From 8184f6c806279272a55a5e4788b3287d0fa272f0 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Mon, 20 Apr 2020 11:03:01 +0200
Subject: [PATCH] stricter hash parsing from git url

---
 fixtures/test.json | 3 ++-
 updates.js         | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/fixtures/test.json b/fixtures/test.json
index 55c34cc..740d0ce 100644
--- a/fixtures/test.json
+++ b/fixtures/test.json
@@ -8,7 +8,8 @@
     "jpeg-buffer-orientation": "0.0.0",
     "styled-components": "2.5.0-1",
     "@babel/preset-env": "7.0.0",
-    "updates": "https://github.com/silverwind/updates/tarball/6941e05"
+    "updates": "https://github.com/silverwind/updates/tarball/6941e05",
+    "ipaddr.js": "https://github.com/silverwind/ipaddr.js/tarball/ipv6_cidrs_take2"
   },
   "devDependencies": {
     "updates": "file:."
diff --git a/updates.js b/updates.js
index f179938..5f74e7e 100755
--- a/updates.js
+++ b/updates.js
@@ -25,8 +25,8 @@ const cwd = cwdFn();
 // regexes for url dependencies. does only github and only hash or exact semver
 // https://regex101.com/r/gCZzfK/2
 const stripRe = /^.*?:\/\/(.*?@)?(github\.com[:/])/i;
-const partsRe = /^([^/]+)\/([^/#]+)?.*?([0-9a-f]+|v?[0-9]+\.[0-9]+\.[0-9]+)$/i;
-const hashRe = /^[0-9a-f]+$/i;
+const partsRe = /^([^/]+)\/([^/#]+)?.*?\/([0-9a-f]+|v?[0-9]+\.[0-9]+\.[0-9]+)$/i;
+const hashRe = /^[0-9a-f]{7,}$/i;
 
 const memoize = fn => {
   const cache = {};