dependabot-npm_and_yarn 0.335.0 → 0.336.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 346d7b71bd954f3c940145a417d0fc72b0d53bd9328d38cad95eee321b962b16
-  data.tar.gz: f146f1b02e2ad0f8cde7ab2c57a3bff0a2e6da7fca80d78a51c88f243461c58b
+  metadata.gz: c1f5a7696197e8b084dc928539e2e30ea83a4de52d3904cf0052ce396a56d614
+  data.tar.gz: d842f8c004efa137cce0ffe05e490a82c0e5765bf10fbcefb04e6a14b4288334
 SHA512:
-  metadata.gz: 44811e6584bcdf0aab4dd8bd5970fa8213d8a25c9e2c41656e02fc6bce9dca00fc039f6f8a36a7e7150fc8f68e4be63ca7ed129138109ba7d441a5dd92cd7177
-  data.tar.gz: 5669b41c7ad4b82807fbbed0142a4114f3c84a319b6133c6858311856824a53354ec09cfbb5d93feae3cf32c66b2e0a5989c643d554d6332140790b0005d1774
+  metadata.gz: 195a8dedb0d44acfd79a04d36bd874e954fa56ec327d1d099dae7dc3366913670710afbeba27db66a26ea60b5d4f5aeb9bfa3f7fc92041635894fc2f0ddfccbb
+  data.tar.gz: 852daa4c744e2565e3ae4fe4595d0065cbe472dc8275d5b4b3030f1ede85eb33b7bd5fe4a06fbe7cb04715fffac4b87baae448064c70e71bddae58c3bb5dc214

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -119,6 +119,13 @@ module Dependabot
         # Invalid version format found for dependency in package.json file
         INVALID_VERSION = /Invalid Version: (?<ver>.*)/
 
+        # Invalid package manager specification in package.json
+        INVALID_PACKAGE_MANAGER_SPEC = /Invalid package manager specification/
+
+        # Invalid npm authentication configuration
+        ERR_INVALID_AUTH = /npm error code ERR_INVALID_AUTH/
+        INVALID_AUTH_CONFIG = /Invalid auth configuration found.*_auth.*must be renamed to/
+
         # TODO: look into fixing this in npm, seems like a bug in the git
         # downloader introduced in npm 7
         #
@@ -613,6 +620,20 @@ module Dependabot
             raise Dependabot::DependencyFileNotResolvable, msg
           end
 
+          # Handle invalid package manager specification in package.json
+          if error_message.match?(INVALID_PACKAGE_MANAGER_SPEC)
+            msg = "Invalid package manager specification in package.json. " \
+                  "The packageManager field must specify a valid semver version"
+            raise Dependabot::DependencyFileNotResolvable, msg
+          end
+
+          if error_message.match?(ERR_INVALID_AUTH) || error_message.match?(INVALID_AUTH_CONFIG)
+            msg = "Invalid npm authentication configuration found " \
+                  "The _auth setting in .npmrc needs to be scoped to the specific registry." \
+                  "Please update your .npmrc configuration to use registry-specific auth settings."
+            raise Dependabot::PrivateSourceAuthenticationFailure, msg
+          end
+
           raise error
         end
         # rubocop:enable Metrics/AbcSize

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -22,11 +22,12 @@ module Dependabot
       NPM_DEFAULT_VERSION = NPM_V10
 
       # PNPM Version Constants
+      PNPM_V10 = 10
       PNPM_V9 = 9
       PNPM_V8 = 8
       PNPM_V7 = 7
       PNPM_V6 = 6
-      PNPM_DEFAULT_VERSION = PNPM_V9
+      PNPM_DEFAULT_VERSION = PNPM_V10
       PNPM_FALLBACK_VERSION = PNPM_V6
 
       # BUN Version Constants
@@ -107,7 +108,7 @@ module Dependabot
 
         pnpm_lockfile_version = pnpm_lockfile_version_str.to_f
 
-        return PNPM_V9 if pnpm_lockfile_version >= 9.0
+        return PNPM_V10 if pnpm_lockfile_version >= 9.0
         return PNPM_V8 if pnpm_lockfile_version >= 6.0
         return PNPM_V7 if pnpm_lockfile_version >= 5.4
 

data/lib/dependabot/npm_and_yarn/package_manager.rb

@@ -404,7 +404,7 @@ module Dependabot
         return unless name == PNPMPackageManager::NAME
         return unless Version.new(version) < Version.new("7")
 
-        raise ToolVersionNotSupported.new(PNPMPackageManager::NAME.upcase, version, "7.*, 8.*, 9.*")
+        raise ToolVersionNotSupported.new(PNPMPackageManager::NAME.upcase, version, "7.*, 8.*, 9.*, 10.*")
       end
 
       sig { params(name: String, version: T.nilable(String)).void }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.335.0
+  version: 0.336.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.335.0
+        version: 0.336.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.335.0
+        version: 0.336.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -362,7 +362,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.335.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.336.0
 rdoc_options: []
 require_paths:
 - lib