mirror of https://github.com/pnpm/pnpm.git synced 2026-04-27 02:20:19 -04:00

Files

Zoltan Kochan aa93759d9b chore(release): drop eslint from lib prepublishOnly (#11320 )

Library packages had `prepublishOnly: pn compile`, which expands to
`tsgo --build && pn lint --fix`. During `pn release` that runs eslint
against ~150 packages for no benefit — the code has already been linted
in CI and the release flow's upfront compile has already built dist/.
Switch lib prepublishOnly to a bare `tsgo --build` so the safety-net
compile stays but the per-package eslint cost is gone.

2026-04-21 01:18:03 +02:00

scripts

fix: prevent path traversal vulnerabilities during ZIP extraction

2026-01-16 20:36:40 +01:00

src

refactor(config): rename rawConfig to authConfig, add nodeDownloadMirrors, simplify config reader (#11194 )

2026-04-04 20:33:43 +02:00

test

style: enforce node: protocol for builtin imports (#10951 )

2026-03-13 07:59:51 +01:00

CHANGELOG.md

chore(release): 11.0.0-rc.3

2026-04-21 00:17:38 +02:00

package.json

chore(release): drop eslint from lib prepublishOnly (#11320 )

2026-04-21 01:18:03 +02:00

README.md

fix: prevent path traversal vulnerabilities during ZIP extraction

2026-01-16 20:36:40 +01:00

tsconfig.json

refactor: rename packages and consolidate runtime resolvers (#10999 )

2026-03-18 00:19:58 +01:00

tsconfig.lint.json

feat: support installing Deno runtime (#9791 )

2025-07-30 11:27:07 +02:00

README.md

@pnpm/fetching.binary-fetcher

A fetcher for binary archives

Installation

pnpm add @pnpm/fetching.binary-fetcher

Testing

Test Fixtures

The test/fixtures/ directory contains malicious ZIP files for testing path traversal protection:

File	Entry Path	Purpose
`path-traversal.zip`	`../../../.npmrc`	Tests `../` escape sequences
`absolute-path.zip`	`/etc/passwd`	Tests absolute path entries
`backslash-traversal.zip`	`..\..\..\evil.txt`	Tests Windows backslash traversal (Windows-only)

These fixtures are manually crafted because AdmZip's addFile() sanitizes paths automatically.

Note: The backslash test only runs on Windows because \ is a valid filename character on Unix.

Regenerating Fixtures

node --experimental-strip-types scripts/create-fixtures.ts

License

MIT