@pnpm/error 1100.1.2 → 1100.1.3

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @pnpm/error
 
+## 1100.1.3
+
+### Patch Changes
+
+- Added `fetchWarnTimeoutMs` and `fetchMinSpeedKiBps` to the Rust pnpm CLI and its N-API bindings. Slow registry metadata requests and tarball downloads now emit pnpm-compatible warnings without exposing URL credentials, query parameters, fragments, or control characters [pnpm/pnpm#12042](https://github.com/pnpm/pnpm/issues/12042).
+
+- Updated dependencies:
+  - @pnpm/constants@1102.0.0
+
 ## 1100.1.2
 
 ### Patch Changes

package/lib/index.d.ts

@@ -49,6 +49,13 @@ export declare function redactUrlCredentials(text: string): string;
  * or inject terminal output via raw escapes / `\r` / `\n`.
  */
 export declare function redactAndSanitize(text: string): string;
+/**
+ * Make a URL safe for user-visible output without exposing credentials,
+ * query parameters, fragments, or terminal control characters. Malformed
+ * URLs are replaced entirely because their authority cannot be redacted
+ * reliably.
+ */
+export declare function redactUrlForDisplay(url: string): string;
 /**
  * {@link redactAndSanitize} for text whose line breaks are worth keeping, such
  * as a subprocess's multi-line stderr.

package/lib/index.js

@@ -94,14 +94,27 @@ export function redactAndSanitize(text) {
     // userinfo (`user:pass\r@host`) would otherwise split the authority across
     // the redaction scan, and removing it afterwards would rejoin the
     // credentials into the output.
-    let sanitized = '';
-    for (const char of text) {
-        const code = char.codePointAt(0);
-        if (code <= 0x1f || (code >= 0x7f && code <= 0x9f))
-            continue;
-        sanitized += char;
+    return redactUrlCredentials(sanitizeControlCharacters(text));
+}
+/**
+ * Make a URL safe for user-visible output without exposing credentials,
+ * query parameters, fragments, or terminal control characters. Malformed
+ * URLs are replaced entirely because their authority cannot be redacted
+ * reliably.
+ */
+export function redactUrlForDisplay(url) {
+    let display;
+    try {
+        display = new URL(sanitizeControlCharacters(url));
     }
-    return redactUrlCredentials(sanitized);
+    catch {
+        return '[hidden]';
+    }
+    display.username = '';
+    display.password = '';
+    display.search = '';
+    display.hash = '';
+    return display.href;
 }
 /**
  * {@link redactAndSanitize} for text whose line breaks are worth keeping, such
@@ -124,6 +137,16 @@ function isSchemeTailChar(code) {
 function isAsciiWhitespace(code) {
     return code === 0x20 || code === 0x09 || code === 0x0a || code === 0x0b || code === 0x0c || code === 0x0d;
 }
+function sanitizeControlCharacters(text) {
+    let sanitized = '';
+    for (const char of text) {
+        const code = char.codePointAt(0);
+        if (code <= 0x1f || (code >= 0x7f && code <= 0x9f))
+            continue;
+        sanitized += char;
+    }
+    return sanitized;
+}
 function hideAuthInformation(authHeaderValue) {
     const [authType, token] = authHeaderValue.split(' ');
     if (token == null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/error",
-  "version": "1100.1.2",
+  "version": "1100.1.3",
   "description": "An error class for pnpm errors",
   "keywords": [
     "pnpm",
@@ -28,11 +28,11 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/constants": "1101.0.0"
+    "@pnpm/constants": "1102.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/error": "1100.1.2"
+    "@pnpm/error": "1100.1.3"
   },
   "engines": {
     "node": ">=22.13"