feat(manager/npm): support parsing lockfileVersion=3

lib/modules/manager/npm/__fixtures__/npm9/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "npm9",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "chalk": "^2.4.1"
+  }
+}

lib/modules/manager/npm/extract/locked-versions.spec.ts

@@ -535,4 +535,90 @@ describe('modules/manager/npm/extract/locked-versions', () => {
       },
     ]);
   });
+
+  describe('lockfileVersion 3', () => {
+    it('uses package-lock.json with npm v9.0.0', async () => {
+      npm.getNpmLock.mockReturnValue({
+        lockedVersions: {
+          a: '1.0.0',
+          b: '2.0.0',
+          c: '3.0.0',
+        },
+        lockfileVersion: 3,
+      });
+      const packageFiles = [
+        {
+          managerData: {
+            npmLock: 'package-lock.json',
+          },
+          extractedConstraints: {},
+          deps: [
+            { depName: 'a', currentValue: '1.0.0' },
+            { depName: 'b', currentValue: '2.0.0' },
+          ],
+          packageFile: 'some-file',
+        },
+      ];
+      await getLockedVersions(packageFiles);
+      expect(packageFiles).toEqual([
+        {
+          extractedConstraints: {
+            npm: '>=7',
+          },
+          deps: [
+            { currentValue: '1.0.0', depName: 'a', lockedVersion: '1.0.0' },
+            { currentValue: '2.0.0', depName: 'b', lockedVersion: '2.0.0' },
+          ],
+          packageFile: 'some-file',
+          lockFiles: ['package-lock.json'],
+          managerData: {
+            npmLock: 'package-lock.json',
+          },
+        },
+      ]);
+    });
+
+    it('uses package-lock.json with npm v7.0.0', async () => {
+      npm.getNpmLock.mockReturnValue({
+        lockedVersions: {
+          a: '1.0.0',
+          b: '2.0.0',
+          c: '3.0.0',
+        },
+        lockfileVersion: 3,
+      });
+      const packageFiles = [
+        {
+          managerData: {
+            npmLock: 'package-lock.json',
+          },
+          extractedConstraints: {
+            npm: '^9.0.0',
+          },
+          deps: [
+            { depName: 'a', currentValue: '1.0.0' },
+            { depName: 'b', currentValue: '2.0.0' },
+          ],
+          packageFile: 'some-file',
+        },
+      ];
+      await getLockedVersions(packageFiles);
+      expect(packageFiles).toEqual([
+        {
+          extractedConstraints: {
+            npm: '^9.0.0',
+          },
+          deps: [
+            { currentValue: '1.0.0', depName: 'a', lockedVersion: '1.0.0' },
+            { currentValue: '2.0.0', depName: 'b', lockedVersion: '2.0.0' },
+          ],
+          packageFile: 'some-file',
+          lockFiles: ['package-lock.json'],
+          managerData: {
+            npmLock: 'package-lock.json',
+          },
+        },
+      ]);
+    });
+  });
 });

lib/modules/manager/npm/extract/locked-versions.ts

@@ -80,6 +80,11 @@ export async function getLockedVersions(
         } else {
           packageFile.extractedConstraints!.npm = '<9';
         }
+      } else if (
+        lockfileVersion === 3 &&
+        !packageFile.extractedConstraints?.npm
+      ) {
+        packageFile.extractedConstraints!.npm = '>=7';
       }
       for (const dep of packageFile.deps) {
         // TODO: types (#7154)

lib/modules/manager/npm/extract/npm.spec.ts

@@ -16,19 +16,60 @@ describe('modules/manager/npm/extract/npm', () => {
       const plocktest1Lock = Fixtures.get('plocktest1/package-lock.json', '..');
       fs.readLocalFile.mockResolvedValueOnce(plocktest1Lock as never);
       const res = await getNpmLock('package.json');
-      expect(res).toMatchSnapshot();
+      expect(res).toEqual({
+        lockedVersions: {
+          'ansi-styles': '3.2.1',
+          chalk: '2.4.1',
+          'color-convert': '1.9.1',
+          'color-name': '1.1.3',
+          'escape-string-regexp': '1.0.5',
+          'has-flag': '3.0.0',
+          'supports-color': '5.4.0',
+        },
+        lockfileVersion: 1,
+      });
       expect(Object.keys(res.lockedVersions)).toHaveLength(7);
+      expect(res.lockfileVersion).toBe(1);
     });
 
     it('extracts npm 7 lockfile', async () => {
       const npm7Lock = Fixtures.get('npm7/package-lock.json', '..');
       fs.readLocalFile.mockResolvedValueOnce(npm7Lock as never);
       const res = await getNpmLock('package.json');
-      expect(res).toMatchSnapshot();
+      expect(res).toEqual({
+        lockedVersions: {
+          'ansi-styles': '3.2.1',
+          chalk: '2.4.1',
+          'color-convert': '1.9.1',
+          'color-name': '1.1.3',
+          'escape-string-regexp': '1.0.5',
+          'has-flag': '3.0.0',
+          'supports-color': '5.4.0',
+        },
+        lockfileVersion: 2,
+      });
       expect(Object.keys(res.lockedVersions)).toHaveLength(7);
       expect(res.lockfileVersion).toBe(2);
     });
 
+    it('extracts npm 9 lockfile', async () => {
+      const npm9Lock = Fixtures.get('npm9/package-lock.json', '..');
+      fs.readLocalFile.mockResolvedValueOnce(npm9Lock as never);
+      const res = await getNpmLock('package.json');
+      expect(res).toEqual({
+        lockedVersions: {
+          'ansi-styles': '3.2.1',
+          chalk: '2.4.2',
+          'color-convert': '1.9.3',
+          'color-name': '1.1.3',
+          'escape-string-regexp': '1.0.5',
+          'has-flag': '3.0.0',
+          'supports-color': '5.5.0',
+        },
+        lockfileVersion: 3,
+      });
+    });
+
     it('returns empty if no deps', async () => {
       fs.readLocalFile.mockResolvedValueOnce('{}');
       const res = await getNpmLock('package.json');

lib/modules/manager/npm/extract/npm.ts

@@ -8,9 +8,7 @@ export async function getNpmLock(filePath: string): Promise<LockFile> {
   try {
     const lockParsed = JSON.parse(lockRaw);
     const lockedVersions: Record<string, string> = {};
-    for (const [entry, val] of Object.entries(
-      (lockParsed.dependencies || {}) as LockFileEntry
-    )) {
+    for (const [entry, val] of Object.entries(getPackages(lockParsed))) {
       logger.trace({ entry, version: val.version });
       lockedVersions[entry] = val.version;
     }
@@ -20,3 +18,20 @@ export async function getNpmLock(filePath: string): Promise<LockFile> {
     return { lockedVersions: {} };
   }
 }
+function getPackages(lockParsed: any): LockFileEntry {
+  let packages: LockFileEntry = {};
+
+  if (
+    (lockParsed.lockfileVersion === 1 || lockParsed.lockfileVersion === 2) &&
+    lockParsed.dependencies
+  ) {
+    packages = lockParsed.dependencies;
+  } else if (lockParsed.lockfileVersion === 3 && lockParsed.packages) {
+    packages = Object.fromEntries(
+      Object.entries(lockParsed.packages)
+        .filter(([key]) => !!key) // filter out root entry
+        .map(([key, val]) => [key.replace(`node_modules/`, ''), val])
+    ) as LockFileEntry;
+  }
+  return packages;
+}