@pnpm/deps.security.signatures 1101.3.1 → 1102.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +31 -0
- package/lib/verifySignatures.js +1 -1
- package/package.json +4 -4
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,36 @@
|
|
|
1
1
|
# @pnpm/deps.security.signatures
|
|
2
2
|
|
|
3
|
+
## 1102.0.1
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Updated dependencies:
|
|
8
|
+
- @pnpm/network.fetch@1100.1.14
|
|
9
|
+
|
|
10
|
+
## 1102.0.0
|
|
11
|
+
|
|
12
|
+
### Major Changes
|
|
13
|
+
|
|
14
|
+
- The three registry lookups are now named for what they are keyed by, so that none of them is called `registries` — a name the `registries` setting itself has taken:
|
|
15
|
+
|
|
16
|
+
| before | after |
|
|
17
|
+
|---|---|
|
|
18
|
+
| `Config.registries` | `Config.registriesByScope` |
|
|
19
|
+
| `Config.namedRegistries` | `Config.registriesByPrefix` |
|
|
20
|
+
| `Config.registryOptions` | `Config.registryOptionsByUrl` |
|
|
21
|
+
|
|
22
|
+
The same rename applies to the `RegistryContext` fields, the `Registries` and `NamedRegistries` types (now `RegistriesByScope` and `RegistriesByPrefix`), `normalizeRegistries` / `normalizeNamedRegistries` (now `normalizeRegistriesByScope` / `normalizeRegistriesByPrefix`), and the `BUILTIN_NAMED_REGISTRIES` constant (now `BUILTIN_REGISTRIES_BY_PREFIX`).
|
|
23
|
+
|
|
24
|
+
This is an internal rename: no setting, error code, lockfile field, or `.pnpmfile.cjs` hook field changes. A `preResolution` hook still reads `ctx.registries`, which is the name pacquet passes as well. The `registries` and `namedRegistries` settings are read under the names users write them.
|
|
25
|
+
|
|
26
|
+
The pnpr resolve request sends `registriesByPrefix` where it sent `namedRegistries`. A pnpr server and its clients must be on matching versions, which is already the case for an experimental server.
|
|
27
|
+
|
|
28
|
+
### Patch Changes
|
|
29
|
+
|
|
30
|
+
- Updated dependencies:
|
|
31
|
+
- @pnpm/error@1100.1.3
|
|
32
|
+
- @pnpm/network.fetch@1100.1.13
|
|
33
|
+
|
|
3
34
|
## 1101.3.1
|
|
4
35
|
|
|
5
36
|
### Patch Changes
|
package/lib/verifySignatures.js
CHANGED
|
@@ -14,7 +14,7 @@ export async function verifySignatures(packages, getAuthHeader, opts) {
|
|
|
14
14
|
missing: [],
|
|
15
15
|
verified: 0,
|
|
16
16
|
};
|
|
17
|
-
//
|
|
17
|
+
// RegistriesByScope without signing keys are not counted as audited: there is no
|
|
18
18
|
// registry trust root to verify against.
|
|
19
19
|
const packumentCache = new Map();
|
|
20
20
|
const limit = pLimit(opts.networkConcurrency ?? 16);
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@pnpm/deps.security.signatures",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "1102.0.1",
|
|
4
4
|
"description": "Verify package signatures from npm registries",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"pnpm",
|
|
@@ -29,9 +29,9 @@
|
|
|
29
29
|
"!*.map"
|
|
30
30
|
],
|
|
31
31
|
"dependencies": {
|
|
32
|
-
"@pnpm/error": "1100.1.
|
|
32
|
+
"@pnpm/error": "1100.1.3",
|
|
33
33
|
"@pnpm/fetching.types": "1100.0.3",
|
|
34
|
-
"@pnpm/network.fetch": "1100.1.
|
|
34
|
+
"@pnpm/network.fetch": "1100.1.14",
|
|
35
35
|
"p-limit": "^7.3.1"
|
|
36
36
|
},
|
|
37
37
|
"peerDependencies": {
|
|
@@ -39,7 +39,7 @@
|
|
|
39
39
|
},
|
|
40
40
|
"devDependencies": {
|
|
41
41
|
"@jest/globals": "30.4.1",
|
|
42
|
-
"@pnpm/deps.security.signatures": "
|
|
42
|
+
"@pnpm/deps.security.signatures": "1102.0.1",
|
|
43
43
|
"@pnpm/logger": "1100.0.0",
|
|
44
44
|
"@pnpm/testing.mock-agent": "1101.0.7"
|
|
45
45
|
},
|