Bump the pnpm-dependencies group in /npm_and_yarn/helpers with 2 updates #9562
Conversation
Bumps the pnpm-dependencies group in /npm_and_yarn/helpers with 2 updates: [@pnpm/lockfile-file](https://github.com/pnpm/pnpm) and [@pnpm/dependency-path](https://github.com/pnpm/pnpm). Updates `@pnpm/lockfile-file` from 8.1.6 to 9.0.1 - [Release notes](https://github.com/pnpm/pnpm/releases) - [Commits](https://github.com/pnpm/pnpm/commits/v9.0.1) Updates `@pnpm/dependency-path` from 2.1.7 to 3.0.0 - [Release notes](https://github.com/pnpm/pnpm/releases) - [Commits](https://github.com/pnpm/pnpm/commits/v3.0.0) --- updated-dependencies: - dependency-name: "@pnpm/lockfile-file" dependency-type: direct:production update-type: version-update:semver-major dependency-group: pnpm-dependencies - dependency-name: "@pnpm/dependency-path" dependency-type: direct:production update-type: version-update:semver-major dependency-group: pnpm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
…e dependency file.
…ions complains about denied packages.
There was a problem hiding this comment.
@thavaahariharangit we can't just remove tests because they cause some check to fail, we need to address the underlying issue.
In this case, dependency review is complaining about a package in the fixtures directory, so we should configure dependency-review to ignore that fixture as it is not part of the code that we ship, and will explicitly contain files with known dependencies for testing purposes.
|
Why are we adding a pnpm lockfile? We're using npm to manage our internal dependencies and already have a package-lock.json right? |
| const os = require("os"); | ||
| const path = require("path"); | ||
|
|
||
| describe("parseLockfile", () => { |
There was a problem hiding this comment.
Thanks for adding tests to this native helper 👍
…nd adding the test back.
… on: in order to be honored by YAMLLint'.
Ignoring the fixture files in workflow (dependency review and code QL) runs
…/pnpm-dependencies-aed75d57aa
…ture file changes.
|
@abdulapopoola and @jurre I have created new issue for avoiding dependency review workflow running against fixtures And I have updated fixture files here, as it is not directly related this PR or it's fixes. |
| @@ -15,6 +15,7 @@ async function parse(directory) { | |||
| }); | |||
|
|
|||
| return Object.entries(lockfile.packages ?? {}) | |||
| .filter(([depPath, pkgSnapshot]) => dependencyPath.parse(depPath).name) // exclude empty names | |||
There was a problem hiding this comment.
Thought: can dependencyPath.parse() return null/undefined and do we need to handle that? Answer: no 👍
There was a problem hiding this comment.
Answer yes, I am updating the code now.
There was a problem hiding this comment.
@bdragon Thanks and updated.
There was a problem hiding this comment.
Sorry if my comment wasn't clear. I was just checking to see if this was something we needed to handle, but what you had was fine so there was no need to change it.
npm_and_yarn/spec/dependabot/npm_and_yarn/file_parser/lockfile_parser_spec.rb
Outdated
Show resolved
Hide resolved
…ved clarity of comments.
…ved clarity of comments.
…/pnpm-dependencies-aed75d57aa
Jurre is on holiday and Bryan has approved the PR
|
@raj-meka You should be good to go |
…/pnpm-dependencies-aed75d57aa
Bumps the pnpm-dependencies group in /npm_and_yarn/helpers with 2 updates: @pnpm/lockfile-file and @pnpm/dependency-path.
Updates
@pnpm/lockfile-filefrom 8.1.6 to 9.0.1Release notes
Sourced from
@pnpm/lockfile-file's releases.... (truncated)
Commits
Updates
@pnpm/dependency-pathfrom 2.1.7 to 3.0.0Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions