@pnpm/deps.compliance.commands 1000.0.0 → 1101.0.0

package/lib/audit/audit.d.ts

@@ -1,4 +1,4 @@
-import { type Config, type UniversalOptions } from '@pnpm/config.reader';
+import { type Config, type ConfigContext, type UniversalOptions } from '@pnpm/config.reader';
 import { type AuditReport } from '@pnpm/deps.compliance.audit';
 import { type InstallCommandOptions } from '@pnpm/installing.commands';
 import type { Registries } from '@pnpm/types';
@@ -7,6 +7,7 @@ export declare function rcOptionsTypes(): Record<string, unknown>;
 export declare function cliOptionsTypes(): Record<string, unknown>;
 export declare const shorthands: Record<string, string>;
 export declare const commandNames: string[];
+export declare const recursiveByDefault = true;
 export declare function help(): string;
 export type AuditOptions = Pick<UniversalOptions, 'dir'> & {
     fix?: boolean | 'override' | 'update';
@@ -16,7 +17,7 @@ export type AuditOptions = Pick<UniversalOptions, 'dir'> & {
     registries: Registries;
     ignore?: string[];
     ignoreUnfixable?: boolean;
-} & Pick<Config, 'auditConfig' | 'auditLevel' | 'ca' | 'cert' | 'httpProxy' | 'httpsProxy' | 'key' | 'localAddress' | 'maxSockets' | 'noProxy' | 'strictSsl' | 'fetchRetries' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchRetryFactor' | 'fetchTimeout' | 'production' | 'dev' | 'overrides' | 'optional' | 'userConfig' | 'rawConfig' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'virtualStoreDirMaxLength' | 'workspaceDir'> & InstallCommandOptions;
+} & Pick<Config, 'auditConfig' | 'auditLevel' | 'minimumReleaseAge' | 'ca' | 'cert' | 'httpProxy' | 'httpsProxy' | 'key' | 'localAddress' | 'maxSockets' | 'noProxy' | 'strictSsl' | 'fetchRetries' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchRetryFactor' | 'fetchTimeout' | 'production' | 'dev' | 'overrides' | 'optional' | 'configByUri' | 'virtualStoreDirMaxLength' | 'workspaceDir'> & Pick<ConfigContext, 'rootProjectManifest' | 'rootProjectManifestDir'> & InstallCommandOptions;
 export declare function handler(opts: AuditOptions): Promise<{
     exitCode: number;
     output: string;

package/lib/audit/audit.js

@@ -1,25 +1,27 @@
 import { docsUrl, TABLE_OPTIONS } from '@pnpm/cli.utils';
 import { types as allTypes } from '@pnpm/config.reader';
 import { WANTED_LOCKFILE } from '@pnpm/constants';
-import { audit } from '@pnpm/deps.compliance.audit';
+import { audit, normalizeGhsaId } from '@pnpm/deps.compliance.audit';
 import { PnpmError } from '@pnpm/error';
 import { update } from '@pnpm/installing.commands';
 import { readEnvLockfile, readWantedLockfile } from '@pnpm/lockfile.fs';
 import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
 import { table } from '@zkochan/table';
 import chalk, {} from 'chalk';
-import { difference, pick, pickBy } from 'ramda';
+import { pick, pickBy } from 'ramda';
 import { renderHelp } from 'render-help';
 import { fix } from './fix.js';
 import { fixWithUpdate } from './fixWithUpdate.js';
 import { ignore } from './ignore.js';
 const AUDIT_LEVEL_NUMBER = {
-    low: 0,
-    moderate: 1,
-    high: 2,
-    critical: 3,
+    info: 0,
+    low: 1,
+    moderate: 2,
+    high: 3,
+    critical: 4,
 };
 const AUDIT_COLOR = {
+    info: chalk.dim,
     low: chalk.bold,
     moderate: chalk.bold.yellow,
     high: chalk.bold.red,
@@ -46,7 +48,7 @@ export function rcOptionsTypes() {
             'production',
             'registry',
         ], allTypes),
-        'audit-level': ['low', 'moderate', 'high', 'critical'],
+        'audit-level': ['info', 'low', 'moderate', 'high', 'critical'],
         // For fix, use String instead of a list of allowed string values.
         // Otherwise, an unexpected value will get coerced to true because of the Boolean type.
         fix: [String, Boolean],
@@ -69,6 +71,7 @@ export const shorthands = {
     P: '--production',
 };
 export const commandNames = ['audit'];
+export const recursiveByDefault = true;
 export function help() {
     return renderHelp({
         description: 'Checks for known security issues with the installed packages.',
@@ -85,7 +88,7 @@ export function help() {
                         name: '--json',
                     },
                     {
-                        description: 'Only print advisories with severity greater than or equal to one of the following: low|moderate|high|critical. Default: low',
+                        description: 'Only print advisories with severity greater than or equal to one of the following: info|low|moderate|high|critical. Default: low',
                         name: '--audit-level <severity>',
                     },
                     {
@@ -107,11 +110,11 @@ export function help() {
                         name: '--ignore-registry-errors',
                     },
                     {
-                        description: 'Ignore a vulnerability by CVE',
+                        description: 'Ignore a vulnerability by its GitHub advisory ID (e.g. GHSA-xxxx-xxxx-xxxx)',
                         name: '--ignore <vulnerability>',
                     },
                     {
-                        description: 'Ignore all CVEs with no resolution',
+                        description: 'Ignore all vulnerabilities for which no fix exists',
                         name: '--ignore-unfixable',
                     },
                 ],
@@ -135,10 +138,10 @@ export async function handler(opts) {
         optionalDependencies: opts.optional !== false,
     };
     let auditReport;
-    const getAuthHeader = createGetAuthHeaderByURI({ allSettings: opts.rawConfig, userSettings: opts.userConfig });
+    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri, opts.registries?.default);
     try {
         auditReport = await audit(lockfile, getAuthHeader, {
-            agentOptions: {
+            dispatcherOptions: {
                 ca: opts.ca,
                 cert: opts.cert,
                 httpProxy: opts.httpProxy,
@@ -152,7 +155,6 @@ export async function handler(opts) {
             },
             envLockfile,
             include,
-            lockfileDir,
             registry: opts.registries.default,
             retry: {
                 factor: opts.fetchRetryFactor,
@@ -161,7 +163,6 @@ export async function handler(opts) {
                 retries: opts.fetchRetries,
             },
             timeout: opts.fetchTimeout,
-            virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
         });
     }
     catch (err) { // eslint-disable-line
@@ -188,26 +189,34 @@ export async function handler(opts) {
     }
     if (fixMethod === 'update') {
         const result = await fixWithUpdate(auditReport, { ...opts, include });
+        let output = formatFixWithUpdateOutput(result, auditReport);
+        if (result.addedAgeExcludes.length > 0) {
+            output += `\n${result.addedAgeExcludes.length} entries were added to minimumReleaseAgeExclude to allow installing the patched versions:\n${result.addedAgeExcludes.join('\n')}\n`;
+        }
         return {
             exitCode: result.remaining.length > 0 ? 1 : 0,
-            output: formatFixWithUpdateOutput(result, auditReport),
+            output,
         };
     }
     if (fixMethod === 'override') {
-        const newOverrides = await fix(auditReport, opts);
-        if (Object.values(newOverrides).length === 0) {
+        const { vulnOverrides, addedAgeExcludes } = await fix(auditReport, opts);
+        if (Object.values(vulnOverrides).length === 0) {
             return {
                 exitCode: 0,
                 output: 'No fixes were made',
             };
         }
-        return {
-            exitCode: 0,
-            output: `${Object.values(newOverrides).length} overrides were added to package.json to fix vulnerabilities.
+        let output = `${Object.values(vulnOverrides).length} overrides were added to pnpm-workspace.yaml to fix vulnerabilities.
 Run "pnpm install" to apply the fixes.
 
 The added overrides:
-${JSON.stringify(newOverrides, null, 2)}`,
+${JSON.stringify(vulnOverrides, null, 2)}`;
+        if (addedAgeExcludes.length > 0) {
+            output += `\n\n${addedAgeExcludes.length} entries were added to minimumReleaseAgeExclude to allow installing the patched versions:\n${addedAgeExcludes.join('\n')}`;
+        }
+        return {
+            exitCode: 0,
+            output,
         };
     }
     if (opts.ignore !== undefined || opts.ignoreUnfixable) {
@@ -235,6 +244,7 @@ ${newIgnores.join('\n')}`,
     }
     const vulnerabilities = auditReport.metadata.vulnerabilities;
     const ignoredVulnerabilities = {
+        info: 0,
         low: 0,
         moderate: 0,
         high: 0,
@@ -243,19 +253,12 @@ ${newIgnores.join('\n')}`,
     const totalVulnerabilityCount = Object.values(vulnerabilities)
         .reduce((sum, vulnerabilitiesCount) => sum + vulnerabilitiesCount, 0);
     const ignoreGhsas = opts.auditConfig?.ignoreGhsas;
-    if (ignoreGhsas) {
+    if (ignoreGhsas?.length) {
+        // Compare GHSA ids after normalizing so stored entries with varying
+        // casing still match the canonical form on the advisory.
+        const ignoreSet = new Set(ignoreGhsas.map(normalizeGhsaId));
         auditReport.advisories = pickBy(({ github_advisory_id: githubAdvisoryId, severity }) => {
-            if (!ignoreGhsas.includes(githubAdvisoryId)) {
-                return true;
-            }
-            ignoredVulnerabilities[severity] += 1;
-            return false;
-        }, auditReport.advisories);
-    }
-    const ignoreCves = opts.auditConfig?.ignoreCves;
-    if (ignoreCves) {
-        auditReport.advisories = pickBy(({ cves, severity }) => {
-            if (cves.length === 0 || difference(cves, ignoreCves).length > 0) {
+            if (!ignoreSet.has(normalizeGhsaId(githubAdvisoryId))) {
                 return true;
             }
             ignoredVulnerabilities[severity] += 1;
@@ -280,7 +283,7 @@ ${newIgnores.join('\n')}`,
             [AUDIT_COLOR[advisory.severity](advisory.severity), chalk.bold(advisory.title)],
             ['Package', advisory.module_name],
             ['Vulnerable versions', advisory.vulnerable_versions],
-            ['Patched versions', advisory.patched_versions],
+            ['Patched versions', advisory.patched_versions ?? '(unknown)'],
             [
                 'Paths',
                 (paths.length > MAX_PATHS_COUNT

package/lib/audit/fix.d.ts

@@ -1,3 +1,8 @@
-import type { AuditReport } from '@pnpm/deps.compliance.audit';
+import { type AuditAdvisory, type AuditReport } from '@pnpm/deps.compliance.audit';
 import type { AuditOptions } from './audit.js';
-export declare function fix(auditReport: AuditReport, opts: AuditOptions): Promise<Record<string, string>>;
+export interface FixResult {
+    vulnOverrides: Record<string, string>;
+    addedAgeExcludes: string[];
+}
+export declare function fix(auditReport: AuditReport, opts: AuditOptions): Promise<FixResult>;
+export declare function createMinimumReleaseAgeExcludes(advisories: AuditAdvisory[]): string[];

package/lib/audit/fix.js

@@ -1,26 +1,52 @@
 import { writeSettings } from '@pnpm/config.writer';
-import { difference } from 'ramda';
+import { normalizeGhsaId } from '@pnpm/deps.compliance.audit';
+import semver from 'semver';
 export async function fix(auditReport, opts) {
-    const vulnOverrides = createOverrides(Object.values(auditReport.advisories), opts.auditConfig?.ignoreCves);
+    const fixableAdvisories = getFixableAdvisories(Object.values(auditReport.advisories), opts.auditConfig?.ignoreGhsas);
+    const vulnOverrides = createOverrides(fixableAdvisories);
     if (Object.values(vulnOverrides).length === 0)
-        return vulnOverrides;
+        return { vulnOverrides, addedAgeExcludes: [] };
+    const addedAgeExcludes = opts.minimumReleaseAge ? createMinimumReleaseAgeExcludes(fixableAdvisories) : [];
     await writeSettings({
         updatedOverrides: vulnOverrides,
+        addedMinimumReleaseAgeExcludes: addedAgeExcludes.length > 0 ? addedAgeExcludes : undefined,
         rootProjectManifest: opts.rootProjectManifest,
         rootProjectManifestDir: opts.rootProjectManifestDir,
         workspaceDir: opts.workspaceDir ?? opts.rootProjectManifestDir,
     });
-    return vulnOverrides;
+    return { vulnOverrides, addedAgeExcludes };
 }
-function createOverrides(advisories, ignoreCves) {
-    if (ignoreCves) {
-        advisories = advisories.filter(({ cves }) => difference(cves, ignoreCves).length > 0);
+function getFixableAdvisories(advisories, ignoreGhsas) {
+    if (ignoreGhsas) {
+        // Normalize on both sides so ignore entries match regardless of casing.
+        const ignored = new Set(ignoreGhsas.map(normalizeGhsaId));
+        advisories = advisories.filter(({ github_advisory_id: ghsaId }) => !ghsaId || !ignored.has(normalizeGhsaId(ghsaId)));
     }
-    return Object.fromEntries(advisories
-        .filter(({ vulnerable_versions: vulnerableVersions, patched_versions: patchedVersions }) => vulnerableVersions !== '>=0.0.0' && patchedVersions !== '<0.0.0')
-        .map((advisory) => [
-        `${advisory.module_name}@${advisory.vulnerable_versions}`,
-        advisory.patched_versions,
-    ]));
+    // Only advisories with a known patched range can produce an override.
+    // patched_versions is undefined when the range couldn't be inferred from
+    // vulnerable_versions — no override is possible in that case.
+    return advisories.filter(({ patched_versions: patchedVersions }) => patchedVersions != null);
+}
+function createOverrides(advisories) {
+    const entries = [];
+    for (const advisory of advisories) {
+        if (!advisory.patched_versions)
+            continue;
+        entries.push([`${advisory.module_name}@${advisory.vulnerable_versions}`, advisory.patched_versions]);
+    }
+    return Object.fromEntries(entries);
+}
+export function createMinimumReleaseAgeExcludes(advisories) {
+    const excludes = new Set();
+    for (const advisory of advisories) {
+        const patchedVersions = advisory.patched_versions;
+        if (!patchedVersions)
+            continue;
+        const minVersion = semver.minVersion(patchedVersions);
+        if (minVersion) {
+            excludes.add(`${advisory.module_name}@${minVersion.version}`);
+        }
+    }
+    return Array.from(excludes);
 }
 //# sourceMappingURL=fix.js.map

package/lib/audit/fixWithUpdate.d.ts

@@ -4,6 +4,7 @@ import type { AuditOptions } from './audit.js';
 export interface FixWithUpdateResult {
     fixed: number[];
     remaining: number[];
+    addedAgeExcludes: string[];
 }
 export type FixWithUpdateOptions = AuditOptions & {
     include?: {

package/lib/audit/fixWithUpdate.js

@@ -1,8 +1,10 @@
+import { writeSettings } from '@pnpm/config.writer';
 import { WANTED_LOCKFILE } from '@pnpm/constants';
 import { PnpmError } from '@pnpm/error';
 import { update } from '@pnpm/installing.commands';
 import { readWantedLockfile } from '@pnpm/lockfile.fs';
 import semver from 'semver';
+import { createMinimumReleaseAgeExcludes } from './fix.js';
 import { lockfileToPackages } from './lockfileToPackages.js';
 export async function fixWithUpdate(auditReport, opts) {
     const vulnerabilitiesByPackage = new Map();
@@ -58,8 +60,22 @@ export async function fixWithUpdate(auditReport, opts) {
             return allVulnerabilities;
         },
     };
+    // Add minimum patched versions to minimumReleaseAgeExclude so the resolver
+    // can install them even when minimumReleaseAge would otherwise block them.
+    const addedAgeExcludes = opts.minimumReleaseAge ? createMinimumReleaseAgeExcludes(Object.values(auditReport.advisories)) : [];
+    const updateOpts = { ...opts };
+    if (addedAgeExcludes.length > 0) {
+        const existing = updateOpts.minimumReleaseAgeExclude ?? [];
+        updateOpts.minimumReleaseAgeExclude = [...existing, ...addedAgeExcludes];
+        await writeSettings({
+            addedMinimumReleaseAgeExcludes: addedAgeExcludes,
+            rootProjectManifest: opts.rootProjectManifest,
+            rootProjectManifestDir: opts.rootProjectManifestDir,
+            workspaceDir: opts.workspaceDir ?? opts.rootProjectManifestDir,
+        });
+    }
     await update.handler({
-        ...opts,
+        ...updateOpts,
         packageVulnerabilityAudit,
     }, []);
     const lockfileDir = opts.lockfileDir ?? opts.dir;
@@ -105,6 +121,6 @@ export async function fixWithUpdate(auditReport, opts) {
             fixed.push(...unfixableIds);
         }
     }
-    return { fixed, remaining };
+    return { fixed, remaining, addedAgeExcludes };
 }
 //# sourceMappingURL=fixWithUpdate.js.map

package/lib/audit/ignore.d.ts

@@ -1,4 +1,4 @@
-import type { AuditReport } from '@pnpm/deps.compliance.audit';
+import { type AuditReport } from '@pnpm/deps.compliance.audit';
 import type { AuditConfig, ProjectManifest } from '@pnpm/types';
 export interface IgnoreVulnerabilitiesOptions {
     dir: string;

package/lib/audit/ignore.js

@@ -1,31 +1,44 @@
 import { writeSettings } from '@pnpm/config.writer';
+import { normalizeGhsaId } from '@pnpm/deps.compliance.audit';
+import { PnpmError } from '@pnpm/error';
 import { difference } from 'ramda';
 export async function ignore(opts) {
-    const currentCves = opts?.auditConfig?.ignoreCves ?? [];
-    const currentUniqueCves = new Set(currentCves);
-    const advisoryWthNoResolutions = filterAdvisoriesWithNoResolutions(Object.values(opts.auditReport.advisories));
+    // GHSA IDs are canonically uppercase; normalize on read/write so a stored
+    // "ghsa-..." or uppercase user input both match the derived id at filter
+    // time.
+    const currentGhsas = (opts?.auditConfig?.ignoreGhsas ?? []).map(normalizeGhsaId);
+    const currentUniqueGhsas = new Set(currentGhsas);
+    const advisoriesWithNoResolutions = filterAdvisoriesWithNoResolutions(Object.values(opts.auditReport.advisories));
     if (opts.ignoreUnfixable) {
-        Object.values(advisoryWthNoResolutions).forEach((advisory) => {
-            advisory.cves.forEach((cve) => currentUniqueCves.add(cve));
-        });
+        for (const advisory of advisoriesWithNoResolutions) {
+            if (!advisory.github_advisory_id) {
+                throw new PnpmError('AUDIT_MISSING_GHSA', `Cannot ignore advisory ${advisory.id} (${advisory.module_name}): the registry did not provide a GHSA id or a resolvable url.`);
+            }
+            currentUniqueGhsas.add(normalizeGhsaId(advisory.github_advisory_id));
+        }
     }
-    else {
-        opts.ignore?.forEach((cve) => currentUniqueCves.add(cve));
+    else if (opts.ignore) {
+        for (const ghsa of opts.ignore) {
+            currentUniqueGhsas.add(normalizeGhsaId(ghsa));
+        }
     }
-    const newIgnoreCves = currentUniqueCves.size > 0 ? Array.from(currentUniqueCves) : undefined;
-    const diffCve = difference(newIgnoreCves ?? [], currentCves);
+    const newIgnoreGhsas = currentUniqueGhsas.size > 0 ? Array.from(currentUniqueGhsas) : undefined;
+    const diffGhsas = difference(newIgnoreGhsas ?? [], currentGhsas);
     await writeSettings({
         ...opts,
         updatedSettings: {
             auditConfig: {
                 ...opts.auditConfig,
-                ignoreCves: newIgnoreCves,
+                ignoreGhsas: newIgnoreGhsas,
             },
         },
     });
-    return [...diffCve];
+    return [...diffGhsas];
 }
+// Advisories for which no override can be produced — patched_versions is
+// undefined when pnpm couldn't infer a patched range from vulnerable_versions.
+// That is the only "no fix available" signal the bulk endpoint provides.
 function filterAdvisoriesWithNoResolutions(advisories) {
-    return advisories.filter(({ patched_versions: patchedVersions }) => patchedVersions === '<0.0.0');
+    return advisories.filter(({ patched_versions: patchedVersions }) => patchedVersions == null);
 }
 //# sourceMappingURL=ignore.js.map

package/lib/licenses/licensesList.d.ts

@@ -1,9 +1,9 @@
-import type { Config } from '@pnpm/config.reader';
+import type { Config, ConfigContext } from '@pnpm/config.reader';
 import type { LicensesCommandResult } from './LicensesCommandResult.js';
 export type LicensesCommandOptions = {
     compatible?: boolean;
     long?: boolean;
     recursive?: boolean;
     json?: boolean;
-} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'supportedArchitectures' | 'virtualStoreDirMaxLength'> & Partial<Pick<Config, 'userConfig'>>;
+} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'supportedArchitectures' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir'> & Partial<Pick<Config, 'userConfig'>>;
 export declare function licensesList(opts: LicensesCommandOptions): Promise<LicensesCommandResult>;

package/lib/sbom/sbom.d.ts

@@ -1,11 +1,11 @@
-import { type Config } from '@pnpm/config.reader';
+import { type Config, type ConfigContext } from '@pnpm/config.reader';
 export type SbomCommandOptions = {
     sbomFormat?: string;
     sbomType?: string;
     lockfileOnly?: boolean;
     sbomAuthors?: string;
     sbomSupplier?: string;
-} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'virtualStoreDirMaxLength'> & Partial<Pick<Config, 'userConfig'>>;
+} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir'> & Partial<Pick<Config, 'userConfig'>>;
 export declare function rcOptionsTypes(): Record<string, unknown>;
 export declare const cliOptionsTypes: () => Record<string, unknown>;
 export declare const shorthands: Record<string, string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.commands",
-  "version": "1000.0.0",
+  "version": "1101.0.0",
   "description": "pnpm commands for audit, licenses, and sbom",
   "keywords": [
     "pnpm",
@@ -33,41 +33,43 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "semver": "^7.7.2",
-    "@pnpm/cli.command": "1000.0.0",
-    "@pnpm/cli.common-cli-options-help": "1000.0.1",
-    "@pnpm/cli.utils": "1001.2.8",
-    "@pnpm/config.reader": "1004.4.2",
-    "@pnpm/cli.meta": "1000.0.11",
-    "@pnpm/constants": "1001.3.1",
-    "@pnpm/deps.compliance.audit": "1002.0.14",
-    "@pnpm/deps.compliance.license-scanner": "1001.0.27",
-    "@pnpm/deps.compliance.sbom": "1000.0.0-0",
-    "@pnpm/error": "1000.0.5",
-    "@pnpm/installing.commands": "1004.6.10",
-    "@pnpm/lockfile.fs": "1001.1.21",
-    "@pnpm/config.writer": "1000.0.14",
-    "@pnpm/lockfile.utils": "1003.0.3",
-    "@pnpm/lockfile.types": "1002.0.2",
-    "@pnpm/store.path": "1000.0.5",
-    "@pnpm/network.auth-header": "1000.0.6",
-    "@pnpm/types": "1000.9.0",
-    "@pnpm/lockfile.walker": "1001.0.16",
-    "@pnpm/workspace.project-manifest-reader": "1001.1.4"
+    "@pnpm/cli.command": "1100.0.0",
+    "@pnpm/cli.common-cli-options-help": "1100.0.0",
+    "@pnpm/cli.utils": "1100.0.1",
+    "@pnpm/cli.meta": "1100.0.1",
+    "@pnpm/config.reader": "1100.0.1",
+    "@pnpm/deps.compliance.audit": "1101.0.0",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/deps.compliance.license-scanner": "1100.0.1",
+    "@pnpm/lockfile.fs": "1100.0.1",
+    "@pnpm/deps.compliance.sbom": "1100.0.1",
+    "@pnpm/lockfile.types": "1100.0.1",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/installing.commands": "1100.0.1",
+    "@pnpm/lockfile.utils": "1100.0.1",
+    "@pnpm/lockfile.walker": "1100.0.1",
+    "@pnpm/network.auth-header": "1100.0.1",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.1",
+    "@pnpm/store.path": "1100.0.0",
+    "@pnpm/config.writer": "1100.0.1",
+    "@pnpm/types": "1101.0.0"
   },
   "devDependencies": {
-    "@pnpm/registry-mock": "5.2.4",
-    "@types/ramda": "0.29.12",
+    "@pnpm/registry-mock": "6.0.0",
+    "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/zkochan__table": "npm:@types/table@6.0.0",
     "load-json-file": "^7.0.1",
     "nock": "13.3.4",
     "read-yaml-file": "^3.0.0",
     "tempy": "3.0.0",
-    "@pnpm/deps.compliance.commands": "1000.0.0",
-    "@pnpm/pkg-manifest.reader": "1000.1.2",
-    "@pnpm/workspace.projects-filter": "1000.0.43",
-    "@pnpm/test-fixtures": "1000.0.0",
-    "@pnpm/prepare": "1000.0.4"
+    "@pnpm/deps.compliance.commands": "1101.0.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.1",
+    "@pnpm/prepare": "1100.0.1",
+    "@pnpm/testing.command-defaults": "1100.0.0",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/testing.mock-agent": "1100.0.1",
+    "@pnpm/workspace.projects-filter": "1100.0.1"
   },
   "engines": {
     "node": ">=22.13"
@@ -77,9 +79,9 @@
   },
   "scripts": {
     "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
-    "_test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
-    "test": "pnpm run compile && pnpm run _test",
-    "compile": "tsgo --build && pnpm run lint --fix",
-    "update-responses": "node test/audit/utils/responses/update.ts"
+    "test": "pn compile && pn .test",
+    "compile": "tsgo --build && pn lint --fix",
+    "update-responses": "node test/audit/utils/responses/update.ts",
+    ".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
   }
 }