Skip to content

fix(functions): validate npm package exists before installing kit - #11121

Open
wandamora wants to merge 2 commits into
mainfrom
morawand/fix-package-validation
Open

wandamora wants to merge 2 commits into
mainfrom
morawand/fix-package-validation

Conversation

@wandamora

@wandamora wandamora commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Description

Previously, running firebase functions:kits:install --package <pkg> (or firebase ext:migrate when reaching kit installation) with a non-existent package or unavailable version would proceed through third-party/shrinkwrap warnings, confirmation prompts, kit/instance naming prompts, and file scaffolding before failing at npm install (or misleadingly reporting "does not have an npm-shrinkwrap.json file" and "Installation cancelled").

This change:

  • Adds validateNpmPackageExists(rawPkgName) in src/functions/kits/install.ts, which validates the package specifier format (validateNpmPackageName) and verifies that the package/version exists in the npm registry via npm view <pkg> version (distinguishing 404/not-found errors from transient/system errors).
  • Calls validateNpmPackageExists once at the entry point of installKitOrInstance before checking existing kits, prompting, or scaffolding files.

Scenarios Tested

  • Unit tests in src/functions/kits/install.spec.ts for validateNpmPackageExists and installKitOrInstance (valid package, nonexistent package / 404, transient/system lookup errors, unavailable version on existing kit, invalid package name format).

This goes for both ext:migrate and kit:install.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a new validation function, validateNpmPackageExists, to verify that a specified NPM package or version exists in the registry before running migration or installation commands. The review feedback points out that the current implementation causes duplicate network requests and can produce misleading error messages for non-404 errors (such as network timeouts). To address this, the reviewer suggests implementing an internal validation cache to avoid redundant network calls, refining error handling to distinguish between actual 404 errors and other transient failures, and ensuring proper test isolation by clearing the cache between tests.

Comment thread src/functions/kits/install.ts
Comment thread src/functions/kits/install.spec.ts
Comment thread src/functions/kits/install.spec.ts
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants