true);
+    expect(actual.target_version).toBe("2.8.0");
+
+    expect(actual.fix_updates).toEqual(
+      expect.arrayContaining([
+        {
+          dependency_name: "@msgpack/msgpack",
+          current_version: "2.7.2",
+          target_version: "2.8.0",
+          top_level_ancestors: [],
+        },
+        {
+          dependency_name: "@msgpack/msgpack",
+          current_version: "3.0.0",
+          target_version: "3.1.3",
+          top_level_ancestors: ["wireql-client"],
+        },
+      ])
+    );
+  });
+
+  it("fixes an installed lower major when a range for an uninstalled higher major is listed first", async () => {
+    helpers.copyDependencies(
+      "vulnerability-auditor/range-order-lower-major-only",
+      tempDir
+    );
+
+    // Only @msgpack/msgpack 2.7.2 is installed (manifest range ^2.7.2, so the
+    // patched 2.8.0 is an in-range lockfile-only update). The 3.x range applies
+    // to published versions that don't appear in this tree and must be inert.
+    const advisories = [
+      {
+        dependency_name: "@msgpack/msgpack",
+        affected_versions: [">= 3.0.0, < 3.1.2", ">= 2.0.0, < 2.8.0"],
+      },
+    ];
+    const actual = await findVulnerableDependencies(tempDir, advisories);
+
+    expect(actual.dependency_name).toBe("@msgpack/msgpack");
+    expect(actual.current_version).toBe("2.7.2");
+    expect(actual.fix_available).toBe(true);
+    expect(actual.target_version).toBe("2.8.0");
+
+    expect(actual.fix_updates).toEqual([
+      {
+        dependency_name: "@msgpack/msgpack",
+        current_version: "2.7.2",
+        target_version: "2.8.0",
+        top_level_ancestors: [],
+      },
+    ]);
+  });
 });

data/lib/dependabot/npm_and_yarn/constraint_helper.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/npm_and_yarn/dependency_grapher/pnpm_relationship_resolver.rb

@@ -17,7 +17,11 @@ module Dependabot
 
         sig { returns(T::Hash[String, T::Array[String]]) }
         def relationships
-          parsed = YAML.safe_load(T.must(@lockfile.content)) || {}
+          # pnpm 11+ can write pnpm-lock.yaml as a two-document YAML stream: an
+          # env document (pnpm's own binaries, with its own "packages" and
+          # "snapshots" sections) precedes the project document. The project
+          # graph is always the last document in the stream.
+          parsed = YAML.safe_load_stream(T.must(@lockfile.content)).last || {}
 
           # v9+ uses "snapshots" for resolved dependency details; v6 uses "packages"
           entries = parsed.fetch("snapshots", nil) || parsed.fetch("packages", {})

data/lib/dependabot/npm_and_yarn/dependency_grapher.rb

@@ -125,7 +125,7 @@ module Dependabot
         @detected_package_manager ||= T.let(
           PackageManagerDetector.new(
             lockfiles_hash,
-            parsed_package_json
+            Dependabot::Package::NpmPackageManagerConfig.from_package_json(parsed_package_json)
           ).detect_package_manager,
           T.nilable(String)
         )

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -329,7 +329,7 @@ module Dependabot
       def package_manager_helper
         @package_manager_helper ||= T.let(
           PackageManagerHelper.new(
-            parsed_package_json,
+            Dependabot::Package::NpmPackageManagerConfig.from_package_json(parsed_package_json),
             lockfiles,
             registry_config_files,
             credentials

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -99,7 +99,7 @@ module Dependabot
       def package_manager_helper
         @package_manager_helper ||= T.let(
           PackageManagerHelper.new(
-            parsed_package_json,
+            Dependabot::Package::NpmPackageManagerConfig.from_package_json(parsed_package_json),
             lockfiles,
             registry_config_files,
             credentials

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -14,7 +14,7 @@ require "dependabot/npm_and_yarn/native_helpers"
 require "dependabot/npm_and_yarn/package/registry_finder"
 require "dependabot/shared_helpers"
 
-# rubocop:disable Metrics/ClassLength
+# rubocop:disable-next Metrics/ClassLength
 module Dependabot
   module NpmAndYarn
     class FileUpdater < Dependabot::FileUpdaters::Base
@@ -1426,4 +1426,3 @@ module Dependabot
     end
   end
 end
-# rubocop:enable Metrics/ClassLength

data/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb

@@ -114,7 +114,7 @@ module Dependabot
         PNPM_TRUST_LOCKFILE_VERSION = "11.3"
         # pnpm-workspace.yaml settings that govern verification of loaded lockfile
         # entries, and so must not be overridden by `trustLockfile=true`.
-        LOCKFILE_VERIFICATION_SETTINGS = T.let(%w(trustLockfile trustPolicy).freeze, T::Array[String])
+        LOCKFILE_VERIFICATION_SETTINGS = %w(trustLockfile trustPolicy).freeze
 
         UNREACHABLE_GIT = %r{Command failed with exit code 128: git ls-remote (?<url>.*github\.com/[^/]+/[^ ]+)}
         UNREACHABLE_GIT_V8 = %r{ERR_PNPM_FETCH_404[ [^:print]]+GET (?<url>https://codeload\.github\.com/[^/]+/[^/]+)/}

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -13,7 +13,7 @@ require "dependabot/npm_and_yarn/native_helpers"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 
-# rubocop:disable Metrics/ClassLength
+# rubocop:disable-next Metrics/ClassLength
 module Dependabot
   module NpmAndYarn
     class FileUpdater < Dependabot::FileUpdaters::Base
@@ -829,7 +829,7 @@ module Dependabot
           yarnrc_global_registry =
             T.must(T.must(yarnrc_file).content)
              .lines.find { |line| line.match?(regex) }
-                   &.match(regex)
+             &.match(regex)
              &.named_captures
              &.fetch("registry")
 
@@ -967,7 +967,7 @@ module Dependabot
                                      "[#{code}]: #{error_message}"
                                    end
 
-          raise  create_error(handler, modified_error_message, error, params)
+          raise create_error(handler, modified_error_message, error, params)
         end
       end
 
@@ -1107,4 +1107,3 @@ module Dependabot
     end
   end
 end
-# rubocop:enable Metrics/ClassLength

data/lib/dependabot/npm_and_yarn/package_manager.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"
@@ -11,6 +11,7 @@ require "dependabot/npm_and_yarn/yarn_package_manager"
 require "dependabot/npm_and_yarn/pnpm_package_manager"
 require "dependabot/npm_and_yarn/language"
 require "dependabot/npm_and_yarn/constraint_helper"
+require "dependabot/package/npm_package_manager_config"
 
 module Dependabot
   module NpmAndYarn
@@ -82,14 +83,13 @@ module Dependabot
       sig do
         params(
           lockfiles: T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)],
-          package_json: T.nilable(T::Hash[String, T.untyped])
+          config: Dependabot::Package::NpmPackageManagerConfig
         ).void
       end
-      def initialize(lockfiles, package_json)
+      def initialize(lockfiles, config)
         @lockfiles = lockfiles
-        @package_json = package_json
-        @manifest_package_manager = T.let(package_json&.fetch(MANIFEST_PACKAGE_MANAGER_KEY, nil), T.nilable(String))
-        @engines = T.let(package_json&.fetch(MANIFEST_ENGINES_KEY, {}), T::Hash[String, T.untyped])
+        @manifest_package_manager = T.let(config.package_manager, T.nilable(String))
+        @engines = T.let(config.engines || {}, T::Hash[String, String])
       end
 
       # Returns npm, yarn, or pnpm based on the lockfiles, package.json, and engines
@@ -130,8 +130,6 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def name_from_engines
-        return unless @engines.is_a?(Hash)
-
         PACKAGE_MANAGER_CLASSES.each_key do |manager_name|
           return manager_name if @engines[manager_name]
         end
@@ -145,22 +143,21 @@ module Dependabot
 
       sig do
         params(
-          package_json: T.nilable(T::Hash[String, T.untyped]),
+          config: Dependabot::Package::NpmPackageManagerConfig,
           lockfiles: T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)],
           registry_config_files: T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)],
           credentials: T.nilable(T::Array[Dependabot::Credential])
         ).void
       end
-      def initialize(package_json, lockfiles, registry_config_files, credentials)
-        @package_json = package_json
+      def initialize(config, lockfiles, registry_config_files, credentials)
         @lockfiles = lockfiles
         @registry_helper = T.let(
           RegistryHelper.new(registry_config_files, credentials),
           Dependabot::NpmAndYarn::RegistryHelper
         )
-        @package_manager_detector = T.let(PackageManagerDetector.new(lockfiles, package_json), PackageManagerDetector)
-        @manifest_package_manager = T.let(package_json&.fetch(MANIFEST_PACKAGE_MANAGER_KEY, nil), T.nilable(String))
-        @engines = T.let(package_json&.fetch(MANIFEST_ENGINES_KEY, nil), T.nilable(T::Hash[String, T.untyped]))
+        @package_manager_detector = T.let(PackageManagerDetector.new(lockfiles, config), PackageManagerDetector)
+        @manifest_package_manager = T.let(config.package_manager, T.nilable(String))
+        @engines = T.let(config.engines, T.nilable(T::Hash[String, String]))
 
         @installed_versions = T.let({}, T::Hash[String, String])
         @registries = T.let({}, T::Hash[String, String])
@@ -223,9 +220,9 @@ module Dependabot
 
       sig { params(name: String).returns(String) }
       def raw_engine_constraint(name)
-        return "" unless @engines.is_a?(Hash) && @engines[name]
+        return "" unless @engines
 
-        @engines[name].to_s.strip
+        @engines.fetch(name, "").strip
       end
 
       sig { params(raw_constraint: String).returns(T.nilable(T::Array[T::Array[String]])) }
@@ -424,7 +421,7 @@ module Dependabot
 
         # If we can't get the installed version or the version is invalid, we need to get inferred version
         unless @installed_versions[name]&.match?(PACKAGE_MANAGER_VERSION_REGEX)
-          @installed_versions[name] = Helpers.public_send(:"#{name}_version_numeric", @lockfiles[name.to_sym]).to_s
+          @installed_versions[name] = T.must(numeric_lockfile_version(name, @lockfiles[name.to_sym])).to_s
         end
 
         T.must(@installed_versions[name])
@@ -472,25 +469,25 @@ module Dependabot
         match["version"]
       end
 
-      sig { params(name: String).returns(T.nilable(T.any(Integer, String))) }
+      sig { params(name: String).returns(T.nilable(Integer)) }
       def guessed_version(name)
         lockfile = @lockfiles[name.to_sym]
         return unless lockfile
 
-        version = Helpers.send(:"#{name}_version_numeric", lockfile)
+        version = numeric_lockfile_version(name, lockfile)
 
         Dependabot.logger.info("Guessed version info \"#{name}\" : \"#{version}\"")
 
         version
       end
 
-      sig { params(name: T.untyped).returns(T.nilable(String)) }
+      sig { params(name: String).returns(T.nilable(String)) }
       def check_engine_version(name)
-        return if @package_json.nil?
+        return unless @engines
 
         version_selector = VersionSelector.new
 
-        engine_versions = version_selector.setup(@package_json, name, dependabot_versions(name))
+        engine_versions = version_selector.setup(@engines, name, dependabot_versions(name))
 
         return if engine_versions.empty?
 
@@ -510,6 +507,23 @@ module Dependabot
           PNPMPackageManager::SUPPORTED_VERSIONS
         end
       end
+
+      sig do
+        params(
+          name: String,
+          lockfile: T.nilable(Dependabot::DependencyFile)
+        ).returns(T.nilable(Integer))
+      end
+      def numeric_lockfile_version(name, lockfile)
+        case name
+        when NpmPackageManager::NAME
+          Helpers.npm_version_numeric(lockfile)
+        when YarnPackageManager::NAME
+          Helpers.yarn_version_numeric(lockfile)
+        when PNPMPackageManager::NAME
+          Helpers.pnpm_version_numeric(lockfile)
+        end
+      end
     end
   end
 end

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -18,7 +18,7 @@ require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/npm_and_yarn/version"
 require "dependabot/shared_helpers"
 
-# rubocop:disable Metrics/ClassLength
+# rubocop:disable-next Metrics/ClassLength
 module Dependabot
   module NpmAndYarn
     class UpdateChecker
@@ -1085,4 +1085,3 @@ module Dependabot
     end
   end
 end
-# rubocop:enable Metrics/ClassLength

data/lib/dependabot/npm_and_yarn/version_selector.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"
@@ -10,29 +10,27 @@ module Dependabot
       extend T::Sig
       extend T::Helpers
 
-      # Sets up engine versions from the given manifest JSON.
+      # Sets up the requested engine version from the manifest engines.
       #
-      # @param manifest_json [Hash] The manifest JSON containing version information.
+      # @param engine_versions [Hash] The manifest engine constraints.
       # @param name [String] The engine name to match.
       # @return [Hash] A hash with selected versions, if found.
       sig do
         params(
-          manifest_json: T::Hash[String, T.untyped],
+          engine_versions: T.nilable(T::Hash[String, String]),
           name: String,
           dependabot_versions: T.nilable(T::Array[Dependabot::Version])
         )
-          .returns(T::Hash[Symbol, T.untyped])
+          .returns(T::Hash[String, T.nilable(String)])
       end
-      def setup(manifest_json, name, dependabot_versions = nil)
-        engine_versions = manifest_json["engines"]
-
+      def setup(engine_versions, name, dependabot_versions = nil)
         # Return an empty hash if no engine versions are specified
         return {} if engine_versions.nil?
 
-        versions = {}
+        versions = T.let({}, T::Hash[String, T.nilable(String)])
 
         engine_versions.each do |engine, value|
-          next unless engine.to_s == name
+          next unless engine == name
 
           versions[name] = ConstraintHelper.find_highest_version_from_constraint_expression(
             value, dependabot_versions

data/lib/dependabot/npm_and_yarn.rb

@@ -35,7 +35,7 @@ ErrorHandler = T.type_alias do
 end
 
 module Dependabot
-  # rubocop:disable Metrics/ModuleLength
+  # rubocop:disable-next Metrics/ModuleLength
   module NpmAndYarn
     NODE_VERSION_NOT_SATISFY_REGEX = /The current Node version (?<current_version>v?\d+\.\d+\.\d+) does not satisfy the required version (?<required_version>v?\d+\.\d+\.\d+)\./ # rubocop:disable Layout/LineLength
 
@@ -660,5 +660,4 @@ module Dependabot
       }]
     )
   end
-  # rubocop:enable Metrics/ModuleLength
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.394.0
+  version: 0.395.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -178,19 +178,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -281,6 +281,8 @@ files:
 - helpers/test/npm/fixtures/vulnerability-auditor/locked-transitive-dependency/package.json
 - helpers/test/npm/fixtures/vulnerability-auditor/outdated-package-lock/package-lock.json
 - helpers/test/npm/fixtures/vulnerability-auditor/outdated-package-lock/package.json
+- helpers/test/npm/fixtures/vulnerability-auditor/range-order-lower-major-only/package-lock.json
+- helpers/test/npm/fixtures/vulnerability-auditor/range-order-lower-major-only/package.json
 - helpers/test/npm/fixtures/vulnerability-auditor/simple/package-lock.json
 - helpers/test/npm/fixtures/vulnerability-auditor/simple/package.json
 - helpers/test/npm/fixtures/vulnerability-auditor/update-needed-across-two-versions/package-lock.json
@@ -388,7 +390,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
 rdoc_options: []
 require_paths:
 - lib