diff --git a/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb b/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb index a9252ae044d..3b30be3bfb1 100644 --- a/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb +++ b/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb @@ -69,15 +69,15 @@ def yarn_version return @yarn_version if defined?(@yarn_version) package = JSON.parse(package_json.content) - if (pkgmanager = package.fetch("packageManager", nil)) - get_yarn_version_from_path(pkgmanager) + if Experiments.enabled?(:yarn_berry) && (package_manager = package.fetch("packageManager", nil)) + get_yarn_version_from_package_json(package_manager) elsif yarn_lock 1 end end - def get_yarn_version_from_path(path) - version_match = path.match(/yarn@(?\d+.\d+.\d+)/) + def get_yarn_version_from_package_json(package_manager) + version_match = package_manager.match(/yarn@(?\d+.\d+.\d+)/) version_match&.named_captures&.fetch("version", nil) end diff --git a/npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser.rb b/npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser.rb index 9c13e6d4c3c..7e72b6eb590 100644 --- a/npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser.rb +++ b/npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser.rb @@ -241,11 +241,18 @@ def semver_version_for(name, requirement, manifest_name) def source_for(name, requirement, manifest_name) return git_source_for(requirement) if git_url?(requirement) - resolved_url = lockfile_parser.lockfile_details( + lockfile_details = lockfile_parser.lockfile_details( dependency_name: name, requirement: requirement, manifest_name: manifest_name - )&.fetch("resolved", nil) + ) + resolved_url = lockfile_details&.fetch("resolved", nil) + + if Experiments.enabled?(:yarn_berry) && resolved_url.nil? + resolution = lockfile_details&.fetch("resolution", nil) + package_match = resolution&.match(/__archiveUrl=(?.+)/) + resolved_url = CGI.unescape(package_match.named_captures.fetch("package_url", "")) if package_match + end return unless resolved_url return unless resolved_url.start_with?("http")