The proxy panics with a nil pointer dereference in the normaliseHost function when processing npm install commands with --dry-run=true. This appears to happen when handling HTTPS CONNECT requests where the request URL or Host field may not be fully populated.
Stack Trace:
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x28 pc=0x99681b]
goroutine 86 [running]:
main.normaliseHost(0x103d45bc2a00, 0x484205?)
/go/src/github.com/dependabot/proxy/proxy.go:157 +0x1b
...
github.com/elazarl/goproxy.(*ProxyHttpServer).handleHttps.func2()
/go/src/github.com/dependabot/proxy/vendor/github.com/elazarl/goproxy/https.go:243 +0x6a5
Reproduction Steps:
- Run Dependabot update job for an npm package
- The updater executes:
corepack npm install <package>@<<version> --package-lock-only --dry-run=true --ignore-scripts
- Proxy crashes with nil pointer dereference in
normaliseHost
Expected Behavior:
The proxy should handle all request types gracefully, including those from npm dry-run operations, without panicking.
Actual Behavior:
The proxy process crashes, causing the updater job to fail with exit code 1.
Environment:
- Package:
tailwindcss-logical (3.0.1 → 4.2.0)
- Command:
corepack npm install tailwindcss-logical@4.2.0 --package-lock-only --dry-run=true --ignore-scripts
The proxy panics with a nil pointer dereference in the
normaliseHostfunction when processing npm install commands with--dry-run=true. This appears to happen when handling HTTPS CONNECT requests where the request URL or Host field may not be fully populated.Stack Trace:
Reproduction Steps:
corepack npm install <package>@<<version> --package-lock-only --dry-run=true --ignore-scriptsnormaliseHostExpected Behavior:
The proxy should handle all request types gracefully, including those from npm dry-run operations, without panicking.
Actual Behavior:
The proxy process crashes, causing the updater job to fail with exit code 1.
Environment:
tailwindcss-logical(3.0.1 → 4.2.0)corepack npm install tailwindcss-logical@4.2.0 --package-lock-only --dry-run=true --ignore-scripts