dependabot-npm_and_yarn 0.95.46 → 0.95.47

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0b0c29c6be74f4ba08da5971334d1c454c19aec47e2ec22191c4d7dde8c2fa9b
-  data.tar.gz: 620758cc6f298133a366a02f857431933be3a37e913713b2b23e6953d72a3f43
+  metadata.gz: d99c20579d8ac5b660f8ae5a334d4941819efba32c6679286c9af49558d6deef
+  data.tar.gz: 56718fd389329c73ba0d0c715df42aa570943cb18b69af621598d171a34a1f0b
 SHA512:
-  metadata.gz: f801b74f83679bac55ab410dad03dbbdae0123a794cb2f080a0d4696903804c99551da257c99a2cfb3d4d3cfa29cce245e6004b64463954ab982bb2994281b33
-  data.tar.gz: cfeb4b9ad578a1455beafa50834b630a990d9040c9f0591e85b4dbd57422dbd2cd88be7f8c68f22c3dfca797a5e8cdb5c03e7fce469e78c375e2809c15ab9815
+  metadata.gz: 18521ac224c7eba51e8320517cf7290a16ed6cfd73d97a60fdb86ac3f62a26afc94458d08a6f016d1d26c8299d999f77fd197705ac5c6b659a8607dc54f7c329
+  data.tar.gz: 7939b3f95c1223c2f39dfbb847ae88b26c5c7c1f34e2f797c9743038685aeb3b472bad8b259fa4f5087f581e5181ff8b876450c4341a3c832e8b811cd6b6af5b

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -28,7 +28,7 @@ module Dependabot
         (?<repo>[a-z0-9_.-]+)
         (
           (?:\#semver:(?<semver>.+))|
-          (?:\#(?=[\^~=<>])(?<semver>.+))|
+          (?:\#(?=[\^~=<>*])(?<semver>.+))|
           (?:\#(?<ref>.+))
         )?$
       }ix.freeze

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -130,12 +130,9 @@ module Dependabot
       def latest_version_for_git_dependency
         @latest_version_for_git_dependency ||=
           begin
-            latest_release = latest_version_finder.
-                             latest_version_details_from_registry
-
             # If there's been a release that includes the current pinned ref
             # or that the current branch is behind, we switch to that release.
-            if git_branch_or_ref_in_release?(latest_release&.fetch(:version))
+            if git_branch_or_ref_in_latest_release?
               latest_release.fetch(:version)
             elsif version_class.correct?(dependency.version)
               latest_git_version_details[:version] &&
@@ -146,17 +143,30 @@ module Dependabot
           end
       end
 
+      def latest_release
+        @latest_release ||=
+          latest_version_finder.latest_version_details_from_registry
+      end
+
       def should_switch_source_from_git_to_registry?
         return false unless git_dependency?
+        return false unless git_branch_or_ref_in_latest_release?
         return false if latest_version_for_git_dependency.nil?
 
         version_class.correct?(latest_version_for_git_dependency)
       end
 
-      def git_branch_or_ref_in_release?(release)
-        return false unless release
+      def git_branch_or_ref_in_latest_release?
+        return false unless latest_release
 
-        git_commit_checker.branch_or_ref_in_release?(release)
+        if defined?(@git_branch_or_ref_in_latest_release)
+          return @git_branch_or_ref_in_latest_release
+        end
+
+        @git_branch_or_ref_in_latest_release ||=
+          git_commit_checker.branch_or_ref_in_release?(
+            latest_release.fetch(:version)
+          )
       end
 
       def latest_version_details

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.95.46
+  version: 0.95.47
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.46
+        version: 0.95.47
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.46
+        version: 0.95.47
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement