@pnpm/lockfile.utils 1100.0.11 → 1100.0.12

package/lib/index.d.ts

@@ -4,6 +4,6 @@ export { packageIdFromSnapshot } from './packageIdFromSnapshot.js';
 export { packageIsIndependent } from './packageIsIndependent.js';
 export { pkgSnapshotToResolution } from './pkgSnapshotToResolution.js';
 export { refIsLocalDirectory, refIsLocalTarball } from './refIsLocalTarball.js';
-export { toLockfileResolution } from './toLockfileResolution.js';
+export { isGitHostedTarballUrl, toLockfileResolution } from './toLockfileResolution.js';
 export * from '@pnpm/lockfile.types';
 export declare const getPkgShortId: typeof refToRelative;

package/lib/index.js

@@ -4,7 +4,7 @@ export { packageIdFromSnapshot } from './packageIdFromSnapshot.js';
 export { packageIsIndependent } from './packageIsIndependent.js';
 export { pkgSnapshotToResolution } from './pkgSnapshotToResolution.js';
 export { refIsLocalDirectory, refIsLocalTarball } from './refIsLocalTarball.js';
-export { toLockfileResolution } from './toLockfileResolution.js';
+export { isGitHostedTarballUrl, toLockfileResolution } from './toLockfileResolution.js';
 export * from '@pnpm/lockfile.types';
 // for backward compatibility
 export const getPkgShortId = refToRelative;

package/lib/toLockfileResolution.js

@@ -59,9 +59,14 @@ function preservingGitHosted(resolution, gitHosted) {
 // dep graph. Used as a fallback when callers haven't pre-set the
 // `gitHosted` field on TarballResolution.
 export function isGitHostedTarballUrl(url) {
-    return (url.startsWith('https://codeload.github.com/') ||
-        url.startsWith('https://bitbucket.org/') ||
-        url.startsWith('https://gitlab.com/')) && url.includes('tar.gz');
+    // Schemes and hostnames are case-insensitive, so match against a lowercased
+    // copy: a tampered `https://CODELOAD.GITHUB.COM/...` must not slip past as a
+    // non-git-hosted (and therefore registry-trusted) tarball. Only the
+    // lowercased copy is inspected; the original URL is never rewritten.
+    const lowerUrl = url.toLowerCase();
+    return (lowerUrl.startsWith('https://codeload.github.com/') ||
+        lowerUrl.startsWith('https://bitbucket.org/') ||
+        lowerUrl.startsWith('https://gitlab.com/')) && lowerUrl.includes('tar.gz');
 }
 function removeProtocol(url) {
     return url.split('://')[1];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.utils",
-  "version": "1100.0.11",
+  "version": "1100.0.12",
   "description": "Utils for dealing with pnpm-lock.yaml",
   "keywords": [
     "pnpm",
@@ -31,12 +31,12 @@
   "dependencies": {
     "get-npm-tarball-url": "^2.1.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "@pnpm/deps.path": "1100.0.6",
-    "@pnpm/hooks.types": "1100.0.10",
-    "@pnpm/resolving.resolver-base": "1100.4.0",
-    "@pnpm/lockfile.types": "1100.0.9",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/types": "1101.3.0"
+    "@pnpm/deps.path": "1100.0.7",
+    "@pnpm/lockfile.types": "1100.0.10",
+    "@pnpm/resolving.resolver-base": "1100.4.1",
+    "@pnpm/types": "1101.3.1",
+    "@pnpm/hooks.types": "1100.0.11",
+    "@pnpm/error": "1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -44,7 +44,7 @@
     "tempy": "3.0.0",
     "write-yaml-file": "^6.0.0",
     "yaml-tag": "1.1.0",
-    "@pnpm/lockfile.utils": "1100.0.11"
+    "@pnpm/lockfile.utils": "1100.0.12"
   },
   "engines": {
     "node": ">=22.13"