Socket
Socket
Sign inDemoInstall

npm-registry-fetch

Package Overview
Dependencies
6
Maintainers
6
Versions
76
Alerts
File Explorer

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

Comparing version 10.1.2 to 11.0.0

83

check-response.js
'use strict'
const errors = require('./errors.js')
const LRU = require('lru-cache')
const { Response } = require('minipass-fetch')
const defaultOpts = require('./default-opts.js')
const checkResponse = async ({ method, uri, res, registry, startTime, auth, opts }) => {
opts = { ...defaultOpts, ...opts }
if (res.headers.has('npm-notice') && !res.headers.has('x-local-cache'))
opts.log.notice('', res.headers.get('npm-notice'))
const checkResponse =
async ({ method, uri, res, registry, startTime, auth, opts }) => {
opts = { ...defaultOpts, ...opts }
if (res.headers.has('npm-notice') && !res.headers.has('x-local-cache'))
opts.log.notice('', res.headers.get('npm-notice'))
checkWarnings(res, registry, opts)
if (res.status >= 400) {
logRequest(method, res, startTime, opts)
if (auth && auth.scopeAuthKey && !auth.token && !auth.auth) {
if (res.status >= 400) {
logRequest(method, res, startTime, opts)
if (auth && auth.scopeAuthKey && !auth.token && !auth.auth) {
// we didn't have auth for THIS request, but we do have auth for
// requests to the registry indicated by the spec's scope value.
// Warn the user.
opts.log.warn('registry', `No auth for URI, but auth present for scoped registry.
opts.log.warn('registry', `No auth for URI, but auth present for scoped registry.

@@ -26,13 +25,13 @@ URI: ${uri}

More info here: https://github.com/npm/cli/wiki/No-auth-for-URI,-but-auth-present-for-scoped-registry`)
}
return checkErrors(method, res, startTime, opts)
} else {
res.body.on('end', () => logRequest(method, res, startTime, opts))
if (opts.ignoreBody) {
res.body.resume()
return new Response(null, res)
}
return res
}
return checkErrors(method, res, startTime, opts)
} else {
res.body.on('end', () => logRequest(method, res, startTime, opts))
if (opts.ignoreBody) {
res.body.resume()
return new Response(null, res)
}
return res
}
}
module.exports = checkResponse

@@ -44,3 +43,4 @@

const attemptStr = attempt && attempt > 1 ? ` attempt #${attempt}` : ''
const cacheStr = res.headers.get('x-local-cache') ? ' (from cache)' : ''
const cacheStatus = res.headers.get('x-local-cache-status')
const cacheStr = cacheStatus ? ` (cache ${cacheStatus})` : ''

@@ -65,42 +65,2 @@ let urlStr

const WARNING_REGEXP = /^\s*(\d{3})\s+(\S+)\s+"(.*)"\s+"([^"]+)"/
const BAD_HOSTS = new LRU({ max: 50 })
function checkWarnings (res, registry, opts) {
if (res.headers.has('warning') && !BAD_HOSTS.has(registry)) {
const warnings = {}
// note: headers.raw() will preserve case, so we might have a
// key on the object like 'WaRnInG' if that was used first
for (const [key, value] of Object.entries(res.headers.raw())) {
if (key.toLowerCase() !== 'warning')
continue
value.forEach(w => {
const match = w.match(WARNING_REGEXP)
if (match) {
warnings[match[1]] = {
code: match[1],
host: match[2],
message: match[3],
date: new Date(match[4]),
}
}
})
}
BAD_HOSTS.set(registry, true)
if (warnings['199']) {
if (warnings['199'].message.match(/ENOTFOUND/))
opts.log.warn('registry', `Using stale data from ${registry} because the host is inaccessible -- are you offline?`)
else
opts.log.warn('registry', `Unexpected warning for ${registry}: ${warnings['199'].message}`)
}
if (warnings['111']) {
// 111 Revalidation failed -- we're using stale data
opts.log.warn(
'registry',
`Using stale data from ${registry} due to a request error during revalidation.`
)
}
}
}
function checkErrors (method, res, startTime, opts) {

@@ -132,3 +92,4 @@ return res.buffer()

} else if (res.status === 401 && body != null && /one-time pass/.test(body.toString('utf8'))) {
// Heuristic for malformed OTP responses that don't include the www-authenticate header.
// Heuristic for malformed OTP responses that don't include the
// www-authenticate header.
throw new errors.HttpErrorAuthOTP(

@@ -135,0 +96,0 @@ method, res, parsed, opts.spec

@@ -163,3 +163,4 @@ 'use strict'

module.exports.json.stream = fetchJSONStream
function fetchJSONStream (uri, jsonPath, /* istanbul ignore next */ opts_ = {}) {
function fetchJSONStream (uri, jsonPath,
/* istanbul ignore next */ opts_ = {}) {
const opts = { ...defaultOpts, ...opts_ }

@@ -166,0 +167,0 @@ const parser = JSONStream.parse(jsonPath, opts.mapJSON)

{
"name": "npm-registry-fetch",
"version": "10.1.2",
"version": "11.0.0",
"description": "Fetch-based http client for use with npm registry APIs",

@@ -11,3 +11,3 @@ "main": "index.js",

"eslint": "eslint",
"lint": "npm run eslint -- *.js test/*.js",
"lint": "npm run npmclilint -- \"*.*js\" \"test/**/*.*js\"",
"lintfix": "npm run lint -- --fix",

@@ -18,3 +18,5 @@ "prepublishOnly": "git push origin --follow-tags",

"test": "tap",
"posttest": "npm run lint"
"posttest": "npm run lint --",
"npmclilint": "npmcli-lint",
"postsnap": "npm run lintfix --"
},

@@ -34,4 +36,3 @@ "repository": "https://github.com/npm/npm-registry-fetch",

"dependencies": {
"lru-cache": "^6.0.0",
"make-fetch-happen": "^8.0.9",
"make-fetch-happen": "^9.0.1",
"minipass": "^3.1.3",

@@ -44,13 +45,7 @@ "minipass-fetch": "^1.3.0",

"devDependencies": {
"@npmcli/lint": "^1.0.1",
"cacache": "^15.0.0",
"eslint": "^6.8.0",
"eslint-plugin-import": "^2.18.2",
"eslint-plugin-node": "^10.0.0",
"eslint-plugin-promise": "^4.2.1",
"eslint-plugin-standard": "^4.0.1",
"mkdirp": "^0.5.1",
"nock": "^11.7.0",
"nock": "^13.1.0",
"npmlog": "^4.1.2",
"require-inject": "^1.4.4",
"rimraf": "^2.6.2",
"ssri": "^8.0.0",

@@ -57,0 +52,0 @@ "tap": "^15.0.4"

@@ -393,3 +393,3 @@ # npm-registry-fetch

If provided, it will be sent in the `npm-command` header. This yeader is
If provided, it will be sent in the `npm-command` header. This header is
used by the npm registry to identify the npm command that caused this

@@ -520,6 +520,3 @@ request to be made.

Registry configuration for a request. If a request URL only includes the URL
path, this registry setting will be prepended. This configuration is also used
to determine authentication details, so even if the request URL references a
completely different host, `opts.registry` will be used to find the auth details
for that request.
path, this registry setting will be prepended.

@@ -526,0 +523,0 @@ See also [`opts.scope`](#opts-scope), [`opts.spec`](#opts-spec), and

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap

Packages

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc