fix: handle registries missing 'time' metadata during version resolution (#1763)

* fix: improve version resolution when registry time is missing

- for 'newest' target return greatest when time is missing
- don't skip by cooldown versions with no time
- print [missing time] next to the upgraded version

* Add cli test

do not warn about empty results when every dep is already at the highest version for non-latest --target

* safer semver.minVersion calls

Author: onemen

src/lib/logging.ts

@@ -242,8 +242,17 @@ export async function toDependencyTable({
           const diffUrl = format?.includes('diff')
             ? `${process.env.NCU_DIFF || 'https://npmdiff.dev'}/${encodeURIComponent(dep)}/${from.replace(/^\W+/, '')}/${to.replace(/^\W+/, '')}`
             : ''
-          const timestamp = format?.includes('time') && time?.[dep] ? time[dep] : null
-          const publishTime = timestamp ? timeAgoFormat(timestamp, 'en_US') : ''
+
+          const showCoolDown = format?.includes('cooldown')
+          const showTime = format?.includes('time')
+          // show '[missing time]' in publishTime column or cooldown column
+          const missingTime = time?.[dep] ? '' : '[missing time]'
+          const timestamp = showTime && time?.[dep] ? time[dep] : null
+          const publishTime = timestamp
+            ? timeAgoFormat(timestamp, 'en_US')
+            : showTime || !showCooldownCol
+              ? missingTime
+              : ''
 
           const cooldownVersion = skippedByCooldown?.[dep]?.version
           let cooldown = ''
@@ -256,6 +265,8 @@ export async function toDependencyTable({
               coerced && !cooldownVersion.endsWith(coerced.version) ? `${coerced.version}-+` : cooldownVersion
             const skippedColorized = colorizeDiff(to, wildcard + getVersion(shortended))
             cooldown = `[cooldown] ${skippedColorized.replace(wildcard, '')}`
+          } else if (showCoolDown && !showTime) {
+            cooldown = missingTime
           }
 
           return [
@@ -302,7 +313,7 @@ async function printSkippedByCooldownTable({
 
   for (const params of Object.values(skippedByCooldown)) {
     const { name, version, currentVersion, fallbackVersion, time: versionTime } = params
-    if (!isFetchable(currentVersion)) continue
+    if (!isFetchable(currentVersion) || !version) continue
 
     const wildcard = WILDCARDS.includes(currentVersion[0]) ? currentVersion[0] : ''
     const caf = wildcard + stripRange(fallbackVersion ?? currentVersion)

src/package-managers/filters.ts

@@ -75,7 +75,8 @@ export const satisfiesCooldownPeriod = (
   if (!version) return false
 
   if (!cooldownDaysOrPredicateFn) return true
-  if (!versionTimeData) return false
+  // when there is no time to check wh can not check it for cooldown, always return true
+  if (!versionTimeData) return true
 
   const versionReleaseDate = new Date(versionTimeData)
   const DAY_AS_MS = 86400000 // milliseconds in a day

src/package-managers/npm.ts

@@ -162,14 +162,16 @@ const findTargetAndFallback = ({
   compare?: (v1: string, v2: string) => number
 }): GreatestWithFallbackResult => {
   const isValidVersion = filterPredicate(options)
-  const cur = nodeSemver.minVersion(currentVersion)?.version
+  // nodeSemver.minVersion throws on non-semver specs (e.g. catalog: or workspace:)
+  const cur = nodeSemver.validRange(currentVersion) ? nodeSemver.minVersion(currentVersion)?.version : null
   if (!cur) {
     return {
       targetVersion: null,
       fallbackVersion: null,
       targetBlockedByCooldown: false,
     }
   }
+  const currentInCooldown = !satisfiesCooldownPeriod(packageName, cur, time?.[cur], options.cooldown)
 
   const result = versions.reduce(
     (acc, versionData) => {
@@ -204,15 +206,15 @@ const findTargetAndFallback = ({
     {
       targetVersion: cur,
       fallbackVersion: cur,
-      targetBlockedByCooldown: false,
+      targetBlockedByCooldown: currentInCooldown,
     } as {
       targetVersion: string
       fallbackVersion: string
       targetBlockedByCooldown: boolean
     },
   )
 
-  let targetVersion: string | null = result.targetVersion
+  const targetVersion: string | null = result.targetVersion
   let fallbackVersion: string | null = result.fallbackVersion
 
   if (fallbackVersion === result.targetVersion) {
@@ -223,8 +225,9 @@ const findTargetAndFallback = ({
     fallbackVersion = null
   }
 
-  if (!nodeSemver.gt(targetVersion, cur)) {
-    targetVersion = null
+  // don't "Block" current version
+  if (currentInCooldown && targetVersion === cur) {
+    result.targetBlockedByCooldown = false
   }
 
   return {
@@ -263,7 +266,7 @@ const toVersionResult = ({
 
   // only check fallback if target is in cooldown period.
   if (options.cooldown && targetVersion && targetBlockedByCooldown) {
-    const current = nodeSemver.minVersion(currentVersion)?.version
+    const current = nodeSemver.validRange(currentVersion) ? nodeSemver.minVersion(currentVersion)?.version : null
     const cooldownInfo: CooldownInfo = {
       name: packageName,
       currentVersion,
@@ -562,7 +565,10 @@ npmApi.mockFetchUpgradedPackument =
       )
     }
 
-    const time = (isPackument(partialPackument) && partialPackument.time?.[version]) || new Date().toISOString()
+    const time =
+      isPackument(partialPackument) && partialPackument.time
+        ? partialPackument.time?.[version]
+        : new Date().toISOString()
     const packument: Packument = {
       name,
       'dist-tags': {
@@ -1005,9 +1011,11 @@ export const distTag: GetVersion = async (
 
   const publishTime = packument?.time?.[version!]
   const maybeTime = publishTime ? { time: publishTime } : null
+  const current = (nodeSemver.validRange(currentVersion) && nodeSemver.minVersion(currentVersion)?.version) || '0.0.0'
 
   const isSatisfiesCooldown =
-    tagPackument && satisfiesCooldownPeriod(packageName, tagPackument.version, publishTime, options.cooldown)
+    tagPackument.version === current ||
+    (tagPackument && satisfiesCooldownPeriod(packageName, tagPackument.version, publishTime, options.cooldown))
 
   // latest should not be deprecated
   // if latest exists and latest is not a prerelease version, return it
@@ -1031,20 +1039,15 @@ export const distTag: GetVersion = async (
       )
     }
 
-    const current = nodeSemver.minVersion(currentVersion)?.version ?? '0.0.0'
-    if (nodeSemver.gt(tagPackument.version, current)) {
-      return {
-        cooldownInfo: {
-          name: packageName,
-          currentVersion,
-          currentVersionTime: packument?.time?.[current],
-          version: tagPackument.version,
-          ...maybeTime,
-        },
-      }
+    return {
+      cooldownInfo: {
+        name: packageName,
+        currentVersion,
+        currentVersionTime: packument?.time?.[current],
+        version: tagPackument.version,
+        ...maybeTime,
+      },
     }
-
-    return {}
   }
 
   // If we use a custom dist-tag, we do not want to get other 'pre' versions, just the ones from this dist-tag
@@ -1119,16 +1122,24 @@ export const newest: GetVersion = async (
   )
 
   const versions = Object.values(packument?.versions ?? {})
-  const packageInfo = { packageName, currentVersion, options, versions, time: packument?.time }
-
-  const versionResult = findTargetAndFallback({
-    ...packageInfo,
-    compare: (v1, v2) => {
-      const t1 = packument?.time?.[v1] || ''
-      const t2 = packument?.time?.[v2] || ''
-      return t1 > t2 ? 1 : t1 < t2 ? -1 : 0
-    },
-  })
+  const time = packument?.time
+  const isTimeMissing = !time || Object.keys(time).length === 0
+  const packageInfo = { packageName, currentVersion, options, versions, time }
+
+  const versionResult = isTimeMissing
+    ? {
+        targetVersion: currentVersion,
+        fallbackVersion: null,
+        targetBlockedByCooldown: false,
+      }
+    : findTargetAndFallback({
+        ...packageInfo,
+        compare: (v1, v2) => {
+          const t1 = packument?.time?.[v1] || ''
+          const t2 = packument?.time?.[v2] || ''
+          return t1 > t2 ? 1 : t1 < t2 ? -1 : 0
+        },
+      })
 
   return toVersionResult({ ...packageInfo, ...versionResult })
 }

test/bin.test.ts

@@ -237,6 +237,17 @@ describe('bin', async function () {
     stub.restore()
   })
 
+  it('do not warn about empty results when every dep is already at the highest version for non-latest --target', async () => {
+    const stub = stubVersions({ 'ncu-test-v2': '1.0.0' }, { spawn: true })
+    const { stdout } = await spawn('node', [bin, '--stdin', '--target', 'minor'], {
+      stdin: JSON.stringify({ dependencies: { 'ncu-test-v2': '1.0.0' } }),
+    })
+    const out = stripAnsi(stdout)!
+    out.should.not.include('No package versions were returned.')
+    out.should.include('All dependencies match the minor package versions')
+    stub.restore()
+  })
+
   it('combine boolean flags with arguments', async () => {
     const stub = stubVersions('99.9.9', { spawn: true })
     const { stdout } = await spawn('node', [bin, '--stdin', '--jsonUpgraded', 'ncu-test-v2'], {
@@ -287,7 +298,8 @@ describe('bin', async function () {
       const { stdout } = await spawn('node', [bin, '--stdin'], { stdin: JSON.stringify({ dependencies }) })
       stripAnsi(stdout)
         .trim()
-        .should.equal('ncu-test-v2  https://github.com/raineorshine/ncu-test-v2.git#v1.0.0  →  v2.0.0')
+        .replace(/\s+/g, ' ') // Replace all whitespace sequences with a single space
+        .should.equal('ncu-test-v2 https://github.com/raineorshine/ncu-test-v2.git#v1.0.0 → v2.0.0 [missing time]')
     })
 
     it('strip prefix from npm alias in "to" output', async () => {