Read npm min-release-age from .npmrc and apply as cooldown#15132
Open
yeikel wants to merge 1 commit into
Open
Conversation
yeikel
force-pushed
the
npm-min-release-age
branch
4 times, most recently
from
3404fc2 to
e5daee2
Compare
- `default_days` now uses `[existing.default_days, npmrc_days].max` so the npmrc value never lowers a higher value set in dependabot.yml - Conflict warning is conditional: only fires when at least one cooldown field is actually below the npmrc threshold; otherwise logs at debug - Removed `default_days` from the per-field override-warning loop; the top-level conflict message covers it; per-field messages are for the three `semver_*_days` fields only - `.npmrc` filename match tightened to `File.basename(f.name) == ".npmrc"` to avoid false matches like `foo.npmrc` - Extracted `log_npmrc_cooldown_conflicts` and `merge_cooldown_with_npmrc_floor` helpers (satisfies Rubocop Metrics cops) - TODO comment added for Yarn 4.10+ `npmMinimalAgeGate` follow-up Spec changes: - "when explicit update_cooldown already exceeds the npmrc floor": asserts default_days stays unchanged and no warning is logged - "when dependabot.yml default_days is below the npmrc floor": expects conflict warning once and per-field warnings for semver fields only - Replace `instance_variable_get(:@update_cooldown)` with `checker.update_cooldown`
yeikel
force-pushed
the
npm-min-release-age
branch
from
e5daee2 to
b07b1cf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
min-release-agesetting in.npmrcprevents installing any package version younger than N days. Dependabot was unaware of this setting, so it could try to open PRs for versions that would violate user's configurationThis pull request reads
min-release-agefrom.npmrcand uses its value as a lower bound on everyupdate_cooldownfield. If noupdate_cooldownis configured independabot.yml, one is created from the npmrc value. If one is already configured, the npmrc value only raises individual fields that are below itFixes #14151
Merge semantics
update_cooldownindependabot.ymldefault_days=.npmrcvaluedependabot.ymldefault_days>= npmrc valuedependabot.ymldefault_days< npmrc valuedefault_daysraised to npmrc floor; warn loggedsemver_*_daysfield < npmrc valueinclude/excludepatternsmin-release-ageglobally with no per-package filteringThe npmrc value acts as a floor: it can only raise cooldown values, never lower them.
Anything you want to highlight for special attention from reviewers?
.npmrcanddependabot.ymlcooldown settings don't translate cleanly. This is, for the most part, because Dependabot support features that npm does not support yetnpm's
min-release-ageis a global, unconditional install-time constraint with no per-package filteringdependabot.ymlsupportsinclude/excludepatterns and per-semver thresholds that have no npm equivalent. When both are present, the choices are: honourdependabot.ymlas-is and risk Dependabot proposing versionsnpm installimmediately rejects; or usemin-release-ageas a floor and silently drop incompatibledependabot.ymlfeaturesThis PR takes the second path on the grounds that a broken install is worse than a dropped preference, with a log warning to surface the trade-off. A third option such as failing the pipeline on conflict seems more damaging.
How will you know you've accomplished your goal?
Reproducer: https://github.com/yeikel/dependabot-issue-14151
Without this change, dependabot happily suggests the latest version of my dependency at test(3.5.34) ignoring my
min-release-ageconfiguration :However, after this change, it suggests the version the configuration expects(3.4.27):
https://github.com/yeikel/dependabot-issue-14151/blob/bfc9181bbe5b21e8c9f2a8b0853506164946cdab/.npmrc#L1
Checklist