fix: npm outdated parsing invalid specs

This commit fixes a problem in which npm outdated was breaking when
trying to read an invalid semver range spec defined for a given
installed dep by performing the `npm-package-arg` parsing within a
try/catch block instead of expecting to read properties from the
returned instance.

Also, adds the missing test for that specific line of code.

Fixes #1703

PR-URL: https://github.com/npm/cli/pull/1857
Credit: @ruyadorno
Close: #1857
Reviewed-by: @nlf

1 files changed, 6 insertions, 3 deletions

diff --git a/lib/outdated.js b/lib/outdated.js
index c84ed94ed..e7c800dc9 100644
--- a/lib/outdated.js
+++ b/lib/outdated.js
@@ -138,8 +138,11 @@ async function outdated_ (tree, deps, opts) {
       const packument = await getPackument(spec)
       const expected = edge.spec
       // if it's not a range, version, or tag, skip it
-      /* istanbul ignore next */
-      if (!npa(`${edge.name}@${edge.spec}`).registry) {
+      try {
+        if (!npa(`${edge.name}@${edge.spec}`).registry) {
+          return null
+        }
+      } catch (err) {
         return null
       }
       const wanted = pickManifest(packument, expected, npm.flatOptions)
@@ -170,7 +173,7 @@ async function outdated_ (tree, deps, opts) {
         err.code === 'E403' ||
         err.code === 'E404')
       ) {
-        throw (err)
+        throw err
       }
     }
   }