Registries with "url" option cause "URL.canParse is not a function" in Microsoft hosted agents

[rhyskoedijk]

Describe the bug
Running 1.32.847 on ubunutu-latest (node 18.20.4) with a NuGet registry causes:

##[error]url_1.URL.canParse is not a function

Categorization

• This is not a permissions issue (Seek help at 403 error when Dependabot tries to create a pull request #1245)

Repository
N/A

To Reproduce
Use dependabot.yml containing:

version: 2
registries:
  my-nuget:
    type: nuget-feed
    url: https://pkgs.dev.azure.com/...snip.../nuget/v3/index.json
    token: PAT:${{MY_NUGET_FEED_ADO_PAT}}
updates:
    # ...snip...

Expected behavior
No errors

Screenshots

Starting: Initialize job
Agent name: 'Azure Pipelines 2'
Agent machine name: 'fv-az463-789'
Current agent version: '3.243.0'
Operating System
Ubuntu
22.04.4
LTS
Runner Image
Image: ubuntu-22.04
Version: 20240818.1.0
Included Software: https://github.com/actions/runner-images/blob/ubuntu22/20240818.1/images/ubuntu/Ubuntu2204-Readme.md
Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu22%2F20240818.1
Runner Image Provisioner
2.0.382.1
Current image version: '20240818.1.0'
Agent running as: 'vsts'
Prepare build directory.
Set build variables.
Download all required tasks.
Downloading task: dependabot (1.32.847)
Checking job knob settings.
   ...snip...
Finished checking job knob settings.
Start tracking orphan processes.
Finishing: Initialize job

Starting: Run Dependabot
==============================================================================
Task         : Dependabot
Description  : Automatically update dependencies and vulnerabilities in your code
Version      : 1.32.847
Author       : Tingle Software
Help         : https://github.com/tinglesoftware/dependabot-azure-devops/issues
==============================================================================
##[error]url_1.URL.canParse is not a function
Finishing: Run Dependabot

Extension (please complete the following information):

• Azure DevOps

Additional context
It works on local machine using node 18.20.4, but doesn't work in Microsoft hosted agent.
It doesn't like this line:

dependabot-azure-devops/extension/task/utils/parseConfigFile.ts

Line 282 in 6af66d2

if (URL.canParse(url)) {

[rhyskoedijk]

The docs say URL.canParse has been available since node 18.17.0:
https://nodejs.org/docs/latest-v18.x/api/url.html#urlcanparseinput-base

I have no idea why this is causing errors in the Microsoft hosted agents, which are reporting 18.20.4 when running node -v

[Lukejkw]

We're getting this issue too on version 1.30.2.

[BertKooij]

Same error here (I think it is caused by the changes made for #1307 and #1310). Running on a Microsoft hosted machine.

2024-08-26T06:06:53.3953530Z ##[section]Starting: dependabot
2024-08-26T06:06:53.3960350Z ==============================================================================
2024-08-26T06:06:53.3960523Z Task         : Dependabot
2024-08-26T06:06:53.3960608Z Description  : Automatically update dependencies and vulnerabilities in your code
2024-08-26T06:06:53.3960742Z Version      : 1.32.847
2024-08-26T06:06:53.3960833Z Author       : Tingle Software
2024-08-26T06:06:53.3960918Z Help         : https://github.com/tinglesoftware/dependabot-azure-devops/issues
2024-08-26T06:06:53.3961064Z ==============================================================================
2024-08-26T06:06:54.0225578Z ##[error]url_1.URL.canParse is not a function
2024-08-26T06:06:54.0262123Z ##[section]Finishing: dependabot

Also tried it with setting a specific node version, but this does not seem to help.

  - task: UseNode@1
    inputs:
      version: '20.x'
    displayName: 'Install Node.js'

2024-08-26T06:12:05.0785243Z ##[section]Starting: Install Node.js
2024-08-26T06:12:05.0789428Z ==============================================================================
2024-08-26T06:12:05.0789542Z Task         : Use Node.js ecosystem
2024-08-26T06:12:05.0789625Z Description  : Set up a Node.js environment and add it to the PATH, additionally providing proxy support
2024-08-26T06:12:05.0789739Z Version      : 1.235.1
2024-08-26T06:12:05.0789797Z Author       : Microsoft Corporation
2024-08-26T06:12:05.0789866Z Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks
2024-08-26T06:12:05.0789965Z ==============================================================================
2024-08-26T06:12:13.3092797Z Found tool in cache: node 20.16.0 x64
2024-08-26T06:12:13.3110190Z Prepending PATH environment variable with directory: /opt/hostedtoolcache/node/20.16.0/x64/bin
2024-08-26T06:12:13.3337968Z ##[section]Finishing: Install Node.js

[mj0bst]

Dependabot runs in a docker container with ghcr.io/tinglesoftware/dependabot-updater:0.19.1-ci0005, which comes with 16.19.0.

docker run -it ghcr.io/tinglesoftware/dependabot-updater:0.19.1-ci0005 node -v
v16.19.0

See also

dependabot-azure-devops/extension/task/index.ts

Line 256 in 6af66d2

let dockerImage = `ghcr.io/tinglesoftware/dependabot-updater-${update.packageEcosystem}:${variables.dockerImageTag}`;

[rhyskoedijk]

I thought this too initially, but this TS/JS code runs before the dependabot-updater container is started.
Looking in to the extension task configuration more, it might be this:

dependabot-azure-devops/extension/task/task.json

Lines 257 to 261 in 6af66d2

	"execution": {
	"Node16": {
	"target": "index.js"
	}
	}

The latest Microsoft docs use Node20_1 and says that the latest version should be used to keep up to date with azure-pipelines-task-lib.
https://learn.microsoft.com/en-us/azure/devops/extend/develop/add-build-task?view=azure-devops#prerequisites

[rhyskoedijk]

Fixed in 1.33.0