@pnpm/error 1100.0.1 → 1100.1.0

package/CHANGELOG.md

@@ -0,0 +1,18 @@
+# @pnpm/error
+
+## 1100.1.0
+
+### Minor Changes
+
+- Added a new setting, `update.githubActionsServer`, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the `GITHUB_SERVER_URL` environment variable, falling back to `https://github.com`. The URL must use the `https://` or `http://` protocol [#13220](https://github.com/pnpm/pnpm/issues/13220).
+
+  `pnpm outdated` and `pnpm update` no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.
+
+  Setting `update.githubActions` to `false` now makes `pnpm outdated` and the interactive `pnpm update` skip GitHub Actions dependencies.
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/constants@1100.0.1

package/lib/index.d.ts

@@ -41,6 +41,14 @@ export declare class FetchError extends PnpmError {
  * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
  */
 export declare function redactUrlCredentials(text: string): string;
+/**
+ * Make untrusted, URL-bearing text safe to print or log: redact inline
+ * `user:pass@` credentials ({@link redactUrlCredentials}) and strip every
+ * control character. Both can appear in error messages that echo an
+ * untrusted URL or subprocess stderr back, which must not leak credentials
+ * or inject terminal output via raw escapes / `\r` / `\n`.
+ */
+export declare function redactAndSanitize(text: string): string;
 export declare class LockfileMissingDependencyError extends PnpmError {
     constructor(depPath: string);
 }

package/lib/index.js

@@ -82,6 +82,27 @@ export function redactUrlCredentials(text) {
     }
     return result;
 }
+/**
+ * Make untrusted, URL-bearing text safe to print or log: redact inline
+ * `user:pass@` credentials ({@link redactUrlCredentials}) and strip every
+ * control character. Both can appear in error messages that echo an
+ * untrusted URL or subprocess stderr back, which must not leak credentials
+ * or inject terminal output via raw escapes / `\r` / `\n`.
+ */
+export function redactAndSanitize(text) {
+    // Controls are stripped BEFORE redacting: a control character inside the
+    // userinfo (`user:pass\r@host`) would otherwise split the authority across
+    // the redaction scan, and removing it afterwards would rejoin the
+    // credentials into the output.
+    let sanitized = '';
+    for (const char of text) {
+        const code = char.codePointAt(0);
+        if (code <= 0x1f || (code >= 0x7f && code <= 0x9f))
+            continue;
+        sanitized += char;
+    }
+    return redactUrlCredentials(sanitized);
+}
 function isSchemeTailChar(code) {
     return (code >= 0x30 && code <= 0x39) || (code >= 0x41 && code <= 0x5a) || (code >= 0x61 && code <= 0x7a);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/error",
-  "version": "1100.0.1",
+  "version": "1100.1.0",
   "description": "An error class for pnpm errors",
   "keywords": [
     "pnpm",
@@ -28,11 +28,11 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/constants": "1100.0.0"
+    "@pnpm/constants": "1100.0.1"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/error": "1100.0.1"
+    "@pnpm/error": "1100.1.0"
   },
   "engines": {
     "node": ">=22.13"