@pnpm/network.fetch 1100.1.14 → 1100.1.15

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @pnpm/fetch
 
+## 1100.1.15
+
+### Patch Changes
+
+- Authenticate Node.js runtime downloads from `nodeDownloadMirrors` with URL-scoped npm registry credentials, including bearer tokens, basic auth, and `tokenHelper` [pnpm/pnpm#14334](https://github.com/pnpm/pnpm/issues/14334).
+
+- Network and archive retry logs hide credentials and signed query parameters in request URLs.
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.4
+
 ## 1100.1.14
 
 ### Patch Changes

package/lib/fetch.js

@@ -1,4 +1,5 @@
 import { requestRetryLogger } from '@pnpm/core-loggers';
+import { redactUrlForDisplay } from '@pnpm/error';
 import { operation } from '@zkochan/retry';
 import { fetch as undiciFetch } from 'undici';
 export {};
@@ -55,9 +56,10 @@ export async function fetch(url, opts = {}) {
                     }
                     // Extract error properties into a plain object because Error properties
                     // are non-enumerable and don't serialize well through the logging system
+                    const displayUrl = redactUrlForDisplay(urlString);
                     const errorInfo = {
                         name: err.name,
-                        message: err.message,
+                        message: err.message?.replaceAll(urlString, displayUrl),
                         code: err.code,
                         errno: err.errno,
                         // For HTTP errors from ResponseError class
@@ -75,7 +77,7 @@ export async function fetch(url, opts = {}) {
                         maxRetries,
                         method: opts.method ?? 'GET',
                         timeout: retryTimeout,
-                        url: urlString,
+                        url: displayUrl,
                     });
                 }
             });

package/lib/fetchFromRegistry.js

@@ -59,7 +59,7 @@ export function createFetchFromRegistry(defaultOpts) {
         }
         let redirects = 0;
         let urlObject = new URL(url);
-        const originalHost = urlObject.host;
+        const originalOrigin = urlObject.origin;
         /* eslint-disable no-await-in-loop */
         while (true) {
             const dispatcherOptions = {
@@ -87,7 +87,7 @@ export function createFetchFromRegistry(defaultOpts) {
             // This is a workaround to remove authorization headers on redirect.
             // Related pnpm issue: https://github.com/pnpm/pnpm/issues/1815
             urlObject = resolveRedirectUrl(response, urlObject);
-            if (originalHost === urlObject.host)
+            if (originalOrigin === urlObject.origin)
                 continue;
             if (headers['authorization']) {
                 delete headers.authorization;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.fetch",
-  "version": "1100.1.14",
+  "version": "1100.1.15",
   "description": "Native fetch with retries",
   "keywords": [
     "pnpm",
@@ -31,12 +31,12 @@
   "dependencies": {
     "@pnpm/config.registry-auth-key": "1100.0.0",
     "@pnpm/core-loggers": "1100.3.4",
-    "@pnpm/error": "1100.1.3",
+    "@pnpm/error": "1100.1.4",
     "@pnpm/fetching.types": "1100.0.3",
     "@pnpm/types": "1102.1.0",
     "@zkochan/retry": "^0.2.0",
     "lru-cache": "^11.5.2",
-    "socks": "^2.8.9",
+    "socks": "^2.8.10",
     "undici": "^7.29.0"
   },
   "peerDependencies": {
@@ -45,7 +45,7 @@
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.14",
+    "@pnpm/network.fetch": "1100.1.15",
     "https-proxy-server-express": "0.1.2"
   },
   "engines": {