Update npm_and_yarn deprecation and unsupported checks for npm, pnpm, and yarn package managers

[kbukum1]

What are you trying to accomplish?

This PR updates the handling of deprecation and unsupported checks for the npm_and_yarn ecosystem's package managers: npm, pnpm, and yarn.

The changes include:

• Implementing a unified and comprehensive version detection mechanism for npm that prioritizes checking the packageManager field, engines, and lockfiles in that order to determine the version.
• Refining deprecation and unsupported logic for npm to ensure alignment with the ecosystem's requirements.
• Ensuring pnpm and yarn consistently return false for deprecation and unsupported checks, as no such logic applies to them.

Why?

• To improve consistency and accuracy in how version detection and deprecation/unsupported checks are performed across package managers.
• To address gaps in version detection by incorporating packageManager and engines fields along with lockfiles for npm.
• To enhance clarity and reliability for all npm_and_yarn ecosystem package managers in Dependabot.

---

Anything you want to highlight for special attention from reviewers?

• Version Detection for npm:

  • A new mechanism detects the version by evaluating the packageManager field, engines field, and lockfiles in sequence.
  • Ensures accurate detection even in cases where lockfiles alone are insufficient.

• Deprecation and Unsupported Logic:

  • npm: Adjusted logic to use the detected version for determining deprecation and unsupported status.
  • pnpm and yarn: Explicitly set deprecation and unsupported checks to always return false.

• Test Updates:

  • For npm, tests now cover cases where versions are determined using packageManager, engines, or lockfiles.
  • Comprehensive tests for pnpm and yarn validate consistent return values (false) for deprecation and unsupported checks.

---

How will you know you've accomplished your goal?

• All tests for npm_and_yarn ecosystem package managers pass successfully.
• Deprecation and unsupported checks align with the requirements for each package manager:
  • Correct and reliable detection of supported, deprecated, and unsupported versions for npm.
  • Fixed, consistent behavior (false) for pnpm and yarn.

---

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[kbukum1]

Review Tip:
The method npm_version_numeric_latest is used for deprecation/unsupported checks. However, for consistency across package managers, we should use npm_version_numeric and conditionally delegate to npm_version_numeric_latest based on the feature flag npm_v6_deprecation_warning. This aligns with the detection method naming conventions used by other package managers, such as #{name}_version_numeric.

Detection methods for reference:

• npm_version_numeric
• pnpm_version_numeric
• yarn_version_numeric

This approach ensures consistent version detection logic across all package managers in the npm_and_yarn ecosystem.

[kbukum1]

Review Tip:
Added a proper detection method that should be used for detection of version instead of directly using Helper detection method.

@amazimbe : FYI

[kbukum1]

Review Tip:
We need to use npm_v6_deprecation_warning feature flag to use the new method to detect version and raise deprecation/unsupported notification if necessary.

[amazimbe]

Just curious if :enable_corepack_for_npm_and_yarn is no longer needed.

[kbukum1]

It is more for corepack installation and doesn't matter for this part.

[kbukum1]

Review Tip:

• Detected Version: Extracted from manifest or lock files to determine the project's specified package manager version.
• Raw Version: Obtained using versioning commands to identify the active package manager version at runtime.

This distinction ensures precise deprecation checks and reliable metrics collection.

[kbukum1]

@amazimbe,

This PR modifies the npm v6 deprecation/unsupported checks by updating the detection method. It would be great if you could review the changes and, if everything looks good, proceed with deployment. Additionally, you can verify that your previous work functions as expected, which will also serve as a test for my changes as well.

Thanks!

[amazimbe]

If the raw_version is nil wouldn't we want to set the version to the detected version?

[kbukum1]

We want to show that we don't have raw_version on metrics. Later when we add detection version we can see what we are detecting and what we are running on.