From 145e79b657f9612447744944fa447d37a9fc7c9e Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Wed, 14 Jan 2026 14:05:58 +0100 Subject: [PATCH 1/3] fix(ncu-config): allow overriding global encrypted keys with local ones If a value is defined locally, it should make no difference whether the associated key is present or not in the global config. --- lib/config.js | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/lib/config.js b/lib/config.js index 3c91217d..e7724725 100644 --- a/lib/config.js +++ b/lib/config.js @@ -25,7 +25,15 @@ export function getMergedConfig(dir, home, additional) { const globalConfig = getConfig(GLOBAL_CONFIG, home); const projectConfig = getConfig(PROJECT_CONFIG, dir); const localConfig = getConfig(LOCAL_CONFIG, dir); - mergedConfig = Object.assign(globalConfig, projectConfig, localConfig, additional); + + // Using property descriptors to avoid calling any setter if e.g. a + // localConfig value overrides a globalConfig key. + mergedConfig = Object.create(null, { + ...Object.getOwnPropertyDescriptors(globalConfig), + ...Object.getOwnPropertyDescriptors(projectConfig), + ...Object.getOwnPropertyDescriptors(localConfig), + ...(additional && Object.getOwnPropertyDescriptors(additional)), + }); } return mergedConfig; }; From 8d55c1bdeb09a36ac446cc035929c7e7cd6cf22f Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Fri, 20 Mar 2026 18:47:42 +0100 Subject: [PATCH 2/3] `additional` should not be merged --- lib/config.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/config.js b/lib/config.js index e7724725..aeb376e2 100644 --- a/lib/config.js +++ b/lib/config.js @@ -32,10 +32,12 @@ export function getMergedConfig(dir, home, additional) { ...Object.getOwnPropertyDescriptors(globalConfig), ...Object.getOwnPropertyDescriptors(projectConfig), ...Object.getOwnPropertyDescriptors(localConfig), - ...(additional && Object.getOwnPropertyDescriptors(additional)), }); } - return mergedConfig; + return additional ? Object.create(null, { + ...Object.getOwnPropertyDescriptors(mergedConfig), + ...Object.getOwnPropertyDescriptors(additional), + }) : mergedConfig; }; export function clearCachedConfig() { mergedConfig = null; From 13bb6a74c8b26a7ba5a15f19ebeb15f9506152e7 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Fri, 20 Mar 2026 18:50:16 +0100 Subject: [PATCH 3/3] fixup! `additional` should not be merged --- lib/config.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/config.js b/lib/config.js index aeb376e2..b80422ef 100644 --- a/lib/config.js +++ b/lib/config.js @@ -34,10 +34,12 @@ export function getMergedConfig(dir, home, additional) { ...Object.getOwnPropertyDescriptors(localConfig), }); } - return additional ? Object.create(null, { + return additional + ? Object.create(null, { ...Object.getOwnPropertyDescriptors(mergedConfig), ...Object.getOwnPropertyDescriptors(additional), - }) : mergedConfig; + }) + : mergedConfig; }; export function clearCachedConfig() { mergedConfig = null;