[NPM] Registry inferring ignores the registry resource path

[yeikel]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

npm

Package manager version

No response

Language version

6

Manifest location and content before the Dependabot update

No response

dependabot.yml content

I am using dependabot core directly

Updated dependency

No response

What you expected to see, versus what you actually saw

When a dependency is declared in a private registry such as :

"cors": {
			"version": "2.8.5",
			"resolved": "https://myRegistry/api/npm/npm/cors/-/cors-2.8.5.tgz",
			"integrity": "sha1-6sEdpRWS3Ya58G9uesKTs9+HXSk=",
			"requires": {
				"object-assign": "^4",
				"vary": "^1"
			}
		},

The registry detection detects the registry as https://myRegistry/ when it should detect the full URI https://myRegistry/api/npm/npm/

That results in 404 errors when the updater tries to query https://myRegistry/ instead of the expected https://myRegistry/api/npm/npm/

Likely offending code:

dependabot-core/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb

Line 104 in 30f9e40

known_registries << "#{uri.scheme}://#{uri.host}" if uri.scheme && uri.host

One solution for now, is to explicitly declare the registry using .npmrc

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

{"error":"404 Not Found - GET https://myRegistry/cors"}

Smallest manifest that reproduces the issue

Run the registry detection using a private registry like this:

"cors": {
			"version": "2.8.5",
			"resolved": "https://myRegistry/api/npm/npm/cors/-/cors-2.8.5.tgz",
			"integrity": "sha1-6sEdpRWS3Ya58G9uesKTs9+HXSk=",
			"requires": {
				"object-assign": "^4",
				"vary": "^1"
			}
		}

[jeffwidman]

Thanks for the detailed bug report / investigation.

I'm not super familiar with the npm ecosystem, but your explanation makes sense.

How do you suggest tweaking the extraction logic to reliably extract the correct path? 👈 might be easiest to propose as a PR actually so that we're discussing actual code...