dependabot-npm_and_yarn 0.310.0 → 0.311.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a5cb78b6d6b57d7c62cd5ab60e63db0848277800d48ce32d3a6ea35d06955e9
-  data.tar.gz: 5180f0822f3bc3588db82562bc9273841651748b92a216aae5e94670e2efe916
+  metadata.gz: dd4ac6b246c4c95b8125e2770880b1f729276e4e01990de13e52a1a7fd1f9e6f
+  data.tar.gz: 33a4d9f4ea227d1eda55ce264e2a2aa19cf76b04a70b309368bbde7f55c40abe
 SHA512:
-  metadata.gz: 53a449f37470153cd80797d0fa6e6a8f48eb2eb3908d89e9b3f2e0f6217ec2eeca704638022525c2b1454919ee439c17221dc707a288628f398d1a43a84fb3d3
-  data.tar.gz: 60886b10224dcb526953f150f591e814c5333be22747cad39c8b2bee03122b64b252b8846b580d83493de5d9bc0dbd3bb8a80efbb21cc65737eb24dd0da31ab7
+  metadata.gz: 3e96d0e963c92f523a3e8c17a0d43461c519b89da2d2a7c06a9b155e0d4d9b4a9e7d7f5df712f1a94b9e00783f146b10ee6ad21c35639e6e1f23e0acec0ee625
+  data.tar.gz: c3d66d433a60a3b2e7ed64284be142c9dddd49a564ab0a10f1afe362f7975fdcd806c5aef04d3c8e0fa01d8ce3a882a2d03cd80c086a9ec9fea53634766b2bf5

data/lib/dependabot/npm_and_yarn/file_parser/json_lock.rb

@@ -35,7 +35,7 @@ module Dependabot
             .returns(T.nilable(T::Hash[String, T.untyped]))
         end
         def details(dependency_name, _requirement, manifest_name)
-          if Helpers.npm8?(@dependency_file)
+          if Helpers.parse_npm8?(@dependency_file)
             # NOTE: npm 8 sometimes doesn't install workspace dependencies in the
             # workspace folder so we need to fallback to checking top-level
             nested_details = parsed.dig("packages", node_modules_path(manifest_name, dependency_name))

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -248,22 +248,7 @@ module Dependabot
 
         sig { params(top_level_dependencies: T::Array[Dependabot::Dependency]).returns(T::Hash[String, String]) }
         def run_npm_top_level_updater(top_level_dependencies:)
-          if npm8?
-            run_npm8_top_level_updater(top_level_dependencies: top_level_dependencies)
-          else
-            T.cast(
-              SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
-                function: "npm6:update",
-                args: [
-                  Dir.pwd,
-                  lockfile_basename,
-                  top_level_dependencies.map(&:to_h)
-                ]
-              ),
-              T::Hash[String, String]
-            )
-          end
+          run_npm8_top_level_updater(top_level_dependencies: top_level_dependencies)
         end
 
         sig { params(top_level_dependencies: T::Array[Dependabot::Dependency]).returns(T::Hash[String, String]) }
@@ -301,18 +286,7 @@ module Dependabot
           params(sub_dependencies: T::Array[Dependabot::Dependency]).returns(T.nilable(T::Hash[String, String]))
         end
         def run_npm_subdependency_updater(sub_dependencies:)
-          if npm8?
-            run_npm8_subdependency_updater(sub_dependencies: sub_dependencies)
-          else
-            T.cast(
-              SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
-                function: "npm6:updateSubdependency",
-                args: [Dir.pwd, lockfile_basename, sub_dependencies.map(&:to_h)]
-              ),
-              T.nilable(T::Hash[String, String])
-            )
-          end
+          run_npm8_subdependency_updater(sub_dependencies: sub_dependencies)
         end
 
         sig { params(sub_dependencies: T::Array[Dependabot::Dependency]).returns(T::Hash[String, String]) }
@@ -894,8 +868,6 @@ module Dependabot
             .returns(String)
         end
         def restore_packages_name(updated_lockfile_content, parsed_updated_lockfile_content)
-          return updated_lockfile_content unless npm8?
-
           current_name = parsed_updated_lockfile_content.dig("packages", "", "name")
           original_name = parsed_lockfile.dig("packages", "", "name")
 
@@ -973,8 +945,6 @@ module Dependabot
             .returns(String)
         end
         def restore_locked_package_dependencies(updated_lockfile_content, parsed_updated_lockfile_content)
-          return updated_lockfile_content unless npm8?
-
           dependency_names_to_restore = (dependencies.map(&:name) + git_dependencies_to_lock.keys).uniq
 
           NpmAndYarn::FileParser.each_dependency(parsed_package_json) do |dependency_name, original_requirement, type|
@@ -1014,14 +984,8 @@ module Dependabot
             # updates the lockfile "from" field to the new git commit when we
             # run npm install
             original_from = %("from": "#{details[:from]}")
-            if npm8?
-              # NOTE: The `from` syntax has changed in npm 7 to include the dependency name
-              npm8_locked_from = %("from": "#{dependency_name}@#{details[:version]}")
-              updated_lockfile_content = updated_lockfile_content.gsub(npm8_locked_from, original_from)
-            else
-              npm6_locked_from = %("from": "#{details[:version]}")
-              updated_lockfile_content = updated_lockfile_content.gsub(npm6_locked_from, original_from)
-            end
+            npm8_locked_from = %("from": "#{dependency_name}@#{details[:version]}")
+            updated_lockfile_content = updated_lockfile_content.gsub(npm8_locked_from, original_from)
           end
 
           updated_lockfile_content
@@ -1103,16 +1067,6 @@ module Dependabot
           npmrc_content.match?(/^package-lock\s*=\s*false/)
         end
 
-        sig { returns(T::Boolean) }
-        def npm8?
-          return T.must(@npm8) if defined?(@npm8)
-
-          @npm8 ||= T.let(
-            Dependabot::NpmAndYarn::Helpers.npm8?(lockfile),
-            T.nilable(T::Boolean)
-          )
-        end
-
         sig { params(package_name: String).returns(String) }
         def sanitize_package_name(package_name)
           package_name.gsub("%2f", "/").gsub("%2F", "/")

data/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/npm_and_yarn/helpers"
@@ -9,24 +9,47 @@ require "dependabot/shared_helpers"
 module Dependabot
   module NpmAndYarn
     class FileUpdater < Dependabot::FileUpdaters::Base
+      # rubocop:disable Metrics/ClassLength
       class PnpmLockfileUpdater
+        extend T::Sig
+
         require_relative "npmrc_builder"
         require_relative "package_json_updater"
 
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            repo_contents_path: T.nilable(String),
+            credentials: T::Array[Dependabot::Credential]
+          ).void
+        end
         def initialize(dependencies:, dependency_files:, repo_contents_path:, credentials:)
           @dependencies = dependencies
           @dependency_files = dependency_files
           @repo_contents_path = repo_contents_path
           @credentials = credentials
-          @error_handler = PnpmErrorHandler.new(
-            dependencies: dependencies,
-            dependency_files: dependency_files
+          @error_handler = T.let(
+            PnpmErrorHandler.new(
+              dependencies: dependencies,
+              dependency_files: dependency_files
+            ),
+            PnpmErrorHandler
           )
         end
 
+        sig do
+          params(
+            pnpm_lock: Dependabot::DependencyFile,
+            updated_pnpm_workspace_content: T.nilable(T::Hash[String, T.nilable(String)])
+          ).returns(String)
+        end
         def updated_pnpm_lock_content(pnpm_lock, updated_pnpm_workspace_content: nil)
-          @updated_pnpm_lock_content ||= {}
-          return @updated_pnpm_lock_content[pnpm_lock.name] if @updated_pnpm_lock_content[pnpm_lock.name]
+          @updated_pnpm_lock_content ||= T.let(
+            {},
+            T.nilable(T::Hash[String, String])
+          )
+          return T.must(@updated_pnpm_lock_content[pnpm_lock.name]) if @updated_pnpm_lock_content[pnpm_lock.name]
 
           new_content = run_pnpm_update(
             pnpm_lock: pnpm_lock,
@@ -39,10 +62,19 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T.nilable(String)) }
         attr_reader :repo_contents_path
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(PnpmErrorHandler) }
         attr_reader :error_handler
 
         IRRESOLVABLE_PACKAGE = "ERR_PNPM_NO_MATCHING_VERSION"
@@ -103,6 +135,13 @@ module Dependabot
         # Peer dependencies configuration error
         ERR_PNPM_PEER_DEP_ISSUES = /ERR_PNPM_PEER_DEP_ISSUES/
 
+        sig do
+          params(
+            pnpm_lock: Dependabot::DependencyFile,
+            updated_pnpm_workspace_content: T.nilable(T::Hash[String, T.nilable(String)])
+          )
+            .returns(String)
+        end
         def run_pnpm_update(pnpm_lock:, updated_pnpm_workspace_content: nil)
           SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
             File.write(".npmrc", npmrc_content(pnpm_lock))
@@ -122,6 +161,7 @@ module Dependabot
           end
         end
 
+        sig { returns(T.nilable(String)) }
         def run_pnpm_update_packages
           dependency_updates = dependencies.map do |d|
             "#{d.name}@#{d.version}"
@@ -133,18 +173,24 @@ module Dependabot
           )
         end
 
+        sig { returns(T.nilable(String)) }
         def run_pnpm_install
           Helpers.run_pnpm_command(
             "install --lockfile-only"
           )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def workspace_files
-          @workspace_files ||= dependency_files.select { |f| f.name.end_with?("pnpm-workspace.yaml") }
+          @workspace_files ||= T.let(
+            dependency_files.select { |f| f.name.end_with?("pnpm-workspace.yaml") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { params(lockfile: Dependabot::DependencyFile).returns(T::Array[Dependabot::Dependency]) }
         def lockfile_dependencies(lockfile)
-          @lockfile_dependencies ||= {}
+          @lockfile_dependencies ||= T.let({}, T.nilable(T::Hash[String, T::Array[Dependabot::Dependency]]))
           @lockfile_dependencies[lockfile.name] ||=
             NpmAndYarn::FileParser.new(
               dependency_files: [lockfile, *package_files, *workspace_files],
@@ -157,6 +203,13 @@ module Dependabot
         # rubocop:disable Metrics/PerceivedComplexity
         # rubocop:disable Metrics/MethodLength
         # rubocop:disable Metrics/CyclomaticComplexity
+        sig do
+          params(
+            error: SharedHelpers::HelperSubprocessFailed,
+            pnpm_lock: Dependabot::DependencyFile
+          )
+            .returns(T.noreturn)
+        end
         def handle_pnpm_lock_updater_error(error, pnpm_lock)
           error_message = error.message
 
@@ -165,15 +218,15 @@ module Dependabot
           end
 
           if error_message.match?(UNREACHABLE_GIT)
-            url = error_message.match(UNREACHABLE_GIT).named_captures.fetch("url").gsub("git+ssh://git@", "https://").delete_suffix(".git")
+            url = error_message.match(UNREACHABLE_GIT)&.named_captures&.fetch("url")&.gsub("git+ssh://git@", "https://")&.delete_suffix(".git")
 
-            raise Dependabot::GitDependenciesNotReachable, url
+            raise Dependabot::GitDependenciesNotReachable, T.must(url)
           end
 
           if error_message.match?(UNREACHABLE_GIT_V8)
-            url = error_message.match(UNREACHABLE_GIT_V8).named_captures.fetch("url").gsub("codeload.", "")
+            url = error_message.match(UNREACHABLE_GIT_V8)&.named_captures&.fetch("url")&.gsub("codeload.", "")
 
-            raise Dependabot::GitDependenciesNotReachable, url
+            raise Dependabot::GitDependenciesNotReachable, T.must(url)
           end
 
           [FORBIDDEN_PACKAGE, MISSING_PACKAGE, UNAUTHORIZED_PACKAGE, ERR_PNPM_FETCH_401,
@@ -181,14 +234,13 @@ module Dependabot
             .each do |regexp|
             next unless error_message.match?(regexp)
 
-            dependency_url = error_message.match(regexp).named_captures["dependency_url"]
+            dependency_url = T.must(error_message.match(regexp)&.named_captures&.[]("dependency_url"))
             raise_package_access_error(error_message, dependency_url, pnpm_lock)
           end
 
           # TO-DO : subclassifcation of ERR_PNPM_TARBALL_INTEGRITY errors
           if error_message.match?(ERR_PNPM_TARBALL_INTEGRITY)
             dependency_names = dependencies.map(&:name).join(", ")
-
             msg = "Error (ERR_PNPM_TARBALL_INTEGRITY) while resolving \"#{dependency_names}\"."
             Dependabot.logger.warn(error_message)
             raise Dependabot::DependencyFileNotResolvable, msg
@@ -197,20 +249,17 @@ module Dependabot
           # TO-DO : investigate "packageManager" allowed regex
           if error_message.match?(INVALID_PACKAGE_SPEC)
             dependency_names = dependencies.map(&:name).join(", ")
-
             msg = "Invalid package manager specification in package.json while resolving \"#{dependency_names}\"."
             raise Dependabot::DependencyFileNotResolvable, msg
           end
 
           if error_message.match?(ERR_PNPM_META_FETCH_FAIL)
-
             msg = error_message.split(ERR_PNPM_META_FETCH_FAIL).last
             raise Dependabot::DependencyFileNotResolvable, msg
           end
 
           if error_message.match?(ERR_PNPM_WORKSPACE_PKG_NOT_FOUND)
             dependency_names = dependencies.map(&:name).join(", ")
-
             msg = "No package named \"#{dependency_names}\" present in workspace."
             Dependabot.logger.warn(error_message)
             raise Dependabot::DependencyFileNotResolvable, msg
@@ -223,8 +272,8 @@ module Dependabot
           end
 
           if error_message.match?(ERR_PNPM_LINKED_PKG_DIR_NOT_FOUND)
-            dir = error_message.match(ERR_PNPM_LINKED_PKG_DIR_NOT_FOUND).named_captures.fetch("dir")
-            msg = "Could not find linked package installation directory \"#{dir.split('/').last}\""
+            dir = error_message.match(ERR_PNPM_LINKED_PKG_DIR_NOT_FOUND)&.named_captures&.fetch("dir")
+            msg = "Could not find linked package installation directory \"#{dir&.split('/')&.last}\""
             raise Dependabot::DependencyFileNotResolvable, msg
           end
 
@@ -246,13 +295,11 @@ module Dependabot
 
           if error_message.match?(ERR_PNPM_PEER_DEP_ISSUES)
             msg = "Missing or invalid configuration while installing peer dependencies."
-
             Dependabot.logger.warn(error_message)
             raise Dependabot::DependencyFileNotResolvable, msg
           end
 
           raise_patch_dependency_error(error_message) if error_message.match?(ERR_PNPM_PATCH_NOT_APPLIED)
-
           raise_unsupported_engine_error(error_message, pnpm_lock) if error_message.match?(ERR_PNPM_UNSUPPORTED_ENGINE)
 
           if error_message.match?(ERR_INVALID_THIS) && error_message.match?(URL_SEARCH_PARAMS)
@@ -262,8 +309,7 @@ module Dependabot
           end
 
           if error_message.match?(ERR_PNPM_UNSUPPORTED_PLATFORM)
-            raise_unsupported_platform_error(error_message,
-                                             pnpm_lock)
+            raise_unsupported_platform_error(error_message, pnpm_lock)
           end
 
           error_handler.handle_pnpm_error(error)
@@ -275,6 +321,7 @@ module Dependabot
         # rubocop:enable Metrics/MethodLength
         # rubocop:enable Metrics/CyclomaticComplexity
 
+        sig { params(error_message: String, pnpm_lock: Dependabot::DependencyFile).returns(T.noreturn) }
         def raise_resolvability_error(error_message, pnpm_lock)
           dependency_names = dependencies.map(&:name).join(", ")
           msg = "Error whilst updating #{dependency_names} in " \
@@ -282,6 +329,7 @@ module Dependabot
           raise Dependabot::DependencyFileNotResolvable, msg
         end
 
+        sig { params(error_message: String).returns(T.noreturn) }
         def raise_patch_dependency_error(error_message)
           dependency_names = dependencies.map(&:name).join(", ")
           msg = "Error while updating \"#{dependency_names}\" in " \
@@ -290,21 +338,50 @@ module Dependabot
           raise Dependabot::DependencyFileNotResolvable, msg
         end
 
+        sig do
+          params(
+            error_message: String,
+            _pnpm_lock: Dependabot::DependencyFile
+          ).returns(T.nilable(T.noreturn))
+        end
         def raise_unsupported_engine_error(error_message, _pnpm_lock)
-          unless error_message.match(PACAKGE_MANAGER) &&
-                 error_message.match(VERSION_REQUIREMENT)
-            return
+          match_pkg_mgr = error_message.match(PACAKGE_MANAGER)
+          match_version = error_message.match(VERSION_REQUIREMENT)
+
+          unless match_pkg_mgr && match_version &&
+                 match_pkg_mgr.named_captures && match_version.named_captures
+            return nil
           end
 
-          package_manager = error_message.match(PACAKGE_MANAGER).named_captures["pkg_mgr"]
-          supported_version = error_message.match(VERSION_REQUIREMENT).named_captures["supported_ver"]
-          detected_version = error_message.match(VERSION_REQUIREMENT).named_captures["detected_ver"]
+          captures_pkg_mgr = match_pkg_mgr.named_captures
+          captures_version = match_version.named_captures
+
+          pkg_mgr = captures_pkg_mgr["pkg_mgr"]
+          supported_ver = captures_version["supported_ver"]
+          detected_ver = captures_version["detected_ver"]
+
+          if pkg_mgr && supported_ver && detected_ver
+            raise Dependabot::ToolVersionNotSupported.new(
+              pkg_mgr,
+              supported_ver,
+              detected_ver
+            )
+          end
 
-          raise Dependabot::ToolVersionNotSupported.new(package_manager, supported_version, detected_version)
+          nil
         end
 
+        sig do
+          params(
+            error_message: String,
+            dependency_url: String,
+            pnpm_lock: Dependabot::DependencyFile
+          )
+            .returns(T.noreturn)
+        end
         def raise_package_access_error(error_message, dependency_url, pnpm_lock)
-          package_name = RegistryParser.new(resolved_url: dependency_url, credentials: credentials).dependency_name
+          package_name = RegistryParser.new(resolved_url: dependency_url,
+                                            credentials: credentials).dependency_name
           missing_dep = lockfile_dependencies(pnpm_lock)
                         .find { |dep| dep.name == package_name }
           raise DependencyNotFound, package_name unless missing_dep
@@ -318,6 +395,7 @@ module Dependabot
           raise PrivateSourceAuthenticationFailure, reg
         end
 
+        sig { void }
         def write_final_package_json_files
           package_files.each do |file|
             path = file.name
@@ -326,57 +404,88 @@ module Dependabot
           end
         end
 
+        sig do
+          params(
+            error_message: String,
+            _pnpm_lock: Dependabot::DependencyFile
+          )
+            .returns(T.nilable(T.noreturn))
+        end
         def raise_unsupported_platform_error(error_message, _pnpm_lock)
-          unless error_message.match(PLATFORM_PACAKGE_DEP) &&
-                 error_message.match(PLATFORM_VERSION_REQUIREMENT)
-            return
+          match_dep = error_message.match(PLATFORM_PACAKGE_DEP)
+          match_version = error_message.match(PLATFORM_VERSION_REQUIREMENT)
+
+          unless match_dep && match_version &&
+                 match_dep.named_captures && match_version.named_captures
+            return nil
           end
 
-          supported_version = error_message.match(PLATFORM_VERSION_REQUIREMENT)
-                                           .named_captures["supported_ver"]
-                                           .then { sanitize_message(_1) }
-          detected_version = error_message.match(PLATFORM_VERSION_REQUIREMENT)
-                                          .named_captures["detected_ver"]
-                                          .then { sanitize_message(_1) }
+          captures_version = match_version.named_captures
 
-          Dependabot.logger.warn(error_message)
-          raise Dependabot::ToolVersionNotSupported.new(PLATFORM_PACAKGE_MANAGER, supported_version, detected_version)
+          supported_ver = captures_version["supported_ver"]
+          detected_ver = captures_version["detected_ver"]
+
+          if supported_ver && detected_ver
+            supported_version = sanitize_message(supported_ver)
+            detected_version = sanitize_message(detected_ver)
+
+            Dependabot.logger.warn(error_message)
+            raise Dependabot::ToolVersionNotSupported.new(
+              PLATFORM_PACAKGE_MANAGER,
+              supported_version,
+              detected_version
+            )
+          end
+
+          nil
         end
 
+        sig { params(pnpm_lock: Dependabot::DependencyFile).returns(String) }
         def npmrc_content(pnpm_lock)
           NpmrcBuilder.new(
-            credentials: credentials,
+            credentials: T.unsafe(credentials),
             dependency_files: dependency_files,
             dependencies: lockfile_dependencies(pnpm_lock)
           ).npmrc_content
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
         def updated_package_json_content(file)
-          @updated_package_json_content ||= {}
+          @updated_package_json_content ||= T.let({}, T.nilable(T::Hash[String, String]))
           @updated_package_json_content[file.name] ||=
-            PackageJsonUpdater.new(
-              package_json: file,
-              dependencies: dependencies
-            ).updated_package_json.content
+            T.must(
+              PackageJsonUpdater.new(
+                package_json: file,
+                dependencies: dependencies
+              ).updated_package_json.content
+            )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def package_files
-          @package_files ||= dependency_files.select { |f| f.name.end_with?("package.json") }
+          @package_files ||= T.let(
+            dependency_files.select { |f| f.name.end_with?("package.json") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(String) }
         def base_dir
-          dependency_files.first.directory
+          T.must(dependency_files.first).directory
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def npmrc_file
           dependency_files.find { |f| f.name == ".npmrc" }
         end
 
+        sig { params(message: String).returns(String) }
         def sanitize_message(message)
           message.gsub(/"|\[|\]|\}|\{/, "")
         end
       end
     end
+    # rubocop:enable Metrics/ClassLength
 
     class PnpmErrorHandler
       extend T::Sig
@@ -400,7 +509,8 @@ module Dependabot
         params(
           dependencies: T::Array[Dependabot::Dependency],
           dependency_files: T::Array[Dependabot::DependencyFile]
-        ).void
+        )
+          .void
       end
       def initialize(dependencies:, dependency_files:)
         @dependencies = dependencies

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -43,39 +43,17 @@ module Dependabot
       # corepack supported package managers
       SUPPORTED_COREPACK_PACKAGE_MANAGERS = %w(npm yarn pnpm).freeze
 
-      # Determines the npm version depends to the feature flag
-      # If the feature flag is enabled, we are going to use the minimum version npm 8
-      # Otherwise, we are going to use old versionining npm 6
       sig { params(lockfile: T.nilable(DependencyFile)).returns(Integer) }
       def self.npm_version_numeric(lockfile)
-        fallback_version_npm8 = Dependabot::Experiments.enabled?(:npm_fallback_version_above_v6)
+        detected_npm_version = detect_npm_version(lockfile)
 
-        return npm_version_numeric_npm8_or_higher(lockfile) if fallback_version_npm8
+        return NPM_DEFAULT_VERSION if detected_npm_version.nil? || detected_npm_version == NPM_V6
 
-        npm_version_numeric_npm6_or_higher(lockfile)
+        detected_npm_version
       end
 
-      sig { params(lockfile: T.nilable(DependencyFile)).returns(Integer) }
-      def self.npm_version_numeric_npm6_or_higher(lockfile)
-        lockfile_content = lockfile&.content
-
-        if lockfile_content.nil? ||
-           lockfile_content.strip.empty? ||
-           JSON.parse(lockfile_content)["lockfileVersion"].to_i >= 2
-          return NPM_V8
-        end
-
-        NPM_V6
-      rescue JSON::ParserError
-        NPM_V6
-      end
-
-      # Determines the npm version based on the lockfile version
-      # - NPM 7 uses lockfileVersion 2
-      # - NPM 8 uses lockfileVersion 2
-      # - NPM 9 uses lockfileVersion 3
-      sig { params(lockfile: T.nilable(DependencyFile)).returns(Integer) }
-      def self.npm_version_numeric_npm8_or_higher(lockfile)
+      sig { params(lockfile: T.nilable(DependencyFile)).returns(T.nilable(Integer)) }
+      def self.detect_npm_version(lockfile)
         lockfile_content = lockfile&.content
 
         # Return default NPM version if there's no lockfile or it's empty
@@ -94,40 +72,13 @@ module Dependabot
         # Update needed to support npm 9+ based on lockfile version.
         return NPM_V8 if lockfile_version >= 2
 
-        NPM_DEFAULT_VERSION
+        NPM_V6 if lockfile_version >= 1
+        # Return nil if can't capture
       rescue JSON::ParserError
         NPM_DEFAULT_VERSION # Fallback to default npm version if parsing fails
       end
 
-      # rubocop:disable Metrics/PerceivedComplexity
-      sig { params(lockfile: T.nilable(DependencyFile)).returns(Integer) }
-      def self.npm_version_numeric_latest(lockfile)
-        lockfile_content = lockfile&.content
-
-        # Return npm 10 as the default if the lockfile is missing or empty
-        return NPM_V10 if lockfile_content.nil? || lockfile_content.strip.empty?
-
-        # Parse the lockfile content to extract the `lockfileVersion`
-        parsed_lockfile = JSON.parse(lockfile_content)
-        lockfile_version = parsed_lockfile["lockfileVersion"]&.to_i
-
-        # Determine the appropriate npm version based on `lockfileVersion`
-        if lockfile_version.nil?
-          NPM_V10 # Use npm 10 if `lockfileVersion` is missing or nil
-        elsif lockfile_version >= 3
-          NPM_V10 # Use npm 10 for lockfileVersion 3 or higher
-        elsif lockfile_version >= 2
-          NPM_V8 # Use npm 8 for lockfileVersion 2
-        elsif lockfile_version >= 1
-          # Use npm 8 if the fallback version flag is enabled, otherwise use npm 6
-          Dependabot::Experiments.enabled?(:npm_fallback_version_above_v6) ? NPM_V8 : NPM_V6
-        else
-          NPM_V10 # Default to npm 10 for unexpected or unsupported versions
-        end
-      rescue JSON::ParserError
-        NPM_V8 # Fallback to npm 8 if the lockfile content cannot be parsed
-      end
-      # rubocop:enable Metrics/PerceivedComplexity
+      private_class_method :detect_npm_version
 
       sig { params(yarn_lock: T.nilable(DependencyFile)).returns(Integer) }
       def self.yarn_version_numeric(yarn_lock)
@@ -179,10 +130,12 @@ module Dependabot
       end
 
       sig { params(package_lock: T.nilable(DependencyFile)).returns(T::Boolean) }
-      def self.npm8?(package_lock)
+      def self.parse_npm8?(package_lock)
         return true unless package_lock&.content
 
-        npm_version_numeric(package_lock) == NPM_V8
+        detected_npm = detect_npm_version(package_lock)
+        # For conversion reading properly from npm 6 lockfile we need to check if detected version is npm 6
+        detected_npm.nil? || detected_npm != NPM_V6
       end
 
       sig { params(yarn_lock: T.nilable(DependencyFile)).returns(T::Boolean) }

data/lib/dependabot/npm_and_yarn/metadata_finder.rb

@@ -129,15 +129,20 @@ module Dependabot
 
       sig do
         params(
-          details: T.nilable(T.any(String, T::Hash[String, T.untyped]))
-        )
-          .returns(T.nilable(String))
+          details: T.nilable(T.any(String, T::Array[String], T::Hash[String, String]))
+        ).returns(T.nilable(String))
       end
       def get_url(details)
+        return unless details
+
         url =
           case details
           when String then details
           when Hash then details.fetch("url", nil)
+          when Array
+            # Try to find the first valid URL string, and if not, return the first string (even if it isn't a URL)
+            details.find { |d| d.is_a?(String) && d.match?(%r{^[\w.-]+/[\w.-]+$}) } ||
+            details.find { |d| d.is_a?(String) }
           end
         return url unless url&.match?(%r{^[\w.-]+/[\w.-]+$})
 
@@ -215,6 +220,9 @@ module Dependabot
             new_source&.fetch(:url)
           end
 
+        # spaces must be escaped in base URL
+        registry_url = registry_url.gsub(" ", "%20")
+
         # NPM registries expect slashes to be escaped
         escaped_dependency_name = dependency.name.gsub("/", "%2F")
         "#{registry_url}/#{escaped_dependency_name}"

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/dependency"
@@ -12,11 +12,42 @@ require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/npm_and_yarn/update_checker/dependency_files_builder"
 require "dependabot/npm_and_yarn/version"
 require "dependabot/shared_helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module NpmAndYarn
     class UpdateChecker
       class SubdependencyVersionResolver
+        extend T::Sig
+
+        sig { returns(Dependency) }
+        attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :dependency_files
+
+        sig { returns(T::Array[String]) }
+        attr_reader :ignored_versions
+
+        sig { returns(T.nilable(T.any(String, Gem::Version))) }
+        attr_reader :latest_allowable_version
+
+        sig { returns(T.nilable(String)) }
+        attr_reader :repo_contents_path
+
+        sig do
+          params(
+            dependency: Dependency,
+            credentials: T::Array[Dependabot::Credential],
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            ignored_versions: T::Array[String],
+            latest_allowable_version: T.nilable(T.any(String, Gem::Version)),
+            repo_contents_path: T.nilable(String)
+          ).void
+        end
         def initialize(dependency:, credentials:, dependency_files:,
                        ignored_versions:, latest_allowable_version:, repo_contents_path:)
           @dependency = dependency
@@ -27,11 +58,12 @@ module Dependabot
           @repo_contents_path = repo_contents_path
         end
 
+        sig { returns(T.nilable(T.any(String, Gem::Version))) }
         def latest_resolvable_version
           raise "Not a subdependency!" if dependency.requirements.any?
           return if bundled_dependency?
 
-          base_dir = dependency_files.first.directory
+          base_dir = T.must(dependency_files.first).directory
           SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
             dependency_files_builder.write_temporary_dependency_files
 
@@ -53,13 +85,7 @@ module Dependabot
 
         private
 
-        attr_reader :dependency
-        attr_reader :credentials
-        attr_reader :dependency_files
-        attr_reader :ignored_versions
-        attr_reader :latest_allowable_version
-        attr_reader :repo_contents_path
-
+        sig { params(lockfile: Dependabot::DependencyFile).returns(String) }
         def update_subdependency_in_lockfile(lockfile)
           lockfile_name = Pathname.new(lockfile.name).basename.to_s
           path = Pathname.new(lockfile.name).dirname.to_s
@@ -72,7 +98,7 @@ module Dependabot
                             run_pnpm_updater(path, lockfile_name)
                           elsif lockfile.name.end_with?("bun.lock")
                             run_bun_updater(path, lockfile_name)
-                          elsif !Helpers.npm8?(lockfile)
+                          elsif !Helpers.parse_npm8?(lockfile)
                             run_npm6_updater(path, lockfile_name)
                           else
                             run_npm_updater(path, lockfile_name)
@@ -81,6 +107,7 @@ module Dependabot
           updated_files.fetch(lockfile_name)
         end
 
+        sig { params(updated_lockfiles: T::Array[Dependabot::DependencyFile]).returns(T.nilable(Gem::Version)) }
         def version_from_updated_lockfiles(updated_lockfiles)
           updated_files = dependency_files -
                           dependency_files_builder.lockfiles +
@@ -96,13 +123,17 @@ module Dependabot
           version_class.new(updated_version)
         end
 
+        sig { params(path: String, lockfile_name: String).returns(T::Hash[String, String]) }
         def run_yarn_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
-              SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
-                function: "yarn:updateSubdependency",
-                args: [Dir.pwd, lockfile_name, [dependency.to_h]]
+              T.cast(
+                SharedHelpers.run_helper_subprocess(
+                  command: NativeHelpers.helper_path,
+                  function: "yarn:updateSubdependency",
+                  args: [Dir.pwd, lockfile_name, [dependency.to_h]]
+                ),
+                T::Hash[String, String]
               )
             end
           end
@@ -121,6 +152,7 @@ module Dependabot
           retry
         end
 
+        sig { params(path: String, lockfile_name: String).returns(T::Hash[String, String]) }
         def run_yarn_berry_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
@@ -133,6 +165,7 @@ module Dependabot
           end
         end
 
+        sig { params(path: String, lockfile_name: String).returns(T::Hash[String, String]) }
         def run_pnpm_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
@@ -145,6 +178,7 @@ module Dependabot
           end
         end
 
+        sig { params(path: String, lockfile_name: String).returns(T::Hash[String, String]) }
         def run_npm_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
@@ -155,6 +189,7 @@ module Dependabot
           end
         end
 
+        sig { params(path: String, lockfile_name: String).returns(T::Hash[String, String]) }
         def run_bun_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
@@ -167,6 +202,7 @@ module Dependabot
           end
         end
 
+        sig { params(path: String, lockfile_name: String).returns(T::Hash[String, String]) }
         def run_npm6_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
@@ -179,53 +215,46 @@ module Dependabot
           end
         end
 
+        sig { returns(T.class_of(Dependabot::Version)) }
         def version_class
           dependency.version_class
         end
 
+        sig { returns(Dependabot::Dependency) }
         def updated_dependency
           Dependabot::Dependency.new(
             name: dependency.name,
-            version: latest_allowable_version,
+            version: T.cast(latest_allowable_version, T.nilable(T.any(String, Dependabot::Version))),
             previous_version: dependency.version,
             requirements: [],
             package_manager: dependency.package_manager
           )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def filtered_lockfiles
-          @filtered_lockfiles ||=
+          @filtered_lockfiles ||= T.let(
             SubDependencyFilesFilterer.new(
               dependency_files: dependency_files,
               updated_dependencies: [updated_dependency]
-            ).files_requiring_update
+            ).files_requiring_update,
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(Dependabot::NpmAndYarn::UpdateChecker::DependencyFilesBuilder) }
         def dependency_files_builder
-          @dependency_files_builder ||=
+          @dependency_files_builder ||= T.let(
             DependencyFilesBuilder.new(
               dependency: dependency,
               dependency_files: dependency_files,
               credentials: credentials
-            )
-        end
-
-        # TODO: We should try and fix this by updating the parent that's not
-        # bundled. For this case: `chokidar > fsevents > node-pre-gyp > tar` we
-        # would need to update `fsevents`
-        #
-        # We shouldn't update bundled sub-dependencies as they have been bundled
-        # into the release at an exact version by a parent using
-        # `bundledDependencies`.
-        #
-        # For example, fsevents < 2 bundles node-pre-gyp meaning all it's
-        # sub-dependencies get bundled into the release tarball at publish time
-        # so you always get the same sub-dependency versions if you re-install a
-        # specific version of fsevents.
-        #
-        # Updating the sub-dependency by deleting the entry works but it gets
-        # removed from the bundled set of dependencies and moved top level
-        # resulting in a bunch of package duplication which is pretty confusing.
+            ),
+            T.nilable(Dependabot::NpmAndYarn::UpdateChecker::DependencyFilesBuilder)
+          )
+        end
+
+        sig { returns(T::Boolean) }
         def bundled_dependency?
           dependency.subdependency_metadata
                     &.any? { |h| h.fetch(:npm_bundled, false) } ||

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -825,7 +825,7 @@ module Dependabot
                 f.name == [path, "package-lock.json"].join("/").sub(%r{\A.?\/}, "")
               end
 
-              return run_npm8_checker(version: version) if Dependabot::NpmAndYarn::Helpers.npm8?(package_lock)
+              return run_npm8_checker(version: version) if Dependabot::NpmAndYarn::Helpers.parse_npm8?(package_lock)
 
               SharedHelpers.run_helper_subprocess(
                 command: NativeHelpers.helper_path,

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -43,7 +43,7 @@ module Dependabot
                      requirements_update_strategy: nil, dependency_group: nil,
                      update_cooldown: nil, options: {})
         @latest_version = T.let(nil, T.nilable(T.any(String, Gem::Version)))
-        @latest_resolvable_version = T.let(nil, T.nilable(T.any(String, Gem::Version)))
+        @latest_resolvable_version = T.let(nil, T.nilable(T.any(String, Dependabot::Version)))
         @updated_requirements = T.let(nil, T.nilable(T::Array[T::Hash[Symbol, T.untyped]]))
         @vulnerability_audit = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
         @vulnerable_versions = T.let(nil, T.nilable(T::Array[T.any(String, Gem::Version)]))
@@ -88,17 +88,23 @@ module Dependabot
           end
       end
 
-      sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_resolvable_version
         return unless latest_version
 
         @latest_resolvable_version ||=
           if dependency.top_level?
-            version_resolver.latest_resolvable_version
+            T.cast(
+              version_resolver.latest_resolvable_version,
+              T.nilable(T.any(String, Dependabot::Version))
+            )
           else
             # If the dependency is indirect its version is constrained  by the
             # requirements placed on it by dependencies lower down the tree
-            subdependency_version_resolver.latest_resolvable_version
+            T.cast(
+              subdependency_version_resolver.latest_resolvable_version,
+              T.nilable(T.any(String, Dependabot::Version))
+            )
           end
       end
 
@@ -133,7 +139,11 @@ module Dependabot
 
       sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_resolvable_version_with_no_unlock
-        return latest_resolvable_version unless dependency.top_level?
+        unless dependency.top_level?
+          # TODO: We should use `Dependabot::Version` everywhere
+          return T.cast(latest_resolvable_version,
+                        T.nilable(T.any(String, Dependabot::Version)))
+        end
 
         return latest_resolvable_version_with_no_unlock_for_git_dependency if git_dependency?
 

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.310.0
+  version: 0.311.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-04-24 00:00:00.000000000 Z
+date: 2025-05-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.310.0
+        version: 0.311.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.310.0
+        version: 0.311.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -223,16 +223,16 @@ dependencies:
   name: webrick
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
 description: Dependabot-NPM_And_Yarn provides support for bumping Javascript (npm
   and yarn) libraries via Dependabot. If you want support for multiple package managers,
   you probably want the meta-gem dependabot-omnibus.
@@ -356,7 +356,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.310.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.311.0
 rdoc_options: []
 require_paths:
 - lib