dependabot-npm_and_yarn 0.92.2 → 0.92.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8895b3d00673437608817b1b500b468fa15d3d788bbc052437629f6c0d471367
-  data.tar.gz: dd702dcd3b3e30e73b75ad183fd97f606749e1ada3eb10f3186e5d1b8ca433df
+  metadata.gz: 9fa2b9c641fb15406703fb5da15ae5a125b567b9cb1f94a7716f74d001282048
+  data.tar.gz: d2f5ac936ddcaa7ef9734fad56f7857b78d96977d21ed4c55880995551c99dc8
 SHA512:
-  metadata.gz: 198bfa8a8f2b9e5b3a90529b946dfe6c078544acadf3a98f607094128c624d2e74eef5ca9d2141769b1e44dfb725f0c51317ad860bc657bcc3f224f7893420c8
-  data.tar.gz: ab87fea3dff94b199bc265035e29f1ece68339bad749ba9d7dd2f716d58be886bb1fce2c541362b5dc481ebe2fd7d4b5b280b62c4723014af9dae53f9d421a3c
+  metadata.gz: 42edaa08ce39493f1d4da8bcbce75476f153d49ca53ae3c730d30277298fabc1ffc85a1deec4de93357a980d64dd38051ce7b63322f3eb429a3e72a2befb59bd
+  data.tar.gz: 9c5c44cb15b93ce7077f1d04cbebe2517350abd5370b29691f5b88dccf61b735b70f24d023813edcf1bde20795073b8e91d0dd83cae4f9372784db75339c408e

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -358,11 +358,7 @@ module Dependabot
 
             FileUtils.mkdir_p(Pathname.new(f.name).dirname)
 
-            if top_level_dependencies.any?
-              File.write(f.name, f.content)
-            else
-              File.write(f.name, prepared_npm_lockfile_content(f.content))
-            end
+            File.write(f.name, prepared_npm_lockfile_content(f.content))
           end
         end
 
@@ -407,6 +403,30 @@ module Dependabot
           @git_dependencies_to_lock
         end
 
+        # Note: NPM 6.6.0 started failing when a sub-dependency has a "from"
+        # field that includes the dependency name
+        #
+        # Example invalid from: "from": "bignumber.js@git+https://gi...
+        def remove_invalid_from_lines(npm_lockfile)
+          return npm_lockfile unless npm_lockfile.key?("dependencies")
+
+          dependencies =
+            npm_lockfile["dependencies"].
+            map do |k, v|
+              value =
+                if v["from"].to_s.start_with?("#{k}@")
+                  v.dup.tap do |hash|
+                    hash["from"] = hash["from"].gsub(/^#{Regexp.quote(k)}@/, "")
+                  end
+                else v
+                end
+
+              [k, remove_invalid_from_lines(value)]
+            end.to_h
+
+          npm_lockfile.merge("dependencies" => dependencies)
+        end
+
         def replace_ssh_sources(content)
           updated_content = content
 
@@ -438,9 +458,11 @@ module Dependabot
         end
 
         def prepared_npm_lockfile_content(content)
-          JSON.dump(
-            remove_dependency_from_npm_lockfile(JSON.parse(content))
-          )
+          updated_content =
+            JSON.dump(remove_dependency_from_npm_lockfile(JSON.parse(content)))
+          updated_content =
+            JSON.dump(remove_invalid_from_lines(JSON.parse(updated_content)))
+          updated_content
         end
 
         # Duplicated in SubdependencyVersionResolver

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.92.2
+  version: 0.92.3
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-01-21 00:00:00.000000000 Z
+date: 2019-01-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-core
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.92.2
+        version: 0.92.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.92.2
+        version: 0.92.3
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement