dl-git-repo-safe 1.0.2 → 1.0.3

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.0.3] - 2026-04-01
+
+### Fixed
+- Fixed shallow clone logic: when caller passes `opts.checkout` different from repo default, shallow is now based on the effective checkout (`opts.checkout || repo.checkout`) instead of always using `repo.checkout`
+- Fixed `addProtocol` to recognize already-protocol-prefixed origins (`ssh://`, `git://`, `git@`, etc.) so they are not incorrectly rewritten with `https://` or `git@` prefixes
+
 ## [1.0.2] - 2026-04-01
 
 ### Fixed

package/index.js

@@ -2,21 +2,8 @@ var downloadUrl = require('download')
 var gitclone = require('git-clone-safe')
 var rm = require('rimraf').sync
 
-/**
- * Expose `download`.
- */
-
 module.exports = download
 
-/**
- * Download `repo` to `dest` and callback `fn(err)`.
- *
- * @param {String} repo
- * @param {String} dest
- * @param {Object} opts
- * @param {Function} fn
- */
-
 function download (repo, dest, opts, fn) {
   if (typeof opts === 'function') {
     fn = opts
@@ -30,9 +17,10 @@ function download (repo, dest, opts, fn) {
   var url = repo.url || getUrl(repo, clone)
 
   if (clone) {
+    var finalCheckout = opts.checkout || repo.checkout
     var cloneOptions = {
       checkout: repo.checkout,
-      shallow: repo.checkout === 'master',
+      shallow: finalCheckout === 'master',
       ...opts
     }
     gitclone(url, dest, cloneOptions, function (err) {
@@ -64,13 +52,6 @@ function download (repo, dest, opts, fn) {
   }
 }
 
-/**
- * Normalize a repo string.
- *
- * @param {String} repo
- * @return {Object}
- */
-
 function normalize (repo) {
   var regex = /^(?:(direct):([^#]+)(?:#(.+))?)$/
   var match = regex.exec(repo)
@@ -113,36 +94,23 @@ function normalize (repo) {
   }
 }
 
-/**
- * Adds protocol to url in none specified
- *
- * @param {String} url
- * @return {String}
- */
-
 function addProtocol (origin, clone) {
-  if (!/^(f|ht)tps?:\/\//i.test(origin)) {
-    if (clone) {
-      origin = 'git@' + origin
-    } else {
-      origin = 'https://' + origin
-    }
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(origin) || /^git@/i.test(origin)) {
+    return origin
+  }
+
+  if (clone) {
+    origin = 'git@' + origin
+  } else {
+    origin = 'https://' + origin
   }
 
   return origin
 }
 
-/**
- * Return a zip or git url for a given `repo`.
- *
- * @param {Object} repo
- * @return {String}
- */
-
 function getUrl (repo, clone) {
   var url
 
-  // Get origin with protocol and add trailing slash or colon (for ssh)
   var origin = addProtocol(repo.origin, clone)
   if (/^git@/i.test(origin)) {
     origin = origin + ':'
@@ -150,7 +118,6 @@ function getUrl (repo, clone) {
     origin = origin + '/'
   }
 
-  // Build url
   if (clone) {
     url = origin + repo.owner + '/' + repo.name + '.git'
   } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dl-git-repo-safe",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "license": "MIT",
   "repository": {
     "type": "git",