dependabot-npm_and_yarn 0.385.0 → 0.386.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e68f24f2520040b0fb94bb7a0d98af8b36a23bc7a8d27aecf9af8d32830a69d
-  data.tar.gz: 5e81bc9fc5e886d2e1a392899d27443f6d32cafdd08a788eb71052b7abe3266f
+  metadata.gz: eed1a15784e78d8843afd8b8e043e63bf1c3f9af24945e5980244dbdbc20012b
+  data.tar.gz: 44a369d54a689ae0ec9388bee4a79fedb992ce301f20037cbfd8668f3b430d2b
 SHA512:
-  metadata.gz: 618893dff8d6152043cfeab8c89c716f1cf5998f62a6210236df62c726d7c47e4edca330446c10a93c0e4f0704319c3d1ff6be5ddb1a652f5d67e2f51e3e11f5
-  data.tar.gz: 5a82b1c15fb5eb39f269f1d14a072796157758b9d9272f09fbcc1462296d10556d598dfb44b5f379097466661dcc0724f6d2d016dc850b8b2ab0727a8a611ff9
+  metadata.gz: 734cdc4cb55dd3b1361fc128f9590b891ccd6f6d45e67872f71ff9cb5ab5826eb4c9ec4814f09e4e4e046b642b2756366f06fdfd1dba5f3c5e2d8ade6617558a
+  data.tar.gz: 2449823cbdc0f90c27463aa6c04729a5427728ad9747404968ef7007d295f061b7436ed0bff9307dee43897c0c87d1b21d1e8a6426a43193755d54ccfa7348b1

data/helpers/lib/npm/vulnerability-auditor.ts

@@ -123,7 +123,7 @@ export async function findVulnerableDependencies(
 
   const { server, url: auditRegistryUrl } = await startAuditServer(advisories);
 
-  const arb = new Arborist({
+  const arboristOptions = {
     path: directory,
     auditRegistry: auditRegistryUrl,
     noProxy: "127.0.0.1",
@@ -133,7 +133,8 @@ export async function findVulnerableDependencies(
     ignoreScripts: true,
     ...registryOpts,
     ...registryCreds,
-  });
+  };
+  const arb = new Arborist(arboristOptions);
 
   try {
     const name = advisories[0].dependency_name;
@@ -218,7 +219,12 @@ export async function findVulnerableDependencies(
 
     response.top_level_ancestors = [...topLevelAncestors].sort();
 
-    const fixTree = await arb.audit({
+    // Compute the fix tree with a fresh Arborist instance: walking the audit
+    // report above (Vuln#isVulnerable in buildDependencyChains) mutates
+    // vuln.nodes, and a polluted node set corrupts the fix calculation for
+    // workspace repos, leaving the vulnerable version in place.
+    const fixArb = new Arborist(arboristOptions);
+    const fixTree = await fixArb.audit({
       fix: true,
     });
 

data/helpers/test/npm/fixtures/vulnerability-auditor/workspace-transitive-dependency/package-lock.json

@@ -0,0 +1,62 @@
+{
+  "name": "test-workspace-transitive-dependency",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "test-workspace-transitive-dependency",
+      "version": "1.0.0",
+      "workspaces": [
+        "packages/*"
+      ]
+    },
+    "node_modules/@dependabot-fixtures/npm-intermediate-dependency": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/@dependabot-fixtures/npm-intermediate-dependency/-/npm-intermediate-dependency-0.0.2.tgz",
+      "integrity": "sha512-xj/Xn9vf3zO9b4XQXAWysDyMARCajkyceOqcdIdg9blkz6JPzB5e3ShGH+rAo0TBy+DN7WrFBMt1xxwdqezRLg==",
+      "license": "ISC",
+      "dependencies": {
+        "@dependabot-fixtures/npm-transitive-dependency": "^1.0.0"
+      }
+    },
+    "node_modules/@dependabot-fixtures/npm-parent-dependency": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@dependabot-fixtures/npm-parent-dependency/-/npm-parent-dependency-2.0.1.tgz",
+      "integrity": "sha512-iKNiUvswqiwhJLmP6yJv45anOm43uEuKm90LK70bhwdMMbTg2XzK7TqPv5UzmHQHCxUE8zTy82piqDf/Uqui3Q==",
+      "license": "ISC",
+      "dependencies": {
+        "@dependabot-fixtures/npm-intermediate-dependency": "^0.0.1"
+      }
+    },
+    "node_modules/@dependabot-fixtures/npm-transitive-dependency": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@dependabot-fixtures/npm-transitive-dependency/-/npm-transitive-dependency-1.0.0.tgz",
+      "integrity": "sha512-nFbzQH0TRgdzSA2/FH6MPnxZDpD+5Bgz00aD5Edgbc1wY/k8VC9s7lnk22dBTgJLwoY7MgbrnAf9rAvN08hHVg==",
+      "license": "ISC"
+    },
+    "node_modules/app": {
+      "resolved": "packages/app",
+      "link": true
+    },
+    "node_modules/lib": {
+      "resolved": "packages/lib",
+      "link": true
+    },
+    "packages/app": {
+      "name": "app",
+      "version": "1.0.0",
+      "dependencies": {
+        "lib": "*",
+        "@dependabot-fixtures/npm-parent-dependency": "^2.0.1"
+      }
+    },
+    "packages/lib": {
+      "name": "lib",
+      "version": "1.0.0",
+      "dependencies": {
+        "@dependabot-fixtures/npm-parent-dependency": "^2.0.1"
+      }
+    }
+  }
+}

data/helpers/test/npm/fixtures/vulnerability-auditor/workspace-transitive-dependency/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "test-workspace-transitive-dependency",
+  "version": "1.0.0",
+  "private": true,
+  "workspaces": [
+    "packages/*"
+  ]
+}

data/helpers/test/npm/fixtures/vulnerability-auditor/workspace-transitive-dependency/packages/app/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "app",
+  "version": "1.0.0",
+  "dependencies": {
+    "lib": "*",
+    "@dependabot-fixtures/npm-parent-dependency": "^2.0.1"
+  }
+}

data/helpers/test/npm/fixtures/vulnerability-auditor/workspace-transitive-dependency/packages/lib/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "lib",
+  "version": "1.0.0",
+  "dependencies": {
+    "@dependabot-fixtures/npm-parent-dependency": "^2.0.1"
+  }
+}

data/helpers/test/npm/vulnerability-auditor.test.ts

@@ -120,6 +120,46 @@ describe("findVulnerableDependencies", () => {
     ]);
   });
 
+  it("fixes a deep transitive dependency reachable only via workspace packages", async () => {
+    helpers.copyDependenciesTree(
+      "vulnerability-auditor/workspace-transitive-dependency",
+      tempDir
+    );
+
+    const advisories = [
+      {
+        dependency_name: "@dependabot-fixtures/npm-transitive-dependency",
+        affected_versions: ["< 1.0.1"],
+      },
+    ];
+    const actual = await findVulnerableDependencies(tempDir, advisories);
+
+    // The vulnerable dependency sits three levels below the workspace packages
+    // (app/lib -> npm-parent-dependency -> npm-intermediate-dependency ->
+    // npm-transitive-dependency) and isn't required by the workspace root at
+    // all — mirroring the Turborepo layout from issue #14984. The fix is a
+    // lockfile-only in-range bump of the dependency itself, so the audit must
+    // report it as fixable with a non-vulnerable target version even though
+    // all top-level ancestors are workspace packages.
+    expect(actual.dependency_name).toBe(
+      "@dependabot-fixtures/npm-transitive-dependency"
+    );
+    expect(actual.current_version).toBe("1.0.0");
+    expect(actual.fix_available).toBe(true);
+    expect(actual.target_version).toBe("1.0.1");
+
+    expect(actual.top_level_ancestors).toEqual(["app", "lib"]);
+
+    expect(actual.fix_updates).toEqual([
+      {
+        dependency_name: "@dependabot-fixtures/npm-transitive-dependency",
+        current_version: "1.0.0",
+        target_version: "1.0.1",
+        top_level_ancestors: ["app", "lib"],
+      },
+    ]);
+  });
+
   it("returns empty fix updates when package-lock.json is outdated", async () => {
     helpers.copyDependencies(
       "vulnerability-auditor/outdated-package-lock",

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -68,6 +68,7 @@ module Dependabot
 
       # corepack supported package managers
       SUPPORTED_COREPACK_PACKAGE_MANAGERS = %w(npm yarn pnpm).freeze
+      COREPACK_SIGNATURE_METADATA_ERROR = "No compatible signature found in package metadata"
 
       sig { params(lockfile: T.nilable(DependencyFile)).returns(Integer) }
       def self.npm_version_numeric(lockfile)
@@ -564,28 +565,33 @@ module Dependabot
         output_observer: nil,
         env: nil
       )
-        full_command = "corepack #{name} #{command}"
-        fingerprint =  "corepack #{name} #{fingerprint || command}"
+        full_command = T.let("corepack #{name} #{command}", String)
+        command_fingerprint = T.let("corepack #{name} #{fingerprint || command}", String)
 
-        if output_observer
-          return Dependabot::SharedHelpers.run_shell_command(
-            full_command,
-            fingerprint: fingerprint,
-            output_observer: output_observer,
-            env: env
-          ).strip
-        else
-          Dependabot::SharedHelpers.run_shell_command(
-            full_command,
-            fingerprint: fingerprint,
-            env: env
-          )
-        end.strip
+        run_corepack_shell_command(
+          full_command,
+          fingerprint: command_fingerprint,
+          output_observer: output_observer,
+          env: env
+        )
       rescue StandardError => e
         Dependabot.logger.error("Error running package manager command: #{full_command}, Error: #{e.message}")
-        if e.message.match?(/Response Code.*:.*404.*\(Not Found\)/) &&
-           e.message.include?("The remote server failed to provide the requested resource")
-          raise RegistryError.new(404, "The remote server failed to provide the requested resource")
+
+        raise_registry_error_if_not_found(e)
+
+        if retry_without_signature_verification?(error: e, env: env)
+          retry_env = T.must(env).merge(RegistryHelper::COREPACK_INTEGRITY_KEYS_ENV => "")
+          Dependabot.logger.warn(
+            "Corepack signature verification failed against the configured private registry. " \
+            "Retrying once with COREPACK_INTEGRITY_KEYS disabled for this command only."
+          )
+
+          return run_corepack_shell_command(
+            T.must(full_command),
+            fingerprint: T.must(command_fingerprint),
+            output_observer: output_observer,
+            env: retry_env
+          )
         end
 
         raise
@@ -620,6 +626,57 @@ module Dependabot
         registry_helper.find_corepack_env_variables
       end
 
+      sig do
+        params(
+          full_command: String,
+          fingerprint: String,
+          output_observer: CommandHelpers::OutputObserver,
+          env: T.nilable(T::Hash[String, String])
+        ).returns(String)
+      end
+      def self.run_corepack_shell_command(full_command, fingerprint:, output_observer:, env: nil)
+        if output_observer
+          return Dependabot::SharedHelpers.run_shell_command(
+            full_command,
+            fingerprint: fingerprint,
+            output_observer: output_observer,
+            env: env
+          ).strip
+        end
+
+        Dependabot::SharedHelpers.run_shell_command(
+          full_command,
+          fingerprint: fingerprint,
+          env: env
+        ).strip
+      end
+
+      sig { params(error: StandardError).void }
+      def self.raise_registry_error_if_not_found(error)
+        if error.message.match?(/Response Code.*:.*404.*\(Not Found\)/) &&
+           error.message.include?("The remote server failed to provide the requested resource")
+          raise RegistryError.new(404, "The remote server failed to provide the requested resource")
+        end
+      end
+
+      sig { params(error: StandardError, env: T.nilable(T::Hash[String, String])).returns(T::Boolean) }
+      def self.retry_without_signature_verification?(error:, env:)
+        return false unless env
+
+        registry = env[RegistryHelper::COREPACK_NPM_REGISTRY_ENV]
+        return false unless registry
+        return false if default_npm_registry?(registry)
+        return false unless error.message.include?(COREPACK_SIGNATURE_METADATA_ERROR)
+
+        !env.key?(RegistryHelper::COREPACK_INTEGRITY_KEYS_ENV)
+      end
+
+      sig { params(registry: String).returns(T::Boolean) }
+      def self.default_npm_registry?(registry)
+        normalized_registry = RegistryHelper.normalize_registry_url(registry)
+        normalized_registry == RegistryHelper::DEFAULT_NPM_REGISTRY
+      end
+
       private_class_method :run_single_yarn_command
 
       sig { params(pnpm_lock: DependencyFile).returns(T.nilable(String)) }

data/lib/dependabot/npm_and_yarn/metadata_finder.rb

@@ -175,27 +175,37 @@ module Dependabot
 
       sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_registry
-        # Attempt to use version_listing first, as fetching the entire listing
-        # array can be slow (if it's large)
-        potential_sources =
-          [
-            get_source(latest_version_listing["repository"]),
-            get_source(latest_version_listing["homepage"]),
-            get_source(latest_version_listing["bugs"])
-          ].compact
-
-        return potential_sources.first if potential_sources.any?
-
-        potential_sources =
-          all_version_listings.flat_map do |_, listing|
-            [
-              get_source(listing["repository"]),
-              get_source(listing["homepage"]),
-              get_source(listing["bugs"])
-            ]
-          end.compact
-
-        potential_sources.first
+        # Attempt to use the latest version listing first, as fetching the
+        # entire listing array can be slow (if it's large)
+        latest_source = source_from_listing(latest_version_listing)
+        return latest_source if latest_source
+
+        seen_urls = T.let(Set.new, T::Set[String])
+        all_version_listings.each do |_, listing|
+          listing_source = source_from_listing(listing, seen_urls)
+          return listing_source if listing_source
+        end
+
+        nil
+      end
+
+      sig do
+        params(
+          listing: T::Hash[String, T.untyped],
+          seen_urls: T.nilable(T::Set[String])
+        ).returns(T.nilable(Dependabot::Source))
+      end
+      def source_from_listing(listing, seen_urls = nil)
+        [listing["repository"], listing["homepage"], listing["bugs"]].each do |details|
+          url = get_url(details)
+          next unless url
+          next if seen_urls && !seen_urls.add?(url)
+
+          source = get_source(details)
+          return source if source
+        end
+
+        nil
       end
 
       sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped])) }

data/lib/dependabot/npm_and_yarn/registry_helper.rb

@@ -23,6 +23,7 @@ module Dependabot
       COREPACK_NPM_REGISTRY_ENV = "COREPACK_NPM_REGISTRY" # For Corepack
       NPM_CONFIG_REGISTRY_ENV = "npm_config_registry" # For npm
       COREPACK_NPM_TOKEN_ENV = "COREPACK_NPM_TOKEN"
+      COREPACK_INTEGRITY_KEYS_ENV = "COREPACK_INTEGRITY_KEYS"
 
       # Default npm registry - no need to set env vars for this
       DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.385.0
+  version: 0.386.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.386.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.386.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -286,6 +286,10 @@ files:
 - helpers/test/npm/fixtures/vulnerability-auditor/workspace-link-node/package-lock.json
 - helpers/test/npm/fixtures/vulnerability-auditor/workspace-link-node/package.json
 - helpers/test/npm/fixtures/vulnerability-auditor/workspace-link-node/packages/app/package.json
+- helpers/test/npm/fixtures/vulnerability-auditor/workspace-transitive-dependency/package-lock.json
+- helpers/test/npm/fixtures/vulnerability-auditor/workspace-transitive-dependency/package.json
+- helpers/test/npm/fixtures/vulnerability-auditor/workspace-transitive-dependency/packages/app/package.json
+- helpers/test/npm/fixtures/vulnerability-auditor/workspace-transitive-dependency/packages/lib/package.json
 - helpers/test/npm/helpers.ts
 - helpers/test/npm/vulnerability-auditor.test.ts
 - helpers/test/npm6/conflicting-dependency-parser.test.ts
@@ -377,7 +381,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
 rdoc_options: []
 require_paths:
 - lib