Calls to search.issuesAndPullRequests are dropping the "q" parameter

[andyedwardsibm]

Checklist

• I checked all open bugs and none of them matched my problem.

Environment

• https://api.github.com
• GitHub Enterprise Server:
• GitHub Enterprise Cloud
• Node.js
• Browsers:
• Others:

Versions

  ├─┬ @octokit/rest@18.10.0
  │ ├─┬ @octokit/core@3.5.1
  │ │ ├─┬ @octokit/auth-token@2.5.0
  │ │ ├─┬ @octokit/graphql@4.8.0
  │ │ ├─┬ @octokit/request@5.6.1
  │ │ │ ├─┬ @octokit/endpoint@6.0.12
  │ │ ├─┬ @octokit/request-error@2.1.0
  │ │ ├─┬ @octokit/types@6.28.1
  │ │ │ └── @octokit/openapi-types@10.2.2
  │ ├─┬ @octokit/plugin-paginate-rest@2.16.3
  │ ├── @octokit/plugin-request-log@1.0.4
  │ └─┬ @octokit/plugin-rest-endpoint-methods@5.10.4

What happened?

I recently updated my Node dependencies and calls to octokit.rest.search.issuesAndPullRequests have stopped working and now report an error containing {"message":"Validation Failed","errors":[{"resource":"Search","field":"q","code":"missing"}

Minimal test case to reproduce the problem

I've installed octokit/rest fresh today. When I run this snippet below...

const Octokit = require('@octokit/rest').Octokit

async function main () {
  const octokit = new Octokit({})
  const q = 'properties+is:issue+repo:"octokit/rest"+label:bug'
  const issuesFound = await octokit.rest.search.issuesAndPullRequests({ q })
  console.log(`${JSON.stringify(issuesFound)}`)
}

main().catch(e => {
  console.log(JSON.stringify(e, null, 2))
})

I get the error below:

{
  "name": "HttpError",
  "status": 422,
  "response": {
    "url": "https://api.github.com/search/issues?q=properties+is%3Aissue+repo%3A%22octokit%2Frest%22+label%3Abug",
    "status": 422,
    "headers": {
      "access-control-allow-origin": "*",
      "access-control-expose-headers": "ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset",
      "cache-control": "no-cache",
      "connection": "close",
      "content-length": "149",
      "content-security-policy": "default-src 'none'",
      "content-type": "application/json; charset=utf-8",
      "date": "Tue, 21 Sep 2021 13:42:20 GMT",
      "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
      "server": "GitHub.com",
      "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
      "vary": "Accept, Accept-Encoding, Accept, X-Requested-With",
      "x-content-type-options": "nosniff",
      "x-frame-options": "deny",
      "x-github-media-type": "github.v3; format=json",
      "x-github-request-id": "EB7C:DD2A:1CBEB1D:1D4B13C:6149E145",
      "x-ratelimit-limit": "10",
      "x-ratelimit-remaining": "8",
      "x-ratelimit-reset": "1632231800",
      "x-ratelimit-resource": "search",
      "x-ratelimit-used": "2",
      "x-xss-protection": "0"
    },
    "data": {
      "message": "Validation Failed",
      "errors": [
        {
          "resource": "Search",
          "field": "q",
          "code": "missing"
        }
      ],
      "documentation_url": "https://docs.github.com/v3/search"
    }
  },
  "request": {
    "method": "GET",
    "url": "https://api.github.com/search/issues?q=properties+is%3Aissue+repo%3A%22octokit%2Frest%22+label%3Abug",
    "headers": {
      "accept": "application/vnd.github.v3+json",
      "user-agent": "octokit-rest.js/18.7.1 octokit-core.js/3.5.1 Node.js/14.16.1 (linux; x64)"
    },
    "request": {}
  }
}

The error is claiming that the q parameter is missing, but it is specified in the code and is echoed in the error. I find the same behaviour when talking to an enterprise instance with a personal access token.

If I make the equivalent curl call (i.e. curl "https://api.github.com/search/issues?q=properties+is%3Aissue+repo%3A%22octokit%2Frest%22+label%3Abug") then I get the error below...

{
  "message": "Validation Failed",
  "errors": [
    {
      "message": "The listed users and repositories cannot be searched either because the resources do not exist or you do not have permission to view them.",
      "resource": "Search",
      "field": "q",
      "code": "invalid"
    }
  ],
  "documentation_url": "https://docs.github.com/v3/search/"
}

... which is what I'd expect (there is a q value, but I'm not allowed to see the results).

If I change my snippet code such that const octokit = new Octokit({ baseUrl: 'http://localhost:12345' }) and have netcat listening on 12345 then I see the following request come in...

GET /search/issues HTTP/1.1
accept: application/vnd.github.v3+json
user-agent: octokit-rest.js/18.7.1 octokit-core.js/3.5.1 Node.js/14.16.1 (linux; x64)
Accept-Encoding: gzip,deflate
Connection: close
Host: localhost:12345

... so the endpoint isn't wrong; the q parameter is not being added to the request URL any more

What did you expect to happen?

Calls to octokit.rest.search.issuesAndPullRequests({ q }) would return a list of issues (or at least include the q parameter in the outgoing call)

What the problem might be

Other than it's a change made since about June somewhere in one of the octokit dependencies, I've not yet found where the parameter is being dropped

[gr2m]

Thank you for the thorough bug report!

However, I cannot reproduce the problem:
https://runkit.com/gr2m/octokit-rest-js-114

We didn't have any release of an @octokit/* package in the past 24h, but it might have been a bug in a transcended dependency (though we don't have a lot of these). Very odd 🤔

Does the problem persist for you? If so, could you please create a test repository with a lock file that reliably reproduces the problem you reported?

[gr2m]

I've contacted GitHub support about this, my guess is there was a temporary problem with the API.

We have seen reports of @semantic-release builds that suddenly failed with error messages such as this

The error

{"resource":"Search","field":"q","code":"missing"}

makes no sense to me, because response URL includes the q

    url: 'https://api.github.com/search/issues?q=repo%3Aform8ion%2Fgithub-actions-node-ci+type%3Apr+is%3Amerged+c34e25182476b43a6711b9c53dfba60719ebfb54+1756ad48bc98f4252b06c695ff15f01ddfde5dba+95a9e1eed28b463c8c8b33dc4f599e1ce063d649+51ec64a64939cf990f4dd8af848a8544b976cbfd',

so does the url in the parsed request options

  request: {
   method: 'GET',
   url: 'https://api.github.com/search/issues?q=repo%3Aform8ion%2Fgithub-actions-node-ci+type%3Apr+is%3Amerged+c34e25182476b43a6711b9c53dfba60719ebfb54+1756ad48bc98f4252b06c695ff15f01ddfde5dba+95a9e1eed28b463c8c8b33dc4f599e1ce063d649+51ec64a64939cf990f4dd8af848a8544b976cbfd',

[gr2m]

Mystery solved, please update your lock files, make sure you don't have node-fetch v2.6.3 in there
node-fetch/node-fetch#1301

[andyedwardsibm]

Yep, confirmed...

└─┬ @octokit/rest@18.7.1
  └─┬ @octokit/core@3.5.1
    └─┬ @octokit/request@5.6.1
      └── node-fetch@2.6.3 

Validation Failed: {"resource":"Search","field":"q","code":"missing"}

└─┬ @octokit/rest@18.10.0
  └─┬ @octokit/core@3.5.1
    └─┬ @octokit/request@5.6.1
      └── node-fetch@2.6.4 

All works fine