dependabot-npm_and_yarn 0.351.0 → 0.352.0

data/helpers/package.json

@@ -21,9 +21,9 @@
     "patch-package": "^8.0.0"
   },
   "devDependencies": {
-    "eslint": "^9.31.0",
+    "eslint": "^9.39.1",
     "eslint-config-prettier": "^10.1.8",
-    "jest": "^30.0.5",
-    "prettier": "^3.6.2"
+    "jest": "^30.2.0",
+    "prettier": "^3.7.4"
   }
 }

data/lib/dependabot/npm_and_yarn/dependency_grapher/lockfile_generator.rb

@@ -113,11 +113,14 @@ module Dependabot
 
         sig { void }
         def run_npm_lockfile_generation
+          # Set dependency files and credentials for automatic env variable injection
+          Helpers.dependency_files = dependency_files
+          Helpers.credentials = credentials
+
           # Use --package-lock-only to generate lockfile without installing node_modules
           # Use --ignore-scripts to prevent running any scripts
           # Use --force to ignore platform checks
-          # Use --dry-run false because global .npmrc may have dry-run: true set
-          command = "install --package-lock-only --ignore-scripts --force --dry-run false"
+          command = "install --package-lock-only --ignore-scripts --force"
           Helpers.run_npm_command(command, fingerprint: command)
         end
 

data/lib/dependabot/npm_and_yarn/dependency_grapher.rb

@@ -40,7 +40,7 @@ module Dependabot
 
         T.must(
           @package_json = T.let(
-            T.must(dependency_files.find { |f| f.name.end_with?(MANIFEST_FILENAME) }),
+            T.must(dependency_files.find { |f| f.name.end_with?(NpmAndYarn::MANIFEST_FILENAME) }),
             T.nilable(Dependabot::DependencyFile)
           )
         )

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -139,6 +139,10 @@ module Dependabot
           return lockfile.content if npmrc_disables_lockfile?
           return lockfile.content unless updatable_dependencies.any?
 
+          # Set dependency files and credentials for automatic env variable injection
+          Helpers.dependency_files = dependency_files
+          Helpers.credentials = credentials
+
           @updated_lockfile_content ||= T.let(
             SharedHelpers.in_a_temporary_directory do
               write_temporary_dependency_files
@@ -339,8 +343,6 @@ module Dependabot
         #
         # Other npm flags:
         # - `--force` ignores checks for platform (os, cpu) and engines
-        # - `--dry-run=false` the updater sets a global .npmrc with `dry-run: true`
-        #   to work around an issue in npm 6, we don't want that here
         # - `--ignore-scripts` disables prepare and prepack scripts which are
         #   run when installing git dependencies
         # - `--save-optional` when updating optional dependencies to ensure they
@@ -351,8 +353,6 @@ module Dependabot
             "install",
             *install_args,
             "--force",
-            "--dry-run",
-            "false",
             "--ignore-scripts",
             "--package-lock-only"
           ]
@@ -365,8 +365,6 @@ module Dependabot
             "install",
             install_args.empty? ? "" : "<install_args>",
             "--force",
-            "--dry-run",
-            "false",
             "--ignore-scripts",
             "--package-lock-only"
           ]
@@ -375,25 +373,7 @@ module Dependabot
 
           fingerprint = fingerprint_args.join(" ")
 
-          env = build_registry_env_variables
-
-          Helpers.run_npm_command(command, fingerprint: fingerprint, env: env)
-        end
-
-        sig { returns(T.nilable(T::Hash[String, String])) }
-        def build_registry_env_variables
-          return nil unless Dependabot::Experiments.enabled?(:enable_private_registry_for_corepack)
-
-          registry_helper = NpmAndYarn::RegistryHelper.new(
-            {
-              npmrc: dependency_files.find { |f| f.name.end_with?(".npmrc") },
-              yarnrc: dependency_files.find { |f| f.name.end_with?(".yarnrc") && !f.name.end_with?(".yarnrc.yml") },
-              yarnrc_yml: dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") }
-            },
-            credentials
-          )
-
-          registry_helper.find_corepack_env_variables
+          Helpers.run_npm_command(command, fingerprint: fingerprint)
         end
 
         sig { params(dependency: Dependabot::Dependency).returns(String) }

data/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb

@@ -143,6 +143,10 @@ module Dependabot
             .returns(String)
         end
         def run_pnpm_update(pnpm_lock:, updated_pnpm_workspace_content: nil)
+          # Set dependency files and credentials for automatic env variable injection
+          Helpers.dependency_files = dependency_files
+          Helpers.credentials = credentials
+
           SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
             File.write(".npmrc", npmrc_content(pnpm_lock))
 

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -89,6 +89,10 @@ module Dependabot
 
         sig { params(yarn_lock: Dependabot::DependencyFile).returns(String) }
         def updated_yarn_lock(yarn_lock)
+          # Set dependency files and credentials for automatic env variable injection
+          Helpers.dependency_files = dependency_files
+          Helpers.credentials = credentials
+
           base_dir = T.must(dependency_files.first).directory
           SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
             write_temporary_dependency_files(yarn_lock)

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -5,6 +5,8 @@ require "dependabot/dependency"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/shared_helpers"
+require "dependabot/npm_and_yarn/registry_helper"
+require "dependabot/experiments"
 require "sorbet-runtime"
 
 module Dependabot
@@ -12,6 +14,32 @@ module Dependabot
     module Helpers # rubocop:disable Metrics/ModuleLength
       extend T::Sig
 
+      # Thread-local storage for dependency files and credentials
+      # This allows automatic env variable injection without passing parameters everywhere
+      class << self
+        extend T::Sig
+
+        sig { params(files: T::Array[Dependabot::DependencyFile]).void }
+        def dependency_files=(files)
+          Thread.current[:npm_and_yarn_dependency_files] = files
+        end
+
+        sig { returns(T.nilable(T::Array[Dependabot::DependencyFile])) }
+        def dependency_files
+          T.cast(Thread.current[:npm_and_yarn_dependency_files], T.nilable(T::Array[Dependabot::DependencyFile]))
+        end
+
+        sig { params(creds: T::Array[Dependabot::Credential]).void }
+        def credentials=(creds)
+          Thread.current[:npm_and_yarn_credentials] = creds
+        end
+
+        sig { returns(T.nilable(T::Array[Dependabot::Credential])) }
+        def credentials
+          T.cast(Thread.current[:npm_and_yarn_credentials], T.nilable(T::Array[Dependabot::Credential]))
+        end
+      end
+
       YARN_PATH_NOT_FOUND =
         /^.*(?<error>The "yarn-path" option has been set \(in [^)]+\), but the specified location doesn't exist)/
 
@@ -268,13 +296,14 @@ module Dependabot
         ).returns(String)
       end
       def self.run_npm_command(command, fingerprint: command, env: nil)
+        merged_env = merge_corepack_env(env)
         if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
           package_manager_run_command(
             NpmPackageManager::NAME,
             command,
             fingerprint: fingerprint,
             output_observer: ->(output) { command_observer(output) },
-            env: env
+            env: merged_env
           )
         else
           Dependabot::SharedHelpers.run_shell_command(
@@ -510,6 +539,35 @@ module Dependabot
         raise
       end
 
+      sig { params(env: T.nilable(T::Hash[String, String])).returns(T.nilable(T::Hash[String, String])) }
+      def self.merge_corepack_env(env)
+        corepack_env = build_corepack_env_variables
+        return env if corepack_env.nil? || corepack_env.empty?
+        return corepack_env if env.nil?
+
+        corepack_env.merge(env)
+      end
+
+      sig { returns(T.nilable(T::Hash[String, String])) }
+      def self.build_corepack_env_variables
+        return nil unless Dependabot::Experiments.enabled?(:enable_private_registry_for_corepack)
+        return nil if dependency_files.nil? || credentials.nil?
+
+        files = T.must(dependency_files)
+        creds = T.must(credentials)
+
+        registry_helper = RegistryHelper.new(
+          {
+            npmrc: files.find { |f| f.name.end_with?(".npmrc") },
+            yarnrc: files.find { |f| f.name.end_with?(".yarnrc") && !f.name.end_with?(".yarnrc.yml") },
+            yarnrc_yml: files.find { |f| f.name.end_with?(".yarnrc.yml") }
+          },
+          creds
+        )
+
+        registry_helper.find_corepack_env_variables
+      end
+
       private_class_method :run_single_yarn_command
 
       sig { params(pnpm_lock: DependencyFile).returns(T.nilable(String)) }

data/lib/dependabot/npm_and_yarn/native_helpers.rb

@@ -25,16 +25,12 @@ module Dependabot
       def self.run_npm8_subdependency_update_command(dependency_names)
         # NOTE: npm options
         # - `--force` ignores checks for platform (os, cpu) and engines
-        # - `--dry-run=false` the updater sets a global .npmrc with dry-run: true to
-        #   work around an issue in npm 6, we don't want that here
         # - `--ignore-scripts` disables prepare and prepack scripts which are run
         #   when installing git dependencies
         command = [
           "update",
           *dependency_names,
           "--force",
-          "--dry-run",
-          "false",
           "--ignore-scripts",
           "--package-lock-only"
         ].join(" ")
@@ -43,8 +39,6 @@ module Dependabot
           "update",
           "<dependency_names>",
           "--force",
-          "--dry-run",
-          "false",
           "--ignore-scripts",
           "--package-lock-only"
         ].join(" ")

data/lib/dependabot/npm_and_yarn/registry_helper.rb

@@ -46,7 +46,8 @@ module Dependabot
           env_variables[COREPACK_NPM_REGISTRY_ENV] = registry
         end
 
-        env_variables[COREPACK_NPM_TOKEN_ENV] = registry_info[:auth_token] if registry_info[:auth_token]
+        # NOTE: We only set the registry, not the token
+        # The token should be configured in .npmrc for security
 
         env_variables
       end
@@ -87,7 +88,15 @@ module Dependabot
 
         @credentials.each do |cred|
           next unless cred["type"] == "npm_registry" # Skip if not an npm registry
-          next unless cred["replaces-base"] # Skip if not a reverse-proxy registry
+
+          # Handle both Credential objects and plain hashes
+          replaces_base = if cred.respond_to?(:replaces_base?)
+                            cred.replaces_base?
+                          else
+                            cred["replaces-base"]
+                          end
+
+          next unless replaces_base # Skip if not a reverse-proxy registry
 
           # Set the registry if it's not already set
           registries[:registry] ||= cred["registry"]
@@ -95,10 +104,9 @@ module Dependabot
           # Set the token if it's not already set
           registries[:auth_token] ||= cred["token"]
         end
+
         registries
       end
-
-      # Find registry and token in .npmrc or .yarnrc file
       sig do
         params(
           file: T.nilable(Dependabot::DependencyFile),

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.351.0
+  version: 0.352.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.351.0
+        version: 0.352.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.351.0
+        version: 0.352.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -361,7 +361,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.351.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.352.0
 rdoc_options: []
 require_paths:
 - lib