From af2e566ff23b7c76ee558c4a778f8cc4aa71c37b Mon Sep 17 00:00:00 2001
From: Dami Oyeniyi <damilolaoyeniyi13@gmail.com>
Date: Tue, 28 Apr 2026 00:53:31 +0100
Subject: [PATCH] fix: reject null named catalogs in workspace manifest reader
 (#11231)

---
 .changeset/gentle-hats-doubt.md                          | 6 ++++++
 workspace/workspace-manifest-reader/src/catalogs.ts      | 4 ++++
 .../pnpm-workspace.yaml                                  | 6 ++++++
 workspace/workspace-manifest-reader/test/index.ts        | 9 +++++++++
 4 files changed, 25 insertions(+)
 create mode 100644 .changeset/gentle-hats-doubt.md
 create mode 100644 workspace/workspace-manifest-reader/test/__fixtures__/catalogs-invalid-named-catalog-null/pnpm-workspace.yaml

diff --git a/.changeset/gentle-hats-doubt.md b/.changeset/gentle-hats-doubt.md
new file mode 100644
index 0000000000..db840b97d2
--- /dev/null
+++ b/.changeset/gentle-hats-doubt.md
@@ -0,0 +1,6 @@
+---
+"@pnpm/workspace.workspace-manifest-reader": patch
+"pnpm": patch
+---
+
+Reject `null` named catalogs in workspace manifests with `InvalidWorkspaceManifestError` instead of crashing with a raw `TypeError`.
diff --git a/workspace/workspace-manifest-reader/src/catalogs.ts b/workspace/workspace-manifest-reader/src/catalogs.ts
index b04784881f..b656a7c58f 100644
--- a/workspace/workspace-manifest-reader/src/catalogs.ts
+++ b/workspace/workspace-manifest-reader/src/catalogs.ts
@@ -46,6 +46,10 @@ export function assertValidWorkspaceManifestCatalogs (manifest: { packages?: rea
       throw new InvalidWorkspaceManifestError(`Expected named catalog ${catalogName} to be an object, but found - array`)
     }
 
+    if (catalog === null) {
+      throw new InvalidWorkspaceManifestError(`Expected named catalog ${catalogName} to be an object, but found - null`)
+    }
+
     if (typeof catalog !== 'object') {
       throw new InvalidWorkspaceManifestError(`Expected named catalog ${catalogName} to be an object, but found - ${typeof catalog}`)
     }
diff --git a/workspace/workspace-manifest-reader/test/__fixtures__/catalogs-invalid-named-catalog-null/pnpm-workspace.yaml b/workspace/workspace-manifest-reader/test/__fixtures__/catalogs-invalid-named-catalog-null/pnpm-workspace.yaml
new file mode 100644
index 0000000000..d1c038531e
--- /dev/null
+++ b/workspace/workspace-manifest-reader/test/__fixtures__/catalogs-invalid-named-catalog-null/pnpm-workspace.yaml
@@ -0,0 +1,6 @@
+packages:
+  - "packages/**"
+  - "types"
+
+catalogs:
+  foo: null
diff --git a/workspace/workspace-manifest-reader/test/index.ts b/workspace/workspace-manifest-reader/test/index.ts
index 738424eeef..9bbcf80f1e 100644
--- a/workspace/workspace-manifest-reader/test/index.ts
+++ b/workspace/workspace-manifest-reader/test/index.ts
@@ -133,6 +133,15 @@ describe('readWorkspaceManifest() catalogs field', () => {
     ).rejects.toThrow('Expected named catalog foo to be an object, but found - number')
   })
 
+  test('throws on null named catalog', async () => {
+    await expect(
+      readWorkspaceManifest(path.join(import.meta.dirname, '__fixtures__/catalogs-invalid-named-catalog-null'))
+    ).rejects.toMatchObject({
+      code: 'ERR_PNPM_INVALID_WORKSPACE_CONFIGURATION',
+      message: expect.stringContaining('Expected named catalog foo to be an object, but found - null'),
+    })
+  })
+
   test('throws on invalid named catalog specifier', async () => {
     await expect(
       readWorkspaceManifest(path.join(import.meta.dirname, '__fixtures__/catalogs-invalid-named-catalog-specifier'))