package-audit 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d30d08ba36373c75427371f922cb0a5819a021868bf82001428e0541571df9f8
-  data.tar.gz: ac4dce54e3905dd56de9b137a62101de7267262c1f6b0310e4697c8f016a36b8
+  metadata.gz: 637173ee31a102187a23134942d6df2245d6b7785708747c85029d5fdf2045c0
+  data.tar.gz: d30d4aad7dd1ff9a39348db8125fe991e9877a537eec6962883885f788e79438
 SHA512:
-  metadata.gz: 00be4151f4f124614d117a739a558f9f2816f0f72095f222ddadf5101a6d089b40bdc5369c4a68c9b096b1547932561394f1fee5ca58712e13a4909c4a8c9558
-  data.tar.gz: f224c2c2fe2ff39586d20989ef6999d7b2a52acd2276dcdd9895441105ccaebc5991523676b88545a5afa96d4ffcac10291ab76dfab735b65d42aabc4598d7e4
+  metadata.gz: 187e2559f65548b13eded61cbcc0679e4ddbf99e46484f7ce3a8ae1ddf71d8c095c224dab43aaf3366cc918105a8df4310a2991b69b1a64a23735bd20308f727
+  data.tar.gz: 1b452b5db99d6434d475b04adfa91ac4c49dd934211d160a4a9a4d49dafade42e59b7ac2a2162ba344169bc70f74632ffcd466dcfdef5dc99a7379dace932940

data/lib/package/audit/npm/yarn_lock_parser.rb

@@ -22,7 +22,7 @@ module Package
         private
 
         def fetch_package_block(dep_name, expected_version)
-          regex = /#{Regexp.escape(dep_name)}@#{Regexp.escape(expected_version)}.*?:.*?(\n\n|\z)/m
+          regex = regex_pattern_for_package(dep_name, expected_version)
           blocks = @yarn_lock_file.match(regex)
           if blocks.nil? || blocks[0].nil?
             raise NoMatchingPatternError, "Unable to find \"#{dep_name}\" in #{@yarn_lock_path}"
@@ -40,6 +40,17 @@ module Package
 
           version || '0.0.0.0'
         end
+
+        def regex_pattern_for_package(dep_name, version)
+          # assume the package name is prefixed by a space, a quote or be the first thing on the line
+          # there can be multiple comma-separated versions on the same line with or without quotes
+          # Here are some examples of strings that would be matched:
+          # - aria-query@^5.0.0:
+          # - lodash@^4.17.15, lodash@^4.17.20:
+          # - "@adobe/css-tools@^4.0.1":
+          # - "@babel/runtime@^7.23.1", "@babel/runtime@^7.9.2":
+          /(?:^|[ "])#{Regexp.escape(dep_name)}@#{Regexp.escape(version)}.*?:.*?(\n\n|\z)/m
+        end
       end
     end
   end

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.4.0'
+    VERSION = '0.4.1'
   end
 end

data/sig/package/audit/npm/yarn_lock_parser.rbs

@@ -14,6 +14,8 @@ module Package
         def fetch_package_block: (Symbol, String) -> String
 
         def fetch_package_version: (Symbol, String) -> String
+
+        def regex_pattern_for_package: (Symbol, String) -> Regexp
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: package-audit
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Vadim Kononov
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-07-11 00:00:00.000000000 Z
+date: 2023-10-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler-audit
@@ -148,7 +148,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.12
+rubygems_version: 3.4.17
 signing_key:
 specification_version: 4
 summary: A helper tool to find outdated, deprecated and vulnerable dependencies.