diff --git a/common/lib/dependabot/errors.rb b/common/lib/dependabot/errors.rb index 1db1a2873da..3c604199e77 100644 --- a/common/lib/dependabot/errors.rb +++ b/common/lib/dependabot/errors.rb @@ -149,11 +149,6 @@ def self.parser_error_details(error) "error-type": "git_dependencies_not_reachable", "error-detail": { "dependency-urls": error.dependency_urls } } - when Dependabot::UnresolvableVersionError - { - "error-type": "unresolvable_version", - "error-detail": { dependencies: error.dependencies } - } when Dependabot::NotImplemented { "error-type": "not_implemented", @@ -671,23 +666,6 @@ def initialize(dependencies) end end - class UnresolvableVersionError < DependabotError - extend T::Sig - - sig { returns(T::Array[String]) } - attr_reader :dependencies - - sig { params(dependencies: T::Array[String]).void } - def initialize(dependencies) - @dependencies = dependencies - - msg = "Unable to determine semantic version from tags or commits for dependencies. " \ - "Dependencies must have a tag or commit that references a semantic version. " \ - "Affected dependencies: #{@dependencies.join(', ')}" - super(msg) - end - end - class GitDependenciesNotReachable < DependabotError extend T::Sig diff --git a/github_actions/lib/dependabot/github_actions/file_parser.rb b/github_actions/lib/dependabot/github_actions/file_parser.rb index fc53914e0d9..ba80eb1e62a 100644 --- a/github_actions/lib/dependabot/github_actions/file_parser.rb +++ b/github_actions/lib/dependabot/github_actions/file_parser.rb @@ -30,12 +30,6 @@ def parse dependency_set += workfile_file_dependencies(file) end - dependencies_without_version = dependency_set.dependencies.select { |dep| dep.version.nil? } - unless dependencies_without_version.empty? - raise UnresolvableVersionError, - dependencies_without_version.map(&:name) - end - dependency_set.dependencies end diff --git a/github_actions/spec/dependabot/github_actions/file_parser_spec.rb b/github_actions/spec/dependabot/github_actions/file_parser_spec.rb index 40e0be6a30a..4756049feb8 100644 --- a/github_actions/spec/dependabot/github_actions/file_parser_spec.rb +++ b/github_actions/spec/dependabot/github_actions/file_parser_spec.rb @@ -560,27 +560,6 @@ def mock_service_pack_request(nwo) end end end - - context "with an unresolvable version" do - let(:workflow_file_fixture_name) { "unresolved_version.yml" } - let(:service_pack_url) do - "https://github.com/taiki-e/install-action.git/info/refs" \ - "?service=git-upload-pack" - end - - before do - mock_service_pack_request("taiki-e/install-action") - end - - it "raises an UnresolvableVersionError error" do - expect { parser.parse }.to raise_error( - Dependabot::UnresolvableVersionError, - "Unable to determine semantic version from tags or commits for dependencies. " \ - "Dependencies must have a tag or commit that references a semantic version. " \ - "Affected dependencies: taiki-e/install-action" - ) - end - end end describe "#ecosystem" do diff --git a/github_actions/spec/fixtures/workflow_files/unresolved_version.yml b/github_actions/spec/fixtures/workflow_files/unresolved_version.yml deleted file mode 100644 index 432e2bf2323..00000000000 --- a/github_actions/spec/fixtures/workflow_files/unresolved_version.yml +++ /dev/null @@ -1,7 +0,0 @@ -on: [push] - -name: Integration -jobs: - chore: - steps: - - uses: taiki-e/install-action@nextest diff --git a/npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser/pnpm_lock.rb b/npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser/pnpm_lock.rb index 5bcee19a1fe..2fac653f1c6 100644 --- a/npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser/pnpm_lock.rb +++ b/npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser/pnpm_lock.rb @@ -26,6 +26,10 @@ def parsed end def dependencies + if Dependabot::Experiments.enabled?(:enable_fix_for_pnpm_no_change_error) + return dependencies_with_prioritization + end + dependency_set = Dependabot::FileParsers::Base::DependencySet.new parsed.each do |details| @@ -52,6 +56,49 @@ def dependencies dependency_set end + def dependencies_with_prioritization + dependency_set = Dependabot::FileParsers::Base::DependencySet.new + + # Separate dependencies into two categories: with specifiers and without specifiers. + dependencies_with_specifiers = [] # Main dependencies with specifiers. + dependencies_without_specifiers = [] # Subdependencies without specifiers. + + parsed.each do |details| + next if details["aliased"] + + name = details["name"] + version = details["version"] + + dependency_args = { + name: name, + version: version, + package_manager: "npm_and_yarn", + requirements: [] + } + + # Add metadata for subdependencies if marked as a dev dependency. + dependency_args[:subdependency_metadata] = [{ production: !details["dev"] }] if details["dev"] + + specifiers = details["specifiers"] + if specifiers&.any? + dependencies_with_specifiers << dependency_args + else + dependencies_without_specifiers << dependency_args + end + end + + # Add prioritized dependencies to the dependency set. + dependencies_with_specifiers.each do |dependency_args| + dependency_set << Dependency.new(**dependency_args) + end + + dependencies_without_specifiers.each do |dependency_args| + dependency_set << Dependency.new(**dependency_args) + end + + dependency_set + end + def details(dependency_name, requirement, _manifest_name) details_candidates = parsed.select { |info| info["name"] == dependency_name } diff --git a/npm_and_yarn/spec/dependabot/npm_and_yarn/file_parser_spec.rb b/npm_and_yarn/spec/dependabot/npm_and_yarn/file_parser_spec.rb index 64e5d249fd7..186cb4f959b 100644 --- a/npm_and_yarn/spec/dependabot/npm_and_yarn/file_parser_spec.rb +++ b/npm_and_yarn/spec/dependabot/npm_and_yarn/file_parser_spec.rb @@ -46,6 +46,8 @@ .with(:enable_shared_helpers_command_timeout).and_return(true) allow(Dependabot::Experiments).to receive(:enabled?) .with(:npm_v6_deprecation_warning).and_return(true) + allow(Dependabot::Experiments).to receive(:enabled?) + .with(:enable_fix_for_pnpm_no_change_error).and_return(true) end after do diff --git a/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater_spec.rb b/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater_spec.rb index cbed3e77ff4..b465239d2c7 100644 --- a/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater_spec.rb +++ b/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater_spec.rb @@ -72,6 +72,8 @@ .with(:enable_corepack_for_npm_and_yarn).and_return(enable_corepack_for_npm_and_yarn) allow(Dependabot::Experiments).to receive(:enabled?) .with(:enable_shared_helpers_command_timeout).and_return(true) + allow(Dependabot::Experiments).to receive(:enabled?) + .with(:enable_fix_for_pnpm_no_change_error).and_return(true) end after do diff --git a/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater_spec.rb b/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater_spec.rb index a96a61038f4..44018835671 100644 --- a/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater_spec.rb +++ b/npm_and_yarn/spec/dependabot/npm_and_yarn/file_updater_spec.rb @@ -72,6 +72,8 @@ .with(:enable_shared_helpers_command_timeout).and_return(true) allow(Dependabot::Experiments).to receive(:enabled?) .with(:npm_v6_deprecation_warning).and_return(true) + allow(Dependabot::Experiments).to receive(:enabled?) + .with(:enable_fix_for_pnpm_no_change_error).and_return(true) end after do diff --git a/npm_and_yarn/spec/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver_spec.rb b/npm_and_yarn/spec/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver_spec.rb index 290a2e6b4d2..5f014923054 100644 --- a/npm_and_yarn/spec/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver_spec.rb +++ b/npm_and_yarn/spec/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver_spec.rb @@ -45,6 +45,8 @@ .with(:enable_shared_helpers_command_timeout).and_return(true) allow(Dependabot::Experiments).to receive(:enabled?) .with(:npm_v6_deprecation_warning).and_return(true) + allow(Dependabot::Experiments).to receive(:enabled?) + .with(:enable_fix_for_pnpm_no_change_error).and_return(true) end after do diff --git a/npm_and_yarn/spec/dependabot/npm_and_yarn/update_checker/version_resolver_spec.rb b/npm_and_yarn/spec/dependabot/npm_and_yarn/update_checker/version_resolver_spec.rb index 778745eb63a..aeb5f22a07e 100644 --- a/npm_and_yarn/spec/dependabot/npm_and_yarn/update_checker/version_resolver_spec.rb +++ b/npm_and_yarn/spec/dependabot/npm_and_yarn/update_checker/version_resolver_spec.rb @@ -87,6 +87,8 @@ .with(:enable_shared_helpers_command_timeout).and_return(true) allow(Dependabot::Experiments).to receive(:enabled?) .with(:npm_v6_deprecation_warning).and_return(true) + allow(Dependabot::Experiments).to receive(:enabled?) + .with(:enable_fix_for_pnpm_no_change_error).and_return(true) end after do