Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(resolution): Normalise non-HTTPS NPM registry URLs too #6353

Merged
merged 1 commit into from
Sep 3, 2018
Merged

fix(resolution): Normalise non-HTTPS NPM registry URLs too #6353

merged 1 commit into from
Sep 3, 2018

Commits on Sep 3, 2018

  1. fix(resolution): Normalise non-HTTPS NPM registry URLs too 

    For some packages the NPM registry is incorrectly returning tarball
URLs that are not using HTTPS. For example:
`http://registry.npmjs.org/onetime/-/onetime-1.1.0.tgz`

Previously the `registry.npmjs.org` -> `registry.yarnpkg.com` tarball
URL normalisation was not occurring for these non-HTTPS URLs, causing
unwanted `http://registry.npmjs.org` references in `yarn.lock`.

Whilst the real fix needs to be made upstream:
https://npm.community/t/some-packages-have-dist-tarball-as-http-and-not-https/285

...this change prevents lockfile churn and insecure package downloads
over HTTP in the meantime.

The request-cache entry for `onetime` has been updated to the current
NPM registry response, which contains the bogus `tarball` URLs.

Fixes #6259.
    @edmorley
    edmorley committed Sep 3, 2018
    Configuration menu
    Copy the full SHA
    a72c95b View commit details
    Browse the repository at this point in the history