A package's deprecation notice is free-form text that any publisher can
rewrite on an already-published version. It is not covered by the tarball
integrity hash and not pinned by the lockfile, so it is the one
registry-mutable field that reached the terminal with no integrity check
behind it, and it reached it unfiltered. That made it a channel for
terminal escape sequences, and, for an agent reading install output, for
prompt injection.
A deprecated direct dependency is now reported as `deprecated
<name>@<version>`, in both the TypeScript v11 CLI and pacquet. The notice
is dropped from the `pnpm:deprecation` payload as well, so it does not
reach an NDJSON consumer either.
The identifier itself is sanitized. It comes from the resolved manifest
rather than the validated dependency alias, so a git or tarball
dependency names itself, and it was printed raw.
The shared text sanitizer also strips U+2028 and U+2029, which end a line
for a JSON or JavaScript consumer without being control characters.
The lockfile keeps recording the notice. Replacing it with a flag changes
a field's type inside an unchanged lockfile version, which breaks
strongly typed consumers and churns the file between pnpm versions. That
belongs in the next lockfile major.
Discussed in https://github.com/orgs/pnpm/discussions/13422.
Zoltan Kochan
94d1e762a6