dependabot-npm_and_yarn 0.254.0 → 0.255.0

data/helpers/test/pnpm/lockfile-parser.test.js

@@ -0,0 +1,62 @@
+const {
+    parseLockfile,
+} = require("../../lib/pnpm");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+describe("generates an updated pnpm lock for the original file", () => {
+
+    let tempDir;
+    beforeEach(() => {
+        tempDir = fs.mkdtempSync(os.tmpdir() + path.sep);
+    });
+    afterEach(() => fs.rm(tempDir, { recursive: true }, () => {}));
+
+    function copyDependencies(sourceDir, destDir) {
+        const srcPnpmYaml = path.join(
+            __dirname,
+            `fixtures/parser/${sourceDir}/pnpm-lock.yaml`
+        );
+        fs.copyFileSync(srcPnpmYaml, `${destDir}/pnpm-lock.yaml`);
+    }
+
+    it("that contains duplicate dependencies", async () =>{
+        copyDependencies("no_lockfile_change", tempDir);
+        const result = await parseLockfile(tempDir);
+
+        expect(result.length).toEqual(398);
+    })
+
+    it("that contains only dev dependencies but no (prod) dependencies", async () =>{
+        copyDependencies("only_dev_dependencies", tempDir);
+        const result = await parseLockfile(tempDir);
+
+        expect(result).toEqual([
+            {
+                name: 'etag',
+                version: '1.8.0',
+                resolved: undefined,
+                dev: true,
+                specifiers: [ '^1.0.0' ],
+                aliased: false
+            }
+        ]);
+    })
+
+    it("that contains dependencies which locked to versions with peer disambiguation suffix", async () =>{
+        copyDependencies("peer_disambiguation", tempDir);
+        const result = await parseLockfile(tempDir);
+
+        expect(result.length).toEqual(122);
+    })
+
+    // Should have the version in the lock file.
+    it("that contains dependencies with an empty version", async () =>{
+        copyDependencies("empty_version", tempDir);
+        const result = await parseLockfile(tempDir);
+
+        expect(result.length).toEqual(9);
+    })
+
+})

data/helpers/test/yarn/fixtures/updater/illegal_character/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "@colend-contract-helpers",
+  "dependencies": {
+    "@commitlint/cli": "^15.0.0",
+    "is-positive": "^3.1.0",
+    "left-pad": "^1.1.3"
+  }
+}

data/helpers/test/yarn/fixtures/updater/illegal_character/yarn.lock

@@ -0,0 +1,14 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+"@commitlint/cli@^15.0.0":
+  version "15.0.0"
+  resolved "https://registry.yarnpkg.com/@commitlint/cli/-/cli-15.0.0.tgz#8e78e86ee2b6955c1a5d140e734a6c171ce367ee"
+
+"is-positive@^3.1.0":
+  version "3.1.0"
+  resolved "https://registry.yarnpkg.com/is-positive/-/is-positive-3.1.0.tgz#857db584a1ba5d1cb2980527fc3b6c435d37b0fd"
+
+"left-pad@^1.0.0":
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/left-pad/-/left-pad-1.0.0.tgz#c84e2417581bbb8eaf2b9e3d7a122e572ab1af37"

data/helpers/test/yarn/updater.test.js

@@ -85,4 +85,33 @@ describe("updater", () => {
       expect(error).not.toBeNull();
     }
   });
+
+  it("with a package.json which contains illegal character '@' in the name", async () => {
+    copyDependencies("illegal_character", tempDir);
+
+    try {
+      await updateDependencyFiles(tempDir, [
+          {
+            name: "@commitlint/cli",
+            version: "19.3.0",
+            requirements: [
+              {
+                requirement: "^19.3.0",
+                file: "package.json",
+                groups: ["devDependencies"],
+                source:
+                  {
+                    type: "registry",
+                    url: "https://registry.yarnpkg.com"
+                  }
+              }
+            ]
+          }
+        ]
+      );
+    } catch (error) {
+      expect(error).not.toBeNull();
+      expect(error.message).toEqual("package.json: Name contains illegal characters")
+    }
+  });
 });

data/lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb

@@ -1,6 +1,8 @@
-# typed: false
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/npm_and_yarn/file_updater"
 
 module Dependabot
@@ -10,13 +12,25 @@ module Dependabot
       # committed .npmrc
       # We should refactor this to use UpdateChecker::RegistryFinder
       class NpmrcBuilder
-        CENTRAL_REGISTRIES = %w(
-          registry.npmjs.org
-          registry.yarnpkg.com
-        ).freeze
+        extend T::Sig
+
+        CENTRAL_REGISTRIES = T.let(
+          %w(
+            registry.npmjs.org
+            registry.yarnpkg.com
+          ).freeze,
+          T::Array[String]
+        )
 
         SCOPED_REGISTRY = /^\s*@(?<scope>\S+):registry\s*=\s*(?<registry>\S+)/
 
+        sig do
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            dependencies: T::Array[Dependabot::Dependency]
+          ).void
+        end
         def initialize(dependency_files:, credentials:, dependencies: [])
           @dependency_files = dependency_files
           @credentials = credentials
@@ -24,6 +38,7 @@ module Dependabot
         end
 
         # PROXY WORK
+        sig { returns(String) }
         def npmrc_content
           initial_content =
             if npmrc_file then complete_npmrc_from_credentials
@@ -48,6 +63,7 @@ module Dependabot
         # PROXY WORK
         # Yarn allows registries to be defined either in an .npmrc or .yarnrc
         # so we need to parse both files for registry keys
+        sig { returns(String) }
         def yarnrc_content
           initial_content =
             if npmrc_file then complete_yarnrc_from_credentials
@@ -61,65 +77,83 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
 
+        sig { returns(T.nilable(String)) }
         def build_npmrc_content_from_lockfile
           return unless yarn_lock || package_lock || shrinkwrap
           return unless global_registry
 
-          registry = global_registry["registry"]
-          registry = "https://#{registry}" unless registry.start_with?("http")
+          registry = T.must(global_registry)["registry"]
+          registry = "https://#{registry}" unless registry&.start_with?("http")
           "registry = #{registry}\n" \
             "#{npmrc_global_registry_auth_line}" \
             "always-auth = true"
         end
 
+        sig { returns(T.nilable(String)) }
         def build_yarnrc_content_from_lockfile
           return unless yarn_lock || package_lock
           return unless global_registry
 
-          "registry \"https://#{global_registry['registry']}\"\n" \
+          "registry \"https://#{T.must(global_registry)['registry']}\"\n" \
             "#{yarnrc_global_registry_auth_line}" \
             "npmAlwaysAuth: true"
         end
 
-        def global_registry # rubocop:disable Metrics/PerceivedComplexity
+        # rubocop:disable Metrics/PerceivedComplexity
+        # rubocop:disable Metrics/CyclomaticComplexity
+        # rubocop:disable Metrics/AbcSize
+        sig { returns(T.nilable(Dependabot::Credential)) }
+        def global_registry
           return @global_registry if defined?(@global_registry)
 
-          @global_registry =
+          @global_registry = T.let(
             registry_credentials.find do |cred|
               next false if CENTRAL_REGISTRIES.include?(cred["registry"])
 
               # If all the URLs include this registry, it's global
-              next true if dependency_urls.size.positive? && dependency_urls.all? do |url|
-                             url.include?(cred["registry"])
+              next true if dependency_urls&.size&.positive? && dependency_urls&.all? do |url|
+                             url.include?(T.must(cred["registry"]))
                            end
 
               # Check if this registry has already been defined in .npmrc as a scoped registry
-              next false if npmrc_scoped_registries.any? { |sr| sr.include?(cred["registry"]) }
+              next false if npmrc_scoped_registries&.any? { |sr| sr.include?(T.must(cred["registry"])) }
 
-              next false if yarnrc_scoped_registries.any? { |sr| sr.include?(cred["registry"]) }
+              next false if yarnrc_scoped_registries&.any? { |sr| sr.include?(T.must(cred["registry"])) }
 
               # If any unscoped URLs include this registry, assume it's global
               dependency_urls
-                .reject { |u| u.include?("@") || u.include?("%40") }
-                .any? { |url| url.include?(cred["registry"]) }
-            end
+                &.reject { |u| u.include?("@") || u.include?("%40") }
+                &.any? { |url| url.include?(T.must(cred["registry"])) }
+            end,
+            T.nilable(Dependabot::Credential)
+          )
         end
+        # rubocop:enable Metrics/PerceivedComplexity
+        # rubocop:enable Metrics/CyclomaticComplexity
+        # rubocop:enable Metrics/AbcSize
 
+        sig { returns(String) }
         def npmrc_global_registry_auth_line
           # This token is passed in from the Dependabot Config
           # We write it to the .npmrc file so that it can be used by the VulnerabilityAuditor
-          token = global_registry.fetch("token", nil)
+          token = global_registry&.fetch("token", nil)
           return "" unless token
 
-          auth_line(token, global_registry.fetch("registry")) + "\n"
+          auth_line(token, global_registry&.fetch("registry")) + "\n"
         end
 
+        sig { returns(String) }
         def yarnrc_global_registry_auth_line
-          token = global_registry.fetch("token", nil)
+          token = global_registry&.fetch("token", nil)
           return "" unless token
 
           if token.include?(":")
@@ -133,6 +167,8 @@ module Dependabot
           end
         end
 
+        # rubocop:disable Metrics/AbcSize
+        sig { returns(T.nilable(T::Array[String])) }
         def dependency_urls
           return @dependency_urls if defined?(@dependency_urls)
 
@@ -154,55 +190,62 @@ module Dependabot
           npm_lockfile = package_lock || shrinkwrap
           if npm_lockfile
             @dependency_urls +=
-              npm_lockfile.content.scan(/"resolved"\s*:\s*"(.*)"/)
-                          .flatten
-                          .select { |url| url.is_a?(String) }
-                          .reject { |url| url.start_with?("git") }
+              T.must(npm_lockfile.content).scan(/"resolved"\s*:\s*"(.*)"/)
+               .flatten
+               .select { |url| url.is_a?(String) }
+               .reject { |url| url.start_with?("git") }
           end
           if yarn_lock
             @dependency_urls +=
-              yarn_lock.content.scan(/ resolved "(.*?)"/).flatten
+              T.must(T.must(yarn_lock).content).scan(/ resolved "(.*?)"/).flatten
           end
 
           # The registry URL for Bintray goes into the lockfile in a
           # modified format, so we modify it back before checking against
           # our credentials
-          @dependency_urls =
+          @dependency_urls = T.let(
             @dependency_urls.map do |url|
               url.gsub("dl.bintray.com//", "api.bintray.com/npm/")
-            end
+            end,
+            T.nilable(T::Array[String])
+          )
         end
+        # rubocop:enable Metrics/AbcSize
 
+        sig { returns(String) }
         def complete_npmrc_from_credentials
-          initial_content = npmrc_file.content
-                                      .gsub(/^.*\$\{.*\}.*/, "").strip + "\n"
+          initial_content = T.must(T.must(npmrc_file).content)
+                             .gsub(/^.*\$\{.*\}.*/, "").strip + "\n"
           return initial_content unless yarn_lock || package_lock
           return initial_content unless global_registry
 
-          registry = global_registry["registry"]
-          registry = "https://#{registry}" unless registry.start_with?("http")
+          registry = T.must(global_registry)["registry"]
+          registry = "https://#{registry}" unless registry&.start_with?("http")
           initial_content +
             "registry = #{registry}\n" \
             "#{npmrc_global_registry_auth_line}" \
             "always-auth = true\n"
         end
 
+        sig { returns(String) }
         def complete_yarnrc_from_credentials
-          initial_content = yarnrc_file.content
-                                       .gsub(/^.*\$\{.*\}.*/, "").strip + "\n"
+          initial_content = T.must(T.must(yarnrc_file).content)
+                             .gsub(/^.*\$\{.*\}.*/, "").strip + "\n"
           return initial_content unless yarn_lock || package_lock
           return initial_content unless global_registry
 
           initial_content +
-            "registry: \"https://#{global_registry['registry']}\"\n" \
+            "registry: \"https://#{T.must(global_registry)['registry']}\"\n" \
             "#{yarnrc_global_registry_auth_line}" \
             "npmAlwaysAuth: true\n"
         end
 
+        sig { returns(T.nilable(String)) }
         def build_npmrc_from_yarnrc
           yarnrc_global_registry =
-            yarnrc_file.content
-                       .lines.find { |line| line.match?(/^\s*registry\s/) }
+            yarnrc_file&.content
+                       &.lines
+                       &.find { |line| line.match?(/^\s*registry\s/) }
                        &.match(NpmAndYarn::UpdateChecker::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX)
                        &.named_captures&.fetch("registry")
 
@@ -211,10 +254,12 @@ module Dependabot
           build_npmrc_content_from_lockfile
         end
 
+        sig { returns(T.nilable(String)) }
         def build_yarnrc_from_yarnrc
           yarnrc_global_registry =
-            yarnrc_file.content
-                       .lines.find { |line| line.match?(/^\s*registry\s/) }
+            yarnrc_file&.content
+                       &.lines
+                       &.find { |line| line.match?(/^\s*registry\s/) }
                        &.match(/^\s*registry\s+"(?<registry>[^"]+)"/)
                        &.named_captures&.fetch("registry")
 
@@ -223,12 +268,13 @@ module Dependabot
           build_yarnrc_content_from_lockfile
         end
 
+        sig { returns(T::Array[String]) }
         def credential_lines_for_npmrc
-          lines = []
+          lines = T.let([], T::Array[String])
           registry_credentials.each do |cred|
             registry = cred.fetch("registry")
 
-            lines += registry_scopes(registry) if registry_scopes(registry)
+            lines += T.must(registry_scopes(registry)) if registry_scopes(registry)
 
             token = cred.fetch("token", nil)
             next unless token
@@ -242,6 +288,7 @@ module Dependabot
           ["always-auth = true"] + lines
         end
 
+        sig { params(token: String, registry: T.nilable(String)).returns(String) }
         def auth_line(token, registry = nil)
           auth = if token.include?(":")
                    encoded_token = Base64.encode64(token).delete("\n")
@@ -262,23 +309,30 @@ module Dependabot
           "//#{registry_with_trailing_slash}:#{auth}"
         end
 
+        sig { returns(T.nilable(T::Array[String])) }
         def npmrc_scoped_registries
           return [] unless npmrc_file
 
-          @npmrc_scoped_registries ||=
-            npmrc_file.content.lines.select { |line| line.match?(SCOPED_REGISTRY) }
-                      .filter_map { |line| line.match(SCOPED_REGISTRY)&.named_captures&.fetch("registry") }
+          @npmrc_scoped_registries ||= T.let(
+            T.must(T.must(npmrc_file).content).lines.select { |line| line.match?(SCOPED_REGISTRY) }
+                      .filter_map { |line| line.match(SCOPED_REGISTRY)&.named_captures&.fetch("registry") },
+            T.nilable(T::Array[String])
+          )
         end
 
+        sig { returns(T.nilable(T::Array[String])) }
         def yarnrc_scoped_registries
           return [] unless yarnrc_file
 
-          @yarnrc_scoped_registries ||=
-            yarnrc_file.content.lines.select { |line| line.match?(SCOPED_REGISTRY) }
-                       .filter_map { |line| line.match(SCOPED_REGISTRY)&.named_captures&.fetch("registry") }
+          @yarnrc_scoped_registries ||= T.let(
+            T.must(T.must(yarnrc_file).content).lines.select { |line| line.match?(SCOPED_REGISTRY) }
+                       .filter_map { |line| line.match(SCOPED_REGISTRY)&.named_captures&.fetch("registry") },
+            T.nilable(T::Array[String])
+          )
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(registry: String).returns(T.nilable(T::Array[String])) }
         def registry_scopes(registry)
           # Central registries don't just apply to scopes
           return if CENTRAL_REGISTRIES.include?(registry)
@@ -289,13 +343,13 @@ module Dependabot
             [registry]
           affected_urls =
             dependency_urls
-            .select do |url|
+            &.select do |url|
               next false unless url.include?(registry)
 
               other_regs.none? { |r| r.include?(registry) && url.include?(r) }
             end
 
-          scopes = affected_urls.map do |url|
+          scopes = T.must(affected_urls).map do |url|
             url.split(/\%40|@/)[1]&.split(%r{\%2[fF]|/})&.first
           end.uniq
 
@@ -306,41 +360,65 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { returns(T::Array[Dependabot::Credential]) }
         def registry_credentials
           credentials.select { |cred| cred.fetch("type") == "npm_registry" }
         end
 
+        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
         def parsed_package_lock
-          @parsed_package_lock ||= JSON.parse(package_lock.content)
+          @parsed_package_lock ||= T.let(
+            JSON.parse(T.must(T.must(package_lock).content)),
+            T.nilable(T::Hash[String, T.untyped])
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def npmrc_file
-          @npmrc_file ||= dependency_files
-                          .find { |f| f.name.end_with?(".npmrc") }
+          @npmrc_file ||= T.let(
+            dependency_files.find { |f| f.name.end_with?(".npmrc") },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def yarnrc_file
-          @yarnrc_file ||= dependency_files
-                           .find { |f| f.name.end_with?(".yarnrc") }
+          @yarnrc_file ||= T.let(
+            dependency_files.find { |f| f.name.end_with?(".yarnrc") },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def yarnrc_yml_file
-          @yarnrc_yml_file ||= dependency_files
-                               .find { |f| f.name.end_with?(".yarnrc.yml") }
+          @yarnrc_yml_file ||= T.let(
+            dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def yarn_lock
-          @yarn_lock ||= dependency_files.find { |f| f.name == "yarn.lock" }
+          @yarn_lock ||= T.let(
+            dependency_files.find { |f| f.name == "yarn.lock" },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def package_lock
-          @package_lock ||=
-            dependency_files.find { |f| f.name == "package-lock.json" }
+          @package_lock ||= T.let(
+            dependency_files.find { |f| f.name == "package-lock.json" },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def shrinkwrap
-          @shrinkwrap ||=
-            dependency_files.find { |f| f.name == "npm-shrinkwrap.json" }
+          @shrinkwrap ||= T.let(
+            dependency_files.find { |f| f.name == "npm-shrinkwrap.json" },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
       end
     end

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -128,6 +128,11 @@ module Dependabot
             end
           end
         rescue SharedHelpers::HelperSubprocessFailed => e
+          # package.json name cannot contain characters like empty string or @.
+          if e.message.include?("Name contains illegal characters")
+            raise Dependabot::DependencyFileNotParseable, e.message
+          end
+
           names = dependencies.map(&:name)
           package_missing = names.any? do |name|
             e.message.include?("find package \"#{name}")

data/lib/dependabot/npm_and_yarn/package_name.rb

@@ -12,18 +12,21 @@ module Dependabot
       # - https://github.com/npm/npm-user-validate
       # - https://github.com/npm/validate-npm-package-name
       PACKAGE_NAME_REGEX = %r{
-          \A                                          # beginning of string
-          (?=.{1,214}\z)                              # enforce length (1 - 214)
-          (@(?<scope>                                 # capture 'scope' if present
-            (?=[^\.])                                 # reject leading dot
-            [a-z0-9\-\_\.\!\~\*\'\(\)]+               # URL-safe characters
-          )\/)?
-          (?<name>                                    # capture package name
-            (?=[^\.\_])                               # reject leading dot or underscore
-            [a-z0-9\-\_\.\!\~\*\'\(\)]+               # URL-safe characters
+        \A                                          # beginning of string
+        (?=.{1,214}\z)                              # enforce length (1 - 214)
+        (@(?<scope>                                 # capture 'scope' if present
+          [a-z0-9\-\_\.\!\~\*\'\(\)]+               # URL-safe characters in scope
+        )\/)?                                       # scope must be followed by slash
+        (?<name>                                    # capture package name
+          (?(<scope>)                               # if scope is present
+            [a-z0-9\-\_\.\!\~\*\'\(\)]+             # scoped names can start with any URL-safe character
+          |                                         # if no scope
+            [a-z0-9\-\!\~\*\'\(\)]                  # non-scoped names cannot start with . or _
+            [a-z0-9\-\_\.\!\~\*\'\(\)]*             # subsequent characters can be any URL-safe character
           )
-          \z                                          # end of string
-      }xi                                             # multi-line/case-insensitive
+        )
+        \z                                          # end of string
+      }xi # multi-line/case-insensitive
 
       TYPES_PACKAGE_NAME_REGEX = %r{
           \A                                          # beginning of string
@@ -31,7 +34,7 @@ module Dependabot
           ((?<scope>.+)__)?                           # capture scope
           (?<name>.+)                                 # capture name
           \z                                          # end of string
-      }xi                                             # multi-line/case-insensitive
+      }xi # multi-line/case-insensitive
 
       class InvalidPackageName < StandardError; end
 

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -44,7 +44,15 @@ module Dependabot
         # what ts-jest requests\n
         YARN_BERRY_PEER_DEP_ERROR_REGEX =
           /
-            YN0060:\s|\s.+\sprovides\s(?<required_dep>.+?)\s\((?<info_hash>\w+)\).+what\s(?<requiring_dep>.+?)\srequests
+            YN0060:.+\sprovides\s(?<required_dep>.+?)\s\((?<info_hash>\w+)\).+what\s(?<requiring_dep>.+?)\srequests
+          /x
+
+        # Error message returned by `yarn add` (for Yarn berry v4):
+        # YN0060: │ react is listed by your project with version 15.2.0, \
+        # which doesn't satisfy what react-dom (p89012) requests (^16.0.0).
+        YARN_BERRY_V4_PEER_DEP_ERROR_REGEX =
+          /
+            YN0060:.+\s(?<required_dep>.+?)\sis\s.+what\s(?<requiring_dep>.+?)\s\((?<info_hash>\w+)\)\srequests
           /x
 
         # Error message returned by `pnpm update`:
@@ -366,6 +374,10 @@ module Dependabot
             message.scan(YARN_BERRY_PEER_DEP_ERROR_REGEX) do
               errors << Regexp.last_match.named_captures
             end
+          elsif message.match?(YARN_BERRY_V4_PEER_DEP_ERROR_REGEX)
+            message.scan(YARN_BERRY_V4_PEER_DEP_ERROR_REGEX) do
+              errors << Regexp.last_match.named_captures
+            end
           elsif message.match?(PNPM_PEER_DEP_ERROR_REGEX)
             message.scan(PNPM_PEER_DEP_ERROR_REGEX) do
               captures = Regexp.last_match.named_captures