@pnpm/error 1100.1.1 → 1100.1.3

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @pnpm/error
 
+## 1100.1.3
+
+### Patch Changes
+
+- Added `fetchWarnTimeoutMs` and `fetchMinSpeedKiBps` to the Rust pnpm CLI and its N-API bindings. Slow registry metadata requests and tarball downloads now emit pnpm-compatible warnings without exposing URL credentials, query parameters, fragments, or control characters [pnpm/pnpm#12042](https://github.com/pnpm/pnpm/issues/12042).
+
+- Updated dependencies:
+  - @pnpm/constants@1102.0.0
+
+## 1100.1.2
+
+### Patch Changes
+
+- A git dependency whose clone (or shallow fetch) fails now reports which package it belongs to, under the `ERR_PNPM_GIT_FETCH_FAILED` code, with credentials in the repository URL redacted. When the lockfile records an SSH remote, the error also explains that fetching it needs an SSH key for that host, and that a lockfile entry written before pnpm v11.21 can be re-recorded over HTTPS with `pnpm update <package>` [#13743](https://github.com/pnpm/pnpm/issues/13743).
+
 ## 1100.1.1
 
 ### Patch Changes

package/lib/index.d.ts

@@ -49,6 +49,24 @@ export declare function redactUrlCredentials(text: string): string;
  * or inject terminal output via raw escapes / `\r` / `\n`.
  */
 export declare function redactAndSanitize(text: string): string;
+/**
+ * Make a URL safe for user-visible output without exposing credentials,
+ * query parameters, fragments, or terminal control characters. Malformed
+ * URLs are replaced entirely because their authority cannot be redacted
+ * reliably.
+ */
+export declare function redactUrlForDisplay(url: string): string;
+/**
+ * {@link redactAndSanitize} for text whose line breaks are worth keeping, such
+ * as a subprocess's multi-line stderr.
+ *
+ * Line breaks are kept only when doing so redacts exactly as much as
+ * collapsing the text would: a newline can fall inside a `user:pass@`
+ * authority — git echoes such a URL back verbatim, password included — and
+ * redacting each line separately would leave the credentials split but
+ * readable. Whenever the two disagree, the collapsed form wins.
+ */
+export declare function redactAndSanitizeMultiline(text: string): string;
 export declare class LockfileMissingDependencyError extends PnpmError {
     constructor(depPath: string);
 }

package/lib/index.js

@@ -94,14 +94,42 @@ export function redactAndSanitize(text) {
     // userinfo (`user:pass\r@host`) would otherwise split the authority across
     // the redaction scan, and removing it afterwards would rejoin the
     // credentials into the output.
-    let sanitized = '';
-    for (const char of text) {
-        const code = char.codePointAt(0);
-        if (code <= 0x1f || (code >= 0x7f && code <= 0x9f))
-            continue;
-        sanitized += char;
+    return redactUrlCredentials(sanitizeControlCharacters(text));
+}
+/**
+ * Make a URL safe for user-visible output without exposing credentials,
+ * query parameters, fragments, or terminal control characters. Malformed
+ * URLs are replaced entirely because their authority cannot be redacted
+ * reliably.
+ */
+export function redactUrlForDisplay(url) {
+    let display;
+    try {
+        display = new URL(sanitizeControlCharacters(url));
     }
-    return redactUrlCredentials(sanitized);
+    catch {
+        return '[hidden]';
+    }
+    display.username = '';
+    display.password = '';
+    display.search = '';
+    display.hash = '';
+    return display.href;
+}
+/**
+ * {@link redactAndSanitize} for text whose line breaks are worth keeping, such
+ * as a subprocess's multi-line stderr.
+ *
+ * Line breaks are kept only when doing so redacts exactly as much as
+ * collapsing the text would: a newline can fall inside a `user:pass@`
+ * authority — git echoes such a URL back verbatim, password included — and
+ * redacting each line separately would leave the credentials split but
+ * readable. Whenever the two disagree, the collapsed form wins.
+ */
+export function redactAndSanitizeMultiline(text) {
+    const collapsed = redactAndSanitize(text);
+    const perLine = text.split('\n').map(redactAndSanitize).join('\n');
+    return perLine.replaceAll('\n', '') === collapsed ? perLine : collapsed;
 }
 function isSchemeTailChar(code) {
     return (code >= 0x30 && code <= 0x39) || (code >= 0x41 && code <= 0x5a) || (code >= 0x61 && code <= 0x7a);
@@ -109,6 +137,16 @@ function isSchemeTailChar(code) {
 function isAsciiWhitespace(code) {
     return code === 0x20 || code === 0x09 || code === 0x0a || code === 0x0b || code === 0x0c || code === 0x0d;
 }
+function sanitizeControlCharacters(text) {
+    let sanitized = '';
+    for (const char of text) {
+        const code = char.codePointAt(0);
+        if (code <= 0x1f || (code >= 0x7f && code <= 0x9f))
+            continue;
+        sanitized += char;
+    }
+    return sanitized;
+}
 function hideAuthInformation(authHeaderValue) {
     const [authType, token] = authHeaderValue.split(' ');
     if (token == null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/error",
-  "version": "1100.1.1",
+  "version": "1100.1.3",
   "description": "An error class for pnpm errors",
   "keywords": [
     "pnpm",
@@ -28,11 +28,11 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/constants": "1101.0.0"
+    "@pnpm/constants": "1102.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/error": "1100.1.1"
+    "@pnpm/error": "1100.1.3"
   },
   "engines": {
     "node": ">=22.13"