Module: Dependabot::NpmAndYarn::NativeHelpers

Extended by:
T::Sig
Defined in:
lib/dependabot/npm_and_yarn/native_helpers.rb

Constant Summary collapse

PNPM_VERSION_REGEX = 
/\A(?<major>\d+)\.\d+\.\d+(?:[-+][0-9A-Za-z.+-]+)?\z/

Class Method Summary collapse

Class Method Details

.fingerprint_min_release_age_arg(arg) ⇒ Object 



81
82
83
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 81

def self.fingerprint_min_release_age_arg(arg)
  arg == "--min-release-age=0" ? arg : "--min-release-age=<days>"
end

.helper_path ⇒ Object 



15
16
17
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 15

def self.helper_path
  "node #{File.join(native_helpers_root, 'dist', 'run.js')}"
end

.native_helpers_root ⇒ Object 



20
21
22
23
24
25
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 20

def self.native_helpers_root
  helpers_root = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
  return File.join(helpers_root, "npm_and_yarn") unless helpers_root.nil?

  File.join(__dir__, "../../../helpers")
end

.pnpm_audit_fix_command ⇒ Object 



86
87
88
89
90
91
92
93
94
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 86

def self.pnpm_audit_fix_command
  # Fallback for transitive dependencies where `pnpm update` is a no-op.
  # pnpm 11's update fix method updates vulnerable packages in the lockfile.
  # Older supported versions only accept `--fix`, which may add manifest overrides.
  version_output = Helpers.run_pnpm_command("-v", fingerprint: "-v")
  fix_option = pnpm_major_version(version_output) >= 11 ? "--fix=update" : "--fix"
  command = "audit #{fix_option}"
  [command, command]
end

.pnpm_deep_update_command(dependency_name, recursive: false) ⇒ Object 



114
115
116
117
118
119
120
121
122
123
124
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 114

def self.pnpm_deep_update_command(dependency_name, recursive: false)
  # `pnpm update --depth Infinity <dep>` traverses the full dependency
  # graph, allowing transitive dependencies to be updated in the lockfile
  # without relying on audit fixes that may modify manifests on older pnpm versions.
  # `-r --include-workspace-root` is required for workspace repos so the
  # update is applied across all packages.
  flags = recursive ? "-r --include-workspace-root " : ""
  cmd = "#{flags}update #{dependency_name} --depth Infinity --lockfile-only"
  fingerprint = "#{flags}update <dependency_name> --depth Infinity --lockfile-only"
  [cmd, fingerprint]
end

.run_npm8_subdependency_update_command(dependency_names, min_release_age_arg: nil) ⇒ Object 



30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 30

def self.run_npm8_subdependency_update_command(dependency_names, min_release_age_arg: nil)
  # NOTE: npm options
  # - `--force` ignores checks for platform (os, cpu) and engines
  # - `--ignore-scripts` disables prepare and prepack scripts which are run
  #   when installing git dependencies
  command_args = [
    "update",
    *dependency_names,
    "--force",
    "--ignore-scripts",
    "--package-lock-only"
  ]
  # Apply the effective release-age gate: `=0` bypasses any `.npmrc` gate for
  # security fixes, a positive value enforces the dependabot.yml cooldown
  # floor on transitive updates. nil leaves npm's own resolution untouched.
  command_args << min_release_age_arg if min_release_age_arg
  command = command_args.join(" ")

  fingerprint_args = [
    "update",
    "<dependency_names>",
    "--force",
    "--ignore-scripts",
    "--package-lock-only"
  ]
  fingerprint_args << fingerprint_min_release_age_arg(min_release_age_arg) if min_release_age_arg
  fingerprint = fingerprint_args.join(" ")

  Helpers.run_npm_command(command, fingerprint: fingerprint)
end

.run_npm_audit_fix_command(min_release_age_arg: nil) ⇒ Object 



62
63
64
65
66
67
68
69
70
71
72
73
74
75
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 62

def self.run_npm_audit_fix_command(min_release_age_arg: nil)
  # Fallback for transitive dependencies in workspace repos where
  # `npm update` is a no-op because the package isn't in package.json.
  # `npm audit fix` updates all fixable vulnerabilities in the lockfile.
  # `--force` ignores checks for platform (os, cpu) and engines,
  # matching the flags used by run_npm8_subdependency_update_command.
  command = "audit fix --force --package-lock-only --ignore-scripts"
  # Apply the effective release-age gate (see run_npm8_subdependency_update_command).
  command += " #{min_release_age_arg}" if min_release_age_arg
  fingerprint = "audit fix --force --package-lock-only --ignore-scripts"
  fingerprint += " #{fingerprint_min_release_age_arg(min_release_age_arg)}" if min_release_age_arg

  Helpers.run_npm_command(command, fingerprint: fingerprint)
end

.run_pnpm_audit_fix_command ⇒ Object 



97
98
99
100
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 97

def self.run_pnpm_audit_fix_command
  command, fingerprint = pnpm_audit_fix_command
  Helpers.run_pnpm_command(command, fingerprint: fingerprint)
end

.run_pnpm_deep_update_command(dependency_name, recursive: false) ⇒ Object 



127
128
129
130
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 127

def self.run_pnpm_deep_update_command(dependency_name, recursive: false)
  cmd, fingerprint = pnpm_deep_update_command(dependency_name, recursive: recursive)
  Helpers.run_pnpm_command(cmd, fingerprint: fingerprint)
end

.run_yarn_audit_fix_command(env: nil) ⇒ Object 



133
134
135
136
137
138
139
140
141
142
143
144
 
# File 'lib/dependabot/npm_and_yarn/native_helpers.rb', line 133

def self.run_yarn_audit_fix_command(env: nil)
  # Fallback for transitive dependencies where `yarn up -R` is a no-op.
  # `yarn npm audit --fix` updates vulnerable deps in the lockfile. The
  # release-age gate env is threaded through so this lockfile-resolving
  # command honours the same cooldown (and security `=0` bypass) as the
  # primary add/dedupe/remove commands.
  Helpers.run_yarn_command(
    "npm audit --fix --mode update-lockfile",
    fingerprint: "npm audit --fix --mode update-lockfile",
    env: env
  )
end