dependabot-npm_and_yarn 0.95.72 → 0.95.73

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 67936223cf32d39f19b3d1ec887ec35c1f9a758c145bf12583238916f46089db
-  data.tar.gz: e5fec3b524bb5e248620724e3087829c3aa9ffd2277dba6e945a75df7090bde9
+  metadata.gz: 19ed4fc405b5bf30bd418ddab7c68658ac38e8407ed4c6da1645a41f9d23c9b0
+  data.tar.gz: 5fe85ce1ba8f8a746eca22cc668527a5f68505eee7aa59cfe48a739feb69c21f
 SHA512:
-  metadata.gz: 68ea25d3d62aba83202b2e0fed9ff439edd56f75bcfc398b072a0fc5fb74c179034d8ddd142536d750b2248d0f0641ef723a2f5dc3f9c61678ebe3627a2baba1
-  data.tar.gz: 41122101f41706bf7787ee11ceca92c1af0c1ac4e6370e0f820a29c80e0e6a42a4779521678311fa7e3be55244693c872c50b9a1f475ca1c69a62e0d73c7b3e3
+  metadata.gz: daa58fff0cd75c4e3a10de46b7b1da58c7e81beba5cdbe7a7526c622db51d63774cf3fc237299926041805f41284c3daa42264e0c942291d0c579389499171d3
+  data.tar.gz: 000eaf2d256fb04d6f54188b91809856d0f9b79ecec976827e0477cc7c815b85c0fa772f7a7ab0da1b298efeb90717ce29db03a7ca954fa07fd3b3de5c022429

data/helpers/npm/lib/updater.js

@@ -39,15 +39,17 @@ async function updateDependencyFiles(directory, dependencies, lockfileName) {
       "prefer-offline": true
     }
   ]);
-  const oldPackage = JSON.parse(readFile("package.json"));
+  const manifest = JSON.parse(readFile("package.json"));
 
   const dryRun = true;
+  const flattenedDependencies = flattenAllDependencies(manifest);
   const args = dependencies.map(dependency => {
+    const existingVersionRequirement = flattenedDependencies[dependency.name];
     return installArgs(
       dependency.name,
       dependency.version,
       dependency.requirements,
-      oldPackage
+      existingVersionRequirement
     );
   });
   const initialInstaller = new installer.Installer(directory, dryRun, args, {
@@ -89,31 +91,45 @@ async function updateDependencyFiles(directory, dependencies, lockfileName) {
   return { [lockfileName]: updatedLockfile };
 }
 
-function flattenAllDependencies(packageJson) {
+function flattenAllDependencies(manifest) {
   return Object.assign(
     {},
-    packageJson.optionalDependencies,
-    packageJson.peerDependencies,
-    packageJson.devDependencies,
-    packageJson.dependencies
+    manifest.optionalDependencies,
+    manifest.peerDependencies,
+    manifest.devDependencies,
+    manifest.dependencies
   );
 }
 
-function installArgs(depName, desiredVersion, requirements, oldPackage) {
+function installArgs(
+  depName,
+  desiredVersion,
+  requirements,
+  existingVersionRequirement
+) {
   const source = (requirements.find(req => req.source) || {}).source;
 
   if (source && source.type === "git") {
-    let originalVersion = flattenAllDependencies(oldPackage)[depName];
-
-    if (!originalVersion) {
-      originalVersion = source.url;
+    if (!existingVersionRequirement) {
+      existingVersionRequirement = source.url;
     }
 
-    originalVersion = originalVersion.replace(
+    // Git is configured to auth over https while updating
+    existingVersionRequirement = existingVersionRequirement.replace(
       /git\+ssh:\/\/git@(.*?)[:/]/,
       "git+https://$1/"
     );
-    return `${originalVersion.replace(/#.*/, "")}#${desiredVersion}`;
+
+    // Keep any semver range that has already been updated in the package
+    // requirement when installing the new version
+    if (existingVersionRequirement.match(desiredVersion)) {
+      return `${depName}@${existingVersionRequirement}`;
+    } else {
+      return `${depName}@${existingVersionRequirement.replace(
+        /#.*/,
+        ""
+      )}#${desiredVersion}`;
+    }
   } else {
     return `${depName}@${desiredVersion}`;
   }

data/helpers/yarn/lib/updater.js

@@ -25,7 +25,6 @@ const Lockfile = require("@dependabot/yarn-lib/lib/lockfile").default;
 const parse = require("@dependabot/yarn-lib/lib/lockfile/parse").default;
 const fixDuplicates = require("./fix-duplicates");
 const replaceDeclaration = require("./replace-lockfile-declaration");
-const urlParse = require("url").parse;
 
 // Add is a subclass of the Install CLI command, which is responsible for
 // adding packages to a package.json and yarn.lock. Upgrading a package is
@@ -66,8 +65,7 @@ class LightweightInstall extends Install {
   }
 }
 
-async function flattenAllDependencies(config) {
-  const manifest = await config.readRootManifest();
+function flattenAllDependencies(manifest) {
   return Object.assign(
     {},
     manifest.optionalDependencies,
@@ -104,57 +102,36 @@ function optionalRequirement(requirements) {
   );
 }
 
-const GIT_HOSTS = [
-  "github.com",
-  "gitlab.com",
-  "bitbucket.com",
-  "bitbucket.org"
-];
-
-function getGitShorthand(depName, url, lockfileJson) {
-  const { hostname, path } = urlParse(url);
-  const isSupportedHost = hostname && path && GIT_HOSTS.indexOf(hostname) >= 0;
-  if (!isSupportedHost) return;
-
-  const hostShorthand = hostname.replace(/\.[a-z]{3}$/, "");
-  const repoShorthand = path.replace(/^\//, "");
-
-  return [repoShorthand, `${hostShorthand}:${repoShorthand}`].find(
-    shorthand => {
-      return Object.keys(lockfileJson).some(name => {
-        return name.startsWith(`${depName}@${shorthand}`);
-      });
-    }
-  );
-}
-
 function installArgsWithVersion(
   depName,
   desiredVersion,
   requirements,
-  lockfileJson
+  existingVersionRequirement
 ) {
   const source = requirements.source;
 
-  // TODO: Use logic from npm updater to find original version instead of doing
-  // all this mad git shorthand logic
-  // e.g. const originalVersion = flattenAllDependencies(oldPackage)[depName];
   if (source && source.type === "git") {
-    // Handle packages added using the github shorthand, e.g.
-    // - yarn add discord.js@discordjs/discord.js
-    //
-    // To keep the correct resolved url in the lockfile we need to explicitly
-    // tell yarn to install using the shorthand and not using the git url
-    //
-    // The resolved url from the shorthand case comes from
-    // https://codeload.github.com/org/repo.. whereas it comes from
-    // https://github.com/org/repo.. in the usual git install case:
-    // yarn add https://github.com/org/repo..
-    const repoShortHand = getGitShorthand(depName, source.url, lockfileJson);
-    if (repoShortHand) {
-      return [`${depName}@${repoShortHand}#${desiredVersion}`];
+    if (!existingVersionRequirement) {
+      existingVersionRequirement = source.url;
+    }
+
+    // Git is configured to auth over https while updating
+    existingVersionRequirement = existingVersionRequirement.replace(
+      /git\+ssh:\/\/git@(.*?)[:/]/,
+      "git+https://$1/"
+    );
+
+    // Keep any semver range that has already been updated in the package
+    // requirement when installing the new version
+    if (existingVersionRequirement.match(desiredVersion)) {
+      return [`${depName}@${existingVersionRequirement}`];
     } else {
-      return [`${depName}@${source.url}#${desiredVersion}`];
+      return [
+        `${depName}@${existingVersionRequirement.replace(
+          /#.*/,
+          ""
+        )}#${desiredVersion}`
+      ];
     }
   } else {
     return [`${depName}@${desiredVersion}`];
@@ -209,12 +186,14 @@ async function updateDependencyFile(
 
   // Just as if we'd run `yarn add package@version`, but using our lightweight
   // implementation of Add that doesn't actually download and install packages
-  const lockfileJson = parse(originalYarnLock).object;
+  const manifest = await config.readRootManifest();
+  const existingVersionRequirement = flattenAllDependencies(manifest)[depName];
+
   const args = installArgsWithVersion(
     depName,
     desiredVersion,
     requirements,
-    lockfileJson
+    existingVersionRequirement
   );
 
   const add = new LightweightAdd(args, flags, config, reporter, lockfile);
@@ -226,9 +205,6 @@ async function updateDependencyFile(
 
   const newVersionRequirement = requirements.requirement;
 
-  const flattenedDependencies = await flattenAllDependencies(config);
-  const existingVersionRequirement = flattenedDependencies[depName];
-
   // Replace the version requirement in the lockfile (which will currently be an
   // exact version, not a requirement range)
   // If we don't have new requirement (e.g. git source) use the existing version

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.95.72
+  version: 0.95.73
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.72
+        version: 0.95.73
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.72
+        version: 0.95.73
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement