dependabot-npm_and_yarn 0.382.0 → 0.383.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f6b62776c4e4f4808215eb847c97e755f49062eda411ee412828ed1d29569378
-  data.tar.gz: 96ce53758c58b319deba6b6611cdff40a9a5673c66b6a0b066eb11410fd5a83d
+  metadata.gz: 36bb333ca707b5155b7c82a95c5a3e934a5b7acf0ae96723bf9e3ef46723679f
+  data.tar.gz: '0889ddfed838d230dd4a7e299847816690a4151ac4cd81b6230160a933e44e67'
 SHA512:
-  metadata.gz: faa9c39442466c97715c626036b1a711217b8e6c4b5dcd1b9438fc63e4009c20acab40a924c52bccf62d56656b3e7f5d3ed79c83e7ebb6a5053407865bd0d883
-  data.tar.gz: 3be31e18189e2e9a541fd884cbc91cf4a83e732a887da56b033785539b4f9e0f332f62774548c62487a1b0ac487060f377c9a9cb3138d232fdb33dfff3f15667
+  metadata.gz: 162d5f20b24ad893b8ae76c6389ded05c31309f7fb43a4f1ce43186cfe8c0cafea09816e245b1a30e3ecc4ffc5f3792a01e5167f5aff09c9f86ff8baa1fa7d11
+  data.tar.gz: 8a97cb90adf36509589b5309bb50036a2d6f86def852456dadec850c8fec0b3b532042898716f1c4920587d42da48b9d62dd08ad57f3d6d7b20821a9c6d11a53

data/helpers/lib/npm/vulnerability-auditor.ts

@@ -49,6 +49,13 @@ interface FixUpdate {
   target_version?: string;
 }
 
+interface BlockingDependency {
+  name: string;
+  version: string;
+  requirement: string;
+  top_level_ancestor: string;
+}
+
 interface AuditResponse {
   dependency_name: string;
   current_version?: string;
@@ -56,6 +63,7 @@ interface AuditResponse {
   fix_available: boolean;
   fix_updates: FixUpdate[];
   top_level_ancestors: string[];
+  blocking_dependencies?: BlockingDependency[];
 }
 
 interface BulkAdvisoryEntry {
@@ -154,6 +162,9 @@ export async function findVulnerableDependencies(
     response.fix_available = !!fixAvailable;
 
     if (!fixAvailable) {
+      // Surface the parent package(s) that pull in the vulnerable version so the
+      // Ruby side can explain exactly what is blocking the update.
+      response.blocking_dependencies = extractBlockingDependencies(vuln, name);
       return response;
     }
 
@@ -161,8 +172,10 @@ export async function findVulnerableDependencies(
 
     // In order for the vuln dependency in question to be considered fixable,
     // all dependency chains originating from it must be fixable.
-    if (chains.some((chain) => !chain.fixAvailable)) {
+    const unfixableChains = chains.filter((chain) => !chain.fixAvailable);
+    if (unfixableChains.length > 0) {
       response.fix_available = false;
+      response.blocking_dependencies = extractBlockingDependencies(vuln, name);
       return response;
     }
 
@@ -345,6 +358,93 @@ function buildDependencyChains(
   return helper(auditReport.tree, { nodes: [] }, new Set());
 }
 
+/* Identify the parent package(s) that require a vulnerable copy of `name`,
+ * together with the requirement (spec) they place on it and the top-level
+ * dependency each is reachable from. This explains why the vulnerable version
+ * can't simply be replaced: a package in the tree depends on it directly.
+ *
+ * We inspect the actual vulnerable nodes' incoming edges rather than the audit's
+ * dependency chains because, when a vulnerability can't be fixed, npm propagates
+ * it up the entire chain. As a result `buildDependencyChains` collapses to the
+ * top-level package and loses the immediate parent that pins the vulnerable
+ * version. Results are de-duplicated by parent + requirement + ancestor.
+ */
+function extractBlockingDependencies(
+  vuln: Arborist.Vuln,
+  name: string
+): BlockingDependency[] {
+  const blockers = new Map<string, BlockingDependency>();
+  for (const node of vuln.nodes) {
+    // `vuln.nodes` may include packages that are only vulnerable *via* this
+    // dependency; we only care about the actual vulnerable copies of `name`.
+    if (node.name !== name) {
+      continue;
+    }
+    for (const edge of node.edgesIn) {
+      const parent = edge.from;
+      if (!parent || parent.isProjectRoot) {
+        // The vulnerable dependency is itself a top-level dependency. Arborist
+        // uses the project root node (which has no incoming edges) as `edge.from`
+        // for direct dependencies, so skip it to avoid reporting the project
+        // root itself as a blocking dependency.
+        continue;
+      }
+      const requirement = edge.spec || "*";
+      const ancestors = findTopLevelAncestorNames(edge);
+      const topLevelAncestors = ancestors.length > 0 ? ancestors : [parent.name];
+      for (const ancestor of topLevelAncestors) {
+        const key = `${parent.name}@${parent.version}|${requirement}|${ancestor}`;
+        if (!blockers.has(key)) {
+          blockers.set(key, {
+            name: parent.name,
+            version: parent.version,
+            requirement,
+            top_level_ancestor: ancestor,
+          });
+        }
+      }
+    }
+  }
+  return [...blockers.values()].sort(
+    (a, b) =>
+      a.name.localeCompare(b.name) ||
+      a.version.localeCompare(b.version) ||
+      a.requirement.localeCompare(b.requirement) ||
+      a.top_level_ancestor.localeCompare(b.top_level_ancestor)
+  );
+}
+
+/* Walk up the dependency graph from the given edge to find the name(s) of the
+ * top-level dependencies (direct dependencies of the project root) the edge is
+ * reachable from. */
+function findTopLevelAncestorNames(edge: Arborist.Edge): string[] {
+  const result = new Set<string>();
+  const seen = new Set<Arborist.Edge>();
+  const visit = (current: Arborist.Edge): void => {
+    if (seen.has(current)) {
+      return;
+    }
+    seen.add(current);
+    const from = current.from;
+    if (!from) {
+      return;
+    }
+    for (const parentEdge of from.edgesIn) {
+      if (parentEdge.from?.isProjectRoot) {
+        // `parentEdge.from` is the project root, so `parentEdge.to` is a
+        // direct (top-level) dependency.
+        if (parentEdge.to) {
+          result.add(parentEdge.to.name);
+        }
+      } else {
+        visit(parentEdge);
+      }
+    }
+  };
+  visit(edge);
+  return [...result];
+}
+
 function groupBy<T>(
   elems: Iterable<T>,
   fn: (elem: T, index: number, elems: Iterable<T>) => string

data/helpers/test/npm/fixtures/vulnerability-auditor/locked-by-parent/package-lock.json

@@ -0,0 +1,60 @@
+{
+  "name": "transitive-dependency-locked-by-parent",
+  "version": "1.0.0",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "transitive-dependency-locked-by-parent",
+      "version": "1.0.0",
+      "license": "ISC",
+      "dependencies": {
+        "@dependabot-fixtures/npm-parent-dependency-5": "1.0.0"
+      }
+    },
+    "node_modules/@dependabot-fixtures/npm-intermediate-dependency": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/@dependabot-fixtures/npm-intermediate-dependency/-/npm-intermediate-dependency-0.0.1.tgz",
+      "integrity": "sha512-/N77Dzpfg8BIfFgpJrMk86ueUYTVhmpc4RobuHpIpKSc3GZr4Ltu4au92brnUGk66UkzgrMmtgqRXO8OrOspKQ==",
+      "dependencies": {
+        "@dependabot-fixtures/npm-transitive-dependency": "1.0.0"
+      }
+    },
+    "node_modules/@dependabot-fixtures/npm-parent-dependency-5": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@dependabot-fixtures/npm-parent-dependency-5/-/npm-parent-dependency-5-1.0.0.tgz",
+      "integrity": "sha512-xWlNw4sxT1wbrnSXZU/5PVd0ta4X+15XT9vNgZfB82q0ybr91SNVVUs+IPNZPbJ/nY70LZuRAg01kOuVPeHFlg==",
+      "dependencies": {
+        "@dependabot-fixtures/npm-intermediate-dependency": "0.0.1"
+      }
+    },
+    "node_modules/@dependabot-fixtures/npm-transitive-dependency": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@dependabot-fixtures/npm-transitive-dependency/-/npm-transitive-dependency-1.0.0.tgz",
+      "integrity": "sha512-nFbzQH0TRgdzSA2/FH6MPnxZDpD+5Bgz00aD5Edgbc1wY/k8VC9s7lnk22dBTgJLwoY7MgbrnAf9rAvN08hHVg=="
+    }
+  },
+  "dependencies": {
+    "@dependabot-fixtures/npm-intermediate-dependency": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/@dependabot-fixtures/npm-intermediate-dependency/-/npm-intermediate-dependency-0.0.1.tgz",
+      "integrity": "sha512-/N77Dzpfg8BIfFgpJrMk86ueUYTVhmpc4RobuHpIpKSc3GZr4Ltu4au92brnUGk66UkzgrMmtgqRXO8OrOspKQ==",
+      "requires": {
+        "@dependabot-fixtures/npm-transitive-dependency": "1.0.0"
+      }
+    },
+    "@dependabot-fixtures/npm-parent-dependency-5": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@dependabot-fixtures/npm-parent-dependency-5/-/npm-parent-dependency-5-1.0.0.tgz",
+      "integrity": "sha512-xWlNw4sxT1wbrnSXZU/5PVd0ta4X+15XT9vNgZfB82q0ybr91SNVVUs+IPNZPbJ/nY70LZuRAg01kOuVPeHFlg==",
+      "requires": {
+        "@dependabot-fixtures/npm-intermediate-dependency": "0.0.1"
+      }
+    },
+    "@dependabot-fixtures/npm-transitive-dependency": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@dependabot-fixtures/npm-transitive-dependency/-/npm-transitive-dependency-1.0.0.tgz",
+      "integrity": "sha512-nFbzQH0TRgdzSA2/FH6MPnxZDpD+5Bgz00aD5Edgbc1wY/k8VC9s7lnk22dBTgJLwoY7MgbrnAf9rAvN08hHVg=="
+    }
+  }
+}

data/helpers/test/npm/fixtures/vulnerability-auditor/locked-by-parent/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "transitive-dependency-locked-by-parent",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "@dependabot-fixtures/npm-parent-dependency-5": "1.0.0"
+  }
+}

data/helpers/test/npm/vulnerability-auditor.test.ts

@@ -144,6 +144,52 @@ describe("findVulnerableDependencies", () => {
     expect(actual).toEqual(expected);
   });
 
+  it("reports blocking dependencies when no fix is available", async () => {
+    helpers.copyDependencies("vulnerability-auditor/locked-by-parent", tempDir);
+
+    const advisories = [
+      {
+        dependency_name: "@dependabot-fixtures/npm-transitive-dependency",
+        affected_versions: ["< 1.0.1"],
+      },
+    ];
+    const actual = await findVulnerableDependencies(tempDir, advisories);
+
+    expect(actual.dependency_name).toBe(
+      "@dependabot-fixtures/npm-transitive-dependency"
+    );
+    expect(actual.current_version).toBe("1.0.0");
+    expect(actual.fix_available).toBe(false);
+    expect(actual.fix_updates).toEqual([]);
+    expect(actual.blocking_dependencies).toEqual([
+      {
+        name: "@dependabot-fixtures/npm-intermediate-dependency",
+        version: "0.0.1",
+        requirement: "1.0.0",
+        top_level_ancestor: "@dependabot-fixtures/npm-parent-dependency-5",
+      },
+    ]);
+  });
+
+  it("does not report the project root as a blocking dependency", async () => {
+    helpers.copyDependencies("vulnerability-auditor/simple", tempDir);
+
+    const advisories = [
+      {
+        dependency_name: "@dependabot-fixtures/npm-parent-dependency",
+        affected_versions: [">= 0"],
+      },
+    ];
+    const actual = await findVulnerableDependencies(tempDir, advisories);
+
+    expect(actual.dependency_name).toBe(
+      "@dependabot-fixtures/npm-parent-dependency"
+    );
+    expect(actual.fix_available).toBe(false);
+    expect(actual.fix_updates).toEqual([]);
+    expect(actual.blocking_dependencies).toEqual([]);
+  });
+
   it("has undefined target_version when a vulnerable package is removed", async () => {
     helpers.copyDependencies(
       "vulnerability-auditor/fix-removes-package",

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -12,6 +12,7 @@ require "dependabot/npm_and_yarn/helpers"
 require "dependabot/npm_and_yarn/package_manager"
 require "dependabot/npm_and_yarn/file_parser"
 require "dependabot/npm_and_yarn/file_parser/lockfile_parser"
+require "dependabot/npm_and_yarn/file_updater/npmrc_builder"
 
 module Dependabot
   module NpmAndYarn
@@ -82,7 +83,7 @@ module Dependabot
       def fetch_files
         fetched_files = T.let([], T::Array[DependencyFile])
         fetched_files << package_json
-        fetched_files << T.must(npmrc) if npmrc
+        fetched_files << T.must(npmrc) if npmrc && !scope_overrides_npmrc?
         fetched_files += npm_files if npm_version
         fetched_files += yarn_files if yarn_version
         fetched_files += pnpm_files if pnpm_version
@@ -137,15 +138,35 @@ module Dependabot
         fetched_lerna_files
       end
 
-      # If every entry in the lockfile uses the same registry, we can infer
-      # that there is a global .npmrc file, so add it here as if it were in the repo.
+      # Generates or infers an .npmrc file for the project.
+      # Priority order:
+      #   1. If credentials have `scope` → generate from credentials (authoritative, overrides everything)
+      #   2. If no `scope` AND `.npmrc` in repo → return nil (committed file handled upstream)
+      #   3. If no `scope` AND no `.npmrc` → try lockfile inference (transitional)
+      #   4. If nothing works → return nil
 
       # rubocop:disable Metrics/AbcSize
       # rubocop:disable Metrics/PerceivedComplexity
+      # rubocop:disable Metrics/CyclomaticComplexity
+      # rubocop:disable Metrics/MethodLength
       sig { returns(T.nilable(DependencyFile)) }
       def inferred_npmrc # rubocop:disable Metrics/PerceivedComplexity
         return @inferred_npmrc if defined?(@inferred_npmrc)
-        return @inferred_npmrc ||= T.let(nil, T.nilable(DependencyFile)) unless npmrc.nil? && package_lock
+
+        if Dependabot::Experiments.enabled?(:enable_npmrc_credential_generation) && credentials_have_scope?
+          npmrc_from_credentials = generate_npmrc_from_credentials
+          if npmrc_from_credentials
+            Dependabot.logger.info("Generated .npmrc from credential scope configuration (overrides committed .npmrc)")
+            return @inferred_npmrc ||= T.let(npmrc_from_credentials, T.nilable(DependencyFile))
+          end
+        end
+
+        unless npmrc.nil? && package_lock
+          # If .npmrc exists in the repo, it handles things — no rejection needed.
+          # If no .npmrc AND no lockfile, we can't infer, so check for rejection.
+          reject_if_private_registry_without_config! if npmrc.nil?
+          return @inferred_npmrc ||= T.let(nil, T.nilable(DependencyFile))
+        end
 
         known_registries = []
         FileParser::JsonLock.new(T.must(package_lock)).parsed.fetch(
@@ -157,9 +178,6 @@ module Dependabot
           begin
             uri = URI.parse(resolved)
           rescue URI::InvalidURIError
-            # Ignoring non-URIs since they're not registries.
-            # This can happen if resolved is `false`, for instance
-            # npm6 bug https://github.com/npm/cli/issues/1138
             next
           end
 
@@ -187,11 +205,87 @@ module Dependabot
           )
         end
 
+        # Lockfile inference failed — fall back to replaces-base credential generation
+        if Dependabot::Experiments.enabled?(:enable_npmrc_credential_generation)
+          npmrc_from_credentials = generate_npmrc_from_credentials
+          if npmrc_from_credentials
+            Dependabot.logger.info("Generated .npmrc from credential replaces-base configuration")
+            return @inferred_npmrc ||= npmrc_from_credentials
+          end
+        end
+
+        # Phase 3: Reject updates when private registries exist but no config is resolvable
+        reject_if_private_registry_without_config!
+
         @inferred_npmrc ||= nil
       end
+      # rubocop:enable Metrics/MethodLength
+      # rubocop:enable Metrics/CyclomaticComplexity
       # rubocop:enable Metrics/AbcSize
       # rubocop:enable Metrics/PerceivedComplexity
 
+      sig { returns(T.nilable(DependencyFile)) }
+      def generate_npmrc_from_credentials
+        content = NpmAndYarn::FileUpdater::NpmrcBuilder.npmrc_content_from_credentials(wrapped_credentials)
+        return unless content
+
+        Dependabot::DependencyFile.new(
+          name: ".npmrc",
+          content: content
+        )
+      end
+
+      sig { void }
+      def reject_if_private_registry_without_config!
+        return unless Dependabot::Experiments.enabled?(:enable_npmrc_credential_generation)
+
+        private_registry_creds = wrapped_credentials.select do |cred|
+          next false unless cred["type"] == "npm_registry"
+
+          registry = cred["registry"]
+          next false if registry.nil?
+
+          # Normalize: strip scheme to compare against CENTRAL_REGISTRIES (bare hostnames)
+          normalized = registry.sub(%r{^https?://}, "")
+          !NpmAndYarn::FileUpdater::NpmrcBuilder::CENTRAL_REGISTRIES.include?(normalized)
+        end
+        return if private_registry_creds.empty?
+
+        registry = private_registry_creds.first&.fetch("registry", nil) || "unknown"
+        raise Dependabot::PrivateRegistryConfigNotFound, registry
+      end
+
+      sig { returns(T::Boolean) }
+      def credentials_have_scope?
+        wrapped_credentials.any? { |cred| cred["type"] == "npm_registry" && cred.scope }
+      end
+
+      # file_fetcher_command.rb may pass raw Hashes as credentials at runtime.
+      # Wrap them in Credential objects so we can use .scope and .replaces_base? safely.
+      # Credential#initialize destructively removes "scope"/"replaces-base" keys, so we .dup first.
+      sig { returns(T::Array[Dependabot::Credential]) }
+      def wrapped_credentials
+        @wrapped_credentials ||= T.let(
+          credentials.map { |cred| ensure_credential(cred) },
+          T.nilable(T::Array[Dependabot::Credential])
+        )
+      end
+
+      sig do
+        params(cred: T.any(Dependabot::Credential, T::Hash[String, T.untyped]))
+          .returns(Dependabot::Credential)
+      end
+      def ensure_credential(cred)
+        return cred if cred.is_a?(Dependabot::Credential)
+
+        Dependabot::Credential.new(cred.dup)
+      end
+
+      sig { returns(T::Boolean) }
+      def scope_overrides_npmrc?
+        Dependabot::Experiments.enabled?(:enable_npmrc_credential_generation) && credentials_have_scope?
+      end
+
       sig { returns(T.nilable(T.any(Integer, String))) }
       def npm_version
         @npm_version ||= T.let(package_manager_helper.setup(NpmPackageManager::NAME), T.nilable(T.any(Integer, String)))

data/lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb

@@ -12,7 +12,7 @@ module Dependabot
       # Build a .npmrc file from the lockfile content, credentials, and any
       # committed .npmrc
       # We should refactor this to use Package::RegistryFinder
-      class NpmrcBuilder
+      class NpmrcBuilder # rubocop:disable Metrics/ClassLength
         extend T::Sig
 
         CENTRAL_REGISTRIES = T.let(
@@ -38,9 +38,50 @@ module Dependabot
           @dependencies = dependencies
         end
 
+        # Generates .npmrc content solely from credential scope/replaces-base properties,
+        # without lockfile inference or auth token lines. Used by FileFetcher as a fallback
+        # when lockfile inference fails.
+        # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(credentials: T::Array[Dependabot::Credential]).returns(T.nilable(String)) }
+        def self.npmrc_content_from_credentials(credentials)
+          registry_creds = credentials.select { |cred| cred.fetch("type") == "npm_registry" }
+          replaces_base_cred = registry_creds.find(&:replaces_base?)
+          scoped_credentials = registry_creds.select { |cred| cred.scope && cred["registry"] }
+          return if replaces_base_cred.nil? && scoped_credentials.empty?
+
+          lines = T.let([], T::Array[String])
+
+          if replaces_base_cred
+            registry = replaces_base_cred.fetch("registry")
+            registry_url = registry.start_with?("http") ? registry : "https://#{registry}"
+            lines << "registry=#{registry_url}"
+          end
+
+          scoped_credentials.each do |cred|
+            registry = cred.fetch("registry")
+            registry_url = registry.start_with?("http") ? registry : "https://#{registry}"
+            T.must(cred.scope).each do |s|
+              lines << "#{Helpers.normalize_npm_scope(s)}:registry=#{registry_url}"
+            end
+          end
+
+          lines.join("\n")
+        end
+        # rubocop:enable Metrics/PerceivedComplexity
+
         # PROXY WORK
+        # rubocop:disable Metrics/PerceivedComplexity
         sig { returns(String) }
         def npmrc_content
+          # When credentials have explicit scope, always generate from credentials
+          # (overrides committed .npmrc and lockfile inference)
+          if credentials_have_scope?
+            Dependabot.logger.info(
+              "Generating .npmrc from credential scope configuration (committed .npmrc ignored)"
+            )
+            return build_npmrc_from_scope_credentials
+          end
+
           initial_content =
             if npmrc_file then complete_npmrc_from_credentials
             elsif yarnrc_file then build_npmrc_from_yarnrc
@@ -60,6 +101,7 @@ module Dependabot
 
           final_content
         end
+        # rubocop:enable Metrics/PerceivedComplexity
 
         # PROXY WORK
         # Yarn allows registries to be defined either in an .npmrc or .yarnrc
@@ -87,6 +129,30 @@ module Dependabot
         sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
 
+        sig { returns(T::Boolean) }
+        def credentials_have_scope?
+          registry_credentials.any?(&:scope)
+        end
+
+        sig { returns(String) }
+        def build_npmrc_from_scope_credentials
+          content = T.must(NpmrcBuilder.npmrc_content_from_credentials(credentials))
+
+          # Append auth lines for all configured registries
+          lines = [content]
+          registry_credentials.each do |cred|
+            token = cred.fetch("token", nil)
+            next unless token
+
+            lines << auth_line(token, cred.fetch("registry"))
+          end
+
+          replaces_base_cred = registry_credentials.find(&:replaces_base?)
+          lines << "always-auth = true" if replaces_base_cred
+
+          lines.reject(&:empty?).join("\n")
+        end
+
         sig { returns(T.nilable(String)) }
         def build_npmrc_content_from_lockfile
           return unless yarn_lock || package_lock || shrinkwrap
@@ -101,19 +167,13 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def build_npmrc_content_from_credential_scopes
-          scoped_credentials = registry_credentials.select { |cred| cred.scope && cred["registry"] }
-          return if scoped_credentials.empty?
+          content = NpmrcBuilder.npmrc_content_from_credentials(credentials)
+          return unless content
 
-          lines = T.let([], T::Array[String])
-          scoped_credentials.each do |cred|
-            registry = cred.fetch("registry")
-            registry_url = registry.start_with?("http") ? registry : "https://#{registry}"
-            T.must(cred.scope).each do |s|
-              lines << "#{Helpers.normalize_npm_scope(s)}:registry=#{registry_url}"
-            end
-          end
+          replaces_base_cred = registry_credentials.find(&:replaces_base?)
+          return content unless replaces_base_cred
 
-          lines.join("\n")
+          "#{content}\nalways-auth = true"
         end
 
         sig { returns(T.nilable(String)) }

data/lib/dependabot/npm_and_yarn/package/registry_finder.rb

@@ -61,7 +61,7 @@ module Dependabot
         def registry
           return @registry if @registry
 
-          @registry = configured_registry || locked_registry || scoped_credential_registry_for_dependency ||
+          @registry = scoped_credential_registry_for_dependency || configured_registry || locked_registry ||
                       first_registry_with_dependency_details
           T.must(@registry)
         end
@@ -226,7 +226,7 @@ module Dependabot
                             .select { |cred| cred["type"] == "npm_registry" && cred["registry"] }
                             .tap do |arr|
                               arr.each do |c|
-                                c["registry"] = prepare_registry_url(c["registry"])
+                                c["registry"] = prepare_registry_url(c["registry"])&.delete_suffix("/")
                                 c["token"] ||= nil
                               end
                             end

data/lib/dependabot/npm_and_yarn/registry_helper.rb

@@ -27,6 +27,16 @@ module Dependabot
       # Default npm registry - no need to set env vars for this
       DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org"
 
+      # Canonicalise a registry URL: ensure an https:// scheme and strip any
+      # trailing slashes. Used wherever a registry URL is written into an env var
+      # so there is a single source of truth for URL normalisation.
+      sig { params(url: String).returns(String) }
+      def self.normalize_registry_url(url)
+        normalized = url.start_with?("http://", "https://") ? url.dup : "https://#{url}"
+        normalized.delete_suffix!("/") while normalized.end_with?("/")
+        normalized
+      end
+
       sig do
         params(
           registry_config_files: T::Hash[Symbol, T.nilable(Dependabot::DependencyFile)],
@@ -44,11 +54,9 @@ module Dependabot
 
         env_variables = {}
 
-        if registry_info[:registry] # Prevent the https from being stripped in the process
-          registry = registry_info[:registry]
-          registry = "https://#{T.must(registry)}" unless T.must(registry).start_with?("http://", "https://")
+        if (raw_registry = registry_info[:registry])
+          registry = RegistryHelper.normalize_registry_url(raw_registry)
 
-          # Set both in the env_variables hash
           unless registry == DEFAULT_NPM_REGISTRY
             env_variables[COREPACK_NPM_REGISTRY_ENV] = registry # For Corepack
             env_variables[NPM_CONFIG_REGISTRY_ENV] = registry # For npm

data/lib/dependabot/npm_and_yarn/update_checker/requirements_updater.rb

@@ -11,6 +11,7 @@ require "sorbet-runtime"
 require "dependabot/npm_and_yarn/requirement"
 require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/npm_and_yarn/version"
+require "dependabot/dependency_requirement"
 require "dependabot/requirements_update_strategy"
 
 module Dependabot
@@ -33,7 +34,7 @@ module Dependabot
 
         sig do
           params(
-            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            requirements: T::Array[Dependabot::DependencyRequirement],
             updated_source: T.nilable(T::Hash[Symbol, T.untyped]),
             update_strategy: Dependabot::RequirementsUpdateStrategy,
             latest_resolvable_version: T.nilable(T.any(String, Gem::Version))
@@ -41,7 +42,10 @@ module Dependabot
             .void
         end
         def initialize(requirements:, updated_source:, update_strategy:, latest_resolvable_version:)
-          @requirements = requirements
+          @requirements = T.let(
+            requirements.map { |req| Dependabot::DependencyRequirement.create(req) },
+            T::Array[Dependabot::DependencyRequirement]
+          )
           @updated_source = updated_source
           @update_strategy = update_strategy
 
@@ -55,12 +59,12 @@ module Dependabot
           )
         end
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         def updated_requirements
           return requirements if update_strategy.lockfile_only?
 
           requirements.map do |req|
-            req = req.merge(source: updated_source)
+            req = Dependabot::DependencyRequirement.create(req.merge(source: updated_source))
             next req unless latest_resolvable_version
             next initial_req_after_source_change(req) unless req[:requirement]
             next req if req[:requirement].sub(NpmAndYarn::Requirement::JSR_PREFIX, "")
@@ -78,7 +82,7 @@ module Dependabot
 
         private
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
         sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
@@ -105,15 +109,15 @@ module Dependabot
           original_source&.fetch(:type) == "git"
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def initial_req_after_source_change(req)
           return req unless updating_from_git_to_npm?
           return req unless req[:requirement].nil?
 
-          req.merge(requirement: "^#{latest_resolvable_version}")
+          Dependabot::DependencyRequirement.create(req.merge(requirement: "^#{latest_resolvable_version}"))
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_version_requirement(req)
           current_requirement = req[:requirement]
 
@@ -122,14 +126,14 @@ module Dependabot
             return req if ruby_req&.satisfied_by?(latest_resolvable_version)
 
             updated_req = update_range_requirement(current_requirement)
-            return req.merge(requirement: updated_req)
+            return Dependabot::DependencyRequirement.create(req.merge(requirement: updated_req))
           end
 
           reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
-          req.merge(requirement: update_version_string(reqs.first))
+          Dependabot::DependencyRequirement.create(req.merge(requirement: update_version_string(reqs.first)))
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_version_requirement_if_needed(req)
           current_requirement = req[:requirement]
           version = latest_resolvable_version
@@ -141,7 +145,7 @@ module Dependabot
           update_version_requirement(req)
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def widen_requirement(req)
           current_requirement = req[:requirement]
           version = latest_resolvable_version
@@ -161,7 +165,7 @@ module Dependabot
               current_requirement
             end
 
-          req.merge(requirement: updated_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: updated_requirement))
         end
 
         sig { params(requirement_string: String).returns(T::Array[NpmAndYarn::Requirement]) }

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -935,7 +935,7 @@ module Dependabot
           registry_url = replaces_base_cred&.[]("registry")
           return nil unless registry_url
 
-          registry_url = "https://#{registry_url}" unless registry_url.start_with?("http")
+          registry_url = Dependabot::NpmAndYarn::RegistryHelper.normalize_registry_url(registry_url)
 
           { "npm_config_registry" => registry_url }
         end

data/lib/dependabot/npm_and_yarn/update_checker/vulnerability_auditor.rb

@@ -32,7 +32,6 @@ module Dependabot
           @credentials = credentials
         end
 
-        # rubocop:disable Metrics/MethodLength
         # Finds any dependencies in the `package-lock.json` or `npm-shrinkwrap.json` that have
         # a subdependency on the given dependency that is locked to a vuln version range.
         #
@@ -63,69 +62,122 @@ module Dependabot
         end
         def audit(dependency:, security_advisories:)
           Dependabot.logger.info("VulnerabilityAuditor: starting audit")
+          fix_unavailable = fix_unavailable_response(dependency)
 
-          fix_unavailable = {
+          run_audit(
+            dependency: dependency,
+            security_advisories: security_advisories,
+            fix_unavailable: fix_unavailable
+          )
+        rescue SharedHelpers::HelperSubprocessFailed => e
+          log_helper_subprocess_failure(dependency, e)
+          T.must(fix_unavailable)
+        end
+
+        private
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { params(dependency: Dependabot::Dependency).returns(T::Hash[String, T.untyped]) }
+        def fix_unavailable_response(dependency)
+          {
             "dependency_name" => dependency.name,
             "fix_available" => false,
             "fix_updates" => [],
             "top_level_ancestors" => []
           }
+        end
 
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            fix_unavailable: T::Hash[String, T.untyped]
+          ).returns(T::Hash[String, T.untyped])
+        end
+        def run_audit(dependency:, security_advisories:, fix_unavailable:)
           SharedHelpers.in_a_temporary_directory do
-            dependency_files_builder = DependencyFilesBuilder.new(
+            dependency_files_builder = prepare_dependency_files(dependency)
+            return fix_unavailable unless lockfile_present?(dependency_files_builder)
+
+            audit_result = run_vulnerability_auditor(security_advisories)
+            handle_audit_result(
               dependency: dependency,
-              dependency_files: dependency_files,
-              credentials: credentials
+              security_advisories: security_advisories,
+              audit_result: audit_result,
+              fix_unavailable: fix_unavailable
             )
-            dependency_files_builder.write_temporary_dependency_files
-
-            # `npm-shrinkwrap.js`, if present, takes precedence over `package-lock.js`.
-            # Both files use the same format. See https://bit.ly/3lDIAJV for more.
-            lockfile = (dependency_files_builder.shrinkwraps + dependency_files_builder.package_locks).first
-            unless lockfile
-              Dependabot.logger.info("VulnerabilityAuditor: missing lockfile")
-              return fix_unavailable
-            end
+          end
+        end
 
-            vuln_versions = security_advisories.map do |a|
-              {
-                dependency_name: a.dependency_name,
-                affected_versions: a.vulnerable_version_strings
-              }
-            end
+        sig { params(dependency: Dependabot::Dependency).returns(DependencyFilesBuilder) }
+        def prepare_dependency_files(dependency)
+          dependency_files_builder = DependencyFilesBuilder.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials
+          )
+          dependency_files_builder.write_temporary_dependency_files
+          dependency_files_builder
+        end
 
-            audit_result = T.cast(
-              SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
-                function: "npm:vulnerabilityAuditor",
-                args: [Dir.pwd, vuln_versions]
-              ),
-              T::Hash[String, T.untyped]
-            )
+        sig { params(dependency_files_builder: DependencyFilesBuilder).returns(T::Boolean) }
+        def lockfile_present?(dependency_files_builder)
+          # `npm-shrinkwrap.js`, if present, takes precedence over `package-lock.js`.
+          # Both files use the same format. See https://bit.ly/3lDIAJV for more.
+          lockfile = (dependency_files_builder.shrinkwraps + dependency_files_builder.package_locks).first
+          return true if lockfile
 
-            validation_result = validate_audit_result(audit_result, security_advisories)
-            if validation_result != :viable
-              Dependabot.logger.info("VulnerabilityAuditor: audit result not viable: #{validation_result}")
-              fix_unavailable["explanation"] = explain_fix_unavailable(validation_result, dependency, audit_result)
-              return fix_unavailable
-            end
+          Dependabot.logger.info("VulnerabilityAuditor: missing lockfile")
+          false
+        end
 
-            Dependabot.logger.info("VulnerabilityAuditor: audit result viable")
-            audit_result
-          end
-        rescue SharedHelpers::HelperSubprocessFailed => e
-          log_helper_subprocess_failure(dependency, e)
-          T.must(fix_unavailable)
+        sig do
+          params(security_advisories: T::Array[Dependabot::SecurityAdvisory]).returns(T::Hash[String, T.untyped])
         end
-        # rubocop:enable Metrics/MethodLength
+        def run_vulnerability_auditor(security_advisories)
+          vuln_versions = security_advisories.map do |advisory|
+            {
+              dependency_name: advisory.dependency_name,
+              affected_versions: advisory.vulnerable_version_strings
+            }
+          end
 
-        private
+          T.cast(
+            SharedHelpers.run_helper_subprocess(
+              command: NativeHelpers.helper_path,
+              function: "npm:vulnerabilityAuditor",
+              args: [Dir.pwd, vuln_versions]
+            ),
+            T::Hash[String, T.untyped]
+          )
+        end
 
-        sig { returns(T::Array[Dependabot::DependencyFile]) }
-        attr_reader :dependency_files
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            audit_result: T::Hash[String, T.untyped],
+            fix_unavailable: T::Hash[String, T.untyped]
+          ).returns(T::Hash[String, T.untyped])
+        end
+        def handle_audit_result(dependency:, security_advisories:, audit_result:, fix_unavailable:)
+          validation_result = validate_audit_result(audit_result, security_advisories)
+          if validation_result == :viable
+            Dependabot.logger.info("VulnerabilityAuditor: audit result viable")
+            return audit_result
+          end
 
-        sig { returns(T::Array[Dependabot::Credential]) }
-        attr_reader :credentials
+          Dependabot.logger.info("VulnerabilityAuditor: audit result not viable: #{validation_result}")
+          fix_unavailable["explanation"] = explain_fix_unavailable(validation_result, dependency, audit_result)
+          blocking_dependencies = audit_result["blocking_dependencies"]
+          fix_unavailable["blocking_dependencies"] = blocking_dependencies if blocking_dependencies
+          fix_unavailable
+        end
 
         sig do
           params(
@@ -137,7 +189,7 @@ module Dependabot
         def explain_fix_unavailable(validation_result, dependency, audit_result)
           case validation_result
           when :fix_unavailable
-            fix_unavailable_message(dependency)
+            fix_unavailable_message(dependency, audit_result)
           when :dependency_still_vulnerable
             dependency_still_vulnerable_message(dependency, audit_result)
           when :downgrades_dependencies
@@ -209,10 +261,43 @@ module Dependabot
           current > target
         end
 
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            audit_result: T::Hash[String, T.untyped]
+          ).returns(String)
+        end
+        def fix_unavailable_message(dependency, audit_result)
+          blockers = audit_result["blocking_dependencies"]
+          return generic_fix_unavailable_message(dependency) if blockers.nil? || blockers.empty?
+
+          conflicts = blockers.map do |blocker|
+            blocker_name = blocker["name"]
+            blocker_version = blocker["version"]
+            blocker_requirement = blocker["requirement"]
+            detail = "#{blocker_name}@#{blocker_version} requires " \
+                     "#{dependency.name}@#{blocker_requirement}"
+            ancestor = blocker["top_level_ancestor"]
+
+            detail += " (pulled in via #{ancestor})" if ancestor && ancestor != blocker_name
+            detail
+          end.join("; ")
+
+          "#{dependency.name} can't be updated to a non-vulnerable version because the npm helper identified parent " \
+            "package constraints in the dependency tree that still require a vulnerable version: #{conflicts}. To " \
+            "resolve this, update the parent " \
+            "package(s) listed above to a release that allows a non-vulnerable #{dependency.name}, or add an " \
+            "override/resolution pinning #{dependency.name} to a non-vulnerable version."
+        end
+
         sig { params(dependency: Dependabot::Dependency).returns(String) }
-        def fix_unavailable_message(dependency)
-          "Dependabot could not find a lockfile update that resolves " \
-            "#{dependency.name} to a non-vulnerable version."
+        def generic_fix_unavailable_message(dependency)
+          "#{dependency.name} is a transitive dependency and no update path was found that " \
+            "resolves it to a non-vulnerable version. A fixed version of #{dependency.name} is published, but the " \
+            "parent package(s) that depend on it in the lockfile require a vulnerable version, and Dependabot could " \
+            "not update those parent package(s) to a release that allows the fixed version without introducing a " \
+            "conflict. To resolve this, update the parent dependency that requires #{dependency.name}, or add an " \
+            "override/resolution pinning #{dependency.name} to a non-vulnerable version."
         end
 
         sig do

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -177,14 +177,12 @@ module Dependabot
           end
 
         @updated_requirements ||=
-          wrap_requirements(
-            RequirementsUpdater.new(
-              requirements: dependency.requirements,
-              updated_source: updated_source,
-              latest_resolvable_version: resolvable_version,
-              update_strategy: T.must(requirements_update_strategy)
-            ).updated_requirements
-          )
+          RequirementsUpdater.new(
+            requirements: dependency.requirements,
+            updated_source: updated_source,
+            latest_resolvable_version: resolvable_version,
+            update_strategy: T.must(requirements_update_strategy)
+          ).updated_requirements
       end
 
       sig { returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.382.0
+  version: 0.383.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -275,6 +275,8 @@ files:
 - helpers/test/npm/fixtures/vulnerability-auditor/fix-hoists-package/package.json
 - helpers/test/npm/fixtures/vulnerability-auditor/fix-removes-package/package-lock.json
 - helpers/test/npm/fixtures/vulnerability-auditor/fix-removes-package/package.json
+- helpers/test/npm/fixtures/vulnerability-auditor/locked-by-parent/package-lock.json
+- helpers/test/npm/fixtures/vulnerability-auditor/locked-by-parent/package.json
 - helpers/test/npm/fixtures/vulnerability-auditor/outdated-package-lock/package-lock.json
 - helpers/test/npm/fixtures/vulnerability-auditor/outdated-package-lock/package.json
 - helpers/test/npm/fixtures/vulnerability-auditor/simple/package-lock.json
@@ -375,7 +377,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
 rdoc_options: []
 require_paths:
 - lib