dependabot-npm_and_yarn 0.395.0 → 0.396.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 814f7f9eb89a5c4996711bb1ec4c541d2d7bbf0c7b3ec3767735fd859f3ea686
-  data.tar.gz: 7be4b8ad726b88f8fb3491326a6cd32b27c3b30e71009aabdc58657156f7f4a9
+  metadata.gz: e7701a231519c944cf2fb1c6141f84c2ed5e391e5b5d29c72e42c2a85923947b
+  data.tar.gz: cdfe34310c136b297c99f715a53e665b53ebaa751022d29bb473c6e80ea82729
 SHA512:
-  metadata.gz: '09a6318dab7354fa6bc0ba314ad763e6bfb2dd347a009fe13f957064a07d50fd25dd827d6a4ad414796133025a8705e78e1cdf9a975a7205e24f8abad9e57cec'
-  data.tar.gz: 8b2ec8e2da37e4597cfc91ad544f52ea5a5f126ba3676f4bd0107abb076bceaff608b75fa898cd56ae8843511f209178130c0ad23889703d582abce0ae48b10d
+  metadata.gz: 29e772e38e68ffb7483a2e0315ae8ff49cf53e62a3d1c3133074641403329173052ae9a6d18bb04109bbb25065c150db195b86c83c81f792c77e654b6e353ecc
+  data.tar.gz: 2edf72ca8610f9145e2388871ae0b05cb952bf512cd9a9a974e643f0e0f73f98d7303388e631df6539db80c87f33e1461528d163d095e4fdbe19558b1d6965d8

data/helpers/package-lock.json

@@ -4572,12 +4572,16 @@
       "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c="
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.9.6",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.6.tgz",
-      "integrity": "sha512-v9BVVpOTLB59C9E7aSnmIF8h7qRsFpx+A2nugVMTszEOMcfjlZMsXRm4LF23I3Z9AJxc8ANpIvzbzONoX9VJlg==",
+      "version": "2.11.21",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz",
+      "integrity": "sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ==",
       "dev": true,
+      "license": "Apache-2.0",
       "bin": {
-        "baseline-browser-mapping": "dist/cli.js"
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
       }
     },
     "node_modules/bcrypt-pbkdf": {
@@ -20131,9 +20135,9 @@
       "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c="
     },
     "baseline-browser-mapping": {
-      "version": "2.9.6",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.6.tgz",
-      "integrity": "sha512-v9BVVpOTLB59C9E7aSnmIF8h7qRsFpx+A2nugVMTszEOMcfjlZMsXRm4LF23I3Z9AJxc8ANpIvzbzONoX9VJlg==",
+      "version": "2.11.21",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz",
+      "integrity": "sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ==",
       "dev": true
     },
     "bcrypt-pbkdf": {

data/lib/dependabot/npm_and_yarn/dependency_files_filterer.rb

@@ -1,7 +1,8 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/utils"
+require "dependabot/package/npm_package_json"
 require "dependabot/npm_and_yarn/file_parser/lockfile_parser"
 require "sorbet-runtime"
 
@@ -88,7 +89,7 @@ module Dependabot
         return false unless ["yarn.lock", "package-lock.json", "pnpm-lock.yaml", "bun.lock", "npm-shrinkwrap.json"]
                             .include?(lockfile.name)
 
-        return false unless parsed_root_package_json["workspaces"] || dependency_files.any? do |file|
+        return false unless root_package_json_document.workspaces? || dependency_files.any? do |file|
           file.name.end_with?("pnpm-workspace.yaml") && File.dirname(file.name) == File.dirname(lockfile.name)
         end
 
@@ -115,14 +116,14 @@ module Dependabot
         )
       end
 
-      sig { returns(T::Hash[String, T.untyped]) }
-      def parsed_root_package_json
-        @parsed_root_package_json ||= T.let(
+      sig { returns(Dependabot::Package::NpmPackageJson) }
+      def root_package_json_document
+        @root_package_json_document ||= T.let(
           begin
             package = T.must(dependency_files.find { |f| f.name == "package.json" })
-            JSON.parse(T.must(package.content))
+            Dependabot::Package::NpmPackageJson.from_file(package)
           end,
-          T.nilable(T::Hash[String, T.untyped])
+          T.nilable(Dependabot::Package::NpmPackageJson)
         )
       end
 

data/lib/dependabot/npm_and_yarn/dependency_grapher/yarn_relationship_resolver.rb

@@ -20,13 +20,11 @@ module Dependabot
           parsed = FileParser::YarnLock.new(@lockfile).parsed
 
           parsed.each_with_object({}) do |(req, details), rels|
-            next unless details.is_a?(Hash)
-
-            version = details["version"]
+            version = details.version
             parent_name = T.must(req.split(/(?<=\w)\@/).first)
-            children = details.fetch("dependencies", {})
+            children = details.dependencies
 
-            next if children.nil? || children.empty?
+            next if children.empty?
 
             key = "#{parent_name}@#{version}"
             resolved_children = resolve_children(children, parsed)
@@ -38,7 +36,10 @@ module Dependabot
 
         private
 
-        sig { params(children: T::Hash[String, String], parsed: T::Hash[String, T.untyped]).returns(T::Array[String]) }
+        sig do
+          params(children: T::Hash[String, String], parsed: T::Hash[String, FileParser::YarnLock::Record])
+            .returns(T::Array[String])
+        end
         def resolve_children(children, parsed)
           children.filter_map do |child_name, child_req|
             version = resolve_child_version(child_name, child_req, parsed)
@@ -46,21 +47,25 @@ module Dependabot
           end
         end
 
-        sig { params(child_name: String, child_req: String, parsed: T::Hash[String, T.untyped]).returns(T.nilable(String)) }
+        sig do
+          params(child_name: String, child_req: String, parsed: T::Hash[String, FileParser::YarnLock::Record])
+            .returns(T.nilable(String))
+        end
         def resolve_child_version(child_name, child_req, parsed)
           # Try exact key first
           child_entry = parsed["#{child_name}@#{child_req}"]
-          return child_entry["version"] if child_entry && child_entry["version"]
+          return child_entry.version if child_entry&.version
 
           # Yarn groups multiple requirements into single keys like "foo@^1.0.0, foo@^1.2.0"
           target_req = "#{child_name}@#{child_req}"
           grouped_match = parsed.find { |k, _| k.split(", ").include?(target_req) }
-          return grouped_match.last["version"] if grouped_match && grouped_match.last["version"]
+          grouped_version = grouped_match&.last&.version
+          return grouped_version if grouped_version
 
           # Fallback: find by name only if there's exactly one candidate
           candidates = parsed.select { |k, _| k.split(/(?<=\w)\@/).first == child_name }
           candidate = candidates.first
-          candidate.last["version"] if candidates.size == 1 && candidate
+          candidate.last.version if candidates.size == 1 && candidate
         end
       end
     end

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -179,17 +179,9 @@ module Dependabot
         end
 
         known_registries = []
-        FileParser::JsonLock.new(T.must(package_lock)).parsed.fetch(
-          "dependencies",
-          {}
-        ).each do |dependency_name, details|
-          resolved = details.fetch("resolved", DEFAULT_NPM_REGISTRY)
-
-          begin
-            uri = URI.parse(resolved)
-          rescue URI::InvalidURIError
-            next
-          end
+        FileParser::JsonLock.new(T.must(package_lock)).legacy_dependencies.each do |dependency_name, details|
+          uri = details.registry_uri(DEFAULT_NPM_REGISTRY)
+          next unless uri
 
           next unless uri.scheme && uri.host
 

data/lib/dependabot/npm_and_yarn/file_parser/json_lock/record.rb

@@ -0,0 +1,155 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "uri"
+require "sorbet-runtime"
+require "dependabot/npm_and_yarn/file_parser/json_lock"
+
+module Dependabot
+  module NpmAndYarn
+    class FileParser < Dependabot::FileParsers::Base
+      class JsonLock
+        class Record
+          extend T::Sig
+
+          ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+          sig { params(data: Object, path: String, context: String).void }
+          def initialize(data, path:, context:)
+            @data = data
+            @path = path
+            @context = context
+            @object = T.let(nil, T.nilable(ObjectHash))
+          end
+
+          sig { returns(T.nilable(String)) }
+          def version
+            optional_string("version")
+          end
+
+          sig { returns(T.nilable(String)) }
+          def name
+            optional_string("name")
+          end
+
+          sig { returns(T.nilable(String)) }
+          def resolved
+            optional_string("resolved")
+          end
+
+          sig { returns(T.nilable(String)) }
+          def resolution
+            optional_string("resolution")
+          end
+
+          sig { returns(T::Boolean) }
+          def dev?
+            boolean("dev")
+          end
+
+          sig { returns(T::Boolean) }
+          def bundled?
+            boolean("bundled")
+          end
+
+          sig { returns(T::Hash[String, Record]) }
+          def dependency_entries
+            field = object["dependencies"] ? "dependencies" : "packages"
+            context = "#{@context}.#{field}"
+            mapping = object_value(object.fetch(field, {}), context)
+
+            # Modern package records contain requirement strings rather than nested lock entries.
+            mapping.reject { |_, value| value.is_a?(String) }.to_h do |key, data|
+              [key, self.class.new(data, path: @path, context: "#{context}.#{key}")]
+            end
+          end
+
+          sig { returns(T::Hash[String, Record]) }
+          def legacy_entries
+            entries(object.fetch("dependencies", {}), "#{@context}.dependencies")
+          end
+
+          sig { params(name: String).returns(T.nilable(Record)) }
+          def legacy_entry(name)
+            dependencies = object["dependencies"]
+            return if dependencies.nil?
+
+            data = object_value(dependencies, "#{@context}.dependencies")[name]
+            self.class.new(data, path: @path, context: "dependencies.#{name}") unless data.nil?
+          end
+
+          sig { params(primary: String, fallback: String).returns(T.nilable(Record)) }
+          def package_entry(primary, fallback)
+            packages = object["packages"]
+            return if packages.nil?
+
+            mapping = object_value(packages, "#{@context}.packages")
+            key = mapping[primary] ? primary : fallback
+            data = mapping[key]
+            self.class.new(data, path: @path, context: "packages.#{key}") unless data.nil?
+          end
+
+          sig { params(default_registry: String).returns(T.nilable(URI::Generic)) }
+          def registry_uri(default_registry)
+            value = object.fetch("resolved", default_registry)
+            # Registry inference filters invalid URIs, including non-string values.
+            return unless value.is_a?(String)
+
+            URI.parse(value)
+          rescue URI::InvalidURIError
+            nil
+          end
+
+          private
+
+          sig { returns(ObjectHash) }
+          def object
+            @object ||= object_value(@data, @context)
+          end
+
+          sig { params(value: Object, context: String).returns(ObjectHash) }
+          def object_value(value, context)
+            invalid!("#{context} must be an object") unless value.is_a?(Hash)
+
+            value.to_h do |raw_key, raw_value|
+              key = T.cast(raw_key, Object)
+              invalid!("#{context} keys must be strings") unless key.is_a?(String)
+
+              [key, T.cast(raw_value, Object)]
+            end
+          end
+
+          sig { params(value: Object, context: String).returns(T::Hash[String, Record]) }
+          def entries(value, context)
+            object_value(value, context).to_h do |key, data|
+              [key, self.class.new(data, path: @path, context: "#{context}.#{key}")]
+            end
+          end
+
+          sig { params(key: String).returns(T.nilable(String)) }
+          def optional_string(key)
+            value = object[key]
+            return if value.nil?
+            return value if value.is_a?(String)
+
+            invalid!("#{@context}.#{key} must be a string or nil")
+          end
+
+          sig { params(key: String).returns(T::Boolean) }
+          def boolean(key)
+            value = object[key]
+            return false if value.nil? || value == false
+            return true if value == true
+
+            invalid!("#{@context}.#{key} must be a boolean or nil")
+          end
+
+          sig { params(message: String).returns(T.noreturn) }
+          def invalid!(message)
+            raise DependencyFileNotParseable.new(@path, message)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/npm_and_yarn/file_parser/json_lock.rb

@@ -1,9 +1,11 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "json"
 require "dependabot/errors"
+require "dependabot/npm_and_yarn/file_parser"
 require "dependabot/npm_and_yarn/helpers"
+require "dependabot/package/npm_lockfile_details"
 require "sorbet-runtime"
 
 module Dependabot
@@ -12,16 +14,24 @@ module Dependabot
       class JsonLock
         extend T::Sig
 
+        require_relative "json_lock/record"
+
         sig { params(dependency_file: DependencyFile, dealias_packages: T::Boolean).void }
         def initialize(dependency_file, dealias_packages: false)
           @dependency_file = dependency_file
           @dealias_packages = dealias_packages
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
+        sig { returns(Record) }
         def parsed
-          json_obj = JSON.parse(T.must(@dependency_file.content))
-          @parsed ||= T.let(json_obj, T.nilable(T::Hash[String, T.untyped]))
+          @parsed ||= T.let(
+            Record.new(
+              T.cast(JSON.parse(T.must(@dependency_file.content)), Object),
+              path: @dependency_file.path,
+              context: "lockfile"
+            ),
+            T.nilable(Record)
+          )
         rescue JSON::ParserError
           raise Dependabot::DependencyFileNotParseable, @dependency_file.path
         end
@@ -31,90 +41,91 @@ module Dependabot
           recursively_fetch_dependencies(parsed)
         end
 
+        sig { returns(T::Hash[String, Record]) }
+        def legacy_dependencies
+          parsed.legacy_entries
+        end
+
         sig do
-          params(dependency_name: String, _requirement: T.untyped, manifest_name: String)
-            .returns(T.nilable(T::Hash[String, T.untyped]))
+          params(dependency_name: String, _requirement: T.nilable(String), manifest_name: String)
+            .returns(T.nilable(Dependabot::Package::NpmLockfileDetails))
         end
         def details(dependency_name, _requirement, manifest_name)
-          if Helpers.parse_npm8?(@dependency_file)
-            # NOTE: npm 8 sometimes doesn't install workspace dependencies in the
-            # workspace folder so we need to fallback to checking top-level
-            nested_details = parsed.dig("packages", node_modules_path(manifest_name, dependency_name))
-            details = nested_details || parsed.dig("packages", "node_modules/#{dependency_name}")
-            details&.slice("version", "resolved", "integrity", "dev")
-          else
-            parsed.dig("dependencies", dependency_name)
-          end
+          modern = Helpers.parse_npm8?(@dependency_file)
+          details = if modern
+                      # NOTE: npm 8 sometimes doesn't install workspace dependencies in the
+                      # workspace folder so we need to fallback to checking top-level
+                      parsed.package_entry(
+                        node_modules_path(manifest_name, dependency_name),
+                        "node_modules/#{dependency_name}"
+                      )
+                    else
+                      parsed.legacy_entry(dependency_name)
+                    end
+          return if details.nil?
+
+          Dependabot::Package::NpmLockfileDetails.new(
+            version: details.version,
+            resolved: details.resolved,
+            resolution: modern ? nil : details.resolution
+          )
         end
 
         private
 
         sig do
-          params(object_with_dependencies: T::Hash[String, T.untyped])
+          params(object_with_dependencies: Record)
             .returns(Dependabot::FileParsers::Base::DependencySet)
         end
         def recursively_fetch_dependencies(object_with_dependencies)
           dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
-          dependencies = object_with_dependencies["dependencies"]
-          dependencies ||= object_with_dependencies.fetch("packages", {})
-
-          dependencies.each do |name, details|
+          object_with_dependencies.dependency_entries.each do |name, details|
             next if name.empty? # v3 lockfiles include an empty key holding info of the current package
 
-            version = Version.semver_for(details["version"])
+            version = Version.semver_for(details.version)
             next unless version
 
             package_name = package_name_for(name, details)
             version = version.to_s
 
-            dependency_args = {
+            metadata = aliased_package?(name, details) ? { alias: name.split("node_modules/").last } : nil
+            subdependency_metadata = T.let(nil, T.nilable(T::Array[T::Hash[Symbol, Object]]))
+            subdependency_metadata = [{ npm_bundled: true }] if details.bundled?
+            subdependency_metadata = [{ production: false }] if details.dev?
+
+            dependency_set << Dependency.new(
               name: package_name,
               version: version,
               package_manager: "npm_and_yarn",
-              requirements: []
-            }
-
-            if aliased_package?(name, details)
-              alias_name = name.split("node_modules/").last
-              dependency_args[:metadata] = { alias: alias_name }
-            end
-
-            if details["bundled"]
-              dependency_args[:subdependency_metadata] =
-                [{ npm_bundled: details["bundled"] }]
-            end
-
-            if details["dev"]
-              dependency_args[:subdependency_metadata] =
-                [{ production: !details["dev"] }]
-            end
-
-            dependency_set << Dependency.new(**dependency_args)
+              requirements: [],
+              metadata: metadata,
+              subdependency_metadata: subdependency_metadata
+            )
             dependency_set += recursively_fetch_dependencies(details)
           end
 
           dependency_set
         end
 
-        sig { params(package_path: String, details: T::Hash[String, T.untyped]).returns(String) }
+        sig { params(package_path: String, details: Record).returns(String) }
         def package_name_for(package_path, details)
           package_name = T.must(package_path.split("node_modules/").last)
           return package_name unless dealias_packages?
 
-          real_package_name = details["name"]
-          return package_name unless real_package_name.is_a?(String)
+          real_package_name = details.name
+          return package_name if real_package_name.nil?
           return package_name if real_package_name == package_name
 
           real_package_name
         end
 
-        sig { params(package_path: String, details: T::Hash[String, T.untyped]).returns(T::Boolean) }
+        sig { params(package_path: String, details: Record).returns(T::Boolean) }
         def aliased_package?(package_path, details)
           return false unless dealias_packages?
 
-          real_package_name = details["name"]
-          return false unless real_package_name.is_a?(String)
+          real_package_name = details.name
+          return false if real_package_name.nil?
 
           package_name = T.must(package_path.split("node_modules/").last)
           real_package_name != package_name

data/lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb

@@ -4,6 +4,7 @@
 require "dependabot/dependency_file"
 require "dependabot/npm_and_yarn/file_parser"
 require "dependabot/npm_and_yarn/helpers"
+require "dependabot/package/npm_lockfile_details"
 require "sorbet-runtime"
 
 module Dependabot
@@ -48,10 +49,10 @@ module Dependabot
 
         sig do
           params(dependency_name: String, requirement: T.nilable(String), manifest_name: String)
-            .returns(T.nilable(T::Hash[String, T.untyped]))
+            .returns(T.nilable(Dependabot::Package::NpmLockfileDetails))
         end
         def lockfile_details(dependency_name:, requirement:, manifest_name:)
-          details = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+          details = T.let(nil, T.nilable(Dependabot::Package::NpmLockfileDetails))
           potential_lockfiles_for_manifest(manifest_name).each do |lockfile|
             details = lockfile_for(lockfile).details(dependency_name, requirement, manifest_name)
 

data/lib/dependabot/npm_and_yarn/file_parser/pnpm_lock.rb

@@ -1,12 +1,13 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
 
+require "dependabot/npm_and_yarn/file_parser"
 require "dependabot/errors"
 require "dependabot/dependency"
-require "dependabot/file_parsers/base"
 require "dependabot/npm_and_yarn/native_helpers"
+require "dependabot/package/npm_lockfile_details"
 require "dependabot/shared_helpers"
 
 module Dependabot
@@ -15,99 +16,112 @@ module Dependabot
       class PnpmLock
         extend T::Sig
 
+        class Record < T::ImmutableStruct
+          extend T::Sig
+
+          const :name, String
+          const :version, String
+          const :resolved, T.nilable(String)
+          const :dev, T::Boolean
+          const :specifiers, T::Array[String]
+          const :aliased, T::Boolean
+
+          sig { params(value: Object, path: String, index: Integer).returns(Record) }
+          def self.from_object(value, path:, index:)
+            context = "pnpm helper result[#{index}]"
+            raise DependencyFileNotParseable.new(path, "#{context} must be an object") unless value.is_a?(Hash)
+
+            resolved = string(T.cast(value["resolved"], Object), path, "#{context}.resolved") if value.key?("resolved")
+
+            new(
+              name: string(T.cast(value["name"], Object), path, "#{context}.name"),
+              version: string(T.cast(value["version"], Object), path, "#{context}.version"),
+              resolved: resolved,
+              dev: boolean(T.cast(value["dev"], Object), path, "#{context}.dev"),
+              specifiers: strings(T.cast(value["specifiers"], Object), path, "#{context}.specifiers"),
+              aliased: boolean(T.cast(value["aliased"], Object), path, "#{context}.aliased")
+            )
+          end
+
+          sig { params(value: Object, path: String, field: String).returns(String) }
+          def self.string(value, path, field)
+            return value if value.is_a?(String)
+
+            raise DependencyFileNotParseable.new(path, "#{field} must be a string")
+          end
+          private_class_method :string
+
+          sig { params(value: Object, path: String, field: String).returns(T::Boolean) }
+          def self.boolean(value, path, field)
+            return value if value.is_a?(TrueClass) || value.is_a?(FalseClass)
+
+            raise DependencyFileNotParseable.new(path, "#{field} must be a boolean")
+          end
+          private_class_method :boolean
+
+          sig { params(value: Object, path: String, field: String).returns(T::Array[String]) }
+          def self.strings(value, path, field)
+            raise DependencyFileNotParseable.new(path, "#{field} must be an array") unless value.is_a?(Array)
+
+            value.each_with_index.map do |specifier, index|
+              string(T.cast(specifier, Object), path, "#{field}[#{index}]")
+            end
+          end
+          private_class_method :strings
+        end
+
         sig { params(dependency_file: Dependabot::DependencyFile, dealias_packages: T::Boolean).void }
         def initialize(dependency_file, dealias_packages: false)
           @dependency_file = dependency_file
           @dealias_packages = dealias_packages
+          @parsed = T.let(nil, T.nilable(T::Array[Record]))
         end
 
-        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+        sig { returns(T::Array[Record]) }
         def parsed
-          @parsed ||= T.let(
-            T.cast(
-              SharedHelpers.in_a_temporary_directory do
-                File.write("pnpm-lock.yaml", @dependency_file.content)
-
-                SharedHelpers.run_helper_subprocess(
-                  command: NativeHelpers.helper_path,
-                  function: "pnpm:parseLockfile",
-                  args: [Dir.pwd]
-                )
-              rescue SharedHelpers::HelperSubprocessFailed
-                raise Dependabot::DependencyFileNotParseable, @dependency_file.path
-              end,
-              T::Array[T::Hash[String, T.untyped]]
-            ),
-            T.nilable(T::Array[T::Hash[String, T.untyped]])
-          )
-        end
-
-        # rubocop:disable Metrics/MethodLength
-        # rubocop:disable Metrics/AbcSize
-        # rubocop:disable Metrics/PerceivedComplexity
-        sig { returns(Dependabot::FileParsers::Base::DependencySet) }
-        def dependencies
-          dependency_set = Dependabot::FileParsers::Base::DependencySet.new
-
-          # Separate dependencies into two categories: with specifiers and without specifiers.
-          dependencies_with_specifiers = T.let([], T::Array[T::Hash[Symbol, T.untyped]])
-          dependencies_without_specifiers = T.let([], T::Array[T::Hash[Symbol, T.untyped]])
-
-          parsed.each do |details|
-            next if details["aliased"] && !dealias_packages?
-
-            name = T.cast(details["name"], String)
-            version = T.cast(details["version"], T.nilable(String))
-
-            dependency_args = {
-              name: name,
-              version: version,
-              package_manager: "npm_and_yarn",
-              requirements: []
-            }
+          return @parsed if @parsed
 
-            # Tag aliased packages with metadata so the grapher can identify them as direct
-            dependency_args[:metadata] = { alias: name } if details["aliased"]
+          result = SharedHelpers.in_a_temporary_directory do
+            File.write("pnpm-lock.yaml", @dependency_file.content)
 
-            # Add metadata for subdependencies if marked as a dev dependency.
-            dependency_args[:subdependency_metadata] = [{ production: !details["dev"] }] if details["dev"]
+            SharedHelpers.run_helper_subprocess(
+              command: NativeHelpers.helper_path,
+              function: "pnpm:parseLockfile",
+              args: [Dir.pwd]
+            )
+          rescue SharedHelpers::HelperSubprocessFailed
+            raise Dependabot::DependencyFileNotParseable, @dependency_file.path
+          end
 
-            specifiers = details["specifiers"]
-            if specifiers&.any?
-              dependencies_with_specifiers << dependency_args
-            else
-              dependencies_without_specifiers << dependency_args
-            end
+          unless result.is_a?(Array)
+            raise DependencyFileNotParseable.new(@dependency_file.path, "pnpm helper result must be an array")
           end
 
-          # Add prioritized dependencies to the dependency set.
-          dependencies_with_specifiers.each do |dependency_args|
-            dependency_set << Dependency.new(
-              name: dependency_args[:name],
-              version: dependency_args[:version],
-              package_manager: dependency_args[:package_manager],
-              requirements: dependency_args[:requirements],
-              subdependency_metadata: dependency_args[:subdependency_metadata],
-              metadata: dependency_args[:metadata]
-            )
+          @parsed = result.each_with_index.map do |record, index|
+            Record.from_object(T.cast(record, Object), path: @dependency_file.path, index: index)
           end
+        end
+
+        sig { returns(Dependabot::FileParsers::Base::DependencySet) }
+        def dependencies
+          dependency_set = Dependabot::FileParsers::Base::DependencySet.new
+          with_specifiers, without_specifiers = parsed.partition { |record| record.specifiers.any? }
+
+          (with_specifiers + without_specifiers).each do |record|
+            next if record.aliased && !dealias_packages?
 
-          dependencies_without_specifiers.each do |dependency_args|
             dependency_set << Dependency.new(
-              name: dependency_args[:name],
-              version: dependency_args[:version],
-              package_manager: dependency_args[:package_manager],
-              requirements: dependency_args[:requirements],
-              subdependency_metadata: dependency_args[:subdependency_metadata],
-              metadata: dependency_args[:metadata]
+              name: record.name,
+              version: record.version,
+              package_manager: "npm_and_yarn",
+              requirements: [],
+              subdependency_metadata: record.dev ? [{ production: false }] : nil,
+              metadata: record.aliased ? { alias: record.name } : nil
             )
           end
 
           dependency_set
         end
-        # rubocop:enable Metrics/PerceivedComplexity
-        # rubocop:enable Metrics/AbcSize
-        # rubocop:enable Metrics/MethodLength
 
         sig do
           params(
@@ -115,18 +129,21 @@ module Dependabot
             requirement: T.nilable(String),
             _manifest_name: T.nilable(String)
           )
-            .returns(T.nilable(T::Hash[String, T.untyped]))
+            .returns(T.nilable(Dependabot::Package::NpmLockfileDetails))
         end
         def details(dependency_name, requirement, _manifest_name)
-          details_candidates = parsed.select { |info| info["name"] == dependency_name }
+          details_candidates = parsed.select { |record| record.name == dependency_name }
 
           # If there's only one entry for this dependency, use it, even if
           # the requirement in the lockfile doesn't match
-          if details_candidates.one?
-            details_candidates.first
-          else
-            details_candidates.find { |info| info["specifiers"]&.include?(requirement) }
-          end
+          details = if details_candidates.one?
+                      details_candidates.first
+                    elsif requirement
+                      details_candidates.find { |record| record.specifiers.include?(requirement) }
+                    end
+          return if details.nil?
+
+          Dependabot::Package::NpmLockfileDetails.new(version: details.version, resolved: details.resolved)
         end
 
         private

data/lib/dependabot/npm_and_yarn/file_parser/yarn_lock/record.rb

@@ -0,0 +1,79 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/npm_and_yarn/file_parser/yarn_lock"
+
+module Dependabot
+  module NpmAndYarn
+    class FileParser < Dependabot::FileParsers::Base
+      class YarnLock
+        class Record
+          extend T::Sig
+
+          ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+          sig { params(data: Object, path: String, context: String).void }
+          def initialize(data, path:, context:)
+            @data = data
+            @path = path
+            @context = context
+            @object = T.let(nil, T.nilable(ObjectHash))
+          end
+
+          sig { returns(T.nilable(String)) }
+          def version
+            value = object["version"]
+            return if value.nil?
+            return value if value.is_a?(String)
+
+            invalid!("#{@context}.version must be a string or nil")
+          end
+
+          sig { returns(Dependabot::Package::NpmLockfileDetails) }
+          def lookup_details
+            Dependabot::Package::NpmLockfileDetails.from_object(object, path: @path, context: @context)
+          end
+
+          sig { returns(T::Hash[String, String]) }
+          def dependencies
+            value = object["dependencies"]
+            return {} if value.nil?
+
+            invalid!("#{@context}.dependencies must be an object") unless value.is_a?(Hash)
+            value.to_h do |raw_name, raw_requirement|
+              name = T.cast(raw_name, Object)
+              requirement = T.cast(raw_requirement, Object)
+              invalid!("#{@context}.dependencies keys must be strings") unless name.is_a?(String)
+              invalid!("#{@context}.dependencies.#{name} must be a string") unless requirement.is_a?(String)
+
+              [name, requirement]
+            end
+          end
+
+          private
+
+          sig { returns(ObjectHash) }
+          def object
+            return @object if @object
+
+            data = @data
+            invalid!("#{@context} must be an object") unless data.is_a?(Hash)
+
+            @object = data.to_h do |raw_key, raw_value|
+              key = T.cast(raw_key, Object)
+              invalid!("#{@context} keys must be strings") unless key.is_a?(String)
+
+              [key, T.cast(raw_value, Object)]
+            end
+          end
+
+          sig { params(message: String).returns(T.noreturn) }
+          def invalid!(message)
+            raise DependencyFileNotParseable.new(@path, message)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/npm_and_yarn/file_parser/yarn_lock.rb

@@ -3,7 +3,9 @@
 
 require "dependabot/shared_helpers"
 require "dependabot/errors"
+require "dependabot/npm_and_yarn/file_parser"
 require "dependabot/npm_and_yarn/native_helpers"
+require "dependabot/package/npm_lockfile_details"
 require "sorbet-runtime"
 
 module Dependabot
@@ -12,35 +14,36 @@ module Dependabot
       class YarnLock
         extend T::Sig
 
+        require_relative "yarn_lock/record"
+
         sig { params(dependency_file: Dependabot::DependencyFile, dealias_packages: T::Boolean).void }
         def initialize(dependency_file, dealias_packages: false)
           @dependency_file = dependency_file
           @dealias_packages = dealias_packages
+          @parsed = T.let(nil, T.nilable(T::Hash[String, Record]))
         end
 
-        sig { returns(T::Hash[String, T::Hash[String, T.untyped]]) }
+        sig { returns(T::Hash[String, Record]) }
         def parsed
-          @parsed ||= T.let(
-            T.cast(
-              SharedHelpers.in_a_temporary_directory do
-                File.write("yarn.lock", @dependency_file.content)
-
-                SharedHelpers.run_helper_subprocess(
-                  command: NativeHelpers.helper_path,
-                  function: "yarn:parseLockfile",
-                  args: [Dir.pwd]
-                )
-              rescue SharedHelpers::HelperSubprocessFailed => e
-                raise Dependabot::OutOfDisk, e.message if e.message.end_with?("No space left on device")
-                raise Dependabot::OutOfDisk, e.message if e.message.end_with?("Out of diskspace")
-                raise Dependabot::OutOfMemory, e.message if e.message.end_with?("MemoryError")
-
-                raise Dependabot::DependencyFileNotParseable, @dependency_file.path
-              end,
-              T::Hash[String, T::Hash[String, T.untyped]]
-            ),
-            T.nilable(T::Hash[String, T::Hash[String, T.untyped]])
-          )
+          return @parsed if @parsed
+
+          result = SharedHelpers.in_a_temporary_directory do
+            File.write("yarn.lock", @dependency_file.content)
+
+            SharedHelpers.run_helper_subprocess(
+              command: NativeHelpers.helper_path,
+              function: "yarn:parseLockfile",
+              args: [Dir.pwd]
+            )
+          rescue SharedHelpers::HelperSubprocessFailed => e
+            raise Dependabot::OutOfDisk, e.message if e.message.end_with?("No space left on device")
+            raise Dependabot::OutOfDisk, e.message if e.message.end_with?("Out of diskspace")
+            raise Dependabot::OutOfMemory, e.message if e.message.end_with?("MemoryError")
+
+            raise Dependabot::DependencyFileNotParseable, @dependency_file.path
+          end
+
+          @parsed = parse_records(result)
         end
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }
@@ -49,11 +52,12 @@ module Dependabot
 
           parsed.each do |reqs, details|
             reqs.split(", ").each do |req|
-              version = Version.semver_for(details["version"])
-              next unless version
               next if workspace_package?(req)
               next if req == "__metadata"
 
+              version = Version.semver_for(details.version)
+              next unless version
+
               if alias_package?(req)
                 # Skip unless we are dealiasing packages
                 next unless dealias_packages?
@@ -88,9 +92,9 @@ module Dependabot
           params(
             dependency_name: String,
             requirement: T.nilable(String),
-            _manifest_name: T.untyped
+            _manifest_name: String
           )
-            .returns(T.nilable(T::Hash[String, T.untyped]))
+            .returns(T.nilable(Dependabot::Package::NpmLockfileDetails))
         end
         def details(dependency_name, requirement, _manifest_name)
           details_candidates =
@@ -99,17 +103,43 @@ module Dependabot
 
           # If there's only one entry for this dependency, use it, even if
           # the requirement in the lockfile doesn't match
-          if details_candidates.one?
-            T.must(details_candidates.first).last
-          else
-            details_candidates.find do |k, _|
-              k.scan(/(?<=\w)\@(?:npm:)?([^\s,]+)/).flatten.include?(requirement)
-            end&.last
-          end
+          details = if details_candidates.one?
+                      T.must(details_candidates.first).last
+                    else
+                      details_candidates.find do |k, _|
+                        k.scan(/(?<=\w)\@(?:npm:)?([^\s,]+)/).flatten.include?(requirement)
+                      end&.last
+                    end
+          return if details.nil?
+
+          details.lookup_details
         end
 
         private
 
+        sig { params(value: Object).returns(T::Hash[String, Record]) }
+        def parse_records(value)
+          unless value.is_a?(Hash)
+            raise DependencyFileNotParseable.new(@dependency_file.path, "yarn helper result must be an object")
+          end
+
+          records = T.let({}, T::Hash[String, Record])
+          value.each_with_index do |(raw_key, data), index|
+            key = T.cast(raw_key, Object)
+            unless key.is_a?(String)
+              raise DependencyFileNotParseable.new(@dependency_file.path, "yarn helper descriptors must be strings")
+            end
+            next if key == "__metadata"
+
+            records[key] = Record.new(
+              T.cast(data, Object),
+              path: @dependency_file.path,
+              context: "yarn helper result[#{index}]"
+            )
+          end
+          records
+        end
+
         sig { returns(T::Boolean) }
         def dealias_packages?
           @dealias_packages

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -5,6 +5,8 @@
 
 require "cgi/escape"
 require "dependabot/dependency"
+require "dependabot/package/npm_lockfile_details"
+require "dependabot/package/npm_package_json"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/shared_helpers"
@@ -99,7 +101,7 @@ module Dependabot
       def package_manager_helper
         @package_manager_helper ||= T.let(
           PackageManagerHelper.new(
-            Dependabot::Package::NpmPackageManagerConfig.from_package_json(parsed_package_json),
+            package_json_document.package_manager_config,
             lockfiles,
             registry_config_files,
             credentials
@@ -126,9 +128,9 @@ module Dependabot
         }
       end
 
-      sig { returns(T.untyped) }
-      def parsed_package_json
-        JSON.parse(T.must(package_json.content))
+      sig { returns(Dependabot::Package::NpmPackageJson) }
+      def package_json_document
+        Dependabot::Package::NpmPackageJson.from_file(package_json)
       rescue JSON::ParserError
         raise Dependabot::DependencyFileNotParseable, package_json.path
       end
@@ -227,16 +229,14 @@ module Dependabot
         dependency_set = DependencySet.new
 
         package_files.each do |file|
-          json = JSON.parse(T.must(file.content))
+          manifest = Dependabot::Package::NpmPackageJson.from_file(file)
 
           # TODO: Currently, Dependabot can't handle flat dependency files
           # (and will error at the FileUpdater stage, because the
           # UpdateChecker doesn't take account of flat resolution).
-          next if json["flat"]
-
-          self.class.each_dependency(json) do |name, requirement, type|
-            next unless requirement.is_a?(String)
+          next if manifest.flat?
 
+          manifest.each_dependency do |name, requirement, type|
             # Skip dependencies using Yarn workspace cross-references as requirements
             next if requirement.start_with?("workspace:", "catalog:")
 
@@ -295,7 +295,7 @@ module Dependabot
       end
 
       sig do
-        params(file: DependencyFile, type: T.untyped, name: String, requirement: String)
+        params(file: DependencyFile, type: String, name: String, requirement: String)
           .returns(T.nilable(Dependency))
       end
       def build_dependency(file:, type:, name:, requirement:)
@@ -454,14 +454,14 @@ module Dependabot
       def workspace_package_names
         @workspace_package_names ||= T.let(
           package_files.filter_map do |f|
-            JSON.parse(T.must(f.content))["name"]
+            Dependabot::Package::NpmPackageJson.from_file(f).name
           end,
           T.nilable(T::Array[String])
         )
       end
 
       sig do
-        params(requirement: String, lockfile_details: T.nilable(T::Hash[String, T.untyped]))
+        params(requirement: String, lockfile_details: T.nilable(Dependabot::Package::NpmLockfileDetails))
           .returns(T.nilable(T.any(String, Integer, Gem::Version)))
       end
       def version_for(requirement, lockfile_details)
@@ -483,10 +483,10 @@ module Dependabot
         end
       end
 
-      sig { params(lockfile_details: T.nilable(T::Hash[String, T.untyped])).returns(T.nilable(String)) }
+      sig { params(lockfile_details: T.nilable(Dependabot::Package::NpmLockfileDetails)).returns(T.nilable(String)) }
       def git_revision_for(lockfile_details)
-        version = T.cast(lockfile_details&.fetch("version", nil), T.nilable(String))
-        resolved = T.cast(lockfile_details&.fetch("resolved", nil), T.nilable(String))
+        version = lockfile_details&.version
+        resolved = lockfile_details&.resolved
         [
           version&.split("#")&.last,
           resolved&.split("#")&.last,
@@ -526,11 +526,11 @@ module Dependabot
       end
 
       sig do
-        params(lockfile_details: T.nilable(T::Hash[String, T.untyped]))
+        params(lockfile_details: T.nilable(Dependabot::Package::NpmLockfileDetails))
           .returns(T.nilable(T.any(String, Integer, Gem::Version)))
       end
       def lockfile_version_for(lockfile_details)
-        semver_version_for(lockfile_details&.fetch("version", ""))
+        semver_version_for(lockfile_details&.version)
       end
 
       sig { params(version: T.nilable(String)).returns(T.nilable(T.any(String, Integer, Gem::Version))) }
@@ -549,18 +549,18 @@ module Dependabot
       end
 
       sig do
-        params(name: String, requirement: String, lockfile_details: T.nilable(T::Hash[String, T.untyped]))
+        params(name: String, requirement: String, lockfile_details: T.nilable(Dependabot::Package::NpmLockfileDetails))
           .returns(T.nilable(T::Hash[Symbol, T.untyped]))
       end
       def source_for(name, requirement, lockfile_details)
         return git_source_for(requirement) if git_url?(requirement)
         return jsr_registry_source if requirement.start_with?("jsr:")
 
-        resolved_url = lockfile_details&.fetch("resolved", nil)
+        resolved_url = lockfile_details&.resolved
 
-        resolution = lockfile_details&.fetch("resolution", nil)
-        package_match = resolution&.match(/__archiveUrl=(?<package_url>.+)/)
-        resolved_url = CGI.unescape(package_match.named_captures.fetch("package_url", "")) if package_match
+        resolution = lockfile_details&.resolution
+        package_url = resolution&.[](/__archiveUrl=(.+)/, 1)
+        resolved_url = CGI.unescape(package_url) if package_url
 
         return unless resolved_url
         return unless resolved_url.start_with?("http")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.395.0
+  version: 0.396.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.396.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.396.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -346,9 +346,11 @@ files:
 - lib/dependabot/npm_and_yarn/file_fetcher/path_dependency_builder.rb
 - lib/dependabot/npm_and_yarn/file_parser.rb
 - lib/dependabot/npm_and_yarn/file_parser/json_lock.rb
+- lib/dependabot/npm_and_yarn/file_parser/json_lock/record.rb
 - lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb
 - lib/dependabot/npm_and_yarn/file_parser/pnpm_lock.rb
 - lib/dependabot/npm_and_yarn/file_parser/yarn_lock.rb
+- lib/dependabot/npm_and_yarn/file_parser/yarn_lock/record.rb
 - lib/dependabot/npm_and_yarn/file_updater.rb
 - lib/dependabot/npm_and_yarn/file_updater/berry_lockfile_handler.rb
 - lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb
@@ -390,7 +392,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.396.0
 rdoc_options: []
 require_paths:
 - lib