@pnpm/crypto.shasums-file 1100.2.2 → 1100.2.3

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @pnpm/crypto.shasums-file
 
+## 1100.2.3
+
+### Patch Changes
+
+- Authenticate Node.js runtime downloads from `nodeDownloadMirrors` with URL-scoped npm registry credentials, including bearer tokens, basic auth, and `tokenHelper` [pnpm/pnpm#14334](https://github.com/pnpm/pnpm/issues/14334).
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.4
+
 ## 1100.2.2
 
 ### Patch Changes

package/lib/diskCache.d.ts

@@ -22,6 +22,8 @@
  *   (their bodies were project-controllable before the cache existed), and
  *   the musl list's download URLs are derived from the hardcoded
  *   unofficial-builds base, never from the cached body.
+ * - Authenticated responses bypass this cache because the URL does not
+ *   identify the credential context that produced the body.
  *
  * The `<trust>` path segment keeps the two classes in disjoint subtrees so
  * their read policies cannot be confused.

package/lib/diskCache.js

@@ -25,6 +25,8 @@ import { threadId } from 'node:worker_threads';
  *   (their bodies were project-controllable before the cache existed), and
  *   the musl list's download URLs are derived from the hardcoded
  *   unofficial-builds base, never from the cached body.
+ * - Authenticated responses bypass this cache because the URL does not
+ *   identify the credential context that produced the body.
  *
  * The `<trust>` path segment keeps the two classes in disjoint subtrees so
  * their read policies cannot be confused.

package/lib/index.d.ts

@@ -16,6 +16,7 @@ export declare function fetchShasumsFile(fetch: FetchFromRegistry, shasumsUrl: s
 export declare function fetchVerifiedNodeShasumsFile(fetch: FetchFromRegistry, shasumsUrl: string): Promise<ShasumsFileItem[]>;
 export interface FetchShasumsFileCachedOpts {
     cacheDir?: string;
+    skipCache?: boolean;
 }
 export interface FetchVerifiedNodeShasumsFileCachedOpts extends FetchShasumsFileCachedOpts {
     trustedKeys?: readonly ArmoredKey[];

package/lib/index.js

@@ -25,7 +25,7 @@ export async function fetchVerifiedNodeShasumsFile(fetch, shasumsUrl) {
  * the cache.
  */
 export async function fetchVerifiedNodeShasumsFileCached(fetch, shasumsUrl, opts) {
-    const cacheOpts = { cacheDir: opts?.cacheDir, trust: 'verified' };
+    const cacheOpts = { cacheDir: opts?.skipCache === true ? undefined : opts?.cacheDir, trust: 'verified' };
     const signatureUrl = `${shasumsUrl}.sig`;
     const [cachedBody, cachedSignature] = await Promise.all([
         readCachedShasums(shasumsUrl, cacheOpts),
@@ -50,7 +50,7 @@ export async function fetchVerifiedNodeShasumsFileCached(fetch, shasumsUrl, opts
  * the cache.
  */
 export async function fetchShasumsFileCached(fetch, shasumsUrl, opts) {
-    const cacheOpts = { cacheDir: opts?.cacheDir, trust: 'unverified' };
+    const cacheOpts = { cacheDir: opts?.skipCache === true ? undefined : opts?.cacheDir, trust: 'unverified' };
     const cached = await readCachedShasums(shasumsUrl, cacheOpts);
     if (cached != null)
         return parseShasumsFile(cached);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/crypto.shasums-file",
-  "version": "1100.2.2",
+  "version": "1100.2.3",
   "description": "Utils for working with shasums files",
   "keywords": [
     "pnpm",
@@ -30,14 +30,14 @@
   ],
   "dependencies": {
     "@pnpm/crypto.hash": "1100.0.3",
-    "@pnpm/error": "1100.1.3",
+    "@pnpm/error": "1100.1.4",
     "@pnpm/fetching.types": "1100.0.3",
     "openpgp": "^6.3.1"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@openpgp/web-stream-tools": "0.3.1",
-    "@pnpm/crypto.shasums-file": "1100.2.2"
+    "@pnpm/crypto.shasums-file": "1100.2.3"
   },
   "engines": {
     "node": ">=22.13"