mirror of https://github.com/pnpm/pnpm.git synced 2026-07-27 07:57:17 -04:00

Files

Zoltan Kochan 3fda443beb feat: inject DYLD_LIBRARY_PATH/LD_LIBRARY_PATH in broop bin wrappers

Native binaries from Homebrew bottles (e.g., wget) are dynamically linked
against shared libraries with hardcoded absolute paths like
/opt/homebrew/opt/openssl@3/lib/libssl.dylib. When installed via pnpm,
these paths don't exist.

This change:
- Adds nativeLibraryDeps to BinaryResolution to carry library dependency
  info through the resolution/fetch pipeline
- Stores nativeLibraryDeps in the fetched package manifest
- Resolves sibling dependency lib/ directories in the store
- Injects DYLD_LIBRARY_PATH (macOS) / LD_LIBRARY_PATH (Linux) into the
  shell wrapper scripts generated by @zkochan/cmd-shim
- Handles Homebrew versioned formula names (e.g., openssl@3) by
  sanitizing @ to -v for valid npm package names and fixing GHCR
  token scope resolution
- Allows broop subdeps through the exotic subdep filter

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-10 00:40:01 +01:00

scripts

fix: prevent path traversal vulnerabilities during ZIP extraction

2026-01-16 20:36:40 +01:00

src

feat: inject DYLD_LIBRARY_PATH/LD_LIBRARY_PATH in broop bin wrappers

2026-03-10 00:40:01 +01:00

test

fix: prevent path traversal vulnerabilities during ZIP extraction

2026-01-16 20:36:40 +01:00

CHANGELOG.md

chore(release): 10.19.0

2025-10-21 15:30:20 +02:00

package.json

feat: use SQLite for storing package index in the content-addressable store (#10827 )

2026-03-06 12:59:04 +01:00

README.md

fix: prevent path traversal vulnerabilities during ZIP extraction

2026-01-16 20:36:40 +01:00

tsconfig.json

feat: use SQLite for storing package index in the content-addressable store (#10827 )

2026-03-06 12:59:04 +01:00

tsconfig.lint.json

feat: support installing Deno runtime (#9791 )

2025-07-30 11:27:07 +02:00

README.md

@pnpm/fetching.binary-fetcher

A fetcher for binary archives

Installation

pnpm add @pnpm/fetching.binary-fetcher

Testing

Test Fixtures

The test/fixtures/ directory contains malicious ZIP files for testing path traversal protection:

File	Entry Path	Purpose
`path-traversal.zip`	`../../../.npmrc`	Tests `../` escape sequences
`absolute-path.zip`	`/etc/passwd`	Tests absolute path entries
`backslash-traversal.zip`	`..\..\..\evil.txt`	Tests Windows backslash traversal (Windows-only)

These fixtures are manually crafted because AdmZip's addFile() sanitizes paths automatically.

Note: The backslash test only runs on Windows because \ is a valid filename character on Unix.

Regenerating Fixtures

node --experimental-strip-types scripts/create-fixtures.ts

License

MIT