dependabot-npm_and_yarn 0.95.55 → 0.95.56

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4829f6fc333c2f2401b4255dc07ebace059b0990d12f15c228305390c5095892
-  data.tar.gz: 31c7a882ff85d7c1943db60df2c1cccc819a226b73ef31d327cc78293c8f3d4b
+  metadata.gz: 042c1ec8fff67eae6767a168fcbe893e6adabb6a603d6fca44d7d6490fa21a32
+  data.tar.gz: 1a1620d75df5db1ae7e8cd30d85fc7f31e551d6e1f34b78a78bc8a620be83685
 SHA512:
-  metadata.gz: 4150f2b342457a3b6bccc74e812daa3e0280d894bc23abaab8971d9c3c050bb2869b2787f7f488a9ac4a1ead33b1fb15f9d8b2ebbfb5b93b9d0f9cc3b1958456
-  data.tar.gz: d71d971c535e1d3f26a90d38c3f74bceab6167cb9a0eec0e628ca95e081185f9133d76fe9a81f1b968a37f6587770b3481958e9b03e0bd32ed161aa652713994
+  metadata.gz: bb56fe83c7b46954449c2824847d5b0dfc4b54d898f988ce76b4fe002551b3f8b584c1a0f7d65e335dde6468429d8acd3810c29eaba3172af72c36b1bfea2262
+  data.tar.gz: c271b8d7ea1e3e98bd68ac3b5895b2a520baf95bb7efc09a96e8258784c67dc500e871213f17eac6fea8f1b80e4231433d52a2a461da92d27148bf9be13912bd

data/lib/dependabot/npm_and_yarn/dependency_files_filterer.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "dependabot/utils"
+require "dependabot/npm_and_yarn/file_parser/lockfile_parser"
 
 # Used in the version resolver and file updater to only run yarn/npm helpers on
 # dependency files that require updates. This is useful for large monorepos with
@@ -14,23 +15,21 @@ module Dependabot
       end
 
       def files_requiring_update
-        dependency_files.select do |file|
-          if manifest?(file)
-            package_manifests.include?(file)
-          elsif lockfile?(file)
-            package_manifests.any? do |package_file|
-              File.dirname(package_file.name) == File.dirname(file.name)
+        @files_requiring_update ||=
+          begin
+            dependency_files.select do |file|
+              package_files_requiring_update.include?(file) ||
+                package_required_lockfile?(file) ||
+                yarn_workspaces_lockfile?(file)
             end
-          else
-            # Include all non-manifest/lockfiles
-            # e.g. .npmrc, lerna.json
-            true
           end
-        end
       end
 
       def package_files_requiring_update
-        files_requiring_update.select { |file| manifest?(file) }
+        @package_files_requiring_update ||=
+          dependency_files.select do |file|
+            dependency_manifest_requirements.include?(file.name)
+          end
       end
 
       private
@@ -44,18 +43,43 @@ module Dependabot
           end
       end
 
-      def package_manifests
-        @package_manifests ||=
-          dependency_files.select do |file|
-            next unless manifest?(file)
+      def package_required_lockfile?(lockfile)
+        return false unless lockfile?(lockfile)
+
+        package_files_requiring_update.any? do |package_file|
+          File.dirname(package_file.name) == File.dirname(lockfile.name)
+        end
+      end
 
-            root_manifest?(file) ||
-              dependency_manifest_requirements.include?(file.name)
+      def yarn_workspaces_lockfile?(lockfile)
+        return false unless lockfile.name == "yarn.lock"
+        return false unless parsed_root_package_json["workspaces"]
+
+        updated_dependencies_in_lockfile?(lockfile)
+      end
+
+      def parsed_root_package_json
+        @parsed_root_package_json ||=
+          begin
+            package = dependency_files.find { |f| f.name == "package.json" }
+            JSON.parse(package.content)
           end
       end
 
-      def root_manifest?(file)
-        file.name == "package.json"
+      def updated_dependencies_in_lockfile?(lockfile)
+        lockfile_dependencies(lockfile).any? do |sub_dep|
+          updated_dependencies.any? do |updated_dep|
+            sub_dep.name == updated_dep.name
+          end
+        end
+      end
+
+      def lockfile_dependencies(lockfile)
+        @lockfile_dependencies ||= {}
+        @lockfile_dependencies[lockfile.name] ||=
+          NpmAndYarn::FileParser::LockfileParser.new(
+            dependency_files: [lockfile]
+          ).parse
       end
 
       def manifest?(file)

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -7,13 +7,14 @@ require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/shared_helpers"
 require "dependabot/npm_and_yarn/native_helpers"
+require "dependabot/npm_and_yarn/version"
 require "dependabot/errors"
 
-# rubocop:disable Metrics/ClassLength
 module Dependabot
   module NpmAndYarn
     class FileParser < Dependabot::FileParsers::Base
       require "dependabot/file_parsers/base/dependency_set"
+      require_relative "file_parser/lockfile_parser"
 
       DEPENDENCY_TYPES =
         %w(dependencies devDependencies optionalDependencies).freeze
@@ -36,9 +37,7 @@ module Dependabot
       def parse
         dependency_set = DependencySet.new
         dependency_set += manifest_dependencies
-        dependency_set += yarn_lock_dependencies if yarn_locks.any?
-        dependency_set += package_lock_dependencies if package_locks.any?
-        dependency_set += shrinkwrap_dependencies if shrinkwraps.any?
+        dependency_set += lockfile_dependencies
         dependencies = dependency_set.dependencies
 
         # TODO: Currently, Dependabot can't handle dependencies that have both
@@ -79,84 +78,22 @@ module Dependabot
         dependency_set
       end
 
-      def yarn_lock_dependencies
-        dependency_set = DependencySet.new
-
-        yarn_locks.each do |yarn_lock|
-          parse_yarn_lock(yarn_lock).each do |req, details|
-            next unless details["version"] && details["version"] != ""
-
-            # Note: The DependencySet will de-dupe our dependencies, so they
-            # end up unique by name. That's not a perfect representation of
-            # the nested nature of JS resolution, but it makes everything work
-            # comparably to other flat-resolution strategies
-            dependency_set << Dependency.new(
-              name: req.split(/(?<=\w)\@/).first,
-              version: details["version"],
-              package_manager: "npm_and_yarn",
-              requirements: []
-            )
-          end
-        end
-
-        dependency_set
-      end
-
-      def package_lock_dependencies
-        dependency_set = DependencySet.new
-
-        # Note: The DependencySet will de-dupe our dependencies, so they
-        # end up unique by name. That's not a perfect representation of
-        # the nested nature of JS resolution, but it makes everything work
-        # comparably to other flat-resolution strategies
-        package_locks.each do |package_lock|
-          parsed_lockfile = parse_package_lock(package_lock)
-          deps = recursively_fetch_npm_lock_dependencies(parsed_lockfile)
-          dependency_set += deps
-        end
-
-        dependency_set
-      end
-
-      def shrinkwrap_dependencies
-        dependency_set = DependencySet.new
-
-        # Note: The DependencySet will de-dupe our dependencies, so they
-        # end up unique by name. That's not a perfect representation of
-        # the nested nature of JS resolution, but it makes everything work
-        # comparably to other flat-resolution strategies
-        shrinkwraps.each do |shrinkwrap|
-          parsed_lockfile = parse_shrinkwrap(shrinkwrap)
-          deps = recursively_fetch_npm_lock_dependencies(parsed_lockfile)
-          dependency_set += deps
-        end
-
-        dependency_set
+      def lockfile_parser
+        @lockfile_parser ||= LockfileParser.new(
+          dependency_files: dependency_files
+        )
       end
 
-      def recursively_fetch_npm_lock_dependencies(object_with_dependencies)
-        dependency_set = DependencySet.new
-
-        object_with_dependencies.
-          fetch("dependencies", {}).each do |name, details|
-            next unless details["version"] && details["version"] != ""
-
-            dependency_set << Dependency.new(
-              name: name,
-              version: details["version"],
-              package_manager: "npm_and_yarn",
-              requirements: []
-            )
-
-            dependency_set += recursively_fetch_npm_lock_dependencies(details)
-          end
-
-        dependency_set
+      def lockfile_dependencies
+        DependencySet.new(lockfile_parser.parse)
       end
 
       def build_dependency(file:, type:, name:, requirement:)
-        return if lockfile_details(name, requirement) &&
-                  !version_for(name, requirement)
+        lockfile_details = lockfile_parser.lockfile_details(
+          dependency_name: name,
+          requirement: requirement
+        )
+        return if lockfile_details && !version_for(name, requirement)
         return if ignore_requirement?(requirement)
         return if workspace_package_names.include?(name)
 
@@ -226,10 +163,12 @@ module Dependabot
       def git_revision_for(name, requirement)
         return unless git_url?(requirement)
 
-        lock_version = lockfile_details(name, requirement)&.
-                       fetch("version", nil)
-        lock_res     = lockfile_details(name, requirement)&.
-                       fetch("resolved", nil)
+        lockfile_details = lockfile_parser.lockfile_details(
+          dependency_name: name,
+          requirement: requirement
+        )
+        lock_version = lockfile_details&.fetch("version", nil)
+        lock_res = lockfile_details&.fetch("resolved", nil)
 
         return lock_version.split("#").last if lock_version&.include?("#")
         return lock_res.split("#").last if lock_res&.include?("#")
@@ -242,8 +181,10 @@ module Dependabot
       end
 
       def semver_version_for(name, requirement)
-        lock_version = lockfile_details(name, requirement)&.
-                       fetch("version", nil)
+        lock_version = lockfile_parser.lockfile_details(
+          dependency_name: name,
+          requirement: requirement
+        )&.fetch("version", nil)
 
         return unless lock_version
         return if lock_version.include?("://")
@@ -257,8 +198,10 @@ module Dependabot
       def source_for(name, requirement)
         return git_source_for(requirement) if git_url?(requirement)
 
-        resolved_url = lockfile_details(name, requirement)&.
-                       fetch("resolved", nil)
+        resolved_url = lockfile_parser.lockfile_details(
+          dependency_name: name,
+          requirement: requirement
+        )&.fetch("resolved", nil)
 
         return unless resolved_url
         return unless resolved_url.start_with?("http")
@@ -314,107 +257,24 @@ module Dependabot
         false
       end
 
-      def lockfile_details(name, requirement)
-        [*package_locks, *shrinkwraps].each do |package_lock|
-          parsed_package_lock_json = parse_package_lock(package_lock)
-          next unless parsed_package_lock_json.dig("dependencies", name)
-
-          return parsed_package_lock_json.dig("dependencies", name)
-        end
-
-        req = requirement
-        yarn_locks.each do |yarn_lock|
-          parsed_yarn_lock = parse_yarn_lock(yarn_lock)
-
-          details_candidates =
-            parsed_yarn_lock.
-            select { |k, _| k.split(/(?<=\w)\@/).first == name }
-
-          # If there's only one entry for this dependency, use it, even if
-          # the requirement in the lockfile doesn't match
-          details = details_candidates.first.last if details_candidates.one?
-
-          details ||=
-            details_candidates.
-            find { |k, _| k.split(/(?<=\w)\@/)[1..-1].join("@") == req }&.
-            last
-
-          return details if details
-        end
-
-        nil
-      end
-
-      def parse_package_lock(package_lock)
-        JSON.parse(package_lock.content)
-      rescue JSON::ParserError
-        raise Dependabot::DependencyFileNotParseable, package_lock.path
-      end
-
-      def parse_shrinkwrap(shrinkwrap)
-        JSON.parse(shrinkwrap.content)
-      rescue JSON::ParserError
-        raise Dependabot::DependencyFileNotParseable, shrinkwrap.path
-      end
-
-      def parse_yarn_lock(yarn_lock)
-        @parsed_yarn_lock ||= {}
-        @parsed_yarn_lock[yarn_lock.name] ||=
-          SharedHelpers.in_a_temporary_directory do
-            File.write("yarn.lock", yarn_lock.content)
-
-            SharedHelpers.run_helper_subprocess(
-              command: "node #{yarn_helper_path}",
-              function: "parseLockfile",
-              args: [Dir.pwd]
-            )
-          rescue SharedHelpers::HelperSubprocessFailed
-            raise Dependabot::DependencyFileNotParseable, yarn_lock.path
-          end
-      end
-
-      def yarn_helper_path
-        NativeHelpers.yarn_helper_path
-      end
-
       def package_files
-        sub_packages =
-          dependency_files.
-          select { |f| f.name.end_with?("package.json") }.
-          reject { |f| f.name == "package.json" }.
-          reject(&:support_file?)
-
-        [
-          dependency_files.find { |f| f.name == "package.json" },
-          *sub_packages
-        ].compact
-      end
-
-      def lockfile?
-        package_locks.any? || yarn_locks.any?
-      end
-
-      def package_locks
-        @package_locks ||=
-          dependency_files.
-          select { |f| f.name.end_with?("package-lock.json") }
-      end
-
-      def yarn_locks
-        @yarn_locks ||=
-          dependency_files.
-          select { |f| f.name.end_with?("yarn.lock") }
-      end
-
-      def shrinkwraps
-        @shrinkwraps ||=
-          dependency_files.
-          select { |f| f.name.end_with?("npm-shrinkwrap.json") }
+        @package_files ||=
+          begin
+            sub_packages =
+              dependency_files.
+              select { |f| f.name.end_with?("package.json") }.
+              reject { |f| f.name == "package.json" }.
+              reject(&:support_file?)
+
+            [
+              dependency_files.find { |f| f.name == "package.json" },
+              *sub_packages
+            ].compact
+          end
       end
     end
   end
 end
-# rubocop:enable Metrics/ClassLength
 
 Dependabot::FileParsers.
   register("npm_and_yarn", Dependabot::NpmAndYarn::FileParser)

data/lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb

@@ -0,0 +1,190 @@
+# frozen_string_literal: true
+
+require "dependabot/dependency_file"
+require "dependabot/npm_and_yarn/file_parser"
+
+module Dependabot
+  module NpmAndYarn
+    class FileParser
+      class LockfileParser
+        def initialize(dependency_files:)
+          @dependency_files = dependency_files
+        end
+
+        def parse
+          dependency_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
+          dependency_set += yarn_lock_dependencies if yarn_locks.any?
+          dependency_set += package_lock_dependencies if package_locks.any?
+          dependency_set += shrinkwrap_dependencies if shrinkwraps.any?
+          dependency_set.dependencies
+        end
+
+        def lockfile_details(dependency_name:, requirement:)
+          [*package_locks, *shrinkwraps].each do |package_lock|
+            parsed_package_lock_json = parse_package_lock(package_lock)
+            next unless parsed_package_lock_json.dig("dependencies",
+                                                     dependency_name)
+
+            return parsed_package_lock_json.dig("dependencies", dependency_name)
+          end
+
+          yarn_locks.each do |yarn_lock|
+            parsed_yarn_lock = parse_yarn_lock(yarn_lock)
+
+            details_candidates =
+              parsed_yarn_lock.
+              select { |k, _| k.split(/(?<=\w)\@/).first == dependency_name }
+
+            # If there's only one entry for this dependency, use it, even if
+            # the requirement in the lockfile doesn't match
+            details = details_candidates.first.last if details_candidates.one?
+
+            details ||=
+              details_candidates.
+              find do |k, _|
+                k.split(/(?<=\w)\@/)[1..-1].join("@") == requirement
+              end&.
+              last
+
+            return details if details
+          end
+
+          nil
+        end
+
+        private
+
+        attr_reader :dependency_files
+
+        def yarn_lock_dependencies
+          dependency_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
+
+          yarn_locks.each do |yarn_lock|
+            parse_yarn_lock(yarn_lock).each do |req, details|
+              next unless details["version"] && details["version"] != ""
+
+              # Note: The DependencySet will de-dupe our dependencies, so they
+              # end up unique by name. That's not a perfect representation of
+              # the nested nature of JS resolution, but it makes everything work
+              # comparably to other flat-resolution strategies
+              dependency_set << Dependency.new(
+                name: req.split(/(?<=\w)\@/).first,
+                version: details["version"],
+                package_manager: "npm_and_yarn",
+                requirements: []
+              )
+            end
+          end
+
+          dependency_set
+        end
+
+        def package_lock_dependencies
+          dependency_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
+
+          # Note: The DependencySet will de-dupe our dependencies, so they
+          # end up unique by name. That's not a perfect representation of
+          # the nested nature of JS resolution, but it makes everything work
+          # comparably to other flat-resolution strategies
+          package_locks.each do |package_lock|
+            parsed_lockfile = parse_package_lock(package_lock)
+            deps = recursively_fetch_npm_lock_dependencies(parsed_lockfile)
+            dependency_set += deps
+          end
+
+          dependency_set
+        end
+
+        def shrinkwrap_dependencies
+          dependency_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
+
+          # Note: The DependencySet will de-dupe our dependencies, so they
+          # end up unique by name. That's not a perfect representation of
+          # the nested nature of JS resolution, but it makes everything work
+          # comparably to other flat-resolution strategies
+          shrinkwraps.each do |shrinkwrap|
+            parsed_lockfile = parse_shrinkwrap(shrinkwrap)
+            deps = recursively_fetch_npm_lock_dependencies(parsed_lockfile)
+            dependency_set += deps
+          end
+
+          dependency_set
+        end
+
+        def recursively_fetch_npm_lock_dependencies(object_with_dependencies)
+          dependency_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
+
+          object_with_dependencies.
+            fetch("dependencies", {}).each do |name, details|
+              next unless details["version"] && details["version"] != ""
+
+              dependency_set << Dependency.new(
+                name: name,
+                version: details["version"],
+                package_manager: "npm_and_yarn",
+                requirements: []
+              )
+
+              dependency_set += recursively_fetch_npm_lock_dependencies(details)
+            end
+
+          dependency_set
+        end
+
+        def parse_package_lock(package_lock)
+          @parse_package_lock ||= {}
+          @parse_package_lock[package_lock.name] ||=
+            JSON.parse(package_lock.content)
+        rescue JSON::ParserError
+          raise Dependabot::DependencyFileNotParseable, package_lock.path
+        end
+
+        def parse_shrinkwrap(shrinkwrap)
+          @parse_shrinkwrap ||= {}
+          @parse_shrinkwrap[shrinkwrap.name] ||=
+            JSON.parse(shrinkwrap.content)
+        rescue JSON::ParserError
+          raise Dependabot::DependencyFileNotParseable, shrinkwrap.path
+        end
+
+        def parse_yarn_lock(yarn_lock)
+          @parsed_yarn_lock ||= {}
+          @parsed_yarn_lock[yarn_lock.name] ||=
+            SharedHelpers.in_a_temporary_directory do
+              File.write("yarn.lock", yarn_lock.content)
+
+              SharedHelpers.run_helper_subprocess(
+                command: "node #{yarn_helper_path}",
+                function: "parseLockfile",
+                args: [Dir.pwd]
+              )
+            rescue SharedHelpers::HelperSubprocessFailed
+              raise Dependabot::DependencyFileNotParseable, yarn_lock.path
+            end
+        end
+
+        def yarn_helper_path
+          NativeHelpers.yarn_helper_path
+        end
+
+        def package_locks
+          @package_locks ||=
+            dependency_files.
+            select { |f| f.name.end_with?("package-lock.json") }
+        end
+
+        def yarn_locks
+          @yarn_locks ||=
+            dependency_files.
+            select { |f| f.name.end_with?("yarn.lock") }
+        end
+
+        def shrinkwraps
+          @shrinkwraps ||=
+            dependency_files.
+            select { |f| f.name.end_with?("npm-shrinkwrap.json") }
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/npm_and_yarn/sub_dependency_files_filterer.rb

@@ -1,9 +1,8 @@
 # frozen_string_literal: true
 
 require "dependabot/utils"
-require "dependabot/dependency_file"
-require "dependabot/npm_and_yarn/file_parser"
 require "dependabot/npm_and_yarn/version"
+require "dependabot/npm_and_yarn/file_parser/lockfile_parser"
 
 # Used in the sub dependency version resolver and file updater to only run
 # yarn/npm helpers on dependency files that require updates. This is useful for
@@ -18,41 +17,35 @@ module Dependabot
       end
 
       def files_requiring_update
-        lockfiles.select do |lockfile|
-          sub_dependencies(lockfile).any? do |sub_dep|
-            updated_dependencies.any? do |updated_dep|
-              next false unless sub_dep.name == updated_dep.name
+        @files_requiring_update ||=
+          begin
+            lockfiles.select do |lockfile|
+              lockfile_dependencies(lockfile).any? do |sub_dep|
+                updated_dependencies.any? do |updated_dep|
+                  next false unless sub_dep.name == updated_dep.name
 
-              version_class.new(updated_dep.version) >
-                version_class.new(sub_dep.version)
+                  version_class.new(updated_dep.version) >
+                    version_class.new(sub_dep.version)
+                end
+              end
             end
           end
-        end
       end
 
       private
 
       attr_reader :dependency_files, :updated_dependencies
 
-      def sub_dependencies(lockfile)
-        # Add dummy_package_manifest to keep existing validation login in base
-        # file parser
-        NpmAndYarn::FileParser.new(
-          dependency_files: [dummy_package_manifest, lockfile],
-          source: nil,
-          credentials: [] # Credentials are only needed for top level deps
-        ).parse
+      def lockfile_dependencies(lockfile)
+        @lockfile_dependencies ||= {}
+        @lockfile_dependencies[lockfile.name] ||=
+          NpmAndYarn::FileParser::LockfileParser.new(
+            dependency_files: [lockfile]
+          ).parse
       end
 
       def lockfiles
-        @lockfiles ||= dependency_files.select { |file| lockfile?(file) }
-      end
-
-      def dummy_package_manifest
-        @dummy_package_manifest ||= Dependabot::DependencyFile.new(
-          content: "{}",
-          name: "package.json"
-        )
+        dependency_files.select { |file| lockfile?(file) }
       end
 
       def lockfile?(file)

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -96,7 +96,6 @@ module Dependabot
 
             updates << { dependency: dep, version: updated_version }
           end
-
           updates
         end
 
@@ -238,12 +237,21 @@ module Dependabot
           return [] if relevant_unmet_peer_dependencies.empty?
 
           # Prune out any pre-existing warnings
-          relevant_unmet_peer_dependencies.reject do |issue|
+          issues = relevant_unmet_peer_dependencies.reject do |issue|
             old_unmet_peer_dependencies.any? do |old_issue|
               old_issue.slice(:requirement_name, :requiring_dep_name) ==
                 issue.slice(:requirement_name, :requiring_dep_name)
             end
           end
+
+          # If we find duplicate errors it probably means we have double run the
+          # checker on the same files and want to hear about it
+          if issues.length != issues.uniq.length
+            duplicate = issues.find { |i| issues.count(i) > 1 }
+            raise "Duplicate peer dep error: #{duplicate[:requiring_dep_name]}"
+          end
+
+          issues
         end
 
         def satisfying_versions
@@ -394,7 +402,7 @@ module Dependabot
         def write_lock_files
           yarn_locks.each do |f|
             FileUtils.mkdir_p(Pathname.new(f.name).dirname)
-            File.write(f.name, prepared_yarn_lockfile_content(f.content))
+            File.write(f.name, f.content)
           end
 
           package_locks.each do |f|
@@ -408,10 +416,6 @@ module Dependabot
           end
         end
 
-        def prepared_yarn_lockfile_content(content)
-          content.gsub(/^#{Regexp.quote(dependency.name)}\@.*?\n\n/m, "")
-        end
-
         def prepared_package_json_content(file)
           NpmAndYarn::FileUpdater::PackageJsonPreparer.new(
             package_json_content: file.content

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.95.55
+  version: 0.95.56
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.55
+        version: 0.95.56
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.55
+        version: 0.95.56
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -184,6 +184,7 @@ files:
 - lib/dependabot/npm_and_yarn/file_fetcher.rb
 - lib/dependabot/npm_and_yarn/file_fetcher/path_dependency_builder.rb
 - lib/dependabot/npm_and_yarn/file_parser.rb
+- lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb
 - lib/dependabot/npm_and_yarn/file_updater.rb
 - lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb
 - lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb