fix: Make paths work as version numbers in @NpmPackage (#14675) (#14682)

Fixes #14673

Co-authored-by: Artur <artur@vaadin.com>

Author: vaadin-bot

flow-server/src/main/java/com/vaadin/flow/server/frontend/NodeUpdater.java

@@ -515,9 +515,9 @@ int addDependency(JsonObject json, String key, String pkg, String version) {
 
     private boolean isNewerVersion(JsonObject json, String pkg,
             String version) {
-        FrontendVersion newVersion = new FrontendVersion(version);
 
         try {
+            FrontendVersion newVersion = new FrontendVersion(version);
             FrontendVersion existingVersion = toVersion(json, pkg);
             return newVersion.isNewerThan(existingVersion);
         } catch (NumberFormatException e) {
@@ -539,9 +539,10 @@ private boolean isNewerVersion(JsonObject json, String pkg,
     private int handleExistingVaadinDep(JsonObject json, String pkg,
             String version, JsonObject vaadinDeps) {
         boolean added = false;
-        FrontendVersion vaadinVersion = toVersion(vaadinDeps, pkg);
-        if (json.hasKey(pkg)) {
-            try {
+        boolean updatedVaadinVersionSection = false;
+        try {
+            FrontendVersion vaadinVersion = toVersion(vaadinDeps, pkg);
+            if (json.hasKey(pkg)) {
                 FrontendVersion packageVersion = toVersion(json, pkg);
                 FrontendVersion newVersion = new FrontendVersion(version);
                 // Vaadin and package.json versions are the same, but dependency
@@ -557,25 +558,28 @@ private int handleExistingVaadinDep(JsonObject json, String pkg,
                     json.put(pkg, version);
                     added = true;
                 }
-            } catch (NumberFormatException e) { // NOSONAR
-                /*
-                 * If the current version is not parseable, it can refer to a
-                 * file and we should leave it alone
-                 */
+            } else {
+                json.put(pkg, version);
+                added = true;
             }
-        } else {
-            json.put(pkg, version);
-            added = true;
+        } catch (NumberFormatException e) { // NOSONAR
+            /*
+             * If the current version is not parseable, it can refer to a file
+             * and we should leave it alone
+             */
         }
         // always update vaadin version to the latest set version
-        vaadinDeps.put(pkg, version);
+        if (!version.equals(vaadinDeps.getString(pkg))) {
+            vaadinDeps.put(pkg, version);
+            updatedVaadinVersionSection = true;
+        }
 
         if (added) {
             log().debug("Added \"{}\": \"{}\" line.", pkg, version);
         } else {
             // we made a change to the package json vaadin defaults
             // even if we didn't add to the dependencies.
-            added = !vaadinVersion.isEqualTo(new FrontendVersion(version));
+            added = updatedVaadinVersionSection;
         }
         return added ? 1 : 0;
     }

flow-server/src/main/java/com/vaadin/flow/server/frontend/TaskUpdatePackages.java

@@ -170,6 +170,12 @@ private boolean shouldLockDependencyVersion(String dependency,
         }
 
         if (projectDependencies.hasKey(dependency)) {
+            try {
+                new FrontendVersion(projectDependencies.getString(dependency));
+            } catch (Exception e) {
+                // Do not lock non-numeric versions, e.g. folder references
+                return false;
+            }
             return true;
         }
 

flow-server/src/test/java/com/vaadin/flow/server/frontend/NodeUpdaterTest.java

@@ -249,27 +249,25 @@ public void shouldSkipUpdatingNonParsableVersions() throws IOException {
     }
 
     @Test
-    public void shouldThrowExceptionOnNewVersionNonParsable() {
+    public void canUpdateNonParseableVersions() throws IOException {
         JsonObject packageJson = Json.createObject();
         JsonObject dependencies = Json.createObject();
         packageJson.put(NodeUpdater.DEPENDENCIES, dependencies);
         JsonObject vaadinDependencies = Json.createObject();
         vaadinDependencies.put(NodeUpdater.DEPENDENCIES, Json.createObject());
         packageJson.put(NodeUpdater.VAADIN_DEP_KEY, vaadinDependencies);
 
-        String formPackage = "@vaadin/form";
-        String existingVersion = "2.0.0";
-        String newVersion = "../../../some/local/path";
+        String pkg = "mypackage";
+        String existingVersion = "./some/path";
 
-        dependencies.put(formPackage, existingVersion);
+        dependencies.put(pkg, existingVersion);
+
+        nodeUpdater.addDependency(packageJson, NodeUpdater.DEPENDENCIES, pkg,
+                existingVersion);
+
+        Assert.assertEquals(existingVersion,
+                packageJson.getObject(NodeUpdater.DEPENDENCIES).getString(pkg));
 
-        NumberFormatException expectedException = Assert
-                .assertThrows(NumberFormatException.class,
-                        () -> nodeUpdater.addDependency(packageJson,
-                                NodeUpdater.DEPENDENCIES, formPackage,
-                                newVersion));
-        Assert.assertTrue(expectedException.getMessage()
-                .contains("is not a valid version"));
     }
 
     @Test

flow-server/src/test/java/com/vaadin/flow/server/frontend/TaskUpdatePackagesNpmTest.java

@@ -525,6 +525,29 @@ public void npmIsInUse_versionsJsonContainsSameVersions_nothingIsModified()
                 task.modified);
     }
 
+    @Test
+    public void nonNumericVersionsNotPinned() throws IOException {
+        final JsonObject packageJson = getOrCreatePackageJson();
+        createBasicVaadinVersionsJson();
+        JsonObject dependencies = packageJson.getObject(DEPENDENCIES);
+        dependencies.put("localdep", "./localdeps/localdep");
+        File file = new File(npmFolder, PACKAGE_JSON);
+        FileUtils.writeStringToFile(file, packageJson.toJson(),
+                StandardCharsets.UTF_8);
+
+        Assert.assertFalse(packageJson.hasKey("overrides")
+                && packageJson.getObject("overrides").hasKey("localdep"));
+
+        final TaskUpdatePackages task = createTask(
+                createApplicationDependencies());
+        task.execute();
+
+        final JsonObject newPackageJson = getOrCreatePackageJson();
+
+        Assert.assertFalse(newPackageJson.hasKey("overrides")
+                && newPackageJson.getObject("overrides").hasKey("localdep"));
+    }
+
     private void createBasicVaadinVersionsJson() {
         createVaadinVersionsJson(PLATFORM_DIALOG_VERSION,
                 PLATFORM_ELEMENT_MIXIN_VERSION, PLATFORM_OVERLAY_VERSION);