diff --git a/npm_and_yarn/lib/dependabot/npm_and_yarn.rb b/npm_and_yarn/lib/dependabot/npm_and_yarn.rb index 151d230a1e8..6ea9834e0a0 100644 --- a/npm_and_yarn/lib/dependabot/npm_and_yarn.rb +++ b/npm_and_yarn/lib/dependabot/npm_and_yarn.rb @@ -362,7 +362,7 @@ def self.sanitize_resolvability_message(error_message, dependencies, yarn_lock) { patterns: [INVALID_NAME_IN_PACKAGE_JSON], handler: lambda { |message, _error, _params| - Dependabot::DependencyFileNotParseable.new(message) + Dependabot::DependencyFileNotResolvable.new(message) }, in_usage: false, matchfn: nil diff --git a/npm_and_yarn/lib/dependabot/npm_and_yarn/registry_parser.rb b/npm_and_yarn/lib/dependabot/npm_and_yarn/registry_parser.rb index 09d40efd599..d1dad8f40bc 100644 --- a/npm_and_yarn/lib/dependabot/npm_and_yarn/registry_parser.rb +++ b/npm_and_yarn/lib/dependabot/npm_and_yarn/registry_parser.rb @@ -46,7 +46,10 @@ def dependency_name end package_name = url_base.gsub("%2F", "/").match(%r{@.*/}) - "#{T.must(package_name)}#{T.must(url_base.gsub('%2F', '/').split('/').last)}" + + return T.must(url_base.gsub("%2F", "/").split("/").last) unless package_name + + "#{package_name}#{T.must(url_base.gsub('%2F', '/').split('/').last)}" end private diff --git a/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater_spec.rb b/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater_spec.rb index 5a90b6a5837..f261c503369 100644 --- a/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater_spec.rb +++ b/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater_spec.rb @@ -144,6 +144,43 @@ end end + context "when there is a private registry we don't have access to" do + let(:project_name) { "pnpm/private_package_access_with_package_name" } + + it "raises a helpful error" do + expect { updated_pnpm_lock_content } + .to raise_error(Dependabot::PrivateSourceAuthenticationFailure) + end + end + + context "when there is a private registry we don't have access to and no package name is mentioned" do + let(:dependency_name) { "rollup" } + let(:version) { "3.29.5" } + let(:previous_version) { "^2.79.1" } + let(:requirements) do + [{ + file: "package.json", + requirement: "3.29.5", + groups: ["devDependencies"], + source: nil + }] + end + let(:previous_requirements) do + [{ + file: "package.json", + requirement: "^2.79.1", + groups: ["devDependencies"], + source: nil + }] + end + let(:project_name) { "pnpm/private_dep_access_with_no_package_name" } + + it "raises a helpful error" do + expect { updated_pnpm_lock_content } + .to raise_error(Dependabot::DependencyNotFound) + end + end + context "when there is a unsupported engine response (pnpm) from registry" do let(:dependency_name) { "eslint" } let(:version) { "9.9.0" } diff --git a/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater_spec.rb b/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater_spec.rb index d85d84af299..36d79adba8e 100644 --- a/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater_spec.rb +++ b/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater_spec.rb @@ -314,13 +314,13 @@ end end - context "with a package.json which contains illegal character '@' in the name" do + context "with a package.json which contains illegal characters in the name" do let(:files) { project_dependency_files("yarn/package_json_contains_illegal_characters_in_name") } it "raises a helpful error" do expect { updated_yarn_lock_content } - .to raise_error(Dependabot::DependencyFileNotParseable) do |error| - expect(error.message).to eq("package.json: Name contains illegal characters not parseable") + .to raise_error(Dependabot::DependencyFileNotResolvable) do |error| + expect(error.message).to eq("package.json: Name contains illegal characters") end end end diff --git a/npm_and_yarn/spec/fixtures/projects/pnpm/private_dep_access_with_no_package_name/package.json b/npm_and_yarn/spec/fixtures/projects/pnpm/private_dep_access_with_no_package_name/package.json new file mode 100644 index 00000000000..60040350f14 --- /dev/null +++ b/npm_and_yarn/spec/fixtures/projects/pnpm/private_dep_access_with_no_package_name/package.json @@ -0,0 +1,6 @@ +{ + "private": true, + "devDependencies": { + "npm:rollup": "^2.79.1" + } +} diff --git a/npm_and_yarn/spec/fixtures/projects/pnpm/private_dep_access_with_no_package_name/pnpm-lock.yaml b/npm_and_yarn/spec/fixtures/projects/pnpm/private_dep_access_with_no_package_name/pnpm-lock.yaml new file mode 100644 index 00000000000..bb4ac00397f --- /dev/null +++ b/npm_and_yarn/spec/fixtures/projects/pnpm/private_dep_access_with_no_package_name/pnpm-lock.yaml @@ -0,0 +1,13 @@ +lockfileVersion: '6.0' + +settings: + autoInstallPeers: true + excludeLinksFromLockfile: false + +importers: + + .: + devDependencies: + rollup: + specifier: ^2.79.1 + version: 2.79.1 diff --git a/npm_and_yarn/spec/fixtures/projects/pnpm/private_package_access_with_package_name/.npmrc b/npm_and_yarn/spec/fixtures/projects/pnpm/private_package_access_with_package_name/.npmrc new file mode 100644 index 00000000000..39674baccea --- /dev/null +++ b/npm_and_yarn/spec/fixtures/projects/pnpm/private_package_access_with_package_name/.npmrc @@ -0,0 +1 @@ +@private-pkg:registry=https://npm.pkg.github.com diff --git a/npm_and_yarn/spec/fixtures/projects/pnpm/private_package_access_with_package_name/package.json b/npm_and_yarn/spec/fixtures/projects/pnpm/private_package_access_with_package_name/package.json new file mode 100644 index 00000000000..b3f4faa3b49 --- /dev/null +++ b/npm_and_yarn/spec/fixtures/projects/pnpm/private_package_access_with_package_name/package.json @@ -0,0 +1,5 @@ +{ + "dependencies": { + "@private-pkg/inner-source-top-secret-npm-2": "1.0.3" + } +} diff --git a/npm_and_yarn/spec/fixtures/projects/pnpm/private_package_access_with_package_name/pnpm-lock.yaml b/npm_and_yarn/spec/fixtures/projects/pnpm/private_package_access_with_package_name/pnpm-lock.yaml new file mode 100644 index 00000000000..3c6b34e898a --- /dev/null +++ b/npm_and_yarn/spec/fixtures/projects/pnpm/private_package_access_with_package_name/pnpm-lock.yaml @@ -0,0 +1,16 @@ +lockfileVersion: '6.0' + +settings: + autoInstallPeers: true + excludeLinksFromLockfile: false + +dependencies: + 'exp-npm-2': + specifier: 1.0.3 + version: 1.0.3 + +packages: + + /exp-npm-2@1.0.3: + resolution: {integrity: sha512-5Kt5AHgt2qE9YFlRnqizh36k1lcuTdGQP3UsxJgxVUo1Uxh4Z7vDgr7wDBm2hp4PjZ6soE4zupSyfaCbYguQqg==, tarball: https://npm.pkg.github.com/download/@dsp-testing/inner-source-top-secret-npm-2/1.0.3/0a19a66110450848d0a88b1be211cadae740a86f0c1c1658ed89c9f391b8f605} + dev: false