@pnpm/fetching.tarball-fetcher 1102.0.15 → 1102.1.1

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @pnpm/tarball-fetcher
 
+## 1102.1.1
+
+### Patch Changes
+
+- Authenticate Node.js runtime downloads from `nodeDownloadMirrors` with URL-scoped npm registry credentials, including bearer tokens, basic auth, and `tokenHelper` [pnpm/pnpm#14334](https://github.com/pnpm/pnpm/issues/14334).
+
+- Network and archive retry logs hide credentials and signed query parameters in request URLs.
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.4
+  - @pnpm/exec.prepare-package@1100.0.35
+  - @pnpm/store.index@1100.3.1
+
+## 1102.1.0
+
+### Minor Changes
+
+- Added support for registry replacement tarballs using standard integrity values, explicit revision fields, registry routing from the `registries` setting, non-redirecting integrity-addressed URLs, canonical safe-integer revision numbers, and pnpr proxying for immutable upstream revision artifacts.
+
+### Patch Changes
+
+- Enforce `allowBuilds` when a prepared git dependency is reused from the shared store, and use the lockfile's canonical git resolution ID in approval suggestions.
+
+- Updated dependencies:
+  - @pnpm/core-loggers@1100.3.4
+  - @pnpm/exec.prepare-package@1100.0.34
+  - @pnpm/fetching.fetcher-base@1100.2.9
+  - @pnpm/fs.graceful-fs@1100.2.0
+  - @pnpm/store.index@1100.3.0
+  - @pnpm/types@1102.1.0
+
 ## 1102.0.15
 
 ### Patch Changes

package/lib/errorTypes/BadTarballError.js

@@ -1,9 +1,9 @@
-import { PnpmError } from '@pnpm/error';
+import { PnpmError, redactUrlForDisplay } from '@pnpm/error';
 export class BadTarballError extends PnpmError {
     expectedSize;
     receivedSize;
     constructor(opts) {
-        const message = `Actual size (${opts.receivedSize}) of tarball (${opts.tarballUrl}) did not match the one specified in 'Content-Length' header (${opts.expectedSize})`;
+        const message = `Actual size (${opts.receivedSize}) of tarball (${redactUrlForDisplay(opts.tarballUrl)}) did not match the one specified in 'Content-Length' header (${opts.expectedSize})`;
         super('BAD_TARBALL_SIZE', message, {
             attempts: opts?.attempts,
         });

package/lib/gitHostedTarballFetcher.js

@@ -23,6 +23,7 @@ export function createGitHostedTarballFetcher(fetchRemoteTarball, fetcherOpts) {
                 filesMap: prepareResult.filesMap,
                 manifest: prepareResult.manifest ?? manifest,
                 requiresBuild,
+                requiresPrepare: prepareResult.requiresPrepare,
                 // Propagate the raw tarball integrity so the lockfile pins it and
                 // future installs detect a tampered tarball from the git host.
                 integrity,
@@ -49,7 +50,7 @@ async function prepareGitHostedPkg(filesMap, cafs, rawFilesIndexFile, filesIndex
     const { shouldBeBuilt, pkgDir } = await preparePackage({
         ...opts,
         allowBuild: fetcherOpts.allowBuild,
-        pkgResolutionId: createGitHostedTarballPkgResolutionId(resolution),
+        pkgResolutionId: fetcherOpts.pkgResolutionId ?? createGitHostedTarballPkgResolutionId(resolution),
     }, tempLocation, resolution.path ?? '');
     const files = await packlist(pkgDir);
     const { storeIndex } = opts;
@@ -57,12 +58,14 @@ async function prepareGitHostedPkg(filesMap, cafs, rawFilesIndexFile, filesIndex
         if (!shouldBeBuilt) {
             const data = storeIndex.get(rawFilesIndexFile);
             if (data) {
+                data.requiresPrepare = false;
                 storeIndex.set(filesIndexFile, data);
                 storeIndex.delete(rawFilesIndexFile);
             }
             return {
                 filesMap,
                 ignoredBuild: false,
+                requiresPrepare: false,
             };
         }
         if (opts.ignoreScripts) {
@@ -70,6 +73,7 @@ async function prepareGitHostedPkg(filesMap, cafs, rawFilesIndexFile, filesIndex
             return {
                 filesMap,
                 ignoredBuild: true,
+                requiresPrepare: true,
             };
         }
     }
@@ -86,8 +90,10 @@ async function prepareGitHostedPkg(filesMap, cafs, rawFilesIndexFile, filesIndex
             filesIndexFile,
             pkg: fetcherOpts.pkg,
             readManifest: fetcherOpts.readManifest,
+            requiresPrepare: shouldBeBuilt,
         }),
         ignoredBuild: Boolean(opts.ignoreScripts),
+        requiresPrepare: shouldBeBuilt,
     };
 }
 function createGitHostedTarballPkgResolutionId(resolution) {

package/lib/index.js

@@ -46,6 +46,8 @@ async function fetchFromTarball(ctx, cafs, resolution, opts) {
         registry: resolution.registry,
         filesIndexFile: opts.filesIndexFile,
         pkg: opts.pkg,
+        redirect: resolution.revision == null ? undefined : 'manual',
+        retry: resolution.revision == null ? undefined : { retries: 0 },
         appendManifest: opts.appendManifest,
         ignoreFilePattern: opts.ignoreFilePattern,
     });

package/lib/remoteTarballFetcher.d.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage } from 'node:http';
 import type { FetchOptions, FetchResult } from '@pnpm/fetching.fetcher-base';
-import type { FetchFromRegistry, GetAuthHeader } from '@pnpm/fetching.types';
+import type { FetchFromRegistry, GetAuthHeader, RetryTimeoutOptions } from '@pnpm/fetching.types';
 import type { Cafs } from '@pnpm/store.cafs-types';
 import type { StoreIndex } from '@pnpm/store.index';
 export interface HttpResponse {
@@ -13,6 +13,8 @@ export type DownloadOptions = {
     onStart?: (totalSize: number | null, attempt: number) => void;
     onProgress?: (downloaded: number) => void;
     integrity?: string;
+    redirect?: RequestRedirect;
+    retry?: Pick<RetryTimeoutOptions, 'retries'>;
     storeIndex: StoreIndex;
     pkg?: FetchOptions['pkg'];
 } & Pick<FetchOptions, 'appendManifest' | 'readManifest' | 'filesIndexFile' | 'ignoreFilePattern'>;

package/lib/remoteTarballFetcher.js

@@ -1,3 +1,4 @@
+import { isIP } from 'node:net';
 import util from 'node:util';
 import { requestRetryLogger } from '@pnpm/core-loggers';
 import { FetchError, redactUrlForDisplay } from '@pnpm/error';
@@ -17,15 +18,17 @@ export function createDownloader(fetchFromRegistry, gotOpts) {
     };
     const fetchMinSpeedKiBps = gotOpts.fetchMinSpeedKiBps ?? 50; // 50 KiB/s
     return async function download(url, opts) {
-        const authHeaderValue = opts.getAuthHeaderByURI(url, { pkgName: opts.pkg?.name });
-        const op = retry.operation(retryOpts);
+        const authHeaderValue = getSecureNodeMirrorAuthHeader(opts.getAuthHeaderByURI(url, { pkgName: opts.pkg?.name }), url, opts.appendManifest?.name);
+        const downloadRetryOpts = { ...retryOpts, ...opts.retry };
+        const op = retry.operation(downloadRetryOpts);
         return new Promise((resolve, reject) => {
             op.attempt(async (attempt) => {
                 try {
                     resolve(await fetch(attempt));
                 }
                 catch (error) { // eslint-disable-line
-                    if (error.response?.status === 401 ||
+                    if ((opts.redirect === 'manual' && error.response?.status >= 300 && error.response.status < 400) ||
+                        error.response?.status === 401 ||
                         error.response?.status === 403 ||
                         error.response?.status === 404 ||
                         error.code === 'ERR_PNPM_PREPARE_PKG_FAILURE') {
@@ -56,10 +59,10 @@ export function createDownloader(fetchFromRegistry, gotOpts) {
                     requestRetryLogger.debug({
                         attempt,
                         error: errorInfo,
-                        maxRetries: retryOpts.retries,
+                        maxRetries: downloadRetryOpts.retries,
                         method: 'GET',
                         timeout,
-                        url,
+                        url: redactUrlForDisplay(url),
                     });
                 }
             });
@@ -79,6 +82,7 @@ export function createDownloader(fetchFromRegistry, gotOpts) {
                     // Hence, we tell fetch to not retry,
                     // and we perform the retries from this function instead.
                     retry: { retries: 0 },
+                    redirect: opts.redirect,
                     timeout: gotOpts.timeout,
                 });
                 if (res.status !== 200) {
@@ -170,6 +174,17 @@ export function createDownloader(fetchFromRegistry, gotOpts) {
         }
     };
 }
+function getSecureNodeMirrorAuthHeader(authHeaderValue, url, appendedPackageName) {
+    if (authHeaderValue == null || appendedPackageName !== 'node')
+        return authHeaderValue;
+    const parsed = new URL(url);
+    if (parsed.protocol === 'https:' || isLoopbackHost(parsed.hostname))
+        return authHeaderValue;
+    return undefined;
+}
+function isLoopbackHost(hostname) {
+    return hostname === 'localhost' || hostname === '[::1]' || (isIP(hostname) === 4 && hostname.startsWith('127.'));
+}
 // Per RFC 9110 §8.4, Content-Encoding is a comma-separated list of codings.
 // The response is encoded unless every coding is `identity` (case-insensitive,
 // surrounding whitespace ignored).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/fetching.tarball-fetcher",
-  "version": "1102.0.15",
+  "version": "1102.1.1",
   "description": "Fetcher for packages hosted as tarballs",
   "keywords": [
     "pnpm",
@@ -29,33 +29,33 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/core-loggers": "1100.3.3",
-    "@pnpm/error": "1100.1.3",
-    "@pnpm/exec.prepare-package": "1100.0.33",
-    "@pnpm/fetching.fetcher-base": "1100.2.8",
+    "@pnpm/core-loggers": "1100.3.4",
+    "@pnpm/error": "1100.1.4",
+    "@pnpm/exec.prepare-package": "1100.0.35",
+    "@pnpm/fetching.fetcher-base": "1100.2.9",
     "@pnpm/fetching.types": "1100.0.3",
-    "@pnpm/fs.graceful-fs": "1100.1.1",
+    "@pnpm/fs.graceful-fs": "1100.2.0",
     "@pnpm/fs.packlist": "1100.0.4",
-    "@pnpm/store.index": "1100.2.5",
-    "@pnpm/types": "1102.0.0",
+    "@pnpm/store.index": "1100.3.1",
+    "@pnpm/types": "1102.1.0",
     "@zkochan/retry": "^0.2.0",
     "lodash.throttle": "4.1.1",
     "ramda": "npm:@pnpm/ramda@0.28.1"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.3.0"
+    "@pnpm/worker": "^1100.4.1"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/fetching.tarball-fetcher": "1102.0.15",
+    "@pnpm/fetching.tarball-fetcher": "1102.1.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.13",
-    "@pnpm/store.cafs-types": "1100.0.2",
-    "@pnpm/store.create-cafs-store": "1100.0.26",
+    "@pnpm/network.fetch": "1100.1.15",
+    "@pnpm/store.cafs-types": "1100.1.0",
+    "@pnpm/store.create-cafs-store": "1100.0.28",
     "@pnpm/test-fixtures": "1100.0.1",
     "@pnpm/text.ordinal-comparator": "1100.0.0",
-    "@pnpm/types": "1102.0.0",
+    "@pnpm/types": "1102.1.0",
     "@types/lodash.throttle": "4.1.9",
     "@types/ramda": "0.32.0",
     "@types/retry": "^0.12.5",