Issues when updating git dependencies in PNPM #7258
Labels
Comments
deivid-rodriguez
added
T: bug 🐞
|
Same situation here. Dependabot Update logsHere is a live repo for repro. "difflib": "github:postlight/difflib.js", |
|
Thanks for that example, will make this much easier to fix confidently! |
|
@deivid-rodriguez We might be able to fix it with a small change to the Git shim. It's currently restricted to which commands to run here, and the protocols to rewrite here. |
|
Yep, I was just looking at that! |
|
We'd need to allow |
|
@deivid-rodriguez Yep, I think that would do it! |
|
Awesome, I'll look into it. This is reproducible with the CLI only, so I'll add a smoke tests since I'm at it! |
|
I wasn't lucky with the git-shim changes, but this other tweak seems to do the trick! diff --git a/common/lib/dependabot/shared_helpers.rb b/common/lib/dependabot/shared_helpers.rb
index 80294552d..9870c1ac9 100644
--- a/common/lib/dependabot/shared_helpers.rb
+++ b/common/lib/dependabot/shared_helpers.rb
@@ -274,6 +274,10 @@ module Dependabot
"git config --global --add url.https://#{host}/." \
"insteadOf git://#{host}/"
)
+ run_shell_command(
+ "git config --global --add url.https://#{host}/." \
+ "insteadOf git+ssh://git@#{host}/"
+ )
end
def self.reset_git_repo(path) |
|
@deivid-rodriguez probably still worth updating the pnpm smoke test to include this case? |
|
There's no pnpm smoke test yet 😳, I'll be adding one though to test this case, yeah. |
|
Just to post today's debugging of this issue, I found the culprit is here: In that method PNPM tries to do a manual HEAD request to Some debugging prints on the failing HEAD request shows this error: It seems like some DNS issue/misconfiguration specific to our CLI/production environment 😬. One potential solution would be to change PNPM to use |
|
I think I figured it out! |
|
@deivid-rodriguez That makes sense. Since the Updater container is on a network where only HTTP(S) is allowed to the proxy, if it were to ignore the proxy setting the first thing it would do is make a DNS request, which will fail. When using the proxy the DNS request happens on the Proxy container. |
1 task
|
I opened an issue and a raw patch to PNPM! |
This was referenced May 12, 2023
Closed
1 task
This was referenced Apr 22, 2024
TonyRL
added a commit
to DIYgod/RSSHub
that referenced
this issue
Nov 5, 2024
remove auto commit since it skips tests related: dependabot/dependabot-core#7258 dependabot/dependabot-core#7851 dependabot/dependabot-core#10124 pnpm/pnpm#6050 pnpm/pnpm#6530 pnpm/pnpm#8343
Gnosnay
pushed a commit
to Gnosnay/RSSHub
that referenced
this issue
Nov 11, 2024
remove auto commit since it skips tests related: dependabot/dependabot-core#7258 dependabot/dependabot-core#7851 dependabot/dependabot-core#10124 pnpm/pnpm#6050 pnpm/pnpm#6530 pnpm/pnpm#8343
MinmoTech
pushed a commit
to MinmoTech/MyRsshub
that referenced
this issue
Nov 24, 2024
remove auto commit since it skips tests related: dependabot/dependabot-core#7258 dependabot/dependabot-core#7851 dependabot/dependabot-core#10124 pnpm/pnpm#6050 pnpm/pnpm#6530 pnpm/pnpm#8343
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is there an existing issue for this?
Package ecosystem
npm
Package manager version
PNPM
Language version
No response
Manifest location and content before the Dependabot update
I don't have a repro for this yet, but we're seeing issues in private repositories related to upgrading dependencies coming from git sources.
dependabot.yml content
No response
Updated dependency
No response
What you expected to see, versus what you actually saw
Updates should happen correctly without errors.
In particular, we see errors like the following:
I have not been able to reproduce this locally. Everytime I specify
git+sshon a package.json file,pnpmignores it and useshttps. However, that's not happening in these repositories for some reason.Yarn & NPM have specific code to replace
git+sshwithhttpsinpackage.jsonbefore trying to update a lockfile, and then replacing back the updatedhttpsreferences withgit+sshagain. So I guess this is a common problem in other package manager, so I will try to "blindly" fix it by applying the same fix.Some preparatory work for that is at #7245.
In general, we should also review how updates behave with
gitdependencies, since I have not done any explicit testing with that.Native package manager behavior
No response
Images of the diff or a link to the PR, issue, or logs
No response
Smallest manifest that reproduces the issue
No response
The text was updated successfully, but these errors were encountered: