secustor 6b6b685619 fix(host-rules): prefer username/password over token in git and node auth ...

Git's `insteadOf` variables, the git remote URL, and the generated `.npmrc` and
`.yarnrc.yml` each preferred a host rule's `token` over its `username` and
`password`. The HTTP layer, the docker datasource, composer and bundler prefer
Basic. Move all three onto `resolveAuth()`, so one precedence applies
everywhere: a `password` wins over a `token`.

Behaviour changes, for a rule that ends up carrying both - which rank merging of
a broad and a specific rule produces easily enough:

- `getGitAuthenticatedEnvironmentVariables()` now writes
  `url.https://<user>:<password>@host/.insteadOf` where it wrote the token -
  "prefers username and password over token" in lib/util/git/auth.spec.ts
- `getRemoteUrlWithToken()` now returns `https://<user>:<password>@host/` where
  it returned the token - "prefers username and password over token" in
  lib/util/git/url.spec.ts
- the post-update rules now write `:username=` and `:_password=`, and yarn's
  `npmAuthIdent`, where they wrote `:_authToken=` (or `:_auth=`) and
  `npmAuthToken` - "prefers username and password over token" in
  lib/modules/manager/npm/post-update/rules.spec.ts

A `password` set without a `username` is a Basic credential at these sites too
now, as it already was for HTTP requests: git gets `https://:<password>@host/`
and the npmrc an empty `:username=`. `getGitEnvironmentVariables()` therefore
also picks up a rule that carries only a `password`.

The `hostRules` documentation now states the precedence, both in general and for
`authType`, which only applies to a `token`.

2026-09-14 23:30:49 +02:00

..

development

feat(manager): pass extracted constraints to updateArtifacts (#45826)

2026-09-14 11:09:07 +00:00

usage

fix(host-rules): prefer username/password over token in git and node auth

2026-09-14 23:30:49 +02:00