Pass --min-release-age=0 for npm security updates to bypass .npmrc#15139
Conversation
yeikel
changed the title
--min-release-age=0 for npm security updates to bypass npmrc
yeikel
force-pushed
the
fix-min-release-age-security
branch
6 times, most recently
from
c73617c to
6e776fe
Compare
yeikel
force-pushed
the
fix-min-release-age-security
branch
2 times, most recently
from
af699b2 to
7c2f6a2
Compare
|
The tests failures are unrelated to my changes but I re-generated them here dependabot/smoke-tests#518 |
yeikel
changed the title
--min-release-age=0 for npm security updates to bypass npmrc--min-release-age=0 for npm security updates to bypass .npmrc
…ting When a project sets min-release-age in .npmrc, npm refuses to install package versions released more recently than the configured age window. Dependabot ignores its own cooldown for security updates, but min-release-age is enforced by npm itself at runtime, so security update PRs fail with ETARGET when the fix version is too new. Pass --min-release-age=0 to the npm install command in NpmLockfileUpdater when running a security update job, overriding the .npmrc setting only for that invocation. The security_updates_only flag is threaded from the Job through DependencyChangeBuilder and FileUpdater options into NpmLockfileUpdater. Fixes dependabot#15112
yeikel
force-pushed
the
fix-min-release-age-security
branch
from
7c2f6a2 to
7b05e51
Compare
|
@yeikel Seems like this affects yarn and pnpm too. Any chance you could expand this PR to cover those ecosystems as well? If not, I'll follow up with a separate PR. I'd also like to pass min-release-age through to cooldown, though I'm not sure that's the right route forward. But that might beyond the scope of this |
Thank you for the feedback @robaiken I did this intentionally to keep the change small and scoped as there are dedicated issues for yarn and pnpm If you don't mind, I think that we could review and sign on this approach and then I'd be happy to send two follow up PRs to cover the other ecosystems. What do you think?
Please see #15132 |
|
Thank you for deploying this. I can confirm that it is now working as expected |
|
@yeikel nice, thanks for the update. I am getting ready to merge your next pr |
2 participants
What are you trying to accomplish?
When a project sets
min-release-agein.npmrc, npm refuses to resolve versions newer than the configured age window. This blocks security updates when the fix version was released too recently, producing anETARGETerror. For security updates the age restriction should not apply, so--min-release-age=0is now appended to thenpm installcommand when security advisories are present.Fixes #15112
How will you know you've accomplished your goal?
I documented and tested with a reproducer : https://github.com/yeikel/dependabot-reproducer-issue-15112
Example failure: https://github.com/yeikel/dependabot-reproducer-issue-15112/actions/runs/26425464099
Example logs:
Validating the change involved running my updated version in the security context using the reproducer:
Job details
{ "job": { "command": "security", "allowed-updates": [ { "dependency-type": "direct", "update-type": "all" } ], "commit-message-options": { "prefix": null, "prefix-development": null, "include-scope": null }, "credentials-metadata": [ { "type": "git_source", "host": "github.com" } ], "debug": null, "dependencies": [ "lodash" ], "dependency-groups": [], "dependency-group-to-refresh": null, "existing-pull-requests": [], "existing-group-pull-requests": [], "experiments": { "record-ecosystem-versions": true, "record-update-job-unknown-error": true, "proxy-cached": true, "enable-corepack-for-npm-and-yarn": true, "enable-private-registry-for-corepack": true, "allow-refresh-for-existing-pr-dependencies": true, "allow-refresh-group-with-all-dependencies": true, "azure-registry-backup": true, "enable-enhanced-error-details-for-updater": true, "gradle-lockfile-updater": true, "enable-exclude-paths-subdirectory-manifest-files": true }, "ignore-conditions": [], "lockfile-only": false, "max-updater-run-time": 2700, "package-manager": "npm_and_yarn", "requirements-update-strategy": null, "reject-external-code": false, "security-advisories": [ { "dependency-name": "lodash", "patched-versions": [], "unaffected-versions": [], "affected-versions": [ ">= 4.0.0 <= 4.17.23" ] }, { "dependency-name": "lodash", "patched-versions": [], "unaffected-versions": [], "affected-versions": [ "<= 4.17.23" ] }, { "dependency-name": "lodash", "patched-versions": [], "unaffected-versions": [], "affected-versions": [ ">= 4.0.0 <= 4.17.22" ] }, { "dependency-name": "lodash", "patched-versions": [], "unaffected-versions": [], "affected-versions": [ ">= 4.0.0 < 4.17.21" ] }, { "dependency-name": "lodash", "patched-versions": [], "unaffected-versions": [], "affected-versions": [ "<= 4.17.21" ] }, { "dependency-name": "lodash", "patched-versions": [], "unaffected-versions": [], "affected-versions": [ "< 4.17.21" ] }, { "dependency-name": "lodash", "patched-versions": [], "unaffected-versions": [], "affected-versions": [ ">= 3.7.0 < 4.17.19" ] }, { "dependency-name": "lodash", "patched-versions": [], "unaffected-versions": [], "affected-versions": [ ">= 4.7.0 < 4.17.11" ] }, { "dependency-name": "lodash", "patched-versions": [], "unaffected-versions": [], "affected-versions": [ "< 4.17.12" ] }, { "dependency-name": "lodash", "patched-versions": [], "unaffected-versions": [], "affected-versions": [ "< 4.17.11" ] }, { "dependency-name": "lodash", "patched-versions": [], "unaffected-versions": [], "affected-versions": [ "< 4.17.5" ] } ], "security-updates-only": true, "source": { "provider": "github", "repo": "yeikel/dependabot-reproducer-issue-15112", "branch": null, "api-endpoint": "https://api.github.com/", "hostname": "github.com", "directories": [ "/." ] }, "updating-a-pull-request": false, "update-subdependencies": false, "vendor-dependencies": false, "enable-beta-ecosystems": false, "repo-private": false, "multi-ecosystem-update": false, "exclude-paths": null } }Before
After
Checklist