fix(npm-resolver): unhandled rejection in fetch (#3413)

When fetch command fails for any reason  catch it and return FetchError to avoid Unhandled rejection

close #3261.

Co-authored-by: amit <amit@enso.security>

.changeset/little-dragons-wave.md

@@ -0,0 +1,5 @@
+---
+"@pnpm/npm-resolver": patch
+---
+
+Fix: unhandled rejection in npm resolver when fetch fails

packages/npm-resolver/src/fetch.ts

@@ -50,11 +50,17 @@ export default async function fromRegistry (
   const op = retry.operation(fetchOpts.retry)
   return new Promise((resolve, reject) =>
     op.attempt(async (attempt) => {
-      const response = await fetch(uri, {
-        authHeaderValue,
-        retry: fetchOpts.retry,
-        timeout: fetchOpts.timeout,
-      }) as RegistryResponse
+      let response: RegistryResponse
+      try {
+        response = await fetch(uri, {
+          authHeaderValue,
+          retry: fetchOpts.retry,
+          timeout: fetchOpts.timeout,
+        }) as RegistryResponse
+      } catch (error) {
+        reject(new PnpmError('META_FETCH_FAIL', `GET ${uri}: ${error.message as string}`, { attempts: attempt }))
+        return
+      }
       if (response.status > 400) {
         const request = {
           authHeaderValue,

packages/npm-resolver/test/index.ts

@@ -664,6 +664,18 @@ test('error is thrown when package is not found in the registry', async () => {
     )
 })
 
+test('error is thrown when registry not responding', async () => {
+  const notExistingPackage = 'foo'
+  const notExistingRegistry = 'http://localhost:4873'
+
+  const resolveFromNpm = createResolveFromNpm({
+    storeDir: tempy.directory(),
+    retry: { retries: 1 },
+  })
+  await expect(resolveFromNpm({ alias: notExistingPackage, pref: '1.0.0' }, { registry: notExistingRegistry })).rejects
+    .toThrow(new PnpmError('META_FETCH_FAIL', `GET ${notExistingRegistry}/${notExistingPackage}: request to ${notExistingRegistry}/${notExistingPackage} failed, reason: connect ECONNREFUSED 127.0.0.1:4873`, { attempts: 1 }))
+})
+
 test('extra info is shown if package has valid semver appended', async () => {
   const notExistingPackage = 'foo1.0.0'