pnpm/patching/plugin-commands-patching/test at release/10 - pnpm

mirror of https://github.com/pnpm/pnpm.git synced 2026-07-14 01:32:40 -04:00

Files

Zoltan Kochan 352ae489f1 fix(security): backport path-traversal and containment fixes to v10 (#12504 )

Backports three merged security fixes from main to release/10:

- Contain hoisted dependency aliases so a crafted lockfile alias cannot
  escape node_modules or overwrite pnpm-owned layout. The hoisted graph
  builder now validates each alias at the safeJoinModulesDir sink.
  (GHSA-fr4h-3cph-29xv, #12343)
- Contain pnpm patch-remove deletions to the configured patches
  directory. (#12341)
- Reject path-traversal config dependency names and versions from
  pnpm-workspace.yaml before they are used to build filesystem paths.
  (GHSA-qrv3-253h-g69c, #12470)

Written by an agent (Claude Code, claude-opus-4-8).

2026-06-18 21:54:19 +02:00

utils

feat: allow to set multiple pnpmfiles (#9702 )

2025-07-08 14:54:07 +02:00

getEditDirPath.test.ts

refactor: always use extensions in relative imports (#9878 )

2025-08-19 15:25:11 +02:00

isSubdirectory.test.ts

fix(security): backport path-traversal and containment fixes to v10 (#12504 )

2026-06-18 21:54:19 +02:00

patch.test.ts

refactor: always use extensions in relative imports (#9878 )