`getAgent` and `getProxyAgent` keyed their agent caches on
`Boolean(strictSsl)`, which maps an omitted strictSsl and an explicit
false to the same key. Node.js verifies certificates when
rejectUnauthorized is omitted, so an insecure agent cached first was
handed to later callers that expected verification. The keys also left
out maxSockets and timeout, so a caller got an agent with another
caller's connection settings.
Both factories now resolve strictSsl, maxSockets, and timeout to their
effective values once, and use those values in the key and the agent.
`pickSettingByUrl` checked candidate keys by truthiness and skipped
settings whose value is false, 0, or an empty string. It now checks
whether the key exists. Its port-stripping fallback appended the slash
after the query string, which turned `/path?a=1` into a URL whose path
was lost when mapped to a registry key. The slash now goes on the path.
None of these packages is used by the pnpm CLI.
Zoltan Kochan
48b1e5425c