From 2ea88f2ac374b53d23ee245cd0249ec7ed461f07 Mon Sep 17 00:00:00 2001 From: Zoltan Kochan Date: Fri, 10 Jul 2026 12:04:43 +0200 Subject: [PATCH] chore(release): 10.34.5 --- .../contain-virtual-store-package-name.md | 8 -------- .changeset/isolated-linker-name-traversal.md | 7 ------- .changeset/pnpm-v10-install-v12.md | 6 ------ .changeset/proxy-fields-env-expansion.md | 6 ------ .meta-updater/CHANGELOG.md | 6 ++++++ .meta-updater/package.json | 2 +- cache/api/CHANGELOG.md | 7 +++++++ cache/api/package.json | 2 +- cache/commands/CHANGELOG.md | 9 +++++++++ cache/commands/package.json | 2 +- cli/cli-utils/CHANGELOG.md | 10 ++++++++++ cli/cli-utils/package.json | 2 +- cli/default-reporter/CHANGELOG.md | 7 +++++++ cli/default-reporter/package.json | 2 +- config/config/CHANGELOG.md | 6 ++++++ config/config/package.json | 2 +- config/plugin-commands-config/CHANGELOG.md | 8 ++++++++ config/plugin-commands-config/package.json | 2 +- deps/graph-builder/CHANGELOG.md | 9 +++++++++ deps/graph-builder/package.json | 2 +- deps/status/CHANGELOG.md | 9 +++++++++ deps/status/package.json | 2 +- env/node.fetcher/CHANGELOG.md | 6 ++++++ env/node.fetcher/package.json | 2 +- env/node.resolver/CHANGELOG.md | 7 +++++++ env/node.resolver/package.json | 2 +- env/plugin-commands-env/CHANGELOG.md | 10 ++++++++++ env/plugin-commands-env/package.json | 2 +- exec/build-commands/CHANGELOG.md | 8 ++++++++ exec/build-commands/package.json | 2 +- exec/build-modules/CHANGELOG.md | 9 +++++++++ exec/build-modules/package.json | 2 +- exec/plugin-commands-rebuild/CHANGELOG.md | 12 ++++++++++++ exec/plugin-commands-rebuild/package.json | 2 +- .../CHANGELOG.md | 13 +++++++++++++ .../package.json | 2 +- lockfile/lockfile-to-pnp/CHANGELOG.md | 6 ++++++ lockfile/lockfile-to-pnp/package.json | 2 +- lockfile/plugin-commands-audit/CHANGELOG.md | 8 ++++++++ lockfile/plugin-commands-audit/package.json | 2 +- modules-mounter/daemon/CHANGELOG.md | 7 +++++++ modules-mounter/daemon/package.json | 2 +- packages/calc-dep-state/CHANGELOG.md | 6 ++++++ packages/calc-dep-state/package.json | 2 +- packages/plugin-commands-doctor/CHANGELOG.md | 8 ++++++++ packages/plugin-commands-doctor/package.json | 2 +- packages/plugin-commands-init/CHANGELOG.md | 8 ++++++++ packages/plugin-commands-init/package.json | 2 +- packages/plugin-commands-setup/CHANGELOG.md | 6 ++++++ packages/plugin-commands-setup/package.json | 2 +- .../plugin-commands-patching/CHANGELOG.md | 10 ++++++++++ .../plugin-commands-patching/package.json | 2 +- pkg-manager/client/CHANGELOG.md | 7 +++++++ pkg-manager/client/package.json | 2 +- pkg-manager/core/CHANGELOG.md | 14 ++++++++++++++ pkg-manager/core/package.json | 2 +- pkg-manager/headless/CHANGELOG.md | 12 ++++++++++++ pkg-manager/headless/package.json | 2 +- .../plugin-commands-installation/CHANGELOG.md | 19 +++++++++++++++++++ .../plugin-commands-installation/package.json | 2 +- pkg-manager/resolve-dependencies/CHANGELOG.md | 8 ++++++++ pkg-manager/resolve-dependencies/package.json | 2 +- pnpm/CHANGELOG.md | 9 +++++++++ pnpm/artifacts/exe/package.json | 2 +- pnpm/artifacts/linux-arm64/package.json | 2 +- pnpm/artifacts/linux-x64/package.json | 2 +- pnpm/artifacts/macos-arm64/package.json | 2 +- pnpm/artifacts/macos-x64/package.json | 2 +- pnpm/artifacts/win-arm64/package.json | 2 +- pnpm/artifacts/win-x64/package.json | 2 +- pnpm/dev/CHANGELOG.md | 6 ++++++ pnpm/dev/package.json | 2 +- pnpm/package.json | 2 +- releasing/plugin-commands-deploy/CHANGELOG.md | 9 +++++++++ releasing/plugin-commands-deploy/package.json | 2 +- .../plugin-commands-publishing/CHANGELOG.md | 10 ++++++++++ .../plugin-commands-publishing/package.json | 2 +- resolving/bun-resolver/CHANGELOG.md | 6 ++++++ resolving/bun-resolver/package.json | 2 +- resolving/default-resolver/CHANGELOG.md | 8 ++++++++ resolving/default-resolver/package.json | 2 +- resolving/deno-resolver/CHANGELOG.md | 6 ++++++ resolving/deno-resolver/package.json | 2 +- reviewing/outdated/CHANGELOG.md | 6 ++++++ reviewing/outdated/package.json | 2 +- .../plugin-commands-licenses/CHANGELOG.md | 8 ++++++++ .../plugin-commands-licenses/package.json | 2 +- .../plugin-commands-listing/CHANGELOG.md | 8 ++++++++ .../plugin-commands-listing/package.json | 2 +- .../plugin-commands-outdated/CHANGELOG.md | 10 ++++++++++ .../plugin-commands-outdated/package.json | 2 +- store/plugin-commands-server/CHANGELOG.md | 10 ++++++++++ store/plugin-commands-server/package.json | 2 +- .../CHANGELOG.md | 8 ++++++++ .../package.json | 2 +- store/plugin-commands-store/CHANGELOG.md | 9 +++++++++ store/plugin-commands-store/package.json | 2 +- store/store-connection-manager/CHANGELOG.md | 10 ++++++++++ store/store-connection-manager/package.json | 2 +- testing/temp-store/CHANGELOG.md | 7 +++++++ testing/temp-store/package.json | 2 +- .../plugin-commands-self-updater/CHANGELOG.md | 10 ++++++++++ .../plugin-commands-self-updater/package.json | 2 +- .../filter-packages-from-dir/CHANGELOG.md | 7 +++++++ .../filter-packages-from-dir/package.json | 2 +- .../filter-workspace-packages/CHANGELOG.md | 6 ++++++ .../filter-workspace-packages/package.json | 2 +- workspace/find-packages/CHANGELOG.md | 6 ++++++ workspace/find-packages/package.json | 2 +- workspace/injected-deps-syncer/CHANGELOG.md | 6 ++++++ workspace/injected-deps-syncer/package.json | 2 +- workspace/state/CHANGELOG.md | 7 +++++++ workspace/state/package.json | 2 +- 113 files changed, 485 insertions(+), 85 deletions(-) delete mode 100644 .changeset/contain-virtual-store-package-name.md delete mode 100644 .changeset/isolated-linker-name-traversal.md delete mode 100644 .changeset/pnpm-v10-install-v12.md delete mode 100644 .changeset/proxy-fields-env-expansion.md diff --git a/.changeset/contain-virtual-store-package-name.md b/.changeset/contain-virtual-store-package-name.md deleted file mode 100644 index 54a164f571..0000000000 --- a/.changeset/contain-virtual-store-package-name.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@pnpm/deps.graph-builder": patch -"@pnpm/calc-dep-state": patch -"@pnpm/lockfile-to-pnp": patch -"pnpm": patch ---- - -Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through. diff --git a/.changeset/isolated-linker-name-traversal.md b/.changeset/isolated-linker-name-traversal.md deleted file mode 100644 index b95e698f61..0000000000 --- a/.changeset/isolated-linker-name-traversal.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@pnpm/resolve-dependencies": patch -"@pnpm/deps.graph-builder": patch -"pnpm": patch ---- - -Fixed a path traversal vulnerability where a dependency whose manifest `name` was a scoped path traversal (e.g. `@x/../../../`) could be written outside `node_modules` to an attacker-controlled location during `pnpm install`, even with `--ignore-scripts`. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker. diff --git a/.changeset/pnpm-v10-install-v12.md b/.changeset/pnpm-v10-install-v12.md deleted file mode 100644 index f72bc90143..0000000000 --- a/.changeset/pnpm-v10-install-v12.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@pnpm/tools.plugin-commands-self-updater": patch -"pnpm": patch ---- - -Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the `pnpm` and `@pnpm/exe` npm packages whose bins are placeholders replaced at install time by the host's native binary from a `@pnpm/exe.-[-musl]` optional dependency. Because pnpm installs its own engine with `--ignore-scripts`, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native `pnpm` package), and verifies the native binary's npm registry signature before running it. diff --git a/.changeset/proxy-fields-env-expansion.md b/.changeset/proxy-fields-env-expansion.md deleted file mode 100644 index 6f6cadd8b4..0000000000 --- a/.changeset/proxy-fields-env-expansion.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@pnpm/config": patch -"pnpm": patch ---- - -`${...}` environment-variable placeholders in the `httpProxy`, `httpsProxy`, `noProxy`, `proxy`, and `noproxy` settings are no longer expanded when these settings come from a project's `pnpm-workspace.yaml`. They now receive the same protection already applied to `registry`. diff --git a/.meta-updater/CHANGELOG.md b/.meta-updater/CHANGELOG.md index f5d78f3524..ebe26bac79 100644 --- a/.meta-updater/CHANGELOG.md +++ b/.meta-updater/CHANGELOG.md @@ -1,5 +1,11 @@ # @pnpm-private/updater +## 1000.0.30 + +### Patch Changes + +- @pnpm/workspace.find-packages@1000.0.71 + ## 1000.0.29 ### Patch Changes diff --git a/.meta-updater/package.json b/.meta-updater/package.json index 00542eaa2c..219f432378 100644 --- a/.meta-updater/package.json +++ b/.meta-updater/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm-private/updater", - "version": "1000.0.29", + "version": "1000.0.30", "private": true, "type": "module", "scripts": { diff --git a/cache/api/CHANGELOG.md b/cache/api/CHANGELOG.md index 622dcce131..2ac9c07968 100644 --- a/cache/api/CHANGELOG.md +++ b/cache/api/CHANGELOG.md @@ -1,5 +1,12 @@ # @pnpm/cache.api +## 1000.0.60 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + ## 1000.0.59 ### Patch Changes diff --git a/cache/api/package.json b/cache/api/package.json index 2763ba4e95..8b78900ea3 100644 --- a/cache/api/package.json +++ b/cache/api/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/cache.api", - "version": "1000.0.59", + "version": "1000.0.60", "description": "API for controlling the cache", "keywords": [ "pnpm", diff --git a/cache/commands/CHANGELOG.md b/cache/commands/CHANGELOG.md index 2e12cf3b07..ba41023a78 100644 --- a/cache/commands/CHANGELOG.md +++ b/cache/commands/CHANGELOG.md @@ -1,5 +1,14 @@ # @pnpm/cache.commands +## 1000.0.71 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cache.api@1000.0.60 + - @pnpm/cli-utils@1001.3.16 + ## 1000.0.70 ### Patch Changes diff --git a/cache/commands/package.json b/cache/commands/package.json index 5a7435a2a3..ce4dd4756e 100644 --- a/cache/commands/package.json +++ b/cache/commands/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/cache.commands", - "version": "1000.0.70", + "version": "1000.0.71", "description": "Commands for controlling the cache", "keywords": [ "pnpm", diff --git a/cli/cli-utils/CHANGELOG.md b/cli/cli-utils/CHANGELOG.md index d966b3691d..14696f1989 100644 --- a/cli/cli-utils/CHANGELOG.md +++ b/cli/cli-utils/CHANGELOG.md @@ -1,5 +1,15 @@ # @pnpm/cli-utils +## 1001.3.16 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/default-reporter@1002.1.20 + - @pnpm/store-connection-manager@1002.3.25 + - @pnpm/config.deps-installer@1000.1.9 + ## 1001.3.15 ### Patch Changes diff --git a/cli/cli-utils/package.json b/cli/cli-utils/package.json index c965117bc3..20fe673c8c 100644 --- a/cli/cli-utils/package.json +++ b/cli/cli-utils/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/cli-utils", - "version": "1001.3.15", + "version": "1001.3.16", "description": "Utils for pnpm commands", "keywords": [ "pnpm", diff --git a/cli/default-reporter/CHANGELOG.md b/cli/default-reporter/CHANGELOG.md index 3c2491fc6c..62813ff615 100644 --- a/cli/default-reporter/CHANGELOG.md +++ b/cli/default-reporter/CHANGELOG.md @@ -1,5 +1,12 @@ # @pnpm/default-reporter +## 1002.1.20 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + ## 1002.1.19 ### Patch Changes diff --git a/cli/default-reporter/package.json b/cli/default-reporter/package.json index 6ddbda3425..67e8bf2a26 100644 --- a/cli/default-reporter/package.json +++ b/cli/default-reporter/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/default-reporter", - "version": "1002.1.19", + "version": "1002.1.20", "description": "The default reporter of pnpm", "keywords": [ "pnpm", diff --git a/config/config/CHANGELOG.md b/config/config/CHANGELOG.md index 09a47cd114..6541710128 100644 --- a/config/config/CHANGELOG.md +++ b/config/config/CHANGELOG.md @@ -1,5 +1,11 @@ # @pnpm/config +## 1004.11.6 + +### Patch Changes + +- 36928be: `${...}` environment-variable placeholders in the `httpProxy`, `httpsProxy`, `noProxy`, `proxy`, and `noproxy` settings are no longer expanded when these settings come from a project's `pnpm-workspace.yaml`. They now receive the same protection already applied to `registry`. + ## 1004.11.5 ### Patch Changes diff --git a/config/config/package.json b/config/config/package.json index f18e16daab..1002520ace 100644 --- a/config/config/package.json +++ b/config/config/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/config", - "version": "1004.11.5", + "version": "1004.11.6", "description": "Gets configuration options for pnpm", "keywords": [ "pnpm", diff --git a/config/plugin-commands-config/CHANGELOG.md b/config/plugin-commands-config/CHANGELOG.md index 5add50ec51..2ef60a9b69 100644 --- a/config/plugin-commands-config/CHANGELOG.md +++ b/config/plugin-commands-config/CHANGELOG.md @@ -1,5 +1,13 @@ # @pnpm/plugin-commands-config +## 1000.3.28 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + ## 1000.3.27 ### Patch Changes diff --git a/config/plugin-commands-config/package.json b/config/plugin-commands-config/package.json index 4d34c7c3fd..986e6777a9 100644 --- a/config/plugin-commands-config/package.json +++ b/config/plugin-commands-config/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-config", - "version": "1000.3.27", + "version": "1000.3.28", "description": "Commands for reading and writing settings to/from config files", "keywords": [ "pnpm", diff --git a/deps/graph-builder/CHANGELOG.md b/deps/graph-builder/CHANGELOG.md index 32c13464d8..aabdb585d1 100644 --- a/deps/graph-builder/CHANGELOG.md +++ b/deps/graph-builder/CHANGELOG.md @@ -1,5 +1,14 @@ # @pnpm/deps.graph-builder +## 1002.3.17 + +### Patch Changes + +- 78e29fe: Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through. +- 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest `name` was a scoped path traversal (e.g. `@x/../../../`) could be written outside `node_modules` to an attacker-controlled location during `pnpm install`, even with `--ignore-scripts`. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker. +- Updated dependencies [78e29fe] + - @pnpm/calc-dep-state@1003.0.7 + ## 1002.3.16 ### Patch Changes diff --git a/deps/graph-builder/package.json b/deps/graph-builder/package.json index 213b8677fe..fb3e24f9d3 100644 --- a/deps/graph-builder/package.json +++ b/deps/graph-builder/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/deps.graph-builder", - "version": "1002.3.16", + "version": "1002.3.17", "description": "A package for building a dependency graph from a lockfile", "keywords": [ "pnpm", diff --git a/deps/status/CHANGELOG.md b/deps/status/CHANGELOG.md index 421a8e2715..b940f45ac5 100644 --- a/deps/status/CHANGELOG.md +++ b/deps/status/CHANGELOG.md @@ -1,5 +1,14 @@ # @pnpm/deps.status +## 1003.0.44 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/workspace.state@1002.1.12 + - @pnpm/workspace.find-packages@1000.0.71 + ## 1003.0.43 ### Patch Changes diff --git a/deps/status/package.json b/deps/status/package.json index bf4401afd2..b118497e66 100644 --- a/deps/status/package.json +++ b/deps/status/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/deps.status", - "version": "1003.0.43", + "version": "1003.0.44", "description": "Check dependencies status", "keywords": [ "pnpm", diff --git a/env/node.fetcher/CHANGELOG.md b/env/node.fetcher/CHANGELOG.md index 6bfe2502b9..61f627be56 100644 --- a/env/node.fetcher/CHANGELOG.md +++ b/env/node.fetcher/CHANGELOG.md @@ -1,5 +1,11 @@ # @pnpm/node.fetcher +## 1001.0.33 + +### Patch Changes + +- @pnpm/node.resolver@1001.0.29 + ## 1001.0.32 ### Patch Changes diff --git a/env/node.fetcher/package.json b/env/node.fetcher/package.json index 8e95f3b7ba..c8dd3c89ec 100644 --- a/env/node.fetcher/package.json +++ b/env/node.fetcher/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/node.fetcher", - "version": "1001.0.32", + "version": "1001.0.33", "description": "Node.js artifacts fetcher", "keywords": [ "pnpm", diff --git a/env/node.resolver/CHANGELOG.md b/env/node.resolver/CHANGELOG.md index 6019134943..0dedd4d475 100644 --- a/env/node.resolver/CHANGELOG.md +++ b/env/node.resolver/CHANGELOG.md @@ -1,5 +1,12 @@ # @pnpm/node.resolver +## 1001.0.29 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + ## 1001.0.28 ### Patch Changes diff --git a/env/node.resolver/package.json b/env/node.resolver/package.json index 8a0c4140c9..d088eb4b10 100644 --- a/env/node.resolver/package.json +++ b/env/node.resolver/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/node.resolver", - "version": "1001.0.28", + "version": "1001.0.29", "description": "Resolves a Node.js version specifier to an exact Node.js version", "keywords": [ "pnpm", diff --git a/env/plugin-commands-env/CHANGELOG.md b/env/plugin-commands-env/CHANGELOG.md index f2cd4c48d8..141d0e7053 100644 --- a/env/plugin-commands-env/CHANGELOG.md +++ b/env/plugin-commands-env/CHANGELOG.md @@ -1,5 +1,15 @@ # @pnpm/plugin-commands-env +## 1000.0.72 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + - @pnpm/node.resolver@1001.0.29 + - @pnpm/node.fetcher@1001.0.33 + ## 1000.0.71 ### Patch Changes diff --git a/env/plugin-commands-env/package.json b/env/plugin-commands-env/package.json index 25712e5b0e..bc349107fb 100644 --- a/env/plugin-commands-env/package.json +++ b/env/plugin-commands-env/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-env", - "version": "1000.0.71", + "version": "1000.0.72", "description": "pnpm commands for managing Node.js", "keywords": [ "pnpm", diff --git a/exec/build-commands/CHANGELOG.md b/exec/build-commands/CHANGELOG.md index e522894b83..d6eb429b76 100644 --- a/exec/build-commands/CHANGELOG.md +++ b/exec/build-commands/CHANGELOG.md @@ -1,5 +1,13 @@ # @pnpm/exec.build-commands +## 1002.1.9 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/plugin-commands-rebuild@1008.0.20 + ## 1002.1.8 ### Patch Changes diff --git a/exec/build-commands/package.json b/exec/build-commands/package.json index c8599db50c..8451e9e076 100644 --- a/exec/build-commands/package.json +++ b/exec/build-commands/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/exec.build-commands", - "version": "1002.1.8", + "version": "1002.1.9", "description": "Commands for managing dependency builds", "keywords": [ "pnpm", diff --git a/exec/build-modules/CHANGELOG.md b/exec/build-modules/CHANGELOG.md index 6a9be5f814..99aeb1fca0 100644 --- a/exec/build-modules/CHANGELOG.md +++ b/exec/build-modules/CHANGELOG.md @@ -1,5 +1,14 @@ # @pnpm/build-modules +## 1007.0.18 + +### Patch Changes + +- Updated dependencies [78e29fe] +- Updated dependencies [36928be] + - @pnpm/calc-dep-state@1003.0.7 + - @pnpm/config@1004.11.6 + ## 1007.0.17 ### Patch Changes diff --git a/exec/build-modules/package.json b/exec/build-modules/package.json index 4ba01f5983..5cd806c134 100644 --- a/exec/build-modules/package.json +++ b/exec/build-modules/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/build-modules", - "version": "1007.0.17", + "version": "1007.0.18", "description": "Build packages in node_modules", "keywords": [ "pnpm", diff --git a/exec/plugin-commands-rebuild/CHANGELOG.md b/exec/plugin-commands-rebuild/CHANGELOG.md index debeebe107..3f84b4d2e1 100644 --- a/exec/plugin-commands-rebuild/CHANGELOG.md +++ b/exec/plugin-commands-rebuild/CHANGELOG.md @@ -1,5 +1,17 @@ # @pnpm/plugin-commands-rebuild +## 1008.0.20 + +### Patch Changes + +- Updated dependencies [78e29fe] +- Updated dependencies [36928be] + - @pnpm/calc-dep-state@1003.0.7 + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + - @pnpm/store-connection-manager@1002.3.25 + - @pnpm/workspace.find-packages@1000.0.71 + ## 1008.0.19 ### Patch Changes diff --git a/exec/plugin-commands-rebuild/package.json b/exec/plugin-commands-rebuild/package.json index d626db545f..adb77ffbf2 100644 --- a/exec/plugin-commands-rebuild/package.json +++ b/exec/plugin-commands-rebuild/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-rebuild", - "version": "1008.0.19", + "version": "1008.0.20", "description": "Commands for rebuilding dependencies", "keywords": [ "pnpm", diff --git a/exec/plugin-commands-script-runners/CHANGELOG.md b/exec/plugin-commands-script-runners/CHANGELOG.md index 4e17bd7d3e..267d7543b6 100644 --- a/exec/plugin-commands-script-runners/CHANGELOG.md +++ b/exec/plugin-commands-script-runners/CHANGELOG.md @@ -1,5 +1,18 @@ # @pnpm/plugin-commands-script-runners +## 1001.2.18 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + - @pnpm/deps.status@1003.0.44 + - @pnpm/plugin-commands-env@1000.0.72 + - @pnpm/plugin-commands-installation@1004.10.5 + - @pnpm/workspace.injected-deps-syncer@1000.0.45 + - @pnpm/client@1001.1.30 + ## 1001.2.17 ### Patch Changes diff --git a/exec/plugin-commands-script-runners/package.json b/exec/plugin-commands-script-runners/package.json index e107b530d0..63f46b7c1e 100644 --- a/exec/plugin-commands-script-runners/package.json +++ b/exec/plugin-commands-script-runners/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-script-runners", - "version": "1001.2.17", + "version": "1001.2.18", "description": "Commands for running scripts", "keywords": [ "pnpm", diff --git a/lockfile/lockfile-to-pnp/CHANGELOG.md b/lockfile/lockfile-to-pnp/CHANGELOG.md index cd9e7f000b..1f2b21edfc 100644 --- a/lockfile/lockfile-to-pnp/CHANGELOG.md +++ b/lockfile/lockfile-to-pnp/CHANGELOG.md @@ -1,5 +1,11 @@ # @pnpm/lockfile-to-pnp +## 1001.0.38 + +### Patch Changes + +- 78e29fe: Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through. + ## 1001.0.37 ### Patch Changes diff --git a/lockfile/lockfile-to-pnp/package.json b/lockfile/lockfile-to-pnp/package.json index 11f834a4bb..7858c90b8a 100644 --- a/lockfile/lockfile-to-pnp/package.json +++ b/lockfile/lockfile-to-pnp/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/lockfile-to-pnp", - "version": "1001.0.37", + "version": "1001.0.38", "description": "Creates a Plug'n'Play file from a pnpm-lock.yaml", "keywords": [ "pnpm", diff --git a/lockfile/plugin-commands-audit/CHANGELOG.md b/lockfile/plugin-commands-audit/CHANGELOG.md index 067d8b52a9..0afcf13ce3 100644 --- a/lockfile/plugin-commands-audit/CHANGELOG.md +++ b/lockfile/plugin-commands-audit/CHANGELOG.md @@ -1,5 +1,13 @@ # @pnpm/plugin-commands-audit +## 1002.2.16 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + ## 1002.2.15 ### Patch Changes diff --git a/lockfile/plugin-commands-audit/package.json b/lockfile/plugin-commands-audit/package.json index 2cdc4813df..c8bf656079 100644 --- a/lockfile/plugin-commands-audit/package.json +++ b/lockfile/plugin-commands-audit/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-audit", - "version": "1002.2.15", + "version": "1002.2.16", "description": "pnpm commands for dependencies audit", "keywords": [ "pnpm", diff --git a/modules-mounter/daemon/CHANGELOG.md b/modules-mounter/daemon/CHANGELOG.md index 04c849c581..c857e8305a 100644 --- a/modules-mounter/daemon/CHANGELOG.md +++ b/modules-mounter/daemon/CHANGELOG.md @@ -1,5 +1,12 @@ # @pnpm/mount-modules +## 1001.0.60 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + ## 1001.0.59 ### Patch Changes diff --git a/modules-mounter/daemon/package.json b/modules-mounter/daemon/package.json index bcb14382a6..fd1f1e6ce4 100644 --- a/modules-mounter/daemon/package.json +++ b/modules-mounter/daemon/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/mount-modules", - "version": "1001.0.59", + "version": "1001.0.60", "description": "Mounts a node_modules directory with FUSE", "keywords": [ "pnpm", diff --git a/packages/calc-dep-state/CHANGELOG.md b/packages/calc-dep-state/CHANGELOG.md index 41373a14fa..98d3cc43e2 100644 --- a/packages/calc-dep-state/CHANGELOG.md +++ b/packages/calc-dep-state/CHANGELOG.md @@ -1,5 +1,11 @@ # @pnpm/calc-dep-state +## 1003.0.7 + +### Patch Changes + +- 78e29fe: Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through. + ## 1003.0.6 ### Patch Changes diff --git a/packages/calc-dep-state/package.json b/packages/calc-dep-state/package.json index 4882e75250..212342da03 100644 --- a/packages/calc-dep-state/package.json +++ b/packages/calc-dep-state/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/calc-dep-state", - "version": "1003.0.6", + "version": "1003.0.7", "description": "Calculates the state of a dependency", "keywords": [ "pnpm", diff --git a/packages/plugin-commands-doctor/CHANGELOG.md b/packages/plugin-commands-doctor/CHANGELOG.md index f89df2cdbf..51f3add7a6 100644 --- a/packages/plugin-commands-doctor/CHANGELOG.md +++ b/packages/plugin-commands-doctor/CHANGELOG.md @@ -1,5 +1,13 @@ # @pnpm/plugin-commands-doctor +## 1000.1.70 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + ## 1000.1.69 ### Patch Changes diff --git a/packages/plugin-commands-doctor/package.json b/packages/plugin-commands-doctor/package.json index 089479b456..1130b6ebf7 100644 --- a/packages/plugin-commands-doctor/package.json +++ b/packages/plugin-commands-doctor/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-doctor", - "version": "1000.1.69", + "version": "1000.1.70", "description": "Commands for checks of known common issues ", "keywords": [ "pnpm", diff --git a/packages/plugin-commands-init/CHANGELOG.md b/packages/plugin-commands-init/CHANGELOG.md index c5ae74020d..0fb8acd375 100644 --- a/packages/plugin-commands-init/CHANGELOG.md +++ b/packages/plugin-commands-init/CHANGELOG.md @@ -1,5 +1,13 @@ # @pnpm/plugin-commands-init +## 1000.3.23 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + ## 1000.3.22 ### Patch Changes diff --git a/packages/plugin-commands-init/package.json b/packages/plugin-commands-init/package.json index c442839022..569875e503 100644 --- a/packages/plugin-commands-init/package.json +++ b/packages/plugin-commands-init/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-init", - "version": "1000.3.22", + "version": "1000.3.23", "description": "Create a package.json file", "keywords": [ "pnpm", diff --git a/packages/plugin-commands-setup/CHANGELOG.md b/packages/plugin-commands-setup/CHANGELOG.md index 15bf6789d7..6a95e5efa2 100644 --- a/packages/plugin-commands-setup/CHANGELOG.md +++ b/packages/plugin-commands-setup/CHANGELOG.md @@ -1,5 +1,11 @@ # @pnpm/plugin-commands-setup +## 1000.1.48 + +### Patch Changes + +- @pnpm/cli-utils@1001.3.16 + ## 1000.1.47 ### Patch Changes diff --git a/packages/plugin-commands-setup/package.json b/packages/plugin-commands-setup/package.json index 4c5d43462a..a0a60eedda 100644 --- a/packages/plugin-commands-setup/package.json +++ b/packages/plugin-commands-setup/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-setup", - "version": "1000.1.47", + "version": "1000.1.48", "description": "pnpm commands for setting up pnpm", "keywords": [ "pnpm", diff --git a/patching/plugin-commands-patching/CHANGELOG.md b/patching/plugin-commands-patching/CHANGELOG.md index fc882dfc9d..7d0c85d6ce 100644 --- a/patching/plugin-commands-patching/CHANGELOG.md +++ b/patching/plugin-commands-patching/CHANGELOG.md @@ -1,5 +1,15 @@ # @pnpm/plugin-commands-patching +## 1000.3.53 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + - @pnpm/plugin-commands-installation@1004.10.5 + - @pnpm/store-connection-manager@1002.3.25 + ## 1000.3.52 ### Patch Changes diff --git a/patching/plugin-commands-patching/package.json b/patching/plugin-commands-patching/package.json index f4a36c19a8..56a8200f4d 100644 --- a/patching/plugin-commands-patching/package.json +++ b/patching/plugin-commands-patching/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-patching", - "version": "1000.3.52", + "version": "1000.3.53", "description": "Commands for creating patches", "keywords": [ "pnpm", diff --git a/pkg-manager/client/CHANGELOG.md b/pkg-manager/client/CHANGELOG.md index c27fcf35b4..2f66e268ae 100644 --- a/pkg-manager/client/CHANGELOG.md +++ b/pkg-manager/client/CHANGELOG.md @@ -1,5 +1,12 @@ # @pnpm/client +## 1001.1.30 + +### Patch Changes + +- @pnpm/node.fetcher@1001.0.33 +- @pnpm/default-resolver@1002.3.14 + ## 1001.1.29 ### Patch Changes diff --git a/pkg-manager/client/package.json b/pkg-manager/client/package.json index 07d76ed7cc..352044b69c 100644 --- a/pkg-manager/client/package.json +++ b/pkg-manager/client/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/client", - "version": "1001.1.29", + "version": "1001.1.30", "description": "Creates the package resolve and fetch functions", "keywords": [ "pnpm", diff --git a/pkg-manager/core/CHANGELOG.md b/pkg-manager/core/CHANGELOG.md index 67ed7dee28..64f2ad0fc3 100644 --- a/pkg-manager/core/CHANGELOG.md +++ b/pkg-manager/core/CHANGELOG.md @@ -1,5 +1,19 @@ # @pnpm/core +## 1016.4.5 + +### Patch Changes + +- Updated dependencies [78e29fe] +- Updated dependencies [78e29fe] + - @pnpm/calc-dep-state@1003.0.7 + - @pnpm/lockfile-to-pnp@1001.0.38 + - @pnpm/resolve-dependencies@1008.8.5 + - @pnpm/headless@1010.1.17 + - @pnpm/build-modules@1007.0.18 + - @pnpm/plugin-commands-rebuild@1008.0.20 + - @pnpm/package-requester@1011.2.6 + ## 1016.4.4 ### Patch Changes diff --git a/pkg-manager/core/package.json b/pkg-manager/core/package.json index ca14cf17d9..6781714e8d 100644 --- a/pkg-manager/core/package.json +++ b/pkg-manager/core/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/core", - "version": "1016.4.4", + "version": "1016.4.5", "description": "Fast, disk space efficient installation engine", "keywords": [ "pnpm", diff --git a/pkg-manager/headless/CHANGELOG.md b/pkg-manager/headless/CHANGELOG.md index 48cb492e5a..97256237b9 100644 --- a/pkg-manager/headless/CHANGELOG.md +++ b/pkg-manager/headless/CHANGELOG.md @@ -1,5 +1,17 @@ # @pnpm/headless +## 1010.1.17 + +### Patch Changes + +- Updated dependencies [78e29fe] +- Updated dependencies [78e29fe] + - @pnpm/deps.graph-builder@1002.3.17 + - @pnpm/calc-dep-state@1003.0.7 + - @pnpm/lockfile-to-pnp@1001.0.38 + - @pnpm/build-modules@1007.0.18 + - @pnpm/package-requester@1011.2.6 + ## 1010.1.16 ### Patch Changes diff --git a/pkg-manager/headless/package.json b/pkg-manager/headless/package.json index 8a4a0278d8..a82875b9be 100644 --- a/pkg-manager/headless/package.json +++ b/pkg-manager/headless/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/headless", - "version": "1010.1.16", + "version": "1010.1.17", "description": "Fast installation using only pnpm-lock.yaml", "keywords": [ "pnpm", diff --git a/pkg-manager/plugin-commands-installation/CHANGELOG.md b/pkg-manager/plugin-commands-installation/CHANGELOG.md index 7a2ac803f9..9a8b998e86 100644 --- a/pkg-manager/plugin-commands-installation/CHANGELOG.md +++ b/pkg-manager/plugin-commands-installation/CHANGELOG.md @@ -1,5 +1,24 @@ # @pnpm/plugin-commands-installation +## 1004.10.5 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/plugin-commands-rebuild@1008.0.20 + - @pnpm/core@1016.4.5 + - @pnpm/cli-utils@1001.3.16 + - @pnpm/deps.status@1003.0.44 + - @pnpm/plugin-commands-env@1000.0.72 + - @pnpm/store-connection-manager@1002.3.25 + - @pnpm/workspace.state@1002.1.12 + - @pnpm/workspace.find-packages@1000.0.71 + - @pnpm/filter-workspace-packages@1000.1.12 + - @pnpm/outdated@1001.1.28 + - @pnpm/package-store@1007.1.8 + - @pnpm/config.deps-installer@1000.1.9 + ## 1004.10.4 ### Patch Changes diff --git a/pkg-manager/plugin-commands-installation/package.json b/pkg-manager/plugin-commands-installation/package.json index 2f081efeb5..87e9e01167 100644 --- a/pkg-manager/plugin-commands-installation/package.json +++ b/pkg-manager/plugin-commands-installation/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-installation", - "version": "1004.10.4", + "version": "1004.10.5", "description": "Commands for installation", "keywords": [ "pnpm", diff --git a/pkg-manager/resolve-dependencies/CHANGELOG.md b/pkg-manager/resolve-dependencies/CHANGELOG.md index a4565d6f11..510844d778 100644 --- a/pkg-manager/resolve-dependencies/CHANGELOG.md +++ b/pkg-manager/resolve-dependencies/CHANGELOG.md @@ -1,5 +1,13 @@ # @pnpm/resolve-dependencies +## 1008.8.5 + +### Patch Changes + +- 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest `name` was a scoped path traversal (e.g. `@x/../../../`) could be written outside `node_modules` to an attacker-controlled location during `pnpm install`, even with `--ignore-scripts`. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker. +- Updated dependencies [78e29fe] + - @pnpm/calc-dep-state@1003.0.7 + ## 1008.8.4 ### Patch Changes diff --git a/pkg-manager/resolve-dependencies/package.json b/pkg-manager/resolve-dependencies/package.json index 46516c408c..407c577ef7 100644 --- a/pkg-manager/resolve-dependencies/package.json +++ b/pkg-manager/resolve-dependencies/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/resolve-dependencies", - "version": "1008.8.4", + "version": "1008.8.5", "description": "Resolves dependency graph of a package", "keywords": [ "pnpm", diff --git a/pnpm/CHANGELOG.md b/pnpm/CHANGELOG.md index 5f74d315d3..e662c3bd67 100644 --- a/pnpm/CHANGELOG.md +++ b/pnpm/CHANGELOG.md @@ -1,5 +1,14 @@ # pnpm +## 10.34.5 + +### Patch Changes + +- 78e29fe: Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through. +- 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest `name` was a scoped path traversal (e.g. `@x/../../../`) could be written outside `node_modules` to an attacker-controlled location during `pnpm install`, even with `--ignore-scripts`. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker. +- 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the `pnpm` and `@pnpm/exe` npm packages whose bins are placeholders replaced at install time by the host's native binary from a `@pnpm/exe.-[-musl]` optional dependency. Because pnpm installs its own engine with `--ignore-scripts`, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native `pnpm` package), and verifies the native binary's npm registry signature before running it. +- 36928be: `${...}` environment-variable placeholders in the `httpProxy`, `httpsProxy`, `noProxy`, `proxy`, and `noproxy` settings are no longer expanded when these settings come from a project's `pnpm-workspace.yaml`. They now receive the same protection already applied to `registry`. + ## 10.34.4 ### Patch Changes diff --git a/pnpm/artifacts/exe/package.json b/pnpm/artifacts/exe/package.json index a75a30a9b6..416b9ff71b 100644 --- a/pnpm/artifacts/exe/package.json +++ b/pnpm/artifacts/exe/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/exe", - "version": "10.34.4", + "version": "10.34.5", "description": "Fast, disk space efficient package manager", "keywords": [ "pnpm", diff --git a/pnpm/artifacts/linux-arm64/package.json b/pnpm/artifacts/linux-arm64/package.json index 70dc6553b9..2e695de61e 100644 --- a/pnpm/artifacts/linux-arm64/package.json +++ b/pnpm/artifacts/linux-arm64/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/linux-arm64", - "version": "10.34.4", + "version": "10.34.5", "keywords": [ "pnpm", "pnpm10", diff --git a/pnpm/artifacts/linux-x64/package.json b/pnpm/artifacts/linux-x64/package.json index c64f6fc704..1c6983d0db 100644 --- a/pnpm/artifacts/linux-x64/package.json +++ b/pnpm/artifacts/linux-x64/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/linux-x64", - "version": "10.34.4", + "version": "10.34.5", "keywords": [ "pnpm", "pnpm10", diff --git a/pnpm/artifacts/macos-arm64/package.json b/pnpm/artifacts/macos-arm64/package.json index 65ce2bed84..7aea30aa07 100644 --- a/pnpm/artifacts/macos-arm64/package.json +++ b/pnpm/artifacts/macos-arm64/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/macos-arm64", - "version": "10.34.4", + "version": "10.34.5", "keywords": [ "pnpm", "pnpm10", diff --git a/pnpm/artifacts/macos-x64/package.json b/pnpm/artifacts/macos-x64/package.json index 4ea9ed9bf9..762389beb8 100644 --- a/pnpm/artifacts/macos-x64/package.json +++ b/pnpm/artifacts/macos-x64/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/macos-x64", - "version": "10.34.4", + "version": "10.34.5", "keywords": [ "pnpm", "pnpm10", diff --git a/pnpm/artifacts/win-arm64/package.json b/pnpm/artifacts/win-arm64/package.json index b276498131..6dbddcacbd 100644 --- a/pnpm/artifacts/win-arm64/package.json +++ b/pnpm/artifacts/win-arm64/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/win-arm64", - "version": "10.34.4", + "version": "10.34.5", "keywords": [ "pnpm", "pnpm10", diff --git a/pnpm/artifacts/win-x64/package.json b/pnpm/artifacts/win-x64/package.json index deea9d1ddd..5573085e80 100644 --- a/pnpm/artifacts/win-x64/package.json +++ b/pnpm/artifacts/win-x64/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/win-x64", - "version": "10.34.4", + "version": "10.34.5", "keywords": [ "pnpm", "pnpm10", diff --git a/pnpm/dev/CHANGELOG.md b/pnpm/dev/CHANGELOG.md index a1ee661f5c..5e1756e1fa 100644 --- a/pnpm/dev/CHANGELOG.md +++ b/pnpm/dev/CHANGELOG.md @@ -1,5 +1,11 @@ # pd +## 1000.0.39 + +### Patch Changes + +- @pnpm/workspace.find-packages@1000.0.71 + ## 1000.0.38 ### Patch Changes diff --git a/pnpm/dev/package.json b/pnpm/dev/package.json index 406abed6ba..e58e17ed42 100644 --- a/pnpm/dev/package.json +++ b/pnpm/dev/package.json @@ -1,6 +1,6 @@ { "name": "pd", - "version": "1000.0.38", + "version": "1000.0.39", "bin": "pd.js", "private": true, "scripts": { diff --git a/pnpm/package.json b/pnpm/package.json index f3419e5202..19cf7f3e33 100644 --- a/pnpm/package.json +++ b/pnpm/package.json @@ -1,6 +1,6 @@ { "name": "pnpm", - "version": "10.34.4", + "version": "10.34.5", "description": "Fast, disk space efficient package manager", "keywords": [ "pnpm", diff --git a/releasing/plugin-commands-deploy/CHANGELOG.md b/releasing/plugin-commands-deploy/CHANGELOG.md index 02684968cc..c33e352253 100644 --- a/releasing/plugin-commands-deploy/CHANGELOG.md +++ b/releasing/plugin-commands-deploy/CHANGELOG.md @@ -1,5 +1,14 @@ # @pnpm/plugin-commands-deploy +## 1002.0.46 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + - @pnpm/plugin-commands-installation@1004.10.5 + ## 1002.0.45 ### Patch Changes diff --git a/releasing/plugin-commands-deploy/package.json b/releasing/plugin-commands-deploy/package.json index bdc3dda43d..9d325f0806 100644 --- a/releasing/plugin-commands-deploy/package.json +++ b/releasing/plugin-commands-deploy/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-deploy", - "version": "1002.0.45", + "version": "1002.0.46", "description": "Commands for deploy", "keywords": [ "pnpm", diff --git a/releasing/plugin-commands-publishing/CHANGELOG.md b/releasing/plugin-commands-publishing/CHANGELOG.md index e1042a6070..235f9ce381 100644 --- a/releasing/plugin-commands-publishing/CHANGELOG.md +++ b/releasing/plugin-commands-publishing/CHANGELOG.md @@ -1,5 +1,15 @@ # @pnpm/plugin-commands-publishing +## 1000.3.22 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + - @pnpm/plugin-commands-env@1000.0.72 + - @pnpm/client@1001.1.30 + ## 1000.3.21 ### Patch Changes diff --git a/releasing/plugin-commands-publishing/package.json b/releasing/plugin-commands-publishing/package.json index 0c8d74e7c8..4d7d984973 100644 --- a/releasing/plugin-commands-publishing/package.json +++ b/releasing/plugin-commands-publishing/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-publishing", - "version": "1000.3.21", + "version": "1000.3.22", "description": "The pack and publish commands of pnpm", "keywords": [ "pnpm", diff --git a/resolving/bun-resolver/CHANGELOG.md b/resolving/bun-resolver/CHANGELOG.md index 5ae6f6a037..7725a641b8 100644 --- a/resolving/bun-resolver/CHANGELOG.md +++ b/resolving/bun-resolver/CHANGELOG.md @@ -1,5 +1,11 @@ # @pnpm/resolving.bun-resolver +## 1005.0.17 + +### Patch Changes + +- @pnpm/node.fetcher@1001.0.33 + ## 1005.0.16 ### Patch Changes diff --git a/resolving/bun-resolver/package.json b/resolving/bun-resolver/package.json index 935df45be0..6cebaae291 100644 --- a/resolving/bun-resolver/package.json +++ b/resolving/bun-resolver/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/resolving.bun-resolver", - "version": "1005.0.16", + "version": "1005.0.17", "description": "Resolves the Bun runtime", "keywords": [ "pnpm", diff --git a/resolving/default-resolver/CHANGELOG.md b/resolving/default-resolver/CHANGELOG.md index 93ef303e4f..09fa3092df 100644 --- a/resolving/default-resolver/CHANGELOG.md +++ b/resolving/default-resolver/CHANGELOG.md @@ -1,5 +1,13 @@ # @pnpm/default-resolver +## 1002.3.14 + +### Patch Changes + +- @pnpm/node.resolver@1001.0.29 +- @pnpm/resolving.bun-resolver@1005.0.17 +- @pnpm/resolving.deno-resolver@1005.0.17 + ## 1002.3.13 ### Patch Changes diff --git a/resolving/default-resolver/package.json b/resolving/default-resolver/package.json index 3fd99a5a8e..e31948f54e 100644 --- a/resolving/default-resolver/package.json +++ b/resolving/default-resolver/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/default-resolver", - "version": "1002.3.13", + "version": "1002.3.14", "description": "pnpm's default package resolver", "keywords": [ "pnpm", diff --git a/resolving/deno-resolver/CHANGELOG.md b/resolving/deno-resolver/CHANGELOG.md index be36a7cd41..a6fbc82a40 100644 --- a/resolving/deno-resolver/CHANGELOG.md +++ b/resolving/deno-resolver/CHANGELOG.md @@ -1,5 +1,11 @@ # @pnpm/resolving.deno-resolver +## 1005.0.17 + +### Patch Changes + +- @pnpm/node.fetcher@1001.0.33 + ## 1005.0.16 ### Patch Changes diff --git a/resolving/deno-resolver/package.json b/resolving/deno-resolver/package.json index 7ebc54a7fc..78d63c3eef 100644 --- a/resolving/deno-resolver/package.json +++ b/resolving/deno-resolver/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/resolving.deno-resolver", - "version": "1005.0.16", + "version": "1005.0.17", "description": "Resolves the Deno runtime", "keywords": [ "pnpm", diff --git a/reviewing/outdated/CHANGELOG.md b/reviewing/outdated/CHANGELOG.md index 10d16518e3..a8249f4282 100644 --- a/reviewing/outdated/CHANGELOG.md +++ b/reviewing/outdated/CHANGELOG.md @@ -1,5 +1,11 @@ # @pnpm/outdated +## 1001.1.28 + +### Patch Changes + +- @pnpm/client@1001.1.30 + ## 1001.1.27 ### Patch Changes diff --git a/reviewing/outdated/package.json b/reviewing/outdated/package.json index cecbfb3786..cbc11b0817 100644 --- a/reviewing/outdated/package.json +++ b/reviewing/outdated/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/outdated", - "version": "1001.1.27", + "version": "1001.1.28", "description": "Check for outdated packages", "keywords": [ "pnpm", diff --git a/reviewing/plugin-commands-licenses/CHANGELOG.md b/reviewing/plugin-commands-licenses/CHANGELOG.md index e993edf4a7..50335b5706 100644 --- a/reviewing/plugin-commands-licenses/CHANGELOG.md +++ b/reviewing/plugin-commands-licenses/CHANGELOG.md @@ -1,5 +1,13 @@ # @pnpm/plugin-commands-licenses +## 1000.0.74 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + ## 1000.0.73 ### Patch Changes diff --git a/reviewing/plugin-commands-licenses/package.json b/reviewing/plugin-commands-licenses/package.json index aca2bc409b..844c0407a3 100644 --- a/reviewing/plugin-commands-licenses/package.json +++ b/reviewing/plugin-commands-licenses/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-licenses", - "version": "1000.0.73", + "version": "1000.0.74", "description": "The licenses command of pnpm", "keywords": [ "pnpm", diff --git a/reviewing/plugin-commands-listing/CHANGELOG.md b/reviewing/plugin-commands-listing/CHANGELOG.md index a47bbc60f2..60a942ad2a 100644 --- a/reviewing/plugin-commands-listing/CHANGELOG.md +++ b/reviewing/plugin-commands-listing/CHANGELOG.md @@ -1,5 +1,13 @@ # @pnpm/plugin-commands-listing +## 1000.3.12 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + ## 1000.3.11 ### Patch Changes diff --git a/reviewing/plugin-commands-listing/package.json b/reviewing/plugin-commands-listing/package.json index acd085cf5a..9dbc8e578e 100644 --- a/reviewing/plugin-commands-listing/package.json +++ b/reviewing/plugin-commands-listing/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-listing", - "version": "1000.3.11", + "version": "1000.3.12", "description": "The list and why commands of pnpm", "keywords": [ "pnpm", diff --git a/reviewing/plugin-commands-outdated/CHANGELOG.md b/reviewing/plugin-commands-outdated/CHANGELOG.md index 6db9dfd80d..212e32ccba 100644 --- a/reviewing/plugin-commands-outdated/CHANGELOG.md +++ b/reviewing/plugin-commands-outdated/CHANGELOG.md @@ -1,5 +1,15 @@ # @pnpm/plugin-commands-outdated +## 1000.0.75 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + - @pnpm/default-resolver@1002.3.14 + - @pnpm/outdated@1001.1.28 + ## 1000.0.74 ### Patch Changes diff --git a/reviewing/plugin-commands-outdated/package.json b/reviewing/plugin-commands-outdated/package.json index 2a5a3a0cc9..22fdc590c8 100644 --- a/reviewing/plugin-commands-outdated/package.json +++ b/reviewing/plugin-commands-outdated/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-outdated", - "version": "1000.0.74", + "version": "1000.0.75", "description": "The outdated command of pnpm", "keywords": [ "pnpm", diff --git a/store/plugin-commands-server/CHANGELOG.md b/store/plugin-commands-server/CHANGELOG.md index 18a5fd8e1c..d46b760bc0 100644 --- a/store/plugin-commands-server/CHANGELOG.md +++ b/store/plugin-commands-server/CHANGELOG.md @@ -1,5 +1,15 @@ # @pnpm/plugin-commands-server +## 1000.0.72 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + - @pnpm/store-connection-manager@1002.3.25 + - @pnpm/server@1001.0.22 + ## 1000.0.71 ### Patch Changes diff --git a/store/plugin-commands-server/package.json b/store/plugin-commands-server/package.json index 592f7af0d9..4541e070e0 100644 --- a/store/plugin-commands-server/package.json +++ b/store/plugin-commands-server/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-server", - "version": "1000.0.71", + "version": "1000.0.72", "description": "Commands for controlling the store server", "keywords": [ "pnpm", diff --git a/store/plugin-commands-store-inspecting/CHANGELOG.md b/store/plugin-commands-store-inspecting/CHANGELOG.md index 1be01b1f94..363bd646ad 100644 --- a/store/plugin-commands-store-inspecting/CHANGELOG.md +++ b/store/plugin-commands-store-inspecting/CHANGELOG.md @@ -1,5 +1,13 @@ # @pnpm/plugin-commands-store-inspecting +## 1000.0.67 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/client@1001.1.30 + ## 1000.0.66 ### Patch Changes diff --git a/store/plugin-commands-store-inspecting/package.json b/store/plugin-commands-store-inspecting/package.json index 8cdec4dd7f..c0faec2751 100644 --- a/store/plugin-commands-store-inspecting/package.json +++ b/store/plugin-commands-store-inspecting/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-store-inspecting", - "version": "1000.0.66", + "version": "1000.0.67", "description": "The inspecting store commands of pnpm", "keywords": [ "pnpm", diff --git a/store/plugin-commands-store/CHANGELOG.md b/store/plugin-commands-store/CHANGELOG.md index 9469b1cb33..c41f0b5a97 100644 --- a/store/plugin-commands-store/CHANGELOG.md +++ b/store/plugin-commands-store/CHANGELOG.md @@ -1,5 +1,14 @@ # @pnpm/plugin-commands-store +## 1000.0.74 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + - @pnpm/store-connection-manager@1002.3.25 + ## 1000.0.73 ### Patch Changes diff --git a/store/plugin-commands-store/package.json b/store/plugin-commands-store/package.json index 63e9a932e1..e744f01199 100644 --- a/store/plugin-commands-store/package.json +++ b/store/plugin-commands-store/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/plugin-commands-store", - "version": "1000.0.73", + "version": "1000.0.74", "description": "Commands for controlling the store", "keywords": [ "pnpm", diff --git a/store/store-connection-manager/CHANGELOG.md b/store/store-connection-manager/CHANGELOG.md index dc743ddb94..850609c405 100644 --- a/store/store-connection-manager/CHANGELOG.md +++ b/store/store-connection-manager/CHANGELOG.md @@ -1,5 +1,15 @@ # @pnpm/store-connection-manager +## 1002.3.25 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/client@1001.1.30 + - @pnpm/package-store@1007.1.8 + - @pnpm/server@1001.0.22 + ## 1002.3.24 ### Patch Changes diff --git a/store/store-connection-manager/package.json b/store/store-connection-manager/package.json index 968bbd3549..ad704f4b98 100644 --- a/store/store-connection-manager/package.json +++ b/store/store-connection-manager/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/store-connection-manager", - "version": "1002.3.24", + "version": "1002.3.25", "description": "Create a direct pnpm store controller or connect to a running store server", "keywords": [ "pnpm", diff --git a/testing/temp-store/CHANGELOG.md b/testing/temp-store/CHANGELOG.md index f5719c23dc..f5207e0e28 100644 --- a/testing/temp-store/CHANGELOG.md +++ b/testing/temp-store/CHANGELOG.md @@ -1,5 +1,12 @@ # @pnpm/testing.temp-store +## 1000.0.49 + +### Patch Changes + +- @pnpm/client@1001.1.30 +- @pnpm/package-store@1007.1.8 + ## 1000.0.48 ### Patch Changes diff --git a/testing/temp-store/package.json b/testing/temp-store/package.json index 5a35406146..18d48fda97 100644 --- a/testing/temp-store/package.json +++ b/testing/temp-store/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/testing.temp-store", - "version": "1000.0.48", + "version": "1000.0.49", "description": "A temporary store for testing purposes", "keywords": [ "pnpm", diff --git a/tools/plugin-commands-self-updater/CHANGELOG.md b/tools/plugin-commands-self-updater/CHANGELOG.md index 11cfec0a9e..3bfeeae928 100644 --- a/tools/plugin-commands-self-updater/CHANGELOG.md +++ b/tools/plugin-commands-self-updater/CHANGELOG.md @@ -1,5 +1,15 @@ # @pnpm/tools.plugin-commands-self-updater +## 1000.1.62 + +### Patch Changes + +- 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the `pnpm` and `@pnpm/exe` npm packages whose bins are placeholders replaced at install time by the host's native binary from a `@pnpm/exe.-[-musl]` optional dependency. Because pnpm installs its own engine with `--ignore-scripts`, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native `pnpm` package), and verifies the native binary's npm registry signature before running it. +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + - @pnpm/cli-utils@1001.3.16 + - @pnpm/client@1001.1.30 + ## 1000.1.61 ### Patch Changes diff --git a/tools/plugin-commands-self-updater/package.json b/tools/plugin-commands-self-updater/package.json index 475ba2da80..81561c2ab2 100644 --- a/tools/plugin-commands-self-updater/package.json +++ b/tools/plugin-commands-self-updater/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/tools.plugin-commands-self-updater", - "version": "1000.1.61", + "version": "1000.1.62", "description": "A command for updating pnpm itself", "keywords": [ "pnpm", diff --git a/workspace/filter-packages-from-dir/CHANGELOG.md b/workspace/filter-packages-from-dir/CHANGELOG.md index 5e15214c5d..234d4b6f81 100644 --- a/workspace/filter-packages-from-dir/CHANGELOG.md +++ b/workspace/filter-packages-from-dir/CHANGELOG.md @@ -1,5 +1,12 @@ # @pnpm/workspace.filter-packages-from-dir +## 1000.0.71 + +### Patch Changes + +- @pnpm/workspace.find-packages@1000.0.71 +- @pnpm/filter-workspace-packages@1000.1.12 + ## 1000.0.70 ### Patch Changes diff --git a/workspace/filter-packages-from-dir/package.json b/workspace/filter-packages-from-dir/package.json index 137f99a47b..73c3fefddf 100644 --- a/workspace/filter-packages-from-dir/package.json +++ b/workspace/filter-packages-from-dir/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/workspace.filter-packages-from-dir", - "version": "1000.0.70", + "version": "1000.0.71", "description": "Filters packages in a directory", "keywords": [ "pnpm", diff --git a/workspace/filter-workspace-packages/CHANGELOG.md b/workspace/filter-workspace-packages/CHANGELOG.md index d7f1236e7f..ae5fff6a39 100644 --- a/workspace/filter-workspace-packages/CHANGELOG.md +++ b/workspace/filter-workspace-packages/CHANGELOG.md @@ -1,5 +1,11 @@ # @pnpm/filter-workspace-packages +## 1000.1.12 + +### Patch Changes + +- @pnpm/workspace.find-packages@1000.0.71 + ## 1000.1.11 ### Patch Changes diff --git a/workspace/filter-workspace-packages/package.json b/workspace/filter-workspace-packages/package.json index bb31515a88..8da3fc9c21 100644 --- a/workspace/filter-workspace-packages/package.json +++ b/workspace/filter-workspace-packages/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/filter-workspace-packages", - "version": "1000.1.11", + "version": "1000.1.12", "description": "Filters packages in a workspace", "keywords": [ "pnpm", diff --git a/workspace/find-packages/CHANGELOG.md b/workspace/find-packages/CHANGELOG.md index b5c8fa250f..6024a7bfe0 100644 --- a/workspace/find-packages/CHANGELOG.md +++ b/workspace/find-packages/CHANGELOG.md @@ -1,5 +1,11 @@ # @pnpm/find-workspace-packages +## 1000.0.71 + +### Patch Changes + +- @pnpm/cli-utils@1001.3.16 + ## 1000.0.70 ### Patch Changes diff --git a/workspace/find-packages/package.json b/workspace/find-packages/package.json index f966ed9a89..a655d364ed 100644 --- a/workspace/find-packages/package.json +++ b/workspace/find-packages/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/workspace.find-packages", - "version": "1000.0.70", + "version": "1000.0.71", "description": "Finds packages inside a workspace", "keywords": [ "pnpm", diff --git a/workspace/injected-deps-syncer/CHANGELOG.md b/workspace/injected-deps-syncer/CHANGELOG.md index 1a9e2cb8a6..9e146e0c33 100644 --- a/workspace/injected-deps-syncer/CHANGELOG.md +++ b/workspace/injected-deps-syncer/CHANGELOG.md @@ -1,5 +1,11 @@ # @pnpm/workspace.injected-deps-syncer +## 1000.0.45 + +### Patch Changes + +- @pnpm/workspace.find-packages@1000.0.71 + ## 1000.0.44 ### Patch Changes diff --git a/workspace/injected-deps-syncer/package.json b/workspace/injected-deps-syncer/package.json index e00d40f795..12a02a6a62 100644 --- a/workspace/injected-deps-syncer/package.json +++ b/workspace/injected-deps-syncer/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/workspace.injected-deps-syncer", - "version": "1000.0.44", + "version": "1000.0.45", "description": "Update all injected replica of a workspace package", "keywords": [ "pnpm", diff --git a/workspace/state/CHANGELOG.md b/workspace/state/CHANGELOG.md index 0ec8811e01..d007d799f2 100644 --- a/workspace/state/CHANGELOG.md +++ b/workspace/state/CHANGELOG.md @@ -1,5 +1,12 @@ # @pnpm/workspace.state +## 1002.1.12 + +### Patch Changes + +- Updated dependencies [36928be] + - @pnpm/config@1004.11.6 + ## 1002.1.11 ### Patch Changes diff --git a/workspace/state/package.json b/workspace/state/package.json index 781751354c..fe285de649 100644 --- a/workspace/state/package.json +++ b/workspace/state/package.json @@ -1,6 +1,6 @@ { "name": "@pnpm/workspace.state", - "version": "1002.1.11", + "version": "1002.1.12", "description": "Track the list of actual paths of workspace packages in a cache", "keywords": [ "pnpm",