@pnpm/deps.compliance.sbom 1100.4.1 → 1101.0.0

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @pnpm/deps.compliance.sbom
 
+## 1101.0.0
+
+### Major Changes
+
+- The three registry lookups are now named for what they are keyed by, so that none of them is called `registries` — a name the `registries` setting itself has taken:
+
+  | before | after |
+  |---|---|
+  | `Config.registries` | `Config.registriesByScope` |
+  | `Config.namedRegistries` | `Config.registriesByPrefix` |
+  | `Config.registryOptions` | `Config.registryOptionsByUrl` |
+
+  The same rename applies to the `RegistryContext` fields, the `Registries` and `NamedRegistries` types (now `RegistriesByScope` and `RegistriesByPrefix`), `normalizeRegistries` / `normalizeNamedRegistries` (now `normalizeRegistriesByScope` / `normalizeRegistriesByPrefix`), and the `BUILTIN_NAMED_REGISTRIES` constant (now `BUILTIN_REGISTRIES_BY_PREFIX`).
+
+  This is an internal rename: no setting, error code, lockfile field, or `.pnpmfile.cjs` hook field changes. A `preResolution` hook still reads `ctx.registries`, which is the name pacquet passes as well. The `registries` and `namedRegistries` settings are read under the names users write them.
+
+  The pnpr resolve request sends `registriesByPrefix` where it sent `namedRegistries`. A pnpr server and its clients must be on matching versions, which is already the case for an experimental server.
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/config.normalize-registries@1101.0.0
+  - @pnpm/config.package-is-installable@1100.1.4
+  - @pnpm/constants@1102.0.0
+  - @pnpm/error@1100.1.3
+  - @pnpm/lockfile.detect-dep-types@1100.0.20
+  - @pnpm/lockfile.types@1100.0.20
+  - @pnpm/lockfile.utils@1102.0.0
+  - @pnpm/lockfile.walker@1100.0.20
+  - @pnpm/pkg-manifest.reader@1100.0.17
+  - @pnpm/resolving.resolver-base@1101.1.1
+  - @pnpm/store.index@1100.2.5
+  - @pnpm/store.pkg-finder@1100.0.30
+  - @pnpm/types@1102.0.0
+
 ## 1100.4.1
 
 ### Patch Changes

package/lib/collectComponents.d.ts

@@ -1,6 +1,6 @@
 import type { LockfileObject } from '@pnpm/lockfile.types';
 import type { Resolution } from '@pnpm/resolving.resolver-base';
-import type { DependenciesField, ProjectId, Registries, SupportedArchitectures } from '@pnpm/types';
+import type { DependenciesField, ProjectId, RegistriesByScope, SupportedArchitectures } from '@pnpm/types';
 import type { SbomComponentType, SbomResult } from './types.js';
 export interface WorkspacePackageInfo {
     name: string;
@@ -23,8 +23,8 @@ export interface CollectSbomComponentsOptions {
     include?: {
         [dependenciesField in DependenciesField]: boolean;
     };
-    registries: Registries;
-    namedRegistries?: Record<string, string>;
+    registriesByScope: RegistriesByScope;
+    registriesByPrefix?: Record<string, string>;
     lockfileDir: string;
     includedImporterIds?: ProjectId[];
     supportedArchitectures?: SupportedArchitectures;

package/lib/collectComponents.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { normalizeNamedRegistries } from '@pnpm/config.normalize-registries';
+import { normalizeRegistriesByPrefix } from '@pnpm/config.normalize-registries';
 import { checkPackageInstallability } from '@pnpm/config.package-is-installable';
 import { PnpmError } from '@pnpm/error';
 import { DepType, detectDepTypes } from '@pnpm/lockfile.detect-dep-types';
@@ -158,9 +158,9 @@ async function walkStep(step, parentPurl, depTypes, componentsMap, relationships
         // artifact from a compliance document.
         const registryUrl = registryName == null
             ? undefined
-            : normalizeNamedRegistries(opts.namedRegistries)[registryName];
+            : normalizeRegistriesByPrefix(opts.registriesByPrefix)[registryName];
         if (registryName != null && registryUrl == null) {
-            throw new PnpmError('MISSING_NAMED_REGISTRY', `Cannot describe package "${depPath}": it was resolved from the named registry '${registryName}:', which is not present in the namedRegistries setting.`, { hint: `Add '${registryName}' to the namedRegistries setting in pnpm-workspace.yaml.` });
+            throw new PnpmError('MISSING_NAMED_REGISTRY', `Cannot describe package "${depPath}": it was resolved from the named registry '${registryName}:', which is not present in the registriesByPrefix setting.`, { hint: `Add '${registryName}' to the registriesByPrefix setting in pnpm-workspace.yaml.` });
         }
         const purl = buildPurl({
             name,
@@ -172,11 +172,11 @@ async function walkStep(step, parentPurl, depTypes, componentsMap, relationships
         if (componentsMap.has(purl))
             return;
         const integrity = verifiedIntegrity(pkgSnapshot.resolution);
-        const resolution = pkgSnapshotToResolution(depPath, pkgSnapshot, { registries: opts.registries, namedRegistries: opts.namedRegistries });
+        const resolution = pkgSnapshotToResolution(depPath, pkgSnapshot, { registriesByScope: opts.registriesByScope, registriesByPrefix: opts.registriesByPrefix });
         const tarballUrl = resolution.tarball ?? gitDownloadUrl(resolution);
         let metadata = {};
         if (metadataOpts) {
-            metadata = await getPkgMetadata(depPath, pkgSnapshot, { registries: opts.registries, namedRegistries: opts.namedRegistries }, metadataOpts);
+            metadata = await getPkgMetadata(depPath, pkgSnapshot, { registriesByScope: opts.registriesByScope, registriesByPrefix: opts.registriesByPrefix }, metadataOpts);
         }
         const component = {
             name,

package/lib/purl.js

@@ -28,7 +28,7 @@ export function buildPurl(opts) {
  * Reduce a registry URL to the parts that identify the registry, dropping
  * anything that could carry a secret.
  *
- * An SBOM is meant to be published, and a `namedRegistries` entry may
+ * An SBOM is meant to be published, and a `registriesByPrefix` entry may
  * legitimately embed credentials — as userinfo
  * (`https://user:token@npm.example.com/`) or in a query string
  * (`?api_key=…`). Origin and path are kept because two registries can
@@ -37,7 +37,7 @@ export function buildPurl(opts) {
  * qualifier exists to prevent.
  *
  * A URL that doesn't parse is returned unchanged: it has no userinfo to
- * strip, and `namedRegistries` values are validated as http(s) URLs when
+ * strip, and `registriesByPrefix` values are validated as http(s) URLs when
  * the resolver is constructed, so this is unreachable in practice.
  */
 function sanitizeRegistryUrl(url) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.sbom",
-  "version": "1100.4.1",
+  "version": "1101.0.0",
   "description": "Generate SBOM from pnpm lockfile",
   "keywords": [
     "pnpm",
@@ -30,21 +30,21 @@
     "!*.map"
   ],
   "dependencies": {
-    "@cyclonedx/cyclonedx-library": "10.1.1",
-    "@pnpm/config.normalize-registries": "1100.1.0",
-    "@pnpm/config.package-is-installable": "1100.1.3",
-    "@pnpm/constants": "1101.0.0",
+    "@cyclonedx/cyclonedx-library": "10.2.0",
+    "@pnpm/config.normalize-registries": "1101.0.0",
+    "@pnpm/config.package-is-installable": "1100.1.4",
+    "@pnpm/constants": "1102.0.0",
     "@pnpm/deps.compliance.license-resolver": "1100.0.1",
-    "@pnpm/error": "1100.1.2",
-    "@pnpm/lockfile.detect-dep-types": "1100.0.19",
-    "@pnpm/lockfile.types": "1100.0.19",
-    "@pnpm/lockfile.utils": "1101.1.0",
-    "@pnpm/lockfile.walker": "1100.0.19",
-    "@pnpm/pkg-manifest.reader": "1100.0.16",
-    "@pnpm/resolving.resolver-base": "1101.1.0",
-    "@pnpm/store.index": "1100.2.4",
-    "@pnpm/store.pkg-finder": "1100.0.29",
-    "@pnpm/types": "1101.9.0",
+    "@pnpm/error": "1100.1.3",
+    "@pnpm/lockfile.detect-dep-types": "1100.0.20",
+    "@pnpm/lockfile.types": "1100.0.20",
+    "@pnpm/lockfile.utils": "1102.0.0",
+    "@pnpm/lockfile.walker": "1100.0.20",
+    "@pnpm/pkg-manifest.reader": "1100.0.17",
+    "@pnpm/resolving.resolver-base": "1101.1.1",
+    "@pnpm/store.index": "1100.2.5",
+    "@pnpm/store.pkg-finder": "1100.0.30",
+    "@pnpm/types": "1102.0.0",
     "p-limit": "^7.3.1",
     "ssri": "13.0.1"
   },
@@ -53,9 +53,9 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.compliance.sbom": "1100.4.1",
+    "@pnpm/deps.compliance.sbom": "1101.0.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.19",
+    "@pnpm/store.cafs": "1100.2.0",
     "@types/ssri": "^7.1.5"
   },
   "engines": {