feat: transitiveRemediation (#8883)

* save remediations

* enhance and export NpmResponse

* sort branch lists

* transitive remediation init

* update-lockfile not bump

* version not value

* remediate package.json

* isVulnerabilityAlert

* simplify config

* fix circular

* update snapshots

* add config and docs

* TODO

* flatten tests

* remediation -> update

* lots of renames

* improve readability

* refactor

* remove fetch

* more tests

* reduce fiixtures sizes

* more tests

* fix parent null

* remove exec

* explicit false

* fix

* Apply suggestions from code review

Co-authored-by: Michael Kriese <[email protected]>

* use type-fest PackageJson

* more tests

* coverage

* Update lib/workers/branch/get-updated.ts

Co-authored-by: Michael Kriese <[email protected]>

docs/usage/configuration-options.md

@@ -2104,6 +2104,13 @@ The above config will suppress the comment which is added to a PR whenever you c
 It is only recommended to configure this field if you wish to use the `schedules` feature and want to write them in your local timezone.
 Please see the above link for valid timezone names.
 
+## transitiveRemediation
+
+When enabled, Renovate will attempt to remediate vulnerabilities even if they exist only in transitive dependencies.
+
+Applicable only for GitHub platform (with vulnerability alerts enabled), `npm` manager, and when a `package-lock.json` v1 format is present.
+This is considered a feature flag with the aim to remove it and default to this behavior once it has been more widely tested.
+
 ## unicodeEmoji
 
 If enabled emoji shortcodes (`:warning:`) are replaced with their unicode equivalents (`⚠️`)

lib/config/definitions.ts

@@ -1263,6 +1263,12 @@ const options: RenovateOptions[] = [
     cli: false,
     env: false,
   },
+  {
+    name: 'transitiveRemediation',
+    description: 'Enable remediation of transitive dependencies.',
+    type: 'boolean',
+    default: false,
+  },
   {
     name: 'vulnerabilityAlerts',
     description:

lib/datasource/common.ts

@@ -48,6 +48,8 @@ export interface Release {
   version: string;
   newDigest?: string;
   constraints?: Record<string, string[]>;
+  dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
 }
 
 export interface ReleaseResult {

lib/datasource/npm/get.ts

@@ -212,6 +212,8 @@ export async function getDependency(
       const release: NpmRelease = {
         version,
         gitRef: res.versions[version].gitHead,
+        dependencies: res.versions[version].dependencies,
+        devDependencies: res.versions[version].devDependencies,
       };
       if (res.time?.[version]) {
         release.releaseTimestamp = res.time[version];

lib/manager/common.ts

@@ -236,6 +236,16 @@ export interface BumpedPackageFile {
   newContent: string;
 }
 
+export interface UpdateLockedConfig {
+  packageFile?: string;
+  packageFileContent?: string;
+  lockFile?: string;
+  lockFileContent?: string;
+  depName?: string;
+  currentVersion?: string;
+  newVersion?: string;
+}
+
 export interface ManagerApi {
   defaultConfig: Record<string, unknown>;
   language?: string;
@@ -270,6 +280,10 @@ export interface ManagerApi {
   updateDependency?(
     updateDependencyConfig: UpdateDependencyConfig
   ): Result<string | null>;
+
+  updateLockedDependency?(
+    config: UpdateLockedConfig
+  ): Result<Record<string, string | null>>;
 }
 
 // TODO: name and properties used by npm manager

lib/manager/npm/index.ts

@@ -2,7 +2,11 @@ import { LANGUAGE_JAVASCRIPT } from '../../constants/languages';
 import * as npmVersioning from '../../versioning/npm';
 
 export { extractAllPackageFiles } from './extract';
-export { bumpPackageVersion, updateDependency } from './update';
+export {
+  bumpPackageVersion,
+  updateDependency,
+  updateLockedDependency,
+} from './update';
 export { getRangeStrategy } from './range';
 
 export const language = LANGUAGE_JAVASCRIPT;

lib/manager/npm/update/index.ts

@@ -1,2 +1,3 @@
-export { bumpPackageVersion } from './package-version';
 export { updateDependency } from './dependency';
+export { updateLockedDependency } from './locked-dependency';
+export { bumpPackageVersion } from './package-version';

lib/manager/npm/update/locked-dependency/__fixtures__/package.json

@@ -0,0 +1,5 @@
+{
+  "dependencies": {
+    "express": "4.0.0"
+  }
+}

lib/manager/npm/update/locked-dependency/__snapshots__/dep-constraints.spec.ts.snap

@@ -0,0 +1,29 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`manager/npm/update/locked-dependency/dep-constraints findDepConstraints() finds direct dependency 1`] = `
+Array [
+  Object {
+    "constraint": "4.0.0",
+    "depType": "dependencies",
+  },
+]
+`;
+
+exports[`manager/npm/update/locked-dependency/dep-constraints findDepConstraints() finds direct devDependency 1`] = `
+Array [
+  Object {
+    "constraint": "4.0.0",
+    "depType": "devDependencies",
+  },
+]
+`;
+
+exports[`manager/npm/update/locked-dependency/dep-constraints findDepConstraints() finds indirect dependency 1`] = `
+Array [
+  Object {
+    "constraint": "0.2.0",
+    "parentDepName": "express",
+    "parentVersion": "4.0.0",
+  },
+]
+`;

lib/manager/npm/update/locked-dependency/__snapshots__/get-locked.spec.ts.snap

@@ -0,0 +1,46 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`manager/npm/update/locked-dependency/get-locked getLockedDependencies() finds direct dependency 1`] = `
+Array [
+  Object {
+    "integrity": "sha1-J03IKTPJ9XTMOKDOXqgXK+nGsJQ=",
+    "requires": Object {
+      "accepts": "1.0.0",
+      "buffer-crc32": "0.2.1",
+      "cookie": "0.1.0",
+      "cookie-signature": "1.0.3",
+      "debug": ">= 0.7.3 < 1",
+      "escape-html": "1.0.1",
+      "fresh": "0.2.2",
+      "merge-descriptors": "0.0.2",
+      "methods": "0.1.0",
+      "parseurl": "1.0.1",
+      "path-to-regexp": "0.1.2",
+      "qs": "0.6.6",
+      "range-parser": "1.0.0",
+      "send": "0.2.0",
+      "serve-static": "1.0.1",
+      "type-is": "1.0.0",
+      "utils-merge": "1.0.0",
+    },
+    "resolved": "https://registry.npmjs.org/express/-/express-4.0.0.tgz",
+    "version": "4.0.0",
+  },
+]
+`;
+
+exports[`manager/npm/update/locked-dependency/get-locked getLockedDependencies() finds indirect dependency 1`] = `
+Array [
+  Object {
+    "integrity": "sha1-Bnq/Rc/4v/spy9t0OXJbMjiKLFg=",
+    "requires": Object {
+      "debug": "*",
+      "fresh": "~0.2.1",
+      "mime": "~1.2.9",
+      "range-parser": "~1.0.0",
+    },
+    "resolved": "https://registry.npmjs.org/send/-/send-0.2.0.tgz",
+    "version": "0.2.0",
+  },
+]
+`;

lib/manager/npm/update/locked-dependency/common.ts

@@ -0,0 +1,22 @@
+export interface PackageLockDependency {
+  version: string;
+  resolved?: string;
+  integrity?: string;
+  dependencies?: Record<string, PackageLockDependency>;
+}
+
+export type PackageLockDependencies = Record<string, PackageLockDependency>;
+
+export interface PackageLockOrEntry {
+  lockfileVersion?: number;
+  version?: string;
+  dependencies?: PackageLockDependencies;
+  requires?: Record<string, string>;
+}
+
+export interface ParentDependency {
+  parentDepName?: string;
+  parentVersion?: string;
+  constraint: string;
+  depType?: string;
+}

lib/manager/npm/update/locked-dependency/dep-constraints.spec.ts

@@ -0,0 +1,36 @@
+import { readFileSync } from 'fs';
+import { resolve } from 'upath';
+import { getName } from '../../../../../test/util';
+import { findDepConstraints } from './dep-constraints';
+
+jest.mock('../../../../util/fs');
+
+const packageJson = JSON.parse(
+  readFileSync(resolve(__dirname, './__fixtures__/package.json'), 'utf8')
+);
+const packageLockJson = JSON.parse(
+  readFileSync(resolve(__dirname, './__fixtures__/package-lock.json'), 'utf8')
+);
+
+describe(getName(__filename), () => {
+  describe('findDepConstraints()', () => {
+    it('finds indirect dependency', () => {
+      expect(
+        findDepConstraints(packageJson, packageLockJson, 'send', '0.2.0')
+      ).toMatchSnapshot();
+    });
+    it('finds direct dependency', () => {
+      expect(
+        findDepConstraints(packageJson, packageLockJson, 'express', '4.0.0')
+      ).toMatchSnapshot();
+    });
+    it('finds direct devDependency', () => {
+      const packageJsonDev = { ...packageJson };
+      packageJsonDev.devDependencies = packageJsonDev.dependencies;
+      delete packageJsonDev.dependencies;
+      expect(
+        findDepConstraints(packageJsonDev, packageLockJson, 'express', '4.0.0')
+      ).toMatchSnapshot();
+    });
+  });
+});