dependabot-npm_and_yarn 0.93.16 → 0.93.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 72c089b49a9941d0ff29d184850259518d68d38af41ce251b67f6d58dddae269
-  data.tar.gz: f6438495aaefb06d246105273f4cbe1e4cd41c858e620502e05ac620e97acb26
+  metadata.gz: 64945ec84b780ce05a279eb8ee931b6aaf3382a44c7ebab5040eca929c1bf87b
+  data.tar.gz: '078f787a715c2c28aed522cc43dfef7a17baf5004988f51f3194001400d5badc'
 SHA512:
-  metadata.gz: 8ebf2a039a1d4e4fff32854792474f0d86c4bd34285d04569d5832552ef620bd60c77ee85f95d067876e00c0106b8b8dd335cfcff2e8d730228a819ac698fbfb
-  data.tar.gz: 78ff7ed367a9bd7b5f9a3f23a8003c39037eea395caa8c49307d848667469793b1ec52c19070d2c3c4ded045c81a8a7512eb7bdfd8707b40af995ff2ce416228
+  metadata.gz: 7e25116dc4f25d4dea7a725da7512af4d471057d1bab3bd61ce46d18f84cf96e54cc4a4cd586c099d5728e1d43df7b684b798459a0e11e3de5d566d2b5902129
+  data.tar.gz: 5bde28a07e0e9ca40a51cc3c5e3ea24e456ef95426082773b8bc3a087633436acef2ec59dc3bf58e227bbad482e1bb2bb501ee4ae7a3bbf7499f24ef5923d6ad

data/lib/dependabot/npm_and_yarn/metadata_finder.rb

@@ -198,9 +198,15 @@ module Dependabot
 
       def private_dependency_not_reachable?(npm_response)
         # Check whether this dependency is (likely to be) private
-        if dependency_registry == "registry.npmjs.org" &&
-           !dependency.name.start_with?("@")
-          return false
+        if dependency_registry == "registry.npmjs.org"
+          return false unless dependency.name.start_with?("@")
+
+          web_response = Excon.get(
+            "https://www.npmjs.com/package/#{dependency.name}",
+            idempotent: true,
+            **SharedHelpers.excon_defaults
+          )
+          return web_response.status == 404
         end
 
         [401, 403, 404].include?(npm_response.status)

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -8,6 +8,7 @@ require "dependabot/npm_and_yarn/requirement"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 
+# rubocop:disable ClassLength
 module Dependabot
   module NpmAndYarn
     class UpdateChecker
@@ -285,13 +286,21 @@ module Dependabot
         end
 
         def private_dependency_not_reachable?(npm_response)
+          return false unless [401, 402, 403, 404].include?(npm_response.status)
+
           # Check whether this dependency is (likely to be) private
-          if dependency_registry == "registry.npmjs.org" &&
-             !dependency.name.start_with?("@")
-            return false
+          if dependency_registry == "registry.npmjs.org"
+            return false unless dependency.name.start_with?("@")
+
+            web_response = Excon.get(
+              "https://www.npmjs.com/package/#{dependency.name}",
+              idempotent: true,
+              **SharedHelpers.excon_defaults
+            )
+            return web_response.status == 404
           end
 
-          [401, 402, 403, 404].include?(npm_response.status)
+          true
         end
 
         def dependency_url
@@ -338,3 +347,4 @@ module Dependabot
     end
   end
 end
+# rubocop:enable ClassLength

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.93.16
+  version: 0.93.17
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-01-31 00:00:00.000000000 Z
+date: 2019-02-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-core
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.93.16
+        version: 0.93.17
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.93.16
+        version: 0.93.17
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement