* fix: ensure percent-encoded secrets get masked
Co-authored-by: Gregor Martynus <39992+gr2m@users.noreply.github.com>
* fix: mask secrets in the exact form url.format() embeds them in git URLs
The authenticated repository URL is built with the legacy url.format(),
which encodes the auth field like encodeURIComponent() except that ":"
separators are kept as is. A GIT_CREDENTIALS value such as
"user:abc@def-secret" therefore appears as "user:abc%40def-secret" in a
failing git command, a form matched by neither the raw value, encodeURI(),
nor encodeURIComponent() candidates, and leaked unmasked.
Add the colon-preserving encoded form to the redaction candidates, assert
the unit tests against URLs built the same way get-git-auth-url.js builds
them, and add an integration test reproducing the leak end-to-end with a
git remote on a closed loopback port.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Matt Travi <programmer@travi.org>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This change makes the second segment the optional one rather than the third segment. That ensures that a maintenance branch always needs to end with `.x`
Co-authored-by: Matt Travi <programmer@travi.org>
* chore(deps): update @semantic-release/github to v11.0.0
* refactor: Update e2e.test.js to include clone_url in GET request
* refactor: Update e2e.test.js to include clone_url in GET request
* refactor: Include clone_url in GET request in e2e.test.js
* add `warn` type to logger in `getLogger`
* test: update test case `'Expose "error", "success" and "log" functions'`
* type: add `warn` to `logger` type interface
* doc: add available logger function to docs
* type: update type interface doc for `logger`
* ci: win32 escape slash as doubleslash for test
Pathing in stderr output has double backslash in the filename. The test
will now use double backslash in the existence test.
Signed-off-by: Chris. Webster <chris@webstech.net>
* ci: avoid Windows pop-up in credential tests
Windows uses a `credential.helper` that will open a pop-up for
credentials if they are missing. A git config parameter will now be set
to avoid the pop-up.
Signed-off-by: Chris. Webster <chris@webstech.net>
---------
Signed-off-by: Chris. Webster <chris@webstech.net>
There is legacy support for PortBindings and Binds at the root level of
the config. Currently (including Windows) these reside under the
HostConfig. ExposedPorts is now used to identify the externally
available ports.
Signed-off-by: Chris. Webster <chris@webstech.net>
for #2543
BREAKING CHANGE: semantic-release is now ESM-only. since it is used through its own executable, the impact on consuming projects should be minimal
BREAKING CHANGE: references to plugin files in configs need to include the file extension because of executing in an ESM context
the performance and readability of reduce is not a concern in this project since maintainers are
familiar with the idiom and are iterating over small lists. the filter rule is disabled selectively
since the filter being identified is not Array.filter
closes#2403
Gregor Martynus