chore(release): 10.34.5

.changeset/contain-virtual-store-package-name.md

@@ -1,8 +0,0 @@
----
-"@pnpm/deps.graph-builder": patch
-"@pnpm/calc-dep-state": patch
-"@pnpm/lockfile-to-pnp": patch
-"pnpm": patch
----
-
-Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through.

.changeset/isolated-linker-name-traversal.md

@@ -1,7 +0,0 @@
----
-"@pnpm/resolve-dependencies": patch
-"@pnpm/deps.graph-builder": patch
-"pnpm": patch
----
-
-Fixed a path traversal vulnerability where a dependency whose manifest `name` was a scoped path traversal (e.g. `@x/../../../<path>`) could be written outside `node_modules` to an attacker-controlled location during `pnpm install`, even with `--ignore-scripts`. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.

.changeset/pnpm-v10-install-v12.md

@@ -1,6 +0,0 @@
----
-"@pnpm/tools.plugin-commands-self-updater": patch
-"pnpm": patch
----
-
-Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the `pnpm` and `@pnpm/exe` npm packages whose bins are placeholders replaced at install time by the host's native binary from a `@pnpm/exe.<platform>-<arch>[-musl]` optional dependency. Because pnpm installs its own engine with `--ignore-scripts`, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native `pnpm` package), and verifies the native binary's npm registry signature before running it.

.changeset/proxy-fields-env-expansion.md

@@ -1,6 +0,0 @@
----
-"@pnpm/config": patch
-"pnpm": patch
----
-
-`${...}` environment-variable placeholders in the `httpProxy`, `httpsProxy`, `noProxy`, `proxy`, and `noproxy` settings are no longer expanded when these settings come from a project's `pnpm-workspace.yaml`. They now receive the same protection already applied to `registry`.

.meta-updater/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pnpm-private/updater
 
+## 1000.0.30
+
+### Patch Changes
+
+- @pnpm/workspace.find-packages@1000.0.71
+
 ## 1000.0.29
 
 ### Patch Changes

.meta-updater/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm-private/updater",
-  "version": "1000.0.29",
+  "version": "1000.0.30",
   "private": true,
   "type": "module",
   "scripts": {

cache/api/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @pnpm/cache.api
 
+## 1000.0.60
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+
 ## 1000.0.59
 
 ### Patch Changes

cache/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/cache.api",
-  "version": "1000.0.59",
+  "version": "1000.0.60",
   "description": "API for controlling the cache",
   "keywords": [
     "pnpm",

cache/commands/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @pnpm/cache.commands
 
+## 1000.0.71
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cache.api@1000.0.60
+  - @pnpm/cli-utils@1001.3.16
+
 ## 1000.0.70
 
 ### Patch Changes

cache/commands/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/cache.commands",
-  "version": "1000.0.70",
+  "version": "1000.0.71",
   "description": "Commands for controlling the cache",
   "keywords": [
     "pnpm",

cli/cli-utils/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @pnpm/cli-utils
 
+## 1001.3.16
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/default-reporter@1002.1.20
+  - @pnpm/store-connection-manager@1002.3.25
+  - @pnpm/config.deps-installer@1000.1.9
+
 ## 1001.3.15
 
 ### Patch Changes

cli/cli-utils/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/cli-utils",
-  "version": "1001.3.15",
+  "version": "1001.3.16",
   "description": "Utils for pnpm commands",
   "keywords": [
     "pnpm",

cli/default-reporter/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @pnpm/default-reporter
 
+## 1002.1.20
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+
 ## 1002.1.19
 
 ### Patch Changes

cli/default-reporter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/default-reporter",
-  "version": "1002.1.19",
+  "version": "1002.1.20",
   "description": "The default reporter of pnpm",
   "keywords": [
     "pnpm",

config/config/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pnpm/config
 
+## 1004.11.6
+
+### Patch Changes
+
+- 36928be: `${...}` environment-variable placeholders in the `httpProxy`, `httpsProxy`, `noProxy`, `proxy`, and `noproxy` settings are no longer expanded when these settings come from a project's `pnpm-workspace.yaml`. They now receive the same protection already applied to `registry`.
+
 ## 1004.11.5
 
 ### Patch Changes

config/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/config",
-  "version": "1004.11.5",
+  "version": "1004.11.6",
   "description": "Gets configuration options for pnpm",
   "keywords": [
     "pnpm",

config/plugin-commands-config/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @pnpm/plugin-commands-config
 
+## 1000.3.28
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+
 ## 1000.3.27
 
 ### Patch Changes

config/plugin-commands-config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-config",
-  "version": "1000.3.27",
+  "version": "1000.3.28",
   "description": "Commands for reading and writing settings to/from config files",
   "keywords": [
     "pnpm",

deps/graph-builder/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @pnpm/deps.graph-builder
 
+## 1002.3.17
+
+### Patch Changes
+
+- 78e29fe: Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through.
+- 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest `name` was a scoped path traversal (e.g. `@x/../../../<path>`) could be written outside `node_modules` to an attacker-controlled location during `pnpm install`, even with `--ignore-scripts`. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
+- Updated dependencies [78e29fe]
+  - @pnpm/calc-dep-state@1003.0.7
+
 ## 1002.3.16
 
 ### Patch Changes

deps/graph-builder/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.graph-builder",
-  "version": "1002.3.16",
+  "version": "1002.3.17",
   "description": "A package for building a dependency graph from a lockfile",
   "keywords": [
     "pnpm",

deps/status/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @pnpm/deps.status
 
+## 1003.0.44
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/workspace.state@1002.1.12
+  - @pnpm/workspace.find-packages@1000.0.71
+
 ## 1003.0.43
 
 ### Patch Changes

deps/status/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.status",
-  "version": "1003.0.43",
+  "version": "1003.0.44",
   "description": "Check dependencies status",
   "keywords": [
     "pnpm",

env/node.fetcher/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pnpm/node.fetcher
 
+## 1001.0.33
+
+### Patch Changes
+
+- @pnpm/node.resolver@1001.0.29
+
 ## 1001.0.32
 
 ### Patch Changes

env/node.fetcher/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/node.fetcher",
-  "version": "1001.0.32",
+  "version": "1001.0.33",
   "description": "Node.js artifacts fetcher",
   "keywords": [
     "pnpm",

env/node.resolver/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @pnpm/node.resolver
 
+## 1001.0.29
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+
 ## 1001.0.28
 
 ### Patch Changes

env/node.resolver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/node.resolver",
-  "version": "1001.0.28",
+  "version": "1001.0.29",
   "description": "Resolves a Node.js version specifier to an exact Node.js version",
   "keywords": [
     "pnpm",

env/plugin-commands-env/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @pnpm/plugin-commands-env
 
+## 1000.0.72
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+  - @pnpm/node.resolver@1001.0.29
+  - @pnpm/node.fetcher@1001.0.33
+
 ## 1000.0.71
 
 ### Patch Changes

env/plugin-commands-env/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-env",
-  "version": "1000.0.71",
+  "version": "1000.0.72",
   "description": "pnpm commands for managing Node.js",
   "keywords": [
     "pnpm",

exec/build-commands/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @pnpm/exec.build-commands
 
+## 1002.1.9
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/plugin-commands-rebuild@1008.0.20
+
 ## 1002.1.8
 
 ### Patch Changes

exec/build-commands/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/exec.build-commands",
-  "version": "1002.1.8",
+  "version": "1002.1.9",
   "description": "Commands for managing dependency builds",
   "keywords": [
     "pnpm",

exec/build-modules/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @pnpm/build-modules
 
+## 1007.0.18
+
+### Patch Changes
+
+- Updated dependencies [78e29fe]
+- Updated dependencies [36928be]
+  - @pnpm/calc-dep-state@1003.0.7
+  - @pnpm/config@1004.11.6
+
 ## 1007.0.17
 
 ### Patch Changes

exec/build-modules/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/build-modules",
-  "version": "1007.0.17",
+  "version": "1007.0.18",
   "description": "Build packages in node_modules",
   "keywords": [
     "pnpm",

exec/plugin-commands-rebuild/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @pnpm/plugin-commands-rebuild
 
+## 1008.0.20
+
+### Patch Changes
+
+- Updated dependencies [78e29fe]
+- Updated dependencies [36928be]
+  - @pnpm/calc-dep-state@1003.0.7
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+  - @pnpm/store-connection-manager@1002.3.25
+  - @pnpm/workspace.find-packages@1000.0.71
+
 ## 1008.0.19
 
 ### Patch Changes

exec/plugin-commands-rebuild/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-rebuild",
-  "version": "1008.0.19",
+  "version": "1008.0.20",
   "description": "Commands for rebuilding dependencies",
   "keywords": [
     "pnpm",

exec/plugin-commands-script-runners/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @pnpm/plugin-commands-script-runners
 
+## 1001.2.18
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+  - @pnpm/deps.status@1003.0.44
+  - @pnpm/plugin-commands-env@1000.0.72
+  - @pnpm/plugin-commands-installation@1004.10.5
+  - @pnpm/workspace.injected-deps-syncer@1000.0.45
+  - @pnpm/client@1001.1.30
+
 ## 1001.2.17
 
 ### Patch Changes

exec/plugin-commands-script-runners/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-script-runners",
-  "version": "1001.2.17",
+  "version": "1001.2.18",
   "description": "Commands for running scripts",
   "keywords": [
     "pnpm",

lockfile/lockfile-to-pnp/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pnpm/lockfile-to-pnp
 
+## 1001.0.38
+
+### Patch Changes
+
+- 78e29fe: Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through.
+
 ## 1001.0.37
 
 ### Patch Changes

lockfile/lockfile-to-pnp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile-to-pnp",
-  "version": "1001.0.37",
+  "version": "1001.0.38",
   "description": "Creates a Plug'n'Play file from a pnpm-lock.yaml",
   "keywords": [
     "pnpm",

lockfile/plugin-commands-audit/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @pnpm/plugin-commands-audit
 
+## 1002.2.16
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+
 ## 1002.2.15
 
 ### Patch Changes

lockfile/plugin-commands-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-audit",
-  "version": "1002.2.15",
+  "version": "1002.2.16",
   "description": "pnpm commands for dependencies audit",
   "keywords": [
     "pnpm",

modules-mounter/daemon/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @pnpm/mount-modules
 
+## 1001.0.60
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+
 ## 1001.0.59
 
 ### Patch Changes

modules-mounter/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/mount-modules",
-  "version": "1001.0.59",
+  "version": "1001.0.60",
   "description": "Mounts a node_modules directory with FUSE",
   "keywords": [
     "pnpm",

packages/calc-dep-state/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pnpm/calc-dep-state
 
+## 1003.0.7
+
+### Patch Changes
+
+- 78e29fe: Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through.
+
 ## 1003.0.6
 
 ### Patch Changes

packages/calc-dep-state/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/calc-dep-state",
-  "version": "1003.0.6",
+  "version": "1003.0.7",
   "description": "Calculates the state of a dependency",
   "keywords": [
     "pnpm",

packages/plugin-commands-doctor/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @pnpm/plugin-commands-doctor
 
+## 1000.1.70
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+
 ## 1000.1.69
 
 ### Patch Changes

packages/plugin-commands-doctor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-doctor",
-  "version": "1000.1.69",
+  "version": "1000.1.70",
   "description": "Commands for checks of known common issues ",
   "keywords": [
     "pnpm",

packages/plugin-commands-init/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @pnpm/plugin-commands-init
 
+## 1000.3.23
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+
 ## 1000.3.22
 
 ### Patch Changes

packages/plugin-commands-init/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-init",
-  "version": "1000.3.22",
+  "version": "1000.3.23",
   "description": "Create a package.json file",
   "keywords": [
     "pnpm",

packages/plugin-commands-setup/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pnpm/plugin-commands-setup
 
+## 1000.1.48
+
+### Patch Changes
+
+- @pnpm/cli-utils@1001.3.16
+
 ## 1000.1.47
 
 ### Patch Changes

packages/plugin-commands-setup/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-setup",
-  "version": "1000.1.47",
+  "version": "1000.1.48",
   "description": "pnpm commands for setting up pnpm",
   "keywords": [
     "pnpm",

patching/plugin-commands-patching/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @pnpm/plugin-commands-patching
 
+## 1000.3.53
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+  - @pnpm/plugin-commands-installation@1004.10.5
+  - @pnpm/store-connection-manager@1002.3.25
+
 ## 1000.3.52
 
 ### Patch Changes

patching/plugin-commands-patching/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-patching",
-  "version": "1000.3.52",
+  "version": "1000.3.53",
   "description": "Commands for creating patches",
   "keywords": [
     "pnpm",

pkg-manager/client/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @pnpm/client
 
+## 1001.1.30
+
+### Patch Changes
+
+- @pnpm/node.fetcher@1001.0.33
+- @pnpm/default-resolver@1002.3.14
+
 ## 1001.1.29
 
 ### Patch Changes

pkg-manager/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/client",
-  "version": "1001.1.29",
+  "version": "1001.1.30",
   "description": "Creates the package resolve and fetch functions",
   "keywords": [
     "pnpm",

pkg-manager/core/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @pnpm/core
 
+## 1016.4.5
+
+### Patch Changes
+
+- Updated dependencies [78e29fe]
+- Updated dependencies [78e29fe]
+  - @pnpm/calc-dep-state@1003.0.7
+  - @pnpm/lockfile-to-pnp@1001.0.38
+  - @pnpm/resolve-dependencies@1008.8.5
+  - @pnpm/headless@1010.1.17
+  - @pnpm/build-modules@1007.0.18
+  - @pnpm/plugin-commands-rebuild@1008.0.20
+  - @pnpm/package-requester@1011.2.6
+
 ## 1016.4.4
 
 ### Patch Changes

pkg-manager/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/core",
-  "version": "1016.4.4",
+  "version": "1016.4.5",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",

pkg-manager/headless/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @pnpm/headless
 
+## 1010.1.17
+
+### Patch Changes
+
+- Updated dependencies [78e29fe]
+- Updated dependencies [78e29fe]
+  - @pnpm/deps.graph-builder@1002.3.17
+  - @pnpm/calc-dep-state@1003.0.7
+  - @pnpm/lockfile-to-pnp@1001.0.38
+  - @pnpm/build-modules@1007.0.18
+  - @pnpm/package-requester@1011.2.6
+
 ## 1010.1.16
 
 ### Patch Changes

pkg-manager/headless/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/headless",
-  "version": "1010.1.16",
+  "version": "1010.1.17",
   "description": "Fast installation using only pnpm-lock.yaml",
   "keywords": [
     "pnpm",

pkg-manager/plugin-commands-installation/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @pnpm/plugin-commands-installation
 
+## 1004.10.5
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/plugin-commands-rebuild@1008.0.20
+  - @pnpm/core@1016.4.5
+  - @pnpm/cli-utils@1001.3.16
+  - @pnpm/deps.status@1003.0.44
+  - @pnpm/plugin-commands-env@1000.0.72
+  - @pnpm/store-connection-manager@1002.3.25
+  - @pnpm/workspace.state@1002.1.12
+  - @pnpm/workspace.find-packages@1000.0.71
+  - @pnpm/filter-workspace-packages@1000.1.12
+  - @pnpm/outdated@1001.1.28
+  - @pnpm/package-store@1007.1.8
+  - @pnpm/config.deps-installer@1000.1.9
+
 ## 1004.10.4
 
 ### Patch Changes

pkg-manager/plugin-commands-installation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-installation",
-  "version": "1004.10.4",
+  "version": "1004.10.5",
   "description": "Commands for installation",
   "keywords": [
     "pnpm",

pkg-manager/resolve-dependencies/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @pnpm/resolve-dependencies
 
+## 1008.8.5
+
+### Patch Changes
+
+- 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest `name` was a scoped path traversal (e.g. `@x/../../../<path>`) could be written outside `node_modules` to an attacker-controlled location during `pnpm install`, even with `--ignore-scripts`. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
+- Updated dependencies [78e29fe]
+  - @pnpm/calc-dep-state@1003.0.7
+
 ## 1008.8.4
 
 ### Patch Changes

pkg-manager/resolve-dependencies/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolve-dependencies",
-  "version": "1008.8.4",
+  "version": "1008.8.5",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",

pnpm/CHANGELOG.md

@@ -1,5 +1,14 @@
 # pnpm
 
+## 10.34.5
+
+### Patch Changes
+
+- 78e29fe: Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through.
+- 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest `name` was a scoped path traversal (e.g. `@x/../../../<path>`) could be written outside `node_modules` to an attacker-controlled location during `pnpm install`, even with `--ignore-scripts`. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
+- 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the `pnpm` and `@pnpm/exe` npm packages whose bins are placeholders replaced at install time by the host's native binary from a `@pnpm/exe.<platform>-<arch>[-musl]` optional dependency. Because pnpm installs its own engine with `--ignore-scripts`, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native `pnpm` package), and verifies the native binary's npm registry signature before running it.
+- 36928be: `${...}` environment-variable placeholders in the `httpProxy`, `httpsProxy`, `noProxy`, `proxy`, and `noproxy` settings are no longer expanded when these settings come from a project's `pnpm-workspace.yaml`. They now receive the same protection already applied to `registry`.
+
 ## 10.34.4
 
 ### Patch Changes

pnpm/artifacts/exe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/exe",
-  "version": "10.34.4",
+  "version": "10.34.5",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",

pnpm/artifacts/linux-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/linux-arm64",
-  "version": "10.34.4",
+  "version": "10.34.5",
   "keywords": [
     "pnpm",
     "pnpm10",

pnpm/artifacts/linux-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/linux-x64",
-  "version": "10.34.4",
+  "version": "10.34.5",
   "keywords": [
     "pnpm",
     "pnpm10",

pnpm/artifacts/macos-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/macos-arm64",
-  "version": "10.34.4",
+  "version": "10.34.5",
   "keywords": [
     "pnpm",
     "pnpm10",

pnpm/artifacts/macos-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/macos-x64",
-  "version": "10.34.4",
+  "version": "10.34.5",
   "keywords": [
     "pnpm",
     "pnpm10",

pnpm/artifacts/win-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/win-arm64",
-  "version": "10.34.4",
+  "version": "10.34.5",
   "keywords": [
     "pnpm",
     "pnpm10",

pnpm/artifacts/win-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/win-x64",
-  "version": "10.34.4",
+  "version": "10.34.5",
   "keywords": [
     "pnpm",
     "pnpm10",

pnpm/dev/CHANGELOG.md

@@ -1,5 +1,11 @@
 # pd
 
+## 1000.0.39
+
+### Patch Changes
+
+- @pnpm/workspace.find-packages@1000.0.71
+
 ## 1000.0.38
 
 ### Patch Changes

pnpm/dev/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pd",
-  "version": "1000.0.38",
+  "version": "1000.0.39",
   "bin": "pd.js",
   "private": true,
   "scripts": {

pnpm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pnpm",
-  "version": "10.34.4",
+  "version": "10.34.5",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",

releasing/plugin-commands-deploy/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @pnpm/plugin-commands-deploy
 
+## 1002.0.46
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+  - @pnpm/plugin-commands-installation@1004.10.5
+
 ## 1002.0.45
 
 ### Patch Changes

releasing/plugin-commands-deploy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-deploy",
-  "version": "1002.0.45",
+  "version": "1002.0.46",
   "description": "Commands for deploy",
   "keywords": [
     "pnpm",

releasing/plugin-commands-publishing/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @pnpm/plugin-commands-publishing
 
+## 1000.3.22
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+  - @pnpm/plugin-commands-env@1000.0.72
+  - @pnpm/client@1001.1.30
+
 ## 1000.3.21
 
 ### Patch Changes

releasing/plugin-commands-publishing/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-publishing",
-  "version": "1000.3.21",
+  "version": "1000.3.22",
   "description": "The pack and publish commands of pnpm",
   "keywords": [
     "pnpm",

resolving/bun-resolver/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pnpm/resolving.bun-resolver
 
+## 1005.0.17
+
+### Patch Changes
+
+- @pnpm/node.fetcher@1001.0.33
+
 ## 1005.0.16
 
 ### Patch Changes

resolving/bun-resolver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.bun-resolver",
-  "version": "1005.0.16",
+  "version": "1005.0.17",
   "description": "Resolves the Bun runtime",
   "keywords": [
     "pnpm",

resolving/default-resolver/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @pnpm/default-resolver
 
+## 1002.3.14
+
+### Patch Changes
+
+- @pnpm/node.resolver@1001.0.29
+- @pnpm/resolving.bun-resolver@1005.0.17
+- @pnpm/resolving.deno-resolver@1005.0.17
+
 ## 1002.3.13
 
 ### Patch Changes

resolving/default-resolver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/default-resolver",
-  "version": "1002.3.13",
+  "version": "1002.3.14",
   "description": "pnpm's default package resolver",
   "keywords": [
     "pnpm",

resolving/deno-resolver/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pnpm/resolving.deno-resolver
 
+## 1005.0.17
+
+### Patch Changes
+
+- @pnpm/node.fetcher@1001.0.33
+
 ## 1005.0.16
 
 ### Patch Changes

resolving/deno-resolver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.deno-resolver",
-  "version": "1005.0.16",
+  "version": "1005.0.17",
   "description": "Resolves the Deno runtime",
   "keywords": [
     "pnpm",

reviewing/outdated/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pnpm/outdated
 
+## 1001.1.28
+
+### Patch Changes
+
+- @pnpm/client@1001.1.30
+
 ## 1001.1.27
 
 ### Patch Changes

reviewing/outdated/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/outdated",
-  "version": "1001.1.27",
+  "version": "1001.1.28",
   "description": "Check for outdated packages",
   "keywords": [
     "pnpm",

reviewing/plugin-commands-licenses/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @pnpm/plugin-commands-licenses
 
+## 1000.0.74
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+
 ## 1000.0.73
 
 ### Patch Changes

reviewing/plugin-commands-licenses/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-licenses",
-  "version": "1000.0.73",
+  "version": "1000.0.74",
   "description": "The licenses command of pnpm",
   "keywords": [
     "pnpm",

reviewing/plugin-commands-listing/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @pnpm/plugin-commands-listing
 
+## 1000.3.12
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+
 ## 1000.3.11
 
 ### Patch Changes

reviewing/plugin-commands-listing/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-listing",
-  "version": "1000.3.11",
+  "version": "1000.3.12",
   "description": "The list and why commands of pnpm",
   "keywords": [
     "pnpm",

reviewing/plugin-commands-outdated/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @pnpm/plugin-commands-outdated
 
+## 1000.0.75
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+  - @pnpm/default-resolver@1002.3.14
+  - @pnpm/outdated@1001.1.28
+
 ## 1000.0.74
 
 ### Patch Changes

reviewing/plugin-commands-outdated/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-outdated",
-  "version": "1000.0.74",
+  "version": "1000.0.75",
   "description": "The outdated command of pnpm",
   "keywords": [
     "pnpm",

store/plugin-commands-server/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @pnpm/plugin-commands-server
 
+## 1000.0.72
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+  - @pnpm/store-connection-manager@1002.3.25
+  - @pnpm/server@1001.0.22
+
 ## 1000.0.71
 
 ### Patch Changes

store/plugin-commands-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-server",
-  "version": "1000.0.71",
+  "version": "1000.0.72",
   "description": "Commands for controlling the store server",
   "keywords": [
     "pnpm",

store/plugin-commands-store-inspecting/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @pnpm/plugin-commands-store-inspecting
 
+## 1000.0.67
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/client@1001.1.30
+
 ## 1000.0.66
 
 ### Patch Changes

store/plugin-commands-store-inspecting/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-store-inspecting",
-  "version": "1000.0.66",
+  "version": "1000.0.67",
   "description": "The inspecting store commands of pnpm",
   "keywords": [
     "pnpm",

store/plugin-commands-store/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @pnpm/plugin-commands-store
 
+## 1000.0.74
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/cli-utils@1001.3.16
+  - @pnpm/store-connection-manager@1002.3.25
+
 ## 1000.0.73
 
 ### Patch Changes

store/plugin-commands-store/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/plugin-commands-store",
-  "version": "1000.0.73",
+  "version": "1000.0.74",
   "description": "Commands for controlling the store",
   "keywords": [
     "pnpm",

store/store-connection-manager/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @pnpm/store-connection-manager
 
+## 1002.3.25
+
+### Patch Changes
+
+- Updated dependencies [36928be]
+  - @pnpm/config@1004.11.6
+  - @pnpm/client@1001.1.30
+  - @pnpm/package-store@1007.1.8
+  - @pnpm/server@1001.0.22
+
 ## 1002.3.24
 
 ### Patch Changes

store/store-connection-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/store-connection-manager",
-  "version": "1002.3.24",
+  "version": "1002.3.25",
   "description": "Create a direct pnpm store controller or connect to a running store server",
   "keywords": [
     "pnpm",

testing/temp-store/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @pnpm/testing.temp-store
 
+## 1000.0.49
+
+### Patch Changes
+
+- @pnpm/client@1001.1.30
+- @pnpm/package-store@1007.1.8
+
 ## 1000.0.48
 
 ### Patch Changes