replace credentials with dummy creds (#9466)

dependabot · Apr 10, 2024 · 15c9b2f · 15c9b2f
1 parent 9191d17
commit 15c9b2f
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb b/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb
@@ -372,8 +372,9 @@ def write_temporary_dependency_files(yarn_lock, update_package_json: true)
         end
 
         def sanitize_yarnrc_content(content)
-          # Replace all "${...}" and ${...} occurrences with empty strings
-          content.gsub(/\"\$\{.*?\}\"/, '""').gsub(/\$\{.*?\}/, '""')
+          # Replace all "${...}" and ${...} occurrences with dummy strings. We use
+          # dummy strings instead of empty strings to prevent issues with npmAlwaysAuth
+          content.gsub(/"\$\{.*?}"/, '"DUMMYCREDS"').gsub(/\$\{.*?}/, '"DUMMYCREDS"')
         end
 
         def clean_npmrc_in_path(yarn_lock)