dependabot-npm_and_yarn 0.274.0 → 0.275.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4fe1263109daa3956820bc6977b9d31f6b372d93fac8ee628d98f4f53fdcb992
-  data.tar.gz: 9b8ce74245d5957e545fa43e2fabefb0a0987e9ea8aa0e978a97cd51c59da550
+  metadata.gz: fa9059df74fb7336b4718049555dedd8887c3d08add5cef44110728371612a41
+  data.tar.gz: 4abdcd71749994bbfd88b25e2bd33301debe86459dbe8205d30552475e7e3944
 SHA512:
-  metadata.gz: 81ead43e58c76eed9c89dbfb0fe31c23f95dc692a079e097f540ac136a464d5eeaae7d861c2b8b81de58861bb5b7630875499e2e17154989f3617f06ac3599ed
-  data.tar.gz: 6355efedf3c69ff07f21c1c7bb548045b318fafb0e7acabebdcc231e0564baead08b52fd862707d545b52be77d1dae26077b9ff86cb16592786ed81ebc2d5cd7
+  metadata.gz: a5003914050f7914b55c3d77bba2b05c8905d6959b6a470b86ed029437a703d43436e05527fdbff63ca6d7f346c4ce891f46eada96920c0478e26152aa1eadb5
+  data.tar.gz: 50b3c80faf71ec749c0fe84ec8dd61c387450a5be7c7f5e01c8a2732ae2a776e11f71fb2e38cbc244f75a34ac754c404b58f02e0f55bb606b73f701872652ada

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -98,6 +98,15 @@ module Dependabot
           /Couldn't find package "(?<pkg>.*)" required by "(?<dep>.*)" on the "(?<regis>.*)" registry./
         ].freeze, T::Array[Regexp])
 
+        # dependency access protocol not supported by packagemanager
+        UNSUPPORTED_PROTOCOL = /EUNSUPPORTEDPROTOCOL\n(.*?)Unsupported URL Type "(?<access_method>.*)"/
+
+        # Internal server error returned from registry
+        SERVER_ERROR_500 = /500 Internal Server Error - GET (?<regis>.*)/
+
+        # issue related when dependency url is not mentioned correctly
+        UNRESOLVED_REFERENCE = /Unable to resolve reference (?<deps>.*)/
+
         # TODO: look into fixing this in npm, seems like a bug in the git
         # downloader introduced in npm 7
         #
@@ -428,6 +437,18 @@ module Dependabot
             raise Dependabot::PrivateSourceAuthenticationFailure, url
           end
 
+          if error_message.match?(SERVER_ERROR_500)
+            url = T.must(URI.decode_www_form_component(error_message).split("https://").last).split("/").first
+            msg = "Server error (500) while accessing #{url}."
+            raise Dependabot::DependencyFileNotResolvable, msg
+          end
+
+          if (error_msg = error_message.match(UNRESOLVED_REFERENCE))
+            dep = error_msg.named_captures["deps"]
+            msg = "Unable to resolve reference #{dep}."
+            raise Dependabot::DependencyFileNotResolvable, msg
+          end
+
           if error_message.match?(MISSING_PACKAGE)
             package_name = T.must(error_message.match(MISSING_PACKAGE))
                             .named_captures["package_req"]
@@ -590,6 +611,11 @@ module Dependabot
             raise Dependabot::DependencyFileNotResolvable, msg
           end
 
+          if (error_msg = error_message.match(UNSUPPORTED_PROTOCOL))
+            msg = "Unsupported protocol \"#{error_msg.named_captures.fetch('access_method')}\" while accessing dependency." # rubocop:disable Layout/LineLength
+            raise Dependabot::DependencyFileNotResolvable, msg
+          end
+
           raise error
         end
         # rubocop:enable Metrics/AbcSize

data/lib/dependabot/npm_and_yarn/package_manager.rb

@@ -2,20 +2,55 @@
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"
+require "dependabot/npm_and_yarn/version_selector"
 
 module Dependabot
   module NpmAndYarn
     class PackageManager
+      extend T::Sig
+      extend T::Helpers
       def initialize(package_json, lockfiles:)
         @package_json = package_json
         @lockfiles = lockfiles
         @package_manager = package_json.fetch("packageManager", nil)
+        @engines = package_json.fetch("engines", nil)
       end
 
+      # rubocop:disable Metrics/CyclomaticComplexity
+      # rubocop:disable Metrics/PerceivedComplexity
       def setup(name)
-        return unless @package_manager.nil? || @package_manager.start_with?("#{name}@")
+        # we prioritize version mentioned in "packageManager" instead of "engines"
+        # i.e. if { engines : "pnpm" : "6" } and { packageManager: "pnpm@6.0.2" },
+        # we go for the specificity mentioned in packageManager (6.0.2)
 
-        version = requested_version(name)
+        if Dependabot::Experiments.enabled?(:enable_pnpm_yarn_dynamic_engine)
+
+          unless @package_manager&.start_with?("#{name}@") || (@package_manager&.==name.to_s) || @package_manager.nil?
+            return
+          end
+
+          if @engines && @package_manager.nil?
+            # if "packageManager" doesn't exists in manifest file,
+            # we check if we can extract "engines" information
+            Dependabot.logger.info("No \"packageManager\" info found for \"#{name}\"")
+            version = check_engine_version(name)
+
+          elsif @package_manager&.==name.to_s
+            # if "packageManager" is found but no version is specified (i.e. pnpm@1.2.3),
+            # we check if we can get "engines" info to override default version
+            Dependabot.logger.info("Found \"packageManager\" : \"#{@package_manager}\"")
+            version = check_engine_version(name) if @engines
+
+          elsif @package_manager&.start_with?("#{name}@")
+            # if "packageManager" info has version specification i.e. yarn@3.3.1
+            # we go with the version in "packageManager"
+            Dependabot.logger.info("Found \"packageManager\" : \"#{@package_manager}\". Skipped checking \"engines\".")
+          end
+        else
+          return unless @package_manager.nil? || @package_manager&.start_with?("#{name}@")
+        end
+
+        version ||= requested_version(name)
 
         if version
           raise_if_unsupported!(name, version)
@@ -33,6 +68,8 @@ module Dependabot
 
         version
       end
+      # rubocop:enable Metrics/CyclomaticComplexity
+      # rubocop:enable Metrics/PerceivedComplexity
 
       private
 
@@ -44,6 +81,8 @@ module Dependabot
       end
 
       def install(name, version)
+        Dependabot.logger.info("Installing \"#{name}@#{version}\"")
+
         SharedHelpers.run_shell_command(
           "corepack install #{name}@#{version} --global --cache-only",
           fingerprint: "corepack install <name>@<version> --global --cache-only"
@@ -53,9 +92,10 @@ module Dependabot
       def requested_version(name)
         return unless @package_manager
 
-        match = @package_manager.match(/#{name}@(?<version>\d+.\d+.\d+)/)
+        match = @package_manager.match(/^#{name}@(?<version>\d+.\d+.\d+)/)
         return unless match
 
+        Dependabot.logger.info("Requested version #{match['version']}")
         match["version"]
       end
 
@@ -63,8 +103,24 @@ module Dependabot
         lockfile = @lockfiles[name.to_sym]
         return unless lockfile
 
+        Dependabot.logger.info("Estimating version")
         Helpers.send(:"#{name}_version_numeric", lockfile)
       end
+
+      sig { params(name: T.untyped).returns(T.nilable(String)) }
+      def check_engine_version(name)
+        version_selector = VersionSelector.new
+        engine_versions = version_selector.setup(@package_json, name)
+
+        if engine_versions.empty?
+          Dependabot.logger.info("No relevant (engines) info for \"#{name}\"")
+          return
+        end
+
+        version = engine_versions[name]
+        Dependabot.logger.info("Returned (engines) info \"#{name}\" : \"#{version}\"")
+        version
+      end
     end
   end
 end

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -329,6 +329,8 @@ module Dependabot
               password: password
             }
           )
+        rescue URI::InvalidURIError => e
+          raise DependencyFileNotResolvable, e.message
         end
 
         def check_npm_response(npm_response)

data/lib/dependabot/npm_and_yarn/update_checker/registry_finder.rb

@@ -90,6 +90,8 @@ module Dependabot
                    Excon::Error::Socket,
                    JSON::ParserError
               nil
+            rescue URI::InvalidURIError => e
+              raise DependencyFileNotResolvable, e.message
             end&.fetch("registry")
 
           @first_registry_with_dependency_details ||= global_registry.sub(%r{/+$}, "").sub(%r{^.*?//}, "")

data/lib/dependabot/npm_and_yarn/version_selector.rb

@@ -0,0 +1,45 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module NpmAndYarn
+    class VersionSelector
+      extend T::Sig
+      extend T::Helpers
+
+      # For limited testing, allowing only specific versions defined in engines in package.json
+      # such as "20.8.7", "8.1.2", "8.21.2",
+      NODE_ENGINE_SUPPORTED_REGEX = /^\d+(?:\.\d+)*$/
+
+      sig { params(manifest_json: T::Hash[String, T.untyped], name: String).returns(T::Hash[Symbol, T.untyped]) }
+      def setup(manifest_json, name)
+        engine_versions = manifest_json["engines"]
+
+        if engine_versions.nil?
+          Dependabot.logger.info("No info (engines) found")
+          return {}
+        end
+
+        # logs entries for analysis purposes
+        log = engine_versions.select do |engine, _value|
+          engine.to_s.match(name)
+        end
+        Dependabot.logger.info("Found engine info #{log}") unless log.empty?
+
+        # Only keep matching specs versions i.e. "20.21.2", "7.1.2",
+        # Additional specs can be added later
+        engine_versions.delete_if { |_key, value| !valid_extracted_version?(value) }
+        version = engine_versions.select { |engine, _value| engine.to_s.match(name) }
+
+        version
+      end
+
+      sig { params(version: String).returns(T::Boolean) }
+      def valid_extracted_version?(version)
+        version.match?(NODE_ENGINE_SUPPORTED_REGEX)
+      end
+    end
+  end
+end

data/lib/dependabot/npm_and_yarn.rb

@@ -160,6 +160,11 @@ module Dependabot
       AUTH_ERROR: /YN0001:*.*Fatal Error: could not read Username for '(?<url>.*)': terminal prompts disabled/
     }.freeze, T::Hash[String, Regexp])
 
+    YN0001_REQ_NOT_FOUND_CODES = T.let({
+      REQUIREMENT_NOT_SATISFIED: /provides (?<dep>.*)(.*?)with version (?<ver>.*), which doesn't satisfy what (?<pkg>.*) requests/, # rubocop:disable Layout/LineLength
+      REQUIREMENT_NOT_PROVIDED: /(?<dep>.*)(.*?)doesn't provide (?<pkg>.*)(.*?), requested by (?<parent>.*)/
+    }.freeze, T::Hash[String, Regexp])
+
     class Utils
       extend T::Sig
 
@@ -212,6 +217,13 @@ module Dependabot
               return Dependabot::PrivateSourceAuthenticationFailure.new(url)
             end
           end
+
+          YN0001_REQ_NOT_FOUND_CODES.each do |(_yn0001_key, yn0001_regex)|
+            if (msg = message.match(yn0001_regex))
+              return Dependabot::DependencyFileNotResolvable.new(msg)
+            end
+          end
+
           Dependabot::DependabotError.new(message)
         }
       },

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.274.0
+  version: 0.275.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-09-05 00:00:00.000000000 Z
+date: 2024-09-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.274.0
+        version: 0.275.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.274.0
+        version: 0.275.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -340,12 +340,13 @@ files:
 - lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb
 - lib/dependabot/npm_and_yarn/update_checker/vulnerability_auditor.rb
 - lib/dependabot/npm_and_yarn/version.rb
+- lib/dependabot/npm_and_yarn/version_selector.rb
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.274.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.275.0
 post_install_message: 
 rdoc_options: []
 require_paths: