note: no summary for this digest release
Digest releases are listed without a summary. The original release notes for this version are below.
release-notesgithub.com/pnpm/pnpm · 102 lines
- ## Patch Changes
- * 78e29fe: Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through.
- * 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest `name` was a scoped path traversal (e.g. `@x/../../../<path>`) could be written outside `node_modules` to an attacker-controlled location during `pnpm install`, even with `--ignore-scripts`. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
- * 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the `pnpm` and `@pnpm/exe` npm packages whose bins are placeholders replaced at install time by the host's native binary from a `@pnpm/exe.<platform>-<arch>[-musl]` optional dependency. Because pnpm installs its own engine with `--ignore-scripts`, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native `pnpm` package), and verifies the native binary's npm registry signature before running it.
- * 36928be: `${...}` environment-variable placeholders in the `httpProxy`, `httpsProxy`, `noProxy`, `proxy`, and `noproxy` settings are no longer expanded when these settings come from a project's `pnpm-workspace.yaml`. They now receive the same protection already applied to `registry`.
- <!-- sponsors -->
- ## Platinum Sponsors
- <table>
- <tbody>
- <tr>
- <td align="center" valign="middle">
- <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
- </td>
- </tr>
- </tbody>
- </table>
- ## Gold Sponsors
- <table>
- <tbody>
- <tr>
- <td align="center" valign="middle">
- <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
- <picture>
- <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
- <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
- <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
- </picture>
- </a>
- </td>
- <td align="center" valign="middle">
- <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
- <picture>
- <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
- <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
- <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
- </picture>
- </a>
- </td>
- <td align="center" valign="middle">
- <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
- </td>
- </tr>
- <tr>
- <td align="center" valign="middle">
- <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
- <picture>
- <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
- <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
- <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
- </picture>
- </a>
- </td>
- <td align="center" valign="middle">
- <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
- <picture>
- <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
- <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
- <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
- </picture>
- </a>
- </td>
- <td align="center" valign="middle">
- <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
- <picture>
- <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
- <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
- <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
- </picture>
- </a>
- </td>
- </tr>
- <tr>
- <td align="center" valign="middle">
- <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
- <picture>
- <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
- <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
- <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
- </picture>
- </a>
- </td>
- <td align="center" valign="middle">
- <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
- <picture>
- <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
- <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
- <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
- </picture>
- </a>
- </td>
- </tr>
- </tbody>
- </table>
- <!-- sponsors end -->