dependabot-npm_and_yarn 0.275.0 → 0.276.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa9059df74fb7336b4718049555dedd8887c3d08add5cef44110728371612a41
-  data.tar.gz: 4abdcd71749994bbfd88b25e2bd33301debe86459dbe8205d30552475e7e3944
+  metadata.gz: 71f857c622a3e71c8c1e3099f585ebcc9aa7451b2d4fffc696770ed110b71405
+  data.tar.gz: 6c345e58a378ac08049a9593708f92735d565b48283a23d52233d303cb700d66
 SHA512:
-  metadata.gz: a5003914050f7914b55c3d77bba2b05c8905d6959b6a470b86ed029437a703d43436e05527fdbff63ca6d7f346c4ce891f46eada96920c0478e26152aa1eadb5
-  data.tar.gz: 50b3c80faf71ec749c0fe84ec8dd61c387450a5be7c7f5e01c8a2732ae2a776e11f71fb2e38cbc244f75a34ac754c404b58f02e0f55bb606b73f701872652ada
+  metadata.gz: ec358314a3ce776ab90fa8b9d34e5bd3ec4006bb388467e412d58042bd1bcab2803e51b3fcc816ac49e5cdb6e64fbac2bed472dbb27d36c91e527f904a44797e
+  data.tar.gz: bbbc9073fddf986810a9ca35e1800d9030c8df3743f20d8ba7802a303eb815bf650e171d55beb63cab8f31fb5d9fbe9c65b84b7f2e2ec0db018a15f08ceae1ed

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -107,6 +107,12 @@ module Dependabot
         # issue related when dependency url is not mentioned correctly
         UNRESOLVED_REFERENCE = /Unable to resolve reference (?<deps>.*)/
 
+        # npm git related error for dependencies
+        GIT_CHECKOUT_ERROR_REGEX = /Command failed: git checkout (?<sha>.*)/
+
+        # Invalid version format found for dependency in package.json file
+        INVALID_VERSION = /Invalid Version: (?<ver>.*)/
+
         # TODO: look into fixing this in npm, seems like a bug in the git
         # downloader introduced in npm 7
         #
@@ -616,6 +622,15 @@ module Dependabot
             raise Dependabot::DependencyFileNotResolvable, msg
           end
 
+          if (error_msg = error_message.match(GIT_CHECKOUT_ERROR_REGEX))
+            raise Dependabot::DependencyFileNotResolvable, error_msg
+          end
+
+          if (error_msg = error_message.match(INVALID_VERSION))
+            msg = "Found invalid version \"#{error_msg.named_captures.fetch('ver')}\" while updating"
+            raise Dependabot::DependencyFileNotResolvable, msg
+          end
+
           raise error
         end
         # rubocop:enable Metrics/AbcSize

data/lib/dependabot/npm_and_yarn/registry_parser.rb

@@ -45,7 +45,8 @@ module Dependabot
                      resolved_url
                    end
 
-        T.must(T.must(url_base[/@.*/]).gsub("%2F", "/").split("/")[0..1]).join("/")
+        package_name = url_base.gsub("%2F", "/").match(%r{@.*/})
+        "#{T.must(package_name)}#{T.must(url_base.gsub('%2F', '/').split('/').last)}"
       end
 
       private

data/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb

@@ -17,15 +17,6 @@ module Dependabot
       class LatestVersionFinder
         extend T::Sig
 
-        class RegistryError < StandardError
-          attr_reader :status
-
-          def initialize(status, msg)
-            @status = status
-            super(msg)
-          end
-        end
-
         def initialize(dependency:, credentials:, dependency_files:,
                        ignored_versions:, security_advisories:,
                        raise_on_ignored: false)

data/lib/dependabot/npm_and_yarn.rb

@@ -165,6 +165,9 @@ module Dependabot
       REQUIREMENT_NOT_PROVIDED: /(?<dep>.*)(.*?)doesn't provide (?<pkg>.*)(.*?), requested by (?<parent>.*)/
     }.freeze, T::Hash[String, Regexp])
 
+    # registry returns malformed response
+    REGISTRY_NOT_REACHABLE = /Received malformed response from registry for "(?<ver>.*)". The registry may be down./
+
     class Utils
       extend T::Sig
 
@@ -580,6 +583,15 @@ module Dependabot
         },
         in_usage: false,
         matchfn: nil
+      },
+      {
+        patterns: [REGISTRY_NOT_REACHABLE],
+        handler: lambda { |message, _error, _params|
+          msg = message.match(REGISTRY_NOT_REACHABLE)
+          Dependabot::DependencyFileNotResolvable.new(msg)
+        },
+        in_usage: false,
+        matchfn: nil
       }
     ].freeze, T::Array[{
       patterns: T::Array[T.any(String, Regexp)],

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.275.0
+  version: 0.276.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-09-12 00:00:00.000000000 Z
+date: 2024-09-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.275.0
+        version: 0.276.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.275.0
+        version: 0.276.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -346,7 +346,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.275.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.276.0
 post_install_message: 
 rdoc_options: []
 require_paths: