dependabot-npm_and_yarn 0.93.9 → 0.93.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb3b2be074d8c5c9caabf1a5d4654694fbd0dd2c5cec6a0e21dc55edd88cf676
-  data.tar.gz: c40d57924eba0bdaa92daac8eae1ed949b4a532da8cb2cb202d29175f9b66da0
+  metadata.gz: db5ff83a73aad721050e786fc16520a7b680fbf12244c1bac58c4a881582e772
+  data.tar.gz: 1f5ff37e03a6f35b68e5ff9cd9f0d5fac57728136331972bc7b1f542d3e5275f
 SHA512:
-  metadata.gz: 15aa4efcd8c7699af16f0689a3239986c70da85558eaf3ce1046ecb83f02b983bf12195817d9cd7735c21f263921a876ff6edf08470b16d9947f751b2fc3a722
-  data.tar.gz: 233995e6648366e94c1be1963005214b3fcc87b7274a30ca96bc5245f88e51806c4f6150742a53a921d3bdc8b1cb45072f315e4fc17325f4ed235aa85efea286
+  metadata.gz: 24f34d6d1122cd2f1e4c663bac9d3e898871404c35cc23fa7a598ad7665ba87c013389885e0330ad9fd6d8d452d6cc978bcfb9906be98bcca912e7620b884c6d
+  data.tar.gz: 9cb578b1cdc7a066a830b02f6e67541cd0ced8efbba0b754abe07dee3d557592f0969154b37ef0bc905fb1a23717363812b88fcd1119b548acde5357e3c4ebf6

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -197,30 +197,50 @@ module Dependabot
         requirement.match?(GIT_URL_REGEX)
       end
 
+      def git_url_with_semver?(requirement)
+        return false unless git_url?(requirement)
+
+        !requirement.match(GIT_URL_REGEX).named_captures.fetch("semver").nil?
+      end
+
       def workspace_package_names
         @workspace_package_names ||=
           package_files.map { |f| JSON.parse(f.content)["name"] }.compact
       end
 
-      # rubocop:disable Metrics/CyclomaticComplexity
-      # rubocop:disable Metrics/PerceivedComplexity
       def version_for(name, requirement)
+        if git_url_with_semver?(requirement)
+          semver_version_for(name, requirement) ||
+            git_revision_for(name, requirement)
+        elsif git_url?(requirement)
+          git_revision_for(name, requirement)
+        else
+          semver_version_for(name, requirement)
+        end
+      end
+
+      def git_revision_for(name, requirement)
+        return unless git_url?(requirement)
+
         lock_version = lockfile_details(name, requirement)&.
                        fetch("version", nil)
         lock_res     = lockfile_details(name, requirement)&.
                        fetch("resolved", nil)
 
-        if git_url?(requirement)
-          return lock_version.split("#").last if lock_version&.include?("#")
-          return lock_res.split("#").last if lock_res&.include?("#")
+        return lock_version.split("#").last if lock_version&.include?("#")
+        return lock_res.split("#").last if lock_res&.include?("#")
 
-          if lock_res && lock_res.split("/").last.match?(/^[0-9a-f]{40}$/)
-            return lock_res.split("/").last
-          end
-
-          return nil
+        if lock_res && lock_res.split("/").last.match?(/^[0-9a-f]{40}$/)
+          return lock_res.split("/").last
         end
 
+        nil
+      end
+
+      def semver_version_for(name, requirement)
+        lock_version = lockfile_details(name, requirement)&.
+                       fetch("version", nil)
+
         return unless lock_version
         return if lock_version.include?("://")
         return if lock_version.include?("file:")
@@ -229,8 +249,6 @@ module Dependabot
 
         lock_version
       end
-      # rubocop:enable Metrics/CyclomaticComplexity
-      # rubocop:enable Metrics/PerceivedComplexity
 
       def source_for(name, requirement)
         return git_source_for(requirement) if git_url?(requirement)

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -137,6 +137,8 @@ module Dependabot
             # or that the current branch is behind, we switch to that release.
             if git_branch_or_ref_in_release?(latest_release&.fetch(:version))
               latest_release.fetch(:version)
+            elsif version_class.correct?(dependency.version)
+              latest_git_version_details[:version]
             else
               latest_git_version_details[:sha]
             end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.93.9
+  version: 0.93.10
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.93.9
+        version: 0.93.10
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.93.9
+        version: 0.93.10
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement