dependabot-npm_and_yarn 0.325.0 → 0.326.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: af012c4f702356c44384d448ac394273ca2eaa4688c0d3d6e817f596153ec35d
-  data.tar.gz: 9d5eefa1f87f94f3cab1b4a22be8c20581b7dda1e824987222860c2f86e5751f
+  metadata.gz: b4842f09d3dc4cb14c7092b9281109ab583e8bad0d47db88961a09c6a7e58fc3
+  data.tar.gz: 6497cd3f3b7e8ad082dd51341a2c52eeacbab331e1d7364382ae77b55cd9b7df
 SHA512:
-  metadata.gz: cf4e98a7e242d1c6c942fe688b88c7416014054635aea5c37b65351944f65ee777f763ff4be61cd5ba859b77f78d478d501e55be842c3bd346d6a91c4ae11c12
-  data.tar.gz: d9678ebee5fcca898c0540b6dd34d3770fa3fb6e129aa0d90f9a4cbfcc34e785c3cf7f2c16a7bf0ab37c8a41d0cb345df5c45721f35e2fb1b7b94b2e9bb33e16
+  metadata.gz: 8fee137d5966dfff6fb1e689f98a060ecc86fe186f2c2f11d6a9df527aae7efe41e0d3d63faa23fe246708887c975cabc8257986bf2c8dad681b498ee6bb5bd7
+  data.tar.gz: 1cbb7f8c7653de3509516f5aa9abdd13be8c9e277f97242346e1c0b97a0d9e32770e97f2eb356e23c0d496e2d2c71508c2242811ab025f9eede4cbcc8f9d9df4

data/lib/dependabot/npm_and_yarn/metadata_finder.rb

@@ -215,13 +215,15 @@ module Dependabot
       sig { returns(String) }
       def dependency_url
         registry_url =
-          if new_source.nil? then "https://registry.npmjs.org"
+          if new_source.nil?
+            # Check credentials for a configured registry before falling back to public registry
+            configured_registry_from_credentials || "https://registry.npmjs.org"
           else
             new_source&.fetch(:url)
           end
 
-        # spaces must be escaped in base URL
-        registry_url = registry_url.gsub(" ", "%20")
+        # Remove trailing slashes and escape spaces for proper URL formatting
+        registry_url = URI::DEFAULT_PARSER.escape(registry_url)&.gsub(%r{/+$}, "")
 
         # NPM registries expect slashes to be escaped
         escaped_dependency_name = dependency.name.gsub("/", "%2F")
@@ -235,6 +237,23 @@ module Dependabot
         { "Authorization" => "Bearer #{auth_token}" }
       end
 
+      sig { returns(T.nilable(String)) }
+      def configured_registry_from_credentials
+        # Look for a credential that replaces the base registry (global registry replacement)
+        replaces_base_cred = credentials.find { |cred| cred["type"] == "npm_registry" && cred.replaces_base? }
+        return normalize_registry_url(replaces_base_cred["registry"]) if replaces_base_cred
+
+        nil
+      end
+
+      sig { params(registry: T.nilable(String)).returns(T.nilable(String)) }
+      def normalize_registry_url(registry)
+        return nil unless registry
+        return registry if registry.start_with?("http")
+
+        "https://#{registry}"
+      end
+
       sig { returns(String) }
       def dependency_registry
         if new_source.nil? then "registry.npmjs.org"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.325.0
+  version: 0.326.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.325.0
+        version: 0.326.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.325.0
+        version: 0.326.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -356,7 +356,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.325.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.326.0
 rdoc_options: []
 require_paths:
 - lib