dependabot-npm_and_yarn 0.325.1 → 0.326.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 114ea614f46076a111424ed2a9ae61973726c73e287ca62fe34c6ea0ea6327b9
-  data.tar.gz: 9d5eefa1f87f94f3cab1b4a22be8c20581b7dda1e824987222860c2f86e5751f
+  metadata.gz: 033f2461268e8978305ec559b96b0067a33475b0326b6ba5e6bb5aa64134e7d1
+  data.tar.gz: 6497cd3f3b7e8ad082dd51341a2c52eeacbab331e1d7364382ae77b55cd9b7df
 SHA512:
-  metadata.gz: bf877616d0432d871fca9a1af92700415e64e40cdfe3e76af3b23e4c8c957f209ea63295ec72dec371aabf4c7ae740e44d4ae2fc461539b9bb7f7c2a42f67eb8
-  data.tar.gz: d9678ebee5fcca898c0540b6dd34d3770fa3fb6e129aa0d90f9a4cbfcc34e785c3cf7f2c16a7bf0ab37c8a41d0cb345df5c45721f35e2fb1b7b94b2e9bb33e16
+  metadata.gz: 723ee5329c03807930e6c0ecb75901721277c5307ffd81a472c2afebcb55f3bbef94a5a117bc54ff1302da28f39b7eccb4a25d4f675d701da8dfadaff8a3169a
+  data.tar.gz: 1cbb7f8c7653de3509516f5aa9abdd13be8c9e277f97242346e1c0b97a0d9e32770e97f2eb356e23c0d496e2d2c71508c2242811ab025f9eede4cbcc8f9d9df4

data/lib/dependabot/npm_and_yarn/metadata_finder.rb

@@ -215,13 +215,15 @@ module Dependabot
       sig { returns(String) }
       def dependency_url
         registry_url =
-          if new_source.nil? then "https://registry.npmjs.org"
+          if new_source.nil?
+            # Check credentials for a configured registry before falling back to public registry
+            configured_registry_from_credentials || "https://registry.npmjs.org"
           else
             new_source&.fetch(:url)
           end
 
-        # spaces must be escaped in base URL
-        registry_url = registry_url.gsub(" ", "%20")
+        # Remove trailing slashes and escape spaces for proper URL formatting
+        registry_url = URI::DEFAULT_PARSER.escape(registry_url)&.gsub(%r{/+$}, "")
 
         # NPM registries expect slashes to be escaped
         escaped_dependency_name = dependency.name.gsub("/", "%2F")
@@ -235,6 +237,23 @@ module Dependabot
         { "Authorization" => "Bearer #{auth_token}" }
       end
 
+      sig { returns(T.nilable(String)) }
+      def configured_registry_from_credentials
+        # Look for a credential that replaces the base registry (global registry replacement)
+        replaces_base_cred = credentials.find { |cred| cred["type"] == "npm_registry" && cred.replaces_base? }
+        return normalize_registry_url(replaces_base_cred["registry"]) if replaces_base_cred
+
+        nil
+      end
+
+      sig { params(registry: T.nilable(String)).returns(T.nilable(String)) }
+      def normalize_registry_url(registry)
+        return nil unless registry
+        return registry if registry.start_with?("http")
+
+        "https://#{registry}"
+      end
+
       sig { returns(String) }
       def dependency_registry
         if new_source.nil? then "registry.npmjs.org"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.325.1
+  version: 0.326.1
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.325.1
+        version: 0.326.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.325.1
+        version: 0.326.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -356,7 +356,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.325.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.326.1
 rdoc_options: []
 require_paths:
 - lib