dependabot-npm_and_yarn 0.267.0 → 0.268.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4bdc5fd829c55a7ac15380a9ddbc01b909e74a305946a2c41d4959fce0542dec
-  data.tar.gz: 0bab5e9c6d3e4291b55e50e7785aaf1aa7af1bca985a37f680a70c11db5ca2ba
+  metadata.gz: 473cf091eca02d2d3e0ff9920708779183b7a9a9dba2771c35ffe602eda18003
+  data.tar.gz: 3ff951a1e1970c6818b615b5f10b78950e5cc53c01b3a2b9540a28f3451ac294
 SHA512:
-  metadata.gz: 37a0cca58317b7b605c76c4766b939ccfe6728d37baa4e503711e61331d4d346dd96c67342fc5b62f979167afcc616ceb563353bf9228802af823291766bc679
-  data.tar.gz: 0235ce45b54bea0b5fdb065b9386292383e7103ac808edd597200c59c29070dbac803f6bbc27b6b697318d5daf9f82365b251f060b480d794381ef4a0589e68e
+  metadata.gz: 73a7da3b2062a4adaa70d33616698d418bcda9684e8cf301279bac6756537079136872cc68d6623af7f1ea8bd09197d7ac98edd287da6aafef63f1f6f25243c1
+  data.tar.gz: 68e3d2e1a3b50ccad6359b961a1e3093d6095d08fb8e79175aa83025c57716f080ca03dd5aea9e4f1dead654fa881cf4f20698971150ac5b361a25efbaa74b04

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -79,6 +79,14 @@ module Dependabot
         INVALID_AUTH_TOKEN =
           /401 Unauthorized - GET (?<url>.*) - unauthenticated: User cannot be authenticated with the token provided./
         NPM_PACKAGE_REGISTRY = "https://npm.pkg.github.com"
+        EOVERRIDE = /EOVERRIDE\n *.* Override for (?<deps>.*) conflicts with direct dependency/
+        NESTED_ALIAS = /nested aliases not supported/
+        PEER_DEPS_PATTERNS = T.let([/Cannot read properties of null/,
+                                    /ERESOLVE overriding peer dependency/].freeze, T::Array[Regexp])
+
+        ERROR_E401 = /code E401/
+        ERROR_E403 = /code E403/
+        ERROR_EAI_AGAIN = /request to (?<url>.*) failed, reason: getaddrinfo EAI_AGAIN/
 
         # TODO: look into fixing this in npm, seems like a bug in the git
         # downloader introduced in npm 7
@@ -392,7 +400,23 @@ module Dependabot
         # rubocop:disable Metrics/MethodLength
         sig { params(error: Exception).returns(T.noreturn) }
         def handle_npm_updater_error(error)
+          Dependabot.logger.warn("NPM : " + error.message)
+
           error_message = error.message
+
+          # message groups which are related to peer dependency resolution failure. Peer deps can be updated
+          # with --legacy-peer-deps flag, but it is not recommended as the flag can mess up dependency resolution
+          # and introduce breaking changes. So we let the update fail.
+          peerdep_group = Regexp.union(PEER_DEPS_PATTERNS)
+          if error_message.match(peerdep_group)
+            raise Dependabot::DependencyFileNotResolvable,
+                  "Error while updating peer dependency."
+          end
+
+          if error_message.match?(ERROR_E401) || error_message.match?(ERROR_E403)
+            raise Dependabot::PrivateSourceAuthenticationFailure, error_message
+          end
+
           if error_message.match?(MISSING_PACKAGE)
             package_name = T.must(error_message.match(MISSING_PACKAGE))
                             .named_captures["package_req"]
@@ -516,6 +540,11 @@ module Dependabot
             raise Dependabot::PrivateSourceAuthenticationFailure, msg
           end
 
+          if (git_source = error_message.match(ERROR_EAI_AGAIN))
+            msg = "Network Error. Access to #{git_source.named_captures.fetch('url')} failed."
+            raise Dependabot::PrivateSourceTimedOut, msg
+          end
+
           if (registry_source = error_message.match(INVALID_AUTH_TOKEN) ||
             error_message.match(MISSING_AUTH_TOKEN)) &&
              T.must(registry_source.named_captures.fetch("url")).include?(NPM_PACKAGE_REGISTRY)
@@ -523,6 +552,16 @@ module Dependabot
             raise Dependabot::InvalidGitAuthToken, T.must(msg)
           end
 
+          if (dep = error_message.match(EOVERRIDE))
+            msg = "Override for #{dep.named_captures.fetch('deps')} conflicts with direct dependency"
+            raise Dependabot::DependencyFileNotResolvable, msg
+          end
+
+          if error_message.match(NESTED_ALIAS)
+            msg = "Nested aliases are not supported in NPM versions earlier than 6.9.0."
+            raise Dependabot::DependencyFileNotResolvable, msg
+          end
+
           raise error
         end
         # rubocop:enable Metrics/AbcSize

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.267.0
+  version: 0.268.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-07-25 00:00:00.000000000 Z
+date: 2024-08-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.267.0
+        version: 0.268.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.267.0
+        version: 0.268.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -345,7 +345,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.267.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.268.0
 post_install_message: 
 rdoc_options: []
 require_paths: