dependabot-npm_and_yarn 0.91.0 → 0.91.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1889fc223fdb58d9dd7770efab59c42bd6d21d151b5a54ef9c188265c330d4ad
-  data.tar.gz: e58af2e70dae2064faeed44d5757472e1f2941a4007cb399a377a7e974101568
+  metadata.gz: 3d6bcfcfd51b0a98e5d9c8b40cdbc54ec6d0ebd262761a15457b62cc98a3e0a4
+  data.tar.gz: 260920bfe49c0e05543f0c06d0bea03a78374ff6b5e820397f21184520d8681d
 SHA512:
-  metadata.gz: 68a897d0602de7a4ce486122e74291596fe0792eb5288a75b1b22300a1714f2ee4ef3a4bd2a47d92c13712cace26e75471fa2d1b33a601b8fe349101158ebc14
-  data.tar.gz: fbc567b156e0555bd4984a0100ab2f94abed85384f16d02a0dabe6d319508af450fd3002c724092e3953dc1dc84fa3e9649b3a395ee766dd9ed35a5cd27b44a1
+  metadata.gz: '0691cf13a0fd9d508f246b4c66d4faf9927cbf0d76d6801dbe2110f02ad08ad35e78d4b300deb163cc780319deb32f98a1a9251c9b5dac911ce9501cfe949976'
+  data.tar.gz: 4c4959da35cde273639ce088fa56c0fe8c17fc0f2cafe3330d7f69ac060dc52c4d8fc6a78d67a40e76f701a7725d7065f128d48706c54f7ff59bcb016031b1b9

data/lib/dependabot/npm_and_yarn/dependency_files_filterer.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require "dependabot/utils"
+
+module Dependabot
+  module NpmAndYarn
+    class DependencyFilesFilterer
+      def initialize(dependency_files:, dependencies:)
+        @dependencies = dependencies
+        @dependency_files = dependency_files
+      end
+
+      def filtered_files
+        dependency_files.select do |file|
+          if manifest?(file)
+            package_manifests.include?(file)
+          elsif lockfile?(file)
+            package_manifests.any? do |package_file|
+              File.dirname(package_file.name) == File.dirname(file.name)
+            end
+          else
+            # Include all non-manifest/lockfiles
+            # e.g. .npmrc, lerna.json
+            true
+          end
+        end
+      end
+
+      def filtered_package_files
+        filtered_files.select { |f| manifest?(f) }
+      end
+
+      def filtered_lockfiles
+        filtered_files.select { |f| lockfile?(f) }
+      end
+
+      private
+
+      attr_reader :dependency_files, :dependencies
+
+      def dependency_manifest_requirements
+        @dependency_manifest_requirements ||=
+          dependencies.flat_map do |dep|
+            dep.requirements.map { |requirement| requirement[:file] }
+          end
+      end
+
+      def package_manifests
+        @package_manifests ||=
+          dependency_files.select do |file|
+            next unless manifest?(file)
+
+            root_manifest?(file) ||
+              dependency_manifest_requirements.include?(file.name)
+          end
+      end
+
+      def root_manifest?(file)
+        file.name == "package.json"
+      end
+
+      def manifest?(file)
+        file.name.end_with?("package.json")
+      end
+
+      def lockfile?(file)
+        file.name.end_with?(
+          "package-lock.json",
+          "yarn.lock",
+          "npm-shrinkwrap.json"
+        )
+      end
+    end
+  end
+end
+
+Dependabot::Utils.register_version_class(
+  "npm_and_yarn",
+  Dependabot::NpmAndYarn::DependencyFilesFilterer
+)

data/lib/dependabot/npm_and_yarn/file_updater.rb

@@ -2,6 +2,7 @@
 
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
+require "dependabot/npm_and_yarn/dependency_files_filterer"
 
 module Dependabot
   module NpmAndYarn
@@ -43,7 +44,8 @@ module Dependabot
           )
         end
 
-        if updated_files.sort_by(&:name) == dependency_files.sort_by(&:name)
+        sorted_updated_files = updated_files.sort_by(&:name)
+        if sorted_updated_files == filtered_dependency_files.sort_by(&:name)
           raise NoChangeError.new(
             message: "Updated files are unchanged!",
             error_context: error_context(updated_files: updated_files)
@@ -55,6 +57,14 @@ module Dependabot
 
       private
 
+      def filtered_dependency_files
+        @filtered_dependency_files ||=
+          DependencyFilesFilterer.new(
+            dependency_files: dependency_files,
+            dependencies: dependencies
+          ).filtered_files
+      end
+
       def check_required_files
         raise "No package.json!" unless get_original_file("package.json")
       end
@@ -69,24 +79,27 @@ module Dependabot
 
       def package_locks
         @package_locks ||=
-          dependency_files.
+          filtered_dependency_files.
           select { |f| f.name.end_with?("package-lock.json") }
       end
 
       def yarn_locks
         @yarn_locks ||=
-          dependency_files.
+          filtered_dependency_files.
           select { |f| f.name.end_with?("yarn.lock") }
       end
 
       def shrinkwraps
         @shrinkwraps ||=
-          dependency_files.
+          filtered_dependency_files.
           select { |f| f.name.end_with?("npm-shrinkwrap.json") }
       end
 
       def package_files
-        dependency_files.select { |f| f.name.end_with?("package.json") }
+        @package_files ||=
+          filtered_dependency_files.select do |f|
+            f.name.end_with?("package.json")
+          end
       end
 
       def yarn_lock_changed?(yarn_lock)
@@ -144,7 +157,9 @@ module Dependabot
       end
 
       def updated_yarn_lock_content(yarn_lock)
-        yarn_lockfile_updater.updated_yarn_lock_content(yarn_lock)
+        @updated_yarn_lock_content ||= {}
+        @updated_yarn_lock_content[yarn_lock.name] ||=
+          yarn_lockfile_updater.updated_yarn_lock_content(yarn_lock)
       end
 
       def yarn_lockfile_updater
@@ -157,11 +172,15 @@ module Dependabot
       end
 
       def updated_package_lock_content(package_lock)
-        npm_lockfile_updater.updated_lockfile_content(package_lock)
+        @updated_package_lock_content ||= {}
+        @updated_package_lock_content[package_lock.name] ||=
+          npm_lockfile_updater.updated_lockfile_content(package_lock)
       end
 
       def updated_shrinkwrap_content(shrinkwrap)
-        npm_lockfile_updater.updated_lockfile_content(shrinkwrap)
+        @updated_shrinkwrap_content ||= {}
+        @updated_shrinkwrap_content[shrinkwrap.name] ||=
+          npm_lockfile_updater.updated_lockfile_content(shrinkwrap)
       end
 
       def npm_lockfile_updater

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -24,15 +24,18 @@ module Dependabot
         def latest_resolvable_version
           raise "Not a subdependency!" if dependency.requirements.any?
 
-          lockfiles = [*package_locks, *shrinkwraps, *yarn_locks]
-          updated_lockfiles = lockfiles.map do |lockfile|
-            updated_content = update_subdependency_in_lockfile(lockfile)
-            updated_lockfile = lockfile.dup
-            updated_lockfile.content = updated_content
-            updated_lockfile
-          end
+          SharedHelpers.in_a_temporary_directory do
+            write_temporary_dependency_files
 
-          version_from_updated_lockfiles(updated_lockfiles)
+            updated_lockfiles = lockfiles.map do |lockfile|
+              updated_content = update_subdependency_in_lockfile(lockfile)
+              updated_lockfile = lockfile.dup
+              updated_lockfile.content = updated_content
+              updated_lockfile
+            end
+
+            version_from_updated_lockfiles(updated_lockfiles)
+          end
         rescue SharedHelpers::HelperSubprocessFailed
           # TODO: Move error handling logic from the FileUpdater to this class
 
@@ -46,19 +49,16 @@ module Dependabot
                     :ignored_versions
 
         def update_subdependency_in_lockfile(lockfile)
-          SharedHelpers.in_a_temporary_directory do
-            write_temporary_dependency_files
-            lockfile_name = Pathname.new(lockfile.name).basename.to_s
-            path = Pathname.new(lockfile.name).dirname.to_s
+          lockfile_name = Pathname.new(lockfile.name).basename.to_s
+          path = Pathname.new(lockfile.name).dirname.to_s
 
-            updated_files = if lockfile.name.end_with?("yarn.lock")
-                              run_yarn_updater(path, lockfile_name)
-                            else
-                              run_npm_updater(path, lockfile_name)
-                            end
+          updated_files = if lockfile.name.end_with?("yarn.lock")
+                            run_yarn_updater(path, lockfile_name)
+                          else
+                            run_npm_updater(path, lockfile_name)
+                          end
 
-            updated_files.fetch(lockfile_name)
-          end
+          updated_files.fetch(lockfile_name)
         end
 
         def version_from_updated_lockfiles(updated_lockfiles)
@@ -204,6 +204,10 @@ module Dependabot
             select { |f| f.name.end_with?("npm-shrinkwrap.json") }
         end
 
+        def lockfiles
+          [*package_locks, *shrinkwraps, *yarn_locks]
+        end
+
         def package_files
           @package_files ||=
             dependency_files.

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -6,6 +6,7 @@ require "dependabot/npm_and_yarn/file_parser"
 require "dependabot/npm_and_yarn/version"
 require "dependabot/npm_and_yarn/requirement"
 require "dependabot/npm_and_yarn/native_helpers"
+require "dependabot/npm_and_yarn/dependency_files_filterer"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/npm_and_yarn/file_updater/npmrc_builder"
@@ -181,7 +182,7 @@ module Dependabot
           SharedHelpers.in_a_temporary_directory do
             write_temporary_dependency_files
 
-            package_files.flat_map do |file|
+            filtered_package_files.flat_map do |file|
               path = Pathname.new(file.name).dirname
               run_checker(path: path, version: version)
             rescue SharedHelpers::HelperSubprocessFailed => error
@@ -316,13 +317,21 @@ module Dependabot
             select { |dep| dep[:requiring_dep_name] == dependency.name }
         end
 
+        def lockfiles_for_path(lockfiles:, path:)
+          lockfiles.select do |lockfile|
+            File.dirname(lockfile.name) == File.dirname(path)
+          end
+        end
+
         def run_checker(path:, version:)
-          if [*package_locks, *shrinkwraps].any?
-            run_npm_checker(path: path, version: version)
+          # If there are both yarn lockfiles and npm lockfiles only run the
+          # yarn updater, yarn is also used when only a package.json exists
+          if lockfiles_for_path(lockfiles: yarn_locks, path: path).any? ||
+             lockfiles_for_path(lockfiles: lockfiles, path: path).none?
+            return run_yarn_checker(path: path, version: version)
           end
 
-          run_yarn_checker(path: path, version: version) if yarn_locks.any?
-          run_yarn_checker(path: path, version: version) if lockfiles.none?
+          run_npm_checker(path: path, version: version)
         end
 
         def run_yarn_checker(path:, version:)
@@ -455,6 +464,14 @@ module Dependabot
             select { |f| f.name.end_with?("package.json") }
         end
 
+        def filtered_package_files
+          @filtered_package_files ||=
+            DependencyFilesFilterer.new(
+              dependency_files: dependency_files,
+              dependencies: [dependency]
+            ).filtered_package_files
+        end
+
         def yarn_helper_path
           NativeHelpers.yarn_helper_path
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.91.0
+  version: 0.91.1
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.91.0
+        version: 0.91.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.91.0
+        version: 0.91.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -180,6 +180,7 @@ files:
 - helpers/yarn/test/updater.test.js
 - helpers/yarn/yarn.lock
 - lib/dependabot/npm_and_yarn.rb
+- lib/dependabot/npm_and_yarn/dependency_files_filterer.rb
 - lib/dependabot/npm_and_yarn/file_fetcher.rb
 - lib/dependabot/npm_and_yarn/file_fetcher/path_dependency_builder.rb
 - lib/dependabot/npm_and_yarn/file_parser.rb
@@ -219,7 +220,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.0.1
+rubygems_version: 3.0.2
 signing_key: 
 specification_version: 4
 summary: JS support for dependabot-core