dependabot-npm_and_yarn 0.275.0 → 0.277.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa9059df74fb7336b4718049555dedd8887c3d08add5cef44110728371612a41
-  data.tar.gz: 4abdcd71749994bbfd88b25e2bd33301debe86459dbe8205d30552475e7e3944
+  metadata.gz: 380c540d4ed17ab150738fc8390ce8bc995135c3c19bea687ebcca74d8f0010d
+  data.tar.gz: 294ba80ed94f2fb0981719516ce3eb44ccd537200c144507aac9903749db0f76
 SHA512:
-  metadata.gz: a5003914050f7914b55c3d77bba2b05c8905d6959b6a470b86ed029437a703d43436e05527fdbff63ca6d7f346c4ce891f46eada96920c0478e26152aa1eadb5
-  data.tar.gz: 50b3c80faf71ec749c0fe84ec8dd61c387450a5be7c7f5e01c8a2732ae2a776e11f71fb2e38cbc244f75a34ac754c404b58f02e0f55bb606b73f701872652ada
+  metadata.gz: 1525c5afa58bf9db6b4729e2c27c8b7efce4ba96e14fe2aee965e516da6baaee9a42e81a9339124adf307c3e314592b82bad971ab65f2d56b811b9705a018adf
+  data.tar.gz: 77e389af97a5f61b4ff3916826e46fc944c005e45f1485fd94c623e6a94d90a65d84997c4db215aa1262340a21ed0ecac1374faaddb45ea6bd8cad94f8dbdd82

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -107,6 +107,12 @@ module Dependabot
         # issue related when dependency url is not mentioned correctly
         UNRESOLVED_REFERENCE = /Unable to resolve reference (?<deps>.*)/
 
+        # npm git related error for dependencies
+        GIT_CHECKOUT_ERROR_REGEX = /Command failed: git checkout (?<sha>.*)/
+
+        # Invalid version format found for dependency in package.json file
+        INVALID_VERSION = /Invalid Version: (?<ver>.*)/
+
         # TODO: look into fixing this in npm, seems like a bug in the git
         # downloader introduced in npm 7
         #
@@ -616,6 +622,15 @@ module Dependabot
             raise Dependabot::DependencyFileNotResolvable, msg
           end
 
+          if (error_msg = error_message.match(GIT_CHECKOUT_ERROR_REGEX))
+            raise Dependabot::DependencyFileNotResolvable, error_msg
+          end
+
+          if (error_msg = error_message.match(INVALID_VERSION))
+            msg = "Found invalid version \"#{error_msg.named_captures.fetch('ver')}\" while updating"
+            raise Dependabot::DependencyFileNotResolvable, msg
+          end
+
           raise error
         end
         # rubocop:enable Metrics/AbcSize

data/lib/dependabot/npm_and_yarn/registry_parser.rb

@@ -45,7 +45,8 @@ module Dependabot
                      resolved_url
                    end
 
-        T.must(T.must(url_base[/@.*/]).gsub("%2F", "/").split("/")[0..1]).join("/")
+        package_name = url_base.gsub("%2F", "/").match(%r{@.*/})
+        "#{T.must(package_name)}#{T.must(url_base.gsub('%2F', '/').split('/').last)}"
       end
 
       private

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -17,15 +17,6 @@ module Dependabot
       class LatestVersionFinder
         extend T::Sig
 
-        class RegistryError < StandardError
-          attr_reader :status
-
-          def initialize(status, msg)
-            @status = status
-            super(msg)
-          end
-        end
-
         def initialize(dependency:, credentials:, dependency_files:,
                        ignored_versions:, security_advisories:,
                        raise_on_ignored: false)

data/lib/dependabot/npm_and_yarn.rb

@@ -165,6 +165,9 @@ module Dependabot
       REQUIREMENT_NOT_PROVIDED: /(?<dep>.*)(.*?)doesn't provide (?<pkg>.*)(.*?), requested by (?<parent>.*)/
     }.freeze, T::Hash[String, Regexp])
 
+    # registry returns malformed response
+    REGISTRY_NOT_REACHABLE = /Received malformed response from registry for "(?<ver>.*)". The registry may be down./
+
     class Utils
       extend T::Sig
 
@@ -580,6 +583,15 @@ module Dependabot
         },
         in_usage: false,
         matchfn: nil
+      },
+      {
+        patterns: [REGISTRY_NOT_REACHABLE],
+        handler: lambda { |message, _error, _params|
+          msg = message.match(REGISTRY_NOT_REACHABLE)
+          Dependabot::DependencyFileNotResolvable.new(msg)
+        },
+        in_usage: false,
+        matchfn: nil
       }
     ].freeze, T::Array[{
       patterns: T::Array[T.any(String, Regexp)],

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.275.0
+  version: 0.277.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-09-12 00:00:00.000000000 Z
+date: 2024-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.275.0
+        version: 0.277.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.275.0
+        version: 0.277.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -346,7 +346,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.275.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.277.0
 post_install_message: 
 rdoc_options: []
 require_paths: