dependabot-npm_and_yarn 0.261.1 → 0.263.0

data/helpers/package.json

@@ -11,7 +11,7 @@
   },
   "dependencies": {
     "@dependabot/yarn-lib": "^1.22.22",
-    "@npmcli/arborist": "^7.5.1",
+    "@npmcli/arborist": "^7.5.3",
     "detect-indent": "^6.1.0",
     "nock": "^13.5.4",
     "npm": "6.14.18",

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -421,7 +421,7 @@ module Dependabot
           end
 
           if error_message.include?("EBADENGINE")
-            msg = "Dependabot uses Node.js #{`node --version`} and NPM #{`npm --version`}. " \
+            msg = "Dependabot uses Node.js #{`node --version`.strip} and NPM #{`npm --version`.strip}. " \
                   "Due to the engine-strict setting, the update will not succeed."
             raise Dependabot::DependencyFileNotResolvable, msg
           end

data/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb

@@ -39,9 +39,10 @@ module Dependabot
 
         IRRESOLVABLE_PACKAGE = "ERR_PNPM_NO_MATCHING_VERSION"
         INVALID_REQUIREMENT = "ERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER"
-        UNREACHABLE_GIT = %r{ERR_PNPM_FETCH_404[ [^:print:]]+GET (?<url>https://codeload\.github\.com/[^/]+/[^/]+)/}
+        UNREACHABLE_GIT = %r{Command failed with exit code 128: git ls-remote (?<url>.*github\.com/[^/]+/[^ ]+)}
+        UNREACHABLE_GIT_V8 = %r{ERR_PNPM_FETCH_404[ [^:print:]]+GET (?<url>https://codeload\.github\.com/[^/]+/[^/]+)/}
         FORBIDDEN_PACKAGE = /ERR_PNPM_FETCH_403[ [^:print:]]+GET (?<dependency_url>.*): Forbidden - 403/
-        MISSING_PACKAGE = /ERR_PNPM_FETCH_404[ [^:print:]]+GET (?<dependency_url>.*): Not Found - 404/
+        MISSING_PACKAGE = /ERR_PNPM_FETCH_404[ [^:print:]]+GET (?<dependency_url>.*): (?:Not Found)? - 404/
         UNAUTHORIZED_PACKAGE = /ERR_PNPM_FETCH_401[ [^:print:]]+GET (?<dependency_url>.*): Unauthorized - 401/
 
         def run_pnpm_update(pnpm_lock:)
@@ -95,7 +96,13 @@ module Dependabot
           end
 
           if error_message.match?(UNREACHABLE_GIT)
-            url = error_message.match(UNREACHABLE_GIT).named_captures.fetch("url")
+            url = error_message.match(UNREACHABLE_GIT).named_captures.fetch("url").gsub("git+ssh://git@", "https://").delete_suffix(".git")
+
+            raise Dependabot::GitDependenciesNotReachable, url
+          end
+
+          if error_message.match?(UNREACHABLE_GIT_V8)
+            url = error_message.match(UNREACHABLE_GIT_V8).named_captures.fetch("url").gsub("codeload.", "")
 
             raise Dependabot::GitDependenciesNotReachable, url
           end
@@ -122,6 +129,7 @@ module Dependabot
           package_name = RegistryParser.new(resolved_url: dependency_url, credentials: credentials).dependency_name
           missing_dep = lockfile_dependencies(pnpm_lock)
                         .find { |dep| dep.name == package_name }
+          raise DependencyNotFound, package_name unless missing_dep
 
           reg = NpmAndYarn::UpdateChecker::RegistryFinder.new(
             dependency: missing_dep,

data/lib/dependabot/npm_and_yarn/update_checker/requirements_updater.rb

@@ -42,7 +42,7 @@ module Dependabot
         end
 
         def updated_requirements
-          return requirements if update_strategy == RequirementsUpdateStrategy::LockfileOnly
+          return requirements if update_strategy.lockfile_only?
 
           requirements.map do |req|
             req = req.merge(source: updated_source)

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -106,7 +106,7 @@ module Dependabot
       end
 
       def requirements_unlocked_or_can_be?
-        requirements_update_strategy != RequirementsUpdateStrategy::LockfileOnly
+        !requirements_update_strategy.lockfile_only?
       end
 
       def requirements_update_strategy

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.261.1
+  version: 0.263.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-06-17 00:00:00.000000000 Z
+date: 2024-06-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.261.1
+        version: 0.263.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.261.1
+        version: 0.263.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -345,7 +345,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.261.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.263.0
 post_install_message: 
 rdoc_options: []
 require_paths: