Module: Dependabot::NpmAndYarn::NativeHelpers

Extended by:
T::Sig
Defined in:
lib/dependabot/npm_and_yarn/native_helpers.rb

Constant Summary collapse

PNPM_VERSION_REGEX = 
/\A(?<major>\d+)\.\d+\.\d+(?:[-+][0-9A-Za-z.+-]+)?\z/

Class Method Summary collapse

Class Method Details

.helper_path ⇒ Object 



15
16
17
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 15

def self.helper_path
  "node #{File.join(native_helpers_root, 'dist', 'run.js')}"
end

.native_helpers_root ⇒ Object 



20
21
22
23
24
25
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 20

def self.native_helpers_root
  helpers_root = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
  return File.join(helpers_root, "npm_and_yarn") unless helpers_root.nil?

  File.join(__dir__, "../../../helpers")
end

.run_npm8_subdependency_update_command(dependency_names, security_updates_only: false) ⇒ Object 



28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 28

def self.run_npm8_subdependency_update_command(dependency_names, security_updates_only: false)
  # NOTE: npm options
  # - `--force` ignores checks for platform (os, cpu) and engines
  # - `--ignore-scripts` disables prepare and prepack scripts which are run
  #   when installing git dependencies
  command_args = [
    "update",
    *dependency_names,
    "--force",
    "--ignore-scripts",
    "--package-lock-only"
  ]
  # Override any min-release-age set in .npmrc: security fixes must not be
  # blocked by a release-age gate the user configured for regular updates.
  command_args << "--min-release-age=0" if security_updates_only
  command = command_args.join(" ")

  fingerprint_args = [
    "update",
    "<dependency_names>",
    "--force",
    "--ignore-scripts",
    "--package-lock-only"
  ]
  fingerprint_args << "--min-release-age=0" if security_updates_only
  fingerprint = fingerprint_args.join(" ")

  Helpers.run_npm_command(command, fingerprint: fingerprint)
end

.run_npm_audit_fix_command(security_updates_only: false) ⇒ Object 



59
60
61
62
63
64
65
66
67
68
69
70
71
72
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 59

def self.run_npm_audit_fix_command(security_updates_only: false)
  # Fallback for transitive dependencies in workspace repos where
  # `npm update` is a no-op because the package isn't in package.json.
  # `npm audit fix` updates all fixable vulnerabilities in the lockfile.
  # `--force` ignores checks for platform (os, cpu) and engines,
  # matching the flags used by run_npm8_subdependency_update_command.
  command = "audit fix --force --package-lock-only --ignore-scripts"
  # Override any min-release-age set in .npmrc: security fixes must not be
  # blocked by a release-age gate the user configured for regular updates.
  command += " --min-release-age=0" if security_updates_only
  fingerprint = command

  Helpers.run_npm_command(command, fingerprint: fingerprint)
end

.run_pnpm_audit_fix_command ⇒ Object 



75
76
77
78
79
80
81
82
83
84
85
86
87
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 75

def self.run_pnpm_audit_fix_command
  # Fallback for transitive dependencies where `pnpm update` is a no-op.
  # pnpm 11's update fix method updates vulnerable packages in the lockfile.
  # Older supported versions only accept `--fix`, which may add manifest overrides.
  version_output = Helpers.run_pnpm_command("-v", fingerprint: "-v")
  fix_option = pnpm_major_version(version_output) >= 11 ? "--fix=update" : "--fix"
  command = "audit #{fix_option}"

  Helpers.run_pnpm_command(
    command,
    fingerprint: command
  )
end

.run_pnpm_deep_update_command(dependency_name, recursive: false) ⇒ Object 



101
102
103
104
105
106
107
108
109
110
111
112
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 101

def self.run_pnpm_deep_update_command(dependency_name, recursive: false)
  # `pnpm update --depth Infinity <dep>` traverses the full dependency
  # graph, allowing transitive dependencies to be updated in the lockfile
  # without relying on audit fixes that may modify manifests on older pnpm versions.
  # `-r --include-workspace-root` is required for workspace repos so the
  # update is applied across all packages.
  flags = recursive ? "-r --include-workspace-root " : ""
  Helpers.run_pnpm_command(
    "#{flags}update #{dependency_name} --depth Infinity --lockfile-only",
    fingerprint: "#{flags}update <dependency_name> --depth Infinity --lockfile-only"
  )
end

.run_yarn_audit_fix_command ⇒ Object 



115
116
117
118
119
120
121
122
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 115

def self.run_yarn_audit_fix_command
  # Fallback for transitive dependencies where `yarn up -R` is a no-op.
  # `yarn npm audit --fix` updates vulnerable deps in the lockfile.
  Helpers.run_yarn_command(
    "npm audit --fix --mode update-lockfile",
    fingerprint: "npm audit --fix --mode update-lockfile"
  )
end