dependabot-npm_and_yarn 0.383.0 → 0.384.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 36bb333ca707b5155b7c82a95c5a3e934a5b7acf0ae96723bf9e3ef46723679f
-  data.tar.gz: '0889ddfed838d230dd4a7e299847816690a4151ac4cd81b6230160a933e44e67'
+  metadata.gz: 50054abe467b1c8831c9fe1d24a014dc0944fff9b5991fd2b19acb92f05d5253
+  data.tar.gz: 81d4161505d10bfbafb2a6f7bd66d79dcdf70eb03cb56e3bf187cd795b4ba4c4
 SHA512:
-  metadata.gz: 162d5f20b24ad893b8ae76c6389ded05c31309f7fb43a4f1ce43186cfe8c0cafea09816e245b1a30e3ecc4ffc5f3792a01e5167f5aff09c9f86ff8baa1fa7d11
-  data.tar.gz: 8a97cb90adf36509589b5309bb50036a2d6f86def852456dadec850c8fec0b3b532042898716f1c4920587d42da48b9d62dd08ad57f3d6d7b20821a9c6d11a53
+  metadata.gz: a7641af7236364d01c54cabb30389d3f65a7831b4fcae0484cac7777dd4c5621bdbd144d13ed520f84f5d7d9d759be2bf0770c51e251cbb0f1644ff77364d0f5
+  data.tar.gz: 24ada1ea83d5ca4383168a8e8f9847a3e63c06cfb3c246e1dc1e16cd53688afa1c34fadc22bb27954ff333bfc6f10fc0f25b607e54d6a4c2c3add55bdb91ed5b

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -80,7 +80,7 @@ module Dependabot
       end
 
       sig { override.returns(T::Array[DependencyFile]) }
-      def fetch_files
+      def fetch_files # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
         fetched_files = T.let([], T::Array[DependencyFile])
         fetched_files << package_json
         fetched_files << T.must(npmrc) if npmrc && !scope_overrides_npmrc?
@@ -91,6 +91,17 @@ module Dependabot
         fetched_files += workspace_package_jsons
         fetched_files += path_dependencies(fetched_files)
 
+        # When no package manager version is detected at all (no lockfile, no
+        # packageManager, no engines) AND no committed .npmrc exists, the
+        # inferred_npmrc path inside npm_files is never reached. Try generating
+        # an .npmrc from scope credentials, or reject if no config is available.
+        # Skip for yarn/pnpm-only projects where npm isn't the relevant manager.
+        if no_package_manager_detected? && npmrc.nil?
+          generated = inferred_npmrc
+          fetched_files << generated if generated
+          reject_if_private_registry_without_config! unless generated
+        end
+
         # Filter excluded files from final collection
         filtered_files = fetched_files.uniq.reject do |file|
           Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files) &&
@@ -156,7 +167,7 @@ module Dependabot
         if Dependabot::Experiments.enabled?(:enable_npmrc_credential_generation) && credentials_have_scope?
           npmrc_from_credentials = generate_npmrc_from_credentials
           if npmrc_from_credentials
-            Dependabot.logger.info("Generated .npmrc from credential scope configuration (overrides committed .npmrc)")
+            Dependabot.logger.warn("Generated .npmrc from credential scope configuration (overrides committed .npmrc)")
             return @inferred_npmrc ||= T.let(npmrc_from_credentials, T.nilable(DependencyFile))
           end
         end
@@ -236,8 +247,10 @@ module Dependabot
       end
 
       sig { void }
-      def reject_if_private_registry_without_config!
+      def reject_if_private_registry_without_config! # rubocop:disable Metrics/PerceivedComplexity
         return unless Dependabot::Experiments.enabled?(:enable_npmrc_credential_generation)
+        return if credentials_have_scope?
+        return if wrapped_credentials.any?(&:replaces_base?)
 
         private_registry_creds = wrapped_credentials.select do |cred|
           next false unless cred["type"] == "npm_registry"
@@ -257,7 +270,7 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def credentials_have_scope?
-        wrapped_credentials.any? { |cred| cred["type"] == "npm_registry" && cred.scope }
+        wrapped_credentials.any? { |cred| cred["type"] == "npm_registry" && cred.scope&.any? }
       end
 
       # file_fetcher_command.rb may pass raw Hashes as credentials at runtime.
@@ -286,6 +299,11 @@ module Dependabot
         Dependabot::Experiments.enabled?(:enable_npmrc_credential_generation) && credentials_have_scope?
       end
 
+      sig { returns(T::Boolean) }
+      def no_package_manager_detected?
+        !npm_version && !yarn_version && !pnpm_version
+      end
+
       sig { returns(T.nilable(T.any(Integer, String))) }
       def npm_version
         @npm_version ||= T.let(package_manager_helper.setup(NpmPackageManager::NAME), T.nilable(T.any(Integer, String)))

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -3,6 +3,7 @@
 
 # See https://docs.npmjs.com/files/package.json for package.json format docs.
 
+require "cgi/escape"
 require "dependabot/dependency"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -341,7 +341,10 @@ module Dependabot
           dependency_names = sub_dependencies.map(&:name)
           original_content = File.read(lockfile_basename)
 
-          NativeHelpers.run_npm8_subdependency_update_command(dependency_names)
+          NativeHelpers.run_npm8_subdependency_update_command(
+            dependency_names,
+            security_updates_only: security_updates_only?
+          )
 
           updated_content = File.read(lockfile_basename)
           if updated_content == original_content && Dependabot::Experiments.enabled?(:enable_audit_fix_fallback)
@@ -351,7 +354,7 @@ module Dependabot
             # npm audit fix exits non-zero when vulnerabilities remain, so we
             # rescue and use whatever lockfile changes it managed to make.
             begin
-              NativeHelpers.run_npm_audit_fix_command
+              NativeHelpers.run_npm_audit_fix_command(security_updates_only: security_updates_only?)
               sub_dependencies.each { |dep| dep.metadata[:audit_fix_used] = true }
             rescue SharedHelpers::HelperSubprocessFailed
               Dependabot.logger.info("npm audit fix failed or partially fixed — continuing with any changes made")

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -400,10 +400,17 @@ module Dependabot
       end
 
       # Run single pnpm command returning stdout/stderr
-      sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
-      def self.run_pnpm_command(command, fingerprint: nil)
+      sig do
+        params(
+          command: String,
+          fingerprint: T.nilable(String),
+          env: T.nilable(T::Hash[String, String])
+        ).returns(String)
+      end
+      def self.run_pnpm_command(command, fingerprint: nil, env: nil)
         if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
-          package_manager_run_command(PNPMPackageManager::NAME, command, fingerprint: fingerprint)
+          merged_env = merge_corepack_env(env)
+          package_manager_run_command(PNPMPackageManager::NAME, command, fingerprint: fingerprint, env: merged_env)
         else
           Dependabot::SharedHelpers.run_shell_command(
             "pnpm #{command}",
@@ -422,7 +429,8 @@ module Dependabot
       end
       def self.run_single_yarn_command(command, fingerprint: nil, env: nil)
         if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
-          package_manager_run_command(YarnPackageManager::NAME, command, fingerprint: fingerprint, env: env)
+          merged_env = merge_corepack_env(env)
+          package_manager_run_command(YarnPackageManager::NAME, command, fingerprint: fingerprint, env: merged_env)
         else
           Dependabot::SharedHelpers.run_shell_command(
             "yarn #{command}",

data/lib/dependabot/npm_and_yarn/native_helpers.rb

@@ -21,40 +21,49 @@ module Dependabot
         File.join(__dir__, "../../../helpers")
       end
 
-      sig { params(dependency_names: T::Array[String]).returns(String) }
-      def self.run_npm8_subdependency_update_command(dependency_names)
+      sig { params(dependency_names: T::Array[String], security_updates_only: T::Boolean).returns(String) }
+      def self.run_npm8_subdependency_update_command(dependency_names, security_updates_only: false)
         # NOTE: npm options
         # - `--force` ignores checks for platform (os, cpu) and engines
         # - `--ignore-scripts` disables prepare and prepack scripts which are run
         #   when installing git dependencies
-        command = [
+        command_args = [
           "update",
           *dependency_names,
           "--force",
           "--ignore-scripts",
           "--package-lock-only"
-        ].join(" ")
+        ]
+        # Override any min-release-age set in .npmrc: security fixes must not be
+        # blocked by a release-age gate the user configured for regular updates.
+        command_args << "--min-release-age=0" if security_updates_only
+        command = command_args.join(" ")
 
-        fingerprint = [
+        fingerprint_args = [
           "update",
           "<dependency_names>",
           "--force",
           "--ignore-scripts",
           "--package-lock-only"
-        ].join(" ")
+        ]
+        fingerprint_args << "--min-release-age=0" if security_updates_only
+        fingerprint = fingerprint_args.join(" ")
 
         Helpers.run_npm_command(command, fingerprint: fingerprint)
       end
 
-      sig { returns(String) }
-      def self.run_npm_audit_fix_command
+      sig { params(security_updates_only: T::Boolean).returns(String) }
+      def self.run_npm_audit_fix_command(security_updates_only: false)
         # Fallback for transitive dependencies in workspace repos where
         # `npm update` is a no-op because the package isn't in package.json.
         # `npm audit fix` updates all fixable vulnerabilities in the lockfile.
         # `--force` ignores checks for platform (os, cpu) and engines,
         # matching the flags used by run_npm8_subdependency_update_command.
         command = "audit fix --force --package-lock-only --ignore-scripts"
-        fingerprint = "audit fix --force --package-lock-only --ignore-scripts"
+        # Override any min-release-age set in .npmrc: security fixes must not be
+        # blocked by a release-age gate the user configured for regular updates.
+        command += " --min-release-age=0" if security_updates_only
+        fingerprint = command
 
         Helpers.run_npm_command(command, fingerprint: fingerprint)
       end

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -11,6 +11,7 @@ require "dependabot/npm_and_yarn/sub_dependency_files_filterer"
 require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/npm_and_yarn/update_checker/dependency_files_builder"
 require "dependabot/npm_and_yarn/version"
+require "dependabot/security_advisory"
 require "dependabot/shared_helpers"
 require "sorbet-runtime"
 
@@ -38,6 +39,9 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         attr_reader :repo_contents_path
 
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
+        attr_reader :security_advisories
+
         sig do
           params(
             dependency: Dependency,
@@ -45,7 +49,8 @@ module Dependabot
             dependency_files: T::Array[Dependabot::DependencyFile],
             ignored_versions: T::Array[String],
             latest_allowable_version: T.nilable(T.any(String, Gem::Version)),
-            repo_contents_path: T.nilable(String)
+            repo_contents_path: T.nilable(String),
+            security_advisories: T::Array[Dependabot::SecurityAdvisory]
           ).void
         end
         def initialize(
@@ -54,7 +59,8 @@ module Dependabot
           dependency_files:,
           ignored_versions:,
           latest_allowable_version:,
-          repo_contents_path:
+          repo_contents_path:,
+          security_advisories: []
         )
           @dependency = dependency
           @credentials = credentials
@@ -62,6 +68,7 @@ module Dependabot
           @ignored_versions = ignored_versions
           @latest_allowable_version = latest_allowable_version
           @repo_contents_path = repo_contents_path
+          @security_advisories = security_advisories
         end
 
         sig { returns(T.nilable(T.any(String, Gem::Version))) }
@@ -321,12 +328,15 @@ module Dependabot
             Dir.chdir(path) do
               original_content = File.read(lockfile_name)
 
-              NativeHelpers.run_npm8_subdependency_update_command([dependency.name])
+              NativeHelpers.run_npm8_subdependency_update_command(
+                [dependency.name],
+                security_updates_only: security_updates_only?
+              )
 
               updated_content = File.read(lockfile_name)
               if updated_content == original_content && Dependabot::Experiments.enabled?(:enable_audit_fix_fallback)
                 begin
-                  NativeHelpers.run_npm_audit_fix_command
+                  NativeHelpers.run_npm_audit_fix_command(security_updates_only: security_updates_only?)
                   dependency.metadata[:audit_fix_used] = true
                 rescue SharedHelpers::HelperSubprocessFailed
                   Dependabot.logger.info("npm audit fix failed or partially fixed — continuing with any changes made")
@@ -357,6 +367,14 @@ module Dependabot
           dependency.version_class
         end
 
+        # Security fixes must not be blocked by a min-release-age gate the user
+        # configured in .npmrc for regular updates, so the native npm commands
+        # are invoked with --min-release-age=0 when resolving a security fix.
+        sig { returns(T::Boolean) }
+        def security_updates_only?
+          security_advisories.any?
+        end
+
         sig { returns(Dependabot::Dependency) }
         def updated_dependency
           Dependabot::Dependency.new(

data/lib/dependabot/npm_and_yarn/update_checker.rb

@@ -483,7 +483,8 @@ module Dependabot
             dependency_files: dependency_files,
             ignored_versions: ignored_versions,
             latest_allowable_version: latest_version,
-            repo_contents_path: repo_contents_path
+            repo_contents_path: repo_contents_path,
+            security_advisories: security_advisories
           )
       end
 
@@ -582,6 +583,12 @@ module Dependabot
       # per-package filtering.
       sig { void }
       def apply_npmrc_min_release_age
+        # Security fixes must not be blocked by a release-age gate the user
+        # configured for regular updates. npm install/update is invoked with
+        # --min-release-age=0 for security updates, so the cooldown floor would
+        # only filter out the security fix version at selection time.
+        return if security_update?
+
         npmrc_days = npmrc_min_release_age_days
         return unless npmrc_days&.positive?
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.383.0
+  version: 0.384.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.384.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.384.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -377,7 +377,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
 rdoc_options: []
 require_paths:
 - lib
@@ -392,7 +392,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.14
 specification_version: 4
 summary: Provides Dependabot support for Javascript (npm and yarn)
 test_files: []