Follow-up improvements from mTLS PR review#103
Merged
Conversation
- Warn when client key file permissions are more permissive than 0600 on Unix systems (security risk for private keys) - Extract mtlsCertQuestion() helper to eliminate duplicated prompt definitions across initConfig interactive mode and promptForMissingValues - Extract validateMtlsProtocol() helper to share the http+mtls incompatibility check across CLI validation, env config, and profiles - Update README mTLS examples to use platform-neutral paths (~/.certs/) instead of macOS-specific /Users/you/.certs/
Update follow-redirects 1.15.11 -> 1.16.0 (via axios 1.13.5 -> 1.15.0) to fix moderate severity vulnerability where custom authentication headers leak to cross-domain redirect targets.
pchuri
approved these changes
Apr 14, 2026
Owner
pchuri
left a comment
pchuri
left a comment
There was a problem hiding this comment.
LGTM — clean follow-up that addresses all feedback from #102.
All four items landed correctly: private key permission check with a helpful chmod 600 hint, mtlsCertQuestion() helper eliminating the triple duplication, validateMtlsProtocol() shared across all three config paths, and platform-neutral README paths. Net -39 lines is a nice bonus.
The bundled follow-redirects bump (GHSA-r4q5-vmmm-2653) is a welcome addition — good to get the auth header leak fix in alongside the mTLS work.
|
🎉 This PR is included in version 1.30.1 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #102, addressing the post-merge review suggestions from @pchuri.
0600on Unix systems (private key security risk)mtlsCertQuestion()helper to eliminate duplicated prompt definitions acrossinitConfiginteractive mode andpromptForMissingValuesvalidateMtlsProtocol()helper to share the http+mTLS incompatibility check across CLI validation, env config, and profile config~/.certs/) instead of macOS-specific/Users/you/.certs/Validation
npm test -- --runInBand— 178 tests passingnpm run lint— clean