@pnpm/deps.compliance.commands 1000.0.0

package/lib/audit/audit.d.ts

@@ -0,0 +1,24 @@
+import { type Config, type UniversalOptions } from '@pnpm/config.reader';
+import { type AuditReport } from '@pnpm/deps.compliance.audit';
+import { type InstallCommandOptions } from '@pnpm/installing.commands';
+import type { Registries } from '@pnpm/types';
+import { type FixWithUpdateResult } from './fixWithUpdate.js';
+export declare function rcOptionsTypes(): Record<string, unknown>;
+export declare function cliOptionsTypes(): Record<string, unknown>;
+export declare const shorthands: Record<string, string>;
+export declare const commandNames: string[];
+export declare function help(): string;
+export type AuditOptions = Pick<UniversalOptions, 'dir'> & {
+    fix?: boolean | 'override' | 'update';
+    ignoreRegistryErrors?: boolean;
+    json?: boolean;
+    lockfileDir?: string;
+    registries: Registries;
+    ignore?: string[];
+    ignoreUnfixable?: boolean;
+} & Pick<Config, 'auditConfig' | 'auditLevel' | 'ca' | 'cert' | 'httpProxy' | 'httpsProxy' | 'key' | 'localAddress' | 'maxSockets' | 'noProxy' | 'strictSsl' | 'fetchRetries' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchRetryFactor' | 'fetchTimeout' | 'production' | 'dev' | 'overrides' | 'optional' | 'userConfig' | 'rawConfig' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'virtualStoreDirMaxLength' | 'workspaceDir'> & InstallCommandOptions;
+export declare function handler(opts: AuditOptions): Promise<{
+    exitCode: number;
+    output: string;
+}>;
+export declare function formatFixWithUpdateOutput(result: FixWithUpdateResult, auditReport: AuditReport): string;

package/lib/audit/audit.js

@@ -0,0 +1,350 @@
+import { docsUrl, TABLE_OPTIONS } from '@pnpm/cli.utils';
+import { types as allTypes } from '@pnpm/config.reader';
+import { WANTED_LOCKFILE } from '@pnpm/constants';
+import { audit } from '@pnpm/deps.compliance.audit';
+import { PnpmError } from '@pnpm/error';
+import { update } from '@pnpm/installing.commands';
+import { readEnvLockfile, readWantedLockfile } from '@pnpm/lockfile.fs';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { table } from '@zkochan/table';
+import chalk, {} from 'chalk';
+import { difference, pick, pickBy } from 'ramda';
+import { renderHelp } from 'render-help';
+import { fix } from './fix.js';
+import { fixWithUpdate } from './fixWithUpdate.js';
+import { ignore } from './ignore.js';
+const AUDIT_LEVEL_NUMBER = {
+    low: 0,
+    moderate: 1,
+    high: 2,
+    critical: 3,
+};
+const AUDIT_COLOR = {
+    low: chalk.bold,
+    moderate: chalk.bold.yellow,
+    high: chalk.bold.red,
+    critical: chalk.bold.red,
+};
+const AUDIT_TABLE_OPTIONS = {
+    ...TABLE_OPTIONS,
+    columns: {
+        1: {
+            width: 54, // = table width of 80
+            wrapWord: true,
+        },
+    },
+};
+const MAX_PATHS_COUNT = 3;
+export function rcOptionsTypes() {
+    return {
+        ...update.rcOptionsTypes(),
+        ...pick([
+            'dev',
+            'json',
+            'only',
+            'optional',
+            'production',
+            'registry',
+        ], allTypes),
+        'audit-level': ['low', 'moderate', 'high', 'critical'],
+        // For fix, use String instead of a list of allowed string values.
+        // Otherwise, an unexpected value will get coerced to true because of the Boolean type.
+        fix: [String, Boolean],
+        'ignore-registry-errors': Boolean,
+        ignore: [String, Array],
+        'ignore-unfixable': Boolean,
+    };
+}
+export function cliOptionsTypes() {
+    return {
+        ...pick([
+            'recursive',
+            'workspace',
+        ], update.cliOptionsTypes()),
+        ...rcOptionsTypes(),
+    };
+}
+export const shorthands = {
+    D: '--dev',
+    P: '--production',
+};
+export const commandNames = ['audit'];
+export function help() {
+    return renderHelp({
+        description: 'Checks for known security issues with the installed packages.',
+        descriptionLists: [
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'Fix the audited vulnerabilities using the specified method: "override" or "update". "override" adds overrides to the package.json file in order to force non-vulnerable versions of the dependencies. "update" attempts to update the vulnerable packages in the lockfile to non-vulnerable versions. If no method is specified, "override" is used by default.',
+                        name: '--fix [method]',
+                    },
+                    {
+                        description: 'Output audit report in JSON format',
+                        name: '--json',
+                    },
+                    {
+                        description: 'Only print advisories with severity greater than or equal to one of the following: low|moderate|high|critical. Default: low',
+                        name: '--audit-level <severity>',
+                    },
+                    {
+                        description: 'Only audit "devDependencies"',
+                        name: '--dev',
+                        shortAlias: '-D',
+                    },
+                    {
+                        description: 'Only audit "dependencies" and "optionalDependencies"',
+                        name: '--prod',
+                        shortAlias: '-P',
+                    },
+                    {
+                        description: 'Don\'t audit "optionalDependencies"',
+                        name: '--no-optional',
+                    },
+                    {
+                        description: 'Use exit code 0 if the registry responds with an error. Useful when audit checks are used in CI. A build should not fail because the registry has issues.',
+                        name: '--ignore-registry-errors',
+                    },
+                    {
+                        description: 'Ignore a vulnerability by CVE',
+                        name: '--ignore <vulnerability>',
+                    },
+                    {
+                        description: 'Ignore all CVEs with no resolution',
+                        name: '--ignore-unfixable',
+                    },
+                ],
+            },
+        ],
+        url: docsUrl('audit'),
+        usages: ['pnpm audit [options]'],
+    });
+}
+const DEFAULT_FIX_METHOD = 'override';
+export async function handler(opts) {
+    const lockfileDir = opts.lockfileDir ?? opts.dir;
+    const lockfile = await readWantedLockfile(lockfileDir, { ignoreIncompatible: true });
+    if (lockfile == null) {
+        throw new PnpmError('AUDIT_NO_LOCKFILE', `No ${WANTED_LOCKFILE} found: Cannot audit a project without a lockfile`);
+    }
+    const envLockfile = await readEnvLockfile(opts.workspaceDir ?? lockfileDir);
+    const include = {
+        dependencies: opts.production !== false,
+        devDependencies: opts.dev !== false,
+        optionalDependencies: opts.optional !== false,
+    };
+    let auditReport;
+    const getAuthHeader = createGetAuthHeaderByURI({ allSettings: opts.rawConfig, userSettings: opts.userConfig });
+    try {
+        auditReport = await audit(lockfile, getAuthHeader, {
+            agentOptions: {
+                ca: opts.ca,
+                cert: opts.cert,
+                httpProxy: opts.httpProxy,
+                httpsProxy: opts.httpsProxy,
+                key: opts.key,
+                localAddress: opts.localAddress,
+                maxSockets: opts.maxSockets,
+                noProxy: opts.noProxy,
+                strictSsl: opts.strictSsl,
+                timeout: opts.fetchTimeout,
+            },
+            envLockfile,
+            include,
+            lockfileDir,
+            registry: opts.registries.default,
+            retry: {
+                factor: opts.fetchRetryFactor,
+                maxTimeout: opts.fetchRetryMaxtimeout,
+                minTimeout: opts.fetchRetryMintimeout,
+                retries: opts.fetchRetries,
+            },
+            timeout: opts.fetchTimeout,
+            virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
+        });
+    }
+    catch (err) { // eslint-disable-line
+        if (opts.ignoreRegistryErrors) {
+            return {
+                exitCode: 0,
+                output: err.message,
+            };
+        }
+        throw err;
+    }
+    let fixMethod;
+    if (opts.fix === 'update' || opts.fix === 'override') {
+        fixMethod = opts.fix;
+    }
+    else if (opts.fix === true) {
+        fixMethod = DEFAULT_FIX_METHOD;
+    }
+    else if (!opts.fix) {
+        fixMethod = undefined;
+    }
+    else {
+        throw new PnpmError('INVALID_FIX_OPTION', `Invalid value for --fix: ${opts.fix}. Should be one of "override" or "update"`);
+    }
+    if (fixMethod === 'update') {
+        const result = await fixWithUpdate(auditReport, { ...opts, include });
+        return {
+            exitCode: result.remaining.length > 0 ? 1 : 0,
+            output: formatFixWithUpdateOutput(result, auditReport),
+        };
+    }
+    if (fixMethod === 'override') {
+        const newOverrides = await fix(auditReport, opts);
+        if (Object.values(newOverrides).length === 0) {
+            return {
+                exitCode: 0,
+                output: 'No fixes were made',
+            };
+        }
+        return {
+            exitCode: 0,
+            output: `${Object.values(newOverrides).length} overrides were added to package.json to fix vulnerabilities.
+Run "pnpm install" to apply the fixes.
+
+The added overrides:
+${JSON.stringify(newOverrides, null, 2)}`,
+        };
+    }
+    if (opts.ignore !== undefined || opts.ignoreUnfixable) {
+        const newIgnores = await ignore({
+            auditConfig: opts.auditConfig,
+            auditReport,
+            ignore: opts.ignore,
+            ignoreUnfixable: opts.ignoreUnfixable === true,
+            dir: opts.dir,
+            rootProjectManifest: opts.rootProjectManifest,
+            rootProjectManifestDir: opts.rootProjectManifestDir,
+            workspaceDir: opts.workspaceDir ?? opts.rootProjectManifestDir,
+        });
+        if (newIgnores.length === 0) {
+            return {
+                exitCode: 0,
+                output: 'No new vulnerabilities were ignored',
+            };
+        }
+        return {
+            exitCode: 0,
+            output: `${newIgnores.length} new vulnerabilities were ignored:
+${newIgnores.join('\n')}`,
+        };
+    }
+    const vulnerabilities = auditReport.metadata.vulnerabilities;
+    const ignoredVulnerabilities = {
+        low: 0,
+        moderate: 0,
+        high: 0,
+        critical: 0,
+    };
+    const totalVulnerabilityCount = Object.values(vulnerabilities)
+        .reduce((sum, vulnerabilitiesCount) => sum + vulnerabilitiesCount, 0);
+    const ignoreGhsas = opts.auditConfig?.ignoreGhsas;
+    if (ignoreGhsas) {
+        auditReport.advisories = pickBy(({ github_advisory_id: githubAdvisoryId, severity }) => {
+            if (!ignoreGhsas.includes(githubAdvisoryId)) {
+                return true;
+            }
+            ignoredVulnerabilities[severity] += 1;
+            return false;
+        }, auditReport.advisories);
+    }
+    const ignoreCves = opts.auditConfig?.ignoreCves;
+    if (ignoreCves) {
+        auditReport.advisories = pickBy(({ cves, severity }) => {
+            if (cves.length === 0 || difference(cves, ignoreCves).length > 0) {
+                return true;
+            }
+            ignoredVulnerabilities[severity] += 1;
+            return false;
+        }, auditReport.advisories);
+    }
+    const auditLevel = AUDIT_LEVEL_NUMBER[opts.auditLevel ?? 'low'];
+    const advisoryEntries = Object.entries(auditReport.advisories)
+        .filter(([, { severity }]) => AUDIT_LEVEL_NUMBER[severity] >= auditLevel);
+    if (opts.json) {
+        const advisories = Object.fromEntries(advisoryEntries);
+        return {
+            exitCode: Object.keys(advisories).length > 0 ? 1 : 0,
+            output: JSON.stringify({ ...auditReport, advisories }, null, 2),
+        };
+    }
+    let output = '';
+    advisoryEntries.sort(([, a1], [, a2]) => AUDIT_LEVEL_NUMBER[a2.severity] - AUDIT_LEVEL_NUMBER[a1.severity]);
+    for (const [, advisory] of advisoryEntries) {
+        const paths = advisory.findings.map(({ paths }) => paths).flat();
+        output += table([
+            [AUDIT_COLOR[advisory.severity](advisory.severity), chalk.bold(advisory.title)],
+            ['Package', advisory.module_name],
+            ['Vulnerable versions', advisory.vulnerable_versions],
+            ['Patched versions', advisory.patched_versions],
+            [
+                'Paths',
+                (paths.length > MAX_PATHS_COUNT
+                    ? paths
+                        .slice(0, MAX_PATHS_COUNT)
+                        .concat([
+                        `... Found ${paths.length} paths, run \`pnpm why ${advisory.module_name}\` for more information`,
+                    ])
+                    : paths).join('\n\n'),
+            ],
+            ['More info', advisory.url],
+        ], AUDIT_TABLE_OPTIONS);
+    }
+    return {
+        exitCode: output ? 1 : 0,
+        output: `${output}${reportSummary(auditReport.metadata.vulnerabilities, totalVulnerabilityCount, ignoredVulnerabilities)}`,
+    };
+}
+function reportSummary(vulnerabilities, totalVulnerabilityCount, ignoredVulnerabilities) {
+    if (totalVulnerabilityCount === 0)
+        return 'No known vulnerabilities found\n';
+    return `${chalk.red(totalVulnerabilityCount)} vulnerabilities found\nSeverity: ${Object.entries(vulnerabilities)
+        .filter(([_auditLevel, vulnerabilitiesCount]) => vulnerabilitiesCount > 0)
+        .map(([auditLevel, vulnerabilitiesCount]) => AUDIT_COLOR[auditLevel](`${vulnerabilitiesCount} ${auditLevel}${ignoredVulnerabilities[auditLevel] > 0 ? ` (${ignoredVulnerabilities[auditLevel]} ignored)` : ''}`))
+        .join(' | ')}`;
+}
+export function formatFixWithUpdateOutput(result, auditReport) {
+    const output = [];
+    /**
+     * Sort the given array of advisory IDs by severity descending
+     */
+    function sortBySeverity(ids) {
+        return ids.map(id => ({ id, advisory: auditReport.advisories[id] })).sort((a, b) => {
+            const aValue = a.advisory ? AUDIT_LEVEL_NUMBER[a.advisory.severity] : -1;
+            const bValue = b.advisory ? AUDIT_LEVEL_NUMBER[b.advisory.severity] : -1;
+            return bValue - aValue;
+        });
+    }
+    const fixed = sortBySeverity(result.fixed);
+    const remaining = sortBySeverity(result.remaining);
+    const fixedString = fixed.length === 1 ? 'vulnerability was fixed' : 'vulnerabilities were fixed';
+    const remainingString = remaining.length === 1 ? 'vulnerability remains' : 'vulnerabilities remain';
+    output.push(`${chalk.green(fixed.length)} ${fixedString}, ${chalk.red(remaining.length)} ${remainingString}.`);
+    function summarizeAdvisory(fixed, { id, advisory }) {
+        if (advisory) {
+            const color = fixed ? chalk.green : AUDIT_COLOR[advisory.severity];
+            return `- (${color(advisory.severity)}) "${color(advisory.title)}" ${chalk.blue(advisory.module_name)}`;
+        }
+        return `- Advisory with ID ${id} (details not found in the audit report)`;
+    }
+    if (fixed.length > 0) {
+        output.push('\nThe fixed vulnerabilities are:');
+        for (const f of fixed) {
+            output.push(summarizeAdvisory(true, f));
+        }
+    }
+    if (remaining.length > 0) {
+        output.push('\nThe remaining vulnerabilities are:');
+        for (const r of remaining) {
+            output.push(summarizeAdvisory(false, r));
+        }
+    }
+    // Add trailing newline
+    output.push('');
+    return output.join('\n');
+}
+//# sourceMappingURL=audit.js.map

package/lib/audit/fix.d.ts

@@ -0,0 +1,3 @@
+import type { AuditReport } from '@pnpm/deps.compliance.audit';
+import type { AuditOptions } from './audit.js';
+export declare function fix(auditReport: AuditReport, opts: AuditOptions): Promise<Record<string, string>>;

package/lib/audit/fix.js

@@ -0,0 +1,26 @@
+import { writeSettings } from '@pnpm/config.writer';
+import { difference } from 'ramda';
+export async function fix(auditReport, opts) {
+    const vulnOverrides = createOverrides(Object.values(auditReport.advisories), opts.auditConfig?.ignoreCves);
+    if (Object.values(vulnOverrides).length === 0)
+        return vulnOverrides;
+    await writeSettings({
+        updatedOverrides: vulnOverrides,
+        rootProjectManifest: opts.rootProjectManifest,
+        rootProjectManifestDir: opts.rootProjectManifestDir,
+        workspaceDir: opts.workspaceDir ?? opts.rootProjectManifestDir,
+    });
+    return vulnOverrides;
+}
+function createOverrides(advisories, ignoreCves) {
+    if (ignoreCves) {
+        advisories = advisories.filter(({ cves }) => difference(cves, ignoreCves).length > 0);
+    }
+    return Object.fromEntries(advisories
+        .filter(({ vulnerable_versions: vulnerableVersions, patched_versions: patchedVersions }) => vulnerableVersions !== '>=0.0.0' && patchedVersions !== '<0.0.0')
+        .map((advisory) => [
+        `${advisory.module_name}@${advisory.vulnerable_versions}`,
+        advisory.patched_versions,
+    ]));
+}
+//# sourceMappingURL=fix.js.map

package/lib/audit/fixWithUpdate.d.ts

@@ -0,0 +1,13 @@
+import type { AuditReport } from '@pnpm/deps.compliance.audit';
+import type { DependenciesField } from '@pnpm/types';
+import type { AuditOptions } from './audit.js';
+export interface FixWithUpdateResult {
+    fixed: number[];
+    remaining: number[];
+}
+export type FixWithUpdateOptions = AuditOptions & {
+    include?: {
+        [dependenciesField in DependenciesField]: boolean;
+    };
+};
+export declare function fixWithUpdate(auditReport: AuditReport, opts: FixWithUpdateOptions): Promise<FixWithUpdateResult>;

package/lib/audit/fixWithUpdate.js

@@ -0,0 +1,110 @@
+import { WANTED_LOCKFILE } from '@pnpm/constants';
+import { PnpmError } from '@pnpm/error';
+import { update } from '@pnpm/installing.commands';
+import { readWantedLockfile } from '@pnpm/lockfile.fs';
+import semver from 'semver';
+import { lockfileToPackages } from './lockfileToPackages.js';
+export async function fixWithUpdate(auditReport, opts) {
+    const vulnerabilitiesByPackage = new Map();
+    const unfixableVulnerabilities = new Map();
+    for (const advisory of Object.values(auditReport.advisories)) {
+        let packageVulnerabilities = vulnerabilitiesByPackage.get(advisory.module_name);
+        if (!packageVulnerabilities) {
+            packageVulnerabilities = [];
+            vulnerabilitiesByPackage.set(advisory.module_name, packageVulnerabilities);
+        }
+        const severity = advisory.severity;
+        const versionRange = advisory.vulnerable_versions;
+        if (versionRange === '>=0.0.0' || versionRange === '*') {
+            // skip unfixable vulnerabilities
+            let unfixableForPackage = unfixableVulnerabilities.get(advisory.module_name);
+            if (!unfixableForPackage) {
+                unfixableForPackage = new Set();
+                unfixableVulnerabilities.set(advisory.module_name, unfixableForPackage);
+            }
+            unfixableForPackage.add(advisory.id);
+            continue;
+        }
+        packageVulnerabilities.push({
+            vulnerability: {
+                versionRange,
+                severity,
+            },
+            id: advisory.id,
+        });
+    }
+    const packageVulnerabilityAudit = {
+        isVulnerable(packageName, version) {
+            const vulnerabilities = vulnerabilitiesByPackage.get(packageName);
+            if (!vulnerabilities)
+                return false;
+            for (const vulnerabilityWithRange of vulnerabilities) {
+                let { semverRange } = vulnerabilityWithRange;
+                if (!semverRange) {
+                    semverRange = new semver.Range(vulnerabilityWithRange.vulnerability.versionRange);
+                    vulnerabilityWithRange.semverRange = semverRange;
+                }
+                if (semver.satisfies(version, semverRange)) {
+                    return true;
+                }
+            }
+            return false;
+        },
+        getVulnerabilities() {
+            const allVulnerabilities = new Map();
+            for (const [pkgName, vulnerabilities] of vulnerabilitiesByPackage) {
+                allVulnerabilities.set(pkgName, vulnerabilities.map(v => v.vulnerability));
+            }
+            return allVulnerabilities;
+        },
+    };
+    await update.handler({
+        ...opts,
+        packageVulnerabilityAudit,
+    }, []);
+    const lockfileDir = opts.lockfileDir ?? opts.dir;
+    const lockfile = await readWantedLockfile(lockfileDir, { ignoreIncompatible: true });
+    if (lockfile == null) {
+        throw new PnpmError('AUDIT_NO_LOCKFILE', `No ${WANTED_LOCKFILE} found after update: Cannot report fixed vulnerabilities`);
+    }
+    const updatedPackages = lockfileToPackages(lockfile, { include: opts.include });
+    const fixed = [];
+    const remaining = [];
+    for (const [pkgName, vulnerabilities] of vulnerabilitiesByPackage) {
+        const updatedVersions = updatedPackages.get(pkgName);
+        if (!updatedVersions) {
+            fixed.push(...vulnerabilities.map(v => v.id));
+            continue;
+        }
+        for (const vulnerability of vulnerabilities) {
+            let wasFixed = true;
+            for (const updatedVersion of updatedVersions) {
+                let { semverRange } = vulnerability;
+                if (!semverRange) {
+                    semverRange = new semver.Range(vulnerability.vulnerability.versionRange);
+                    vulnerability.semverRange = semverRange;
+                }
+                if (semver.satisfies(updatedVersion, semverRange)) {
+                    wasFixed = false;
+                    break;
+                }
+            }
+            if (wasFixed) {
+                fixed.push(vulnerability.id);
+            }
+            else {
+                remaining.push(vulnerability.id);
+            }
+        }
+    }
+    for (const [pkgName, unfixableIds] of unfixableVulnerabilities) {
+        if (updatedPackages.has(pkgName)) {
+            remaining.push(...unfixableIds);
+        }
+        else {
+            fixed.push(...unfixableIds);
+        }
+    }
+    return { fixed, remaining };
+}
+//# sourceMappingURL=fixWithUpdate.js.map

package/lib/audit/ignore.d.ts

@@ -0,0 +1,13 @@
+import type { AuditReport } from '@pnpm/deps.compliance.audit';
+import type { AuditConfig, ProjectManifest } from '@pnpm/types';
+export interface IgnoreVulnerabilitiesOptions {
+    dir: string;
+    ignore?: string[];
+    ignoreUnfixable: boolean;
+    auditReport: AuditReport;
+    rootProjectManifest?: ProjectManifest;
+    rootProjectManifestDir: string;
+    workspaceDir: string;
+    auditConfig?: AuditConfig;
+}
+export declare function ignore(opts: IgnoreVulnerabilitiesOptions): Promise<string[]>;

package/lib/audit/ignore.js

@@ -0,0 +1,31 @@
+import { writeSettings } from '@pnpm/config.writer';
+import { difference } from 'ramda';
+export async function ignore(opts) {
+    const currentCves = opts?.auditConfig?.ignoreCves ?? [];
+    const currentUniqueCves = new Set(currentCves);
+    const advisoryWthNoResolutions = filterAdvisoriesWithNoResolutions(Object.values(opts.auditReport.advisories));
+    if (opts.ignoreUnfixable) {
+        Object.values(advisoryWthNoResolutions).forEach((advisory) => {
+            advisory.cves.forEach((cve) => currentUniqueCves.add(cve));
+        });
+    }
+    else {
+        opts.ignore?.forEach((cve) => currentUniqueCves.add(cve));
+    }
+    const newIgnoreCves = currentUniqueCves.size > 0 ? Array.from(currentUniqueCves) : undefined;
+    const diffCve = difference(newIgnoreCves ?? [], currentCves);
+    await writeSettings({
+        ...opts,
+        updatedSettings: {
+            auditConfig: {
+                ...opts.auditConfig,
+                ignoreCves: newIgnoreCves,
+            },
+        },
+    });
+    return [...diffCve];
+}
+function filterAdvisoriesWithNoResolutions(advisories) {
+    return advisories.filter(({ patched_versions: patchedVersions }) => patchedVersions === '<0.0.0');
+}
+//# sourceMappingURL=ignore.js.map

package/lib/audit/index.d.ts

@@ -0,0 +1,2 @@
+import * as audit from './audit.js';
+export { audit };

package/lib/audit/index.js

@@ -0,0 +1,3 @@
+import * as audit from './audit.js';
+export { audit };
+//# sourceMappingURL=index.js.map

package/lib/audit/lockfileToPackages.d.ts

@@ -0,0 +1,7 @@
+import type { LockfileObject } from '@pnpm/lockfile.types';
+import type { DependenciesField } from '@pnpm/types';
+export declare function lockfileToPackages(lockfile: LockfileObject, opts: {
+    include?: {
+        [dependenciesField in DependenciesField]: boolean;
+    };
+}): Map<string, Set<string>>;

package/lib/audit/lockfileToPackages.js

@@ -0,0 +1,23 @@
+import { nameVerFromPkgSnapshot } from '@pnpm/lockfile.utils';
+import { lockfileWalkerGroupImporterSteps } from '@pnpm/lockfile.walker';
+export function lockfileToPackages(lockfile, opts) {
+    const importerWalkers = lockfileWalkerGroupImporterSteps(lockfile, Object.keys(lockfile.importers), { include: opts?.include });
+    const packages = new Map();
+    for (const importerWalker of importerWalkers) {
+        addPackages(packages, importerWalker.step);
+    }
+    return packages;
+}
+function addPackages(packages, step) {
+    for (const { depPath, pkgSnapshot, next } of step.dependencies) {
+        const { name, version } = nameVerFromPkgSnapshot(depPath, pkgSnapshot);
+        if (version != null) {
+            if (!packages.has(name)) {
+                packages.set(name, new Set());
+            }
+            packages.get(name).add(version);
+        }
+        addPackages(packages, next());
+    }
+}
+//# sourceMappingURL=lockfileToPackages.js.map

package/lib/index.d.ts

@@ -0,0 +1,3 @@
+export { audit } from './audit/index.js';
+export { licenses } from './licenses/index.js';
+export { sbom } from './sbom/index.js';

package/lib/index.js

@@ -0,0 +1,4 @@
+export { audit } from './audit/index.js';
+export { licenses } from './licenses/index.js';
+export { sbom } from './sbom/index.js';
+//# sourceMappingURL=index.js.map

package/lib/licenses/LicensesCommandResult.d.ts

@@ -0,0 +1,4 @@
+export interface LicensesCommandResult {
+    exitCode: number;
+    output: string;
+}

package/lib/licenses/LicensesCommandResult.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=LicensesCommandResult.js.map

package/lib/licenses/index.d.ts

@@ -0,0 +1,2 @@
+import * as licenses from './licenses.js';
+export { licenses };

package/lib/licenses/index.js

@@ -0,0 +1,3 @@
+import * as licenses from './licenses.js';
+export { licenses };
+//# sourceMappingURL=index.js.map

package/lib/licenses/licenses.d.ts

@@ -0,0 +1,10 @@
+import type { CompletionFunc } from '@pnpm/cli.command';
+import type { LicensesCommandResult } from './LicensesCommandResult.js';
+import { type LicensesCommandOptions } from './licensesList.js';
+export declare function rcOptionsTypes(): Record<string, unknown>;
+export declare const cliOptionsTypes: () => Record<string, unknown>;
+export declare const shorthands: Record<string, string>;
+export declare const commandNames: string[];
+export declare function help(): string;
+export declare const completion: CompletionFunc;
+export declare function handler(opts: LicensesCommandOptions, params?: string[]): Promise<LicensesCommandResult>;

package/lib/licenses/licenses.js

@@ -0,0 +1,85 @@
+import { FILTERING } from '@pnpm/cli.common-cli-options-help';
+import { docsUrl, readDepNameCompletions, } from '@pnpm/cli.utils';
+import { types as allTypes } from '@pnpm/config.reader';
+import { PnpmError } from '@pnpm/error';
+import { pick } from 'ramda';
+import { renderHelp } from 'render-help';
+import { licensesList } from './licensesList.js';
+export function rcOptionsTypes() {
+    return {
+        ...pick(['dev', 'global-dir', 'global', 'json', 'long', 'optional', 'production'], allTypes),
+        compatible: Boolean,
+        table: Boolean,
+    };
+}
+export const cliOptionsTypes = () => ({
+    ...rcOptionsTypes(),
+    recursive: Boolean,
+});
+export const shorthands = {
+    D: '--dev',
+    P: '--production',
+};
+export const commandNames = ['licenses'];
+export function help() {
+    return renderHelp({
+        description: 'Check the licenses of the installed packages.',
+        descriptionLists: [
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'Show more details (such as a link to the repo) are not displayed. \
+To display the details, pass this option.',
+                        name: '--long',
+                    },
+                    {
+                        description: 'Show information in JSON format',
+                        name: '--json',
+                    },
+                    {
+                        description: 'Check only "dependencies" and "optionalDependencies"',
+                        name: '--prod',
+                        shortAlias: '-P',
+                    },
+                    {
+                        description: 'Check only "devDependencies"',
+                        name: '--dev',
+                        shortAlias: '-D',
+                    },
+                    {
+                        description: 'Don\'t check "optionalDependencies"',
+                        name: '--no-optional',
+                    },
+                ],
+            },
+            FILTERING,
+        ],
+        url: docsUrl('licenses'),
+        usages: [
+            'pnpm licenses ls',
+            'pnpm licenses ls --long',
+            'pnpm licenses list',
+            'pnpm licenses list --long',
+        ],
+    });
+}
+export const completion = async (cliOpts) => {
+    return readDepNameCompletions(cliOpts.dir);
+};
+export async function handler(opts, params = []) {
+    if (params.length === 0) {
+        throw new PnpmError('LICENCES_NO_SUBCOMMAND', 'Please specify the subcommand', {
+            hint: help(),
+        });
+    }
+    switch (params[0]) {
+        case 'list':
+        case 'ls':
+            return licensesList(opts);
+        default: {
+            throw new PnpmError('LICENSES_UNKNOWN_SUBCOMMAND', 'This subcommand is not known');
+        }
+    }
+}
+//# sourceMappingURL=licenses.js.map

package/lib/licenses/licensesList.d.ts

@@ -0,0 +1,9 @@
+import type { Config } from '@pnpm/config.reader';
+import type { LicensesCommandResult } from './LicensesCommandResult.js';
+export type LicensesCommandOptions = {
+    compatible?: boolean;
+    long?: boolean;
+    recursive?: boolean;
+    json?: boolean;
+} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'supportedArchitectures' | 'virtualStoreDirMaxLength'> & Partial<Pick<Config, 'userConfig'>>;
+export declare function licensesList(opts: LicensesCommandOptions): Promise<LicensesCommandResult>;

package/lib/licenses/licensesList.js

@@ -0,0 +1,48 @@
+import path from 'node:path';
+import { readProjectManifestOnly } from '@pnpm/cli.utils';
+import { WANTED_LOCKFILE } from '@pnpm/constants';
+import { findDependencyLicenses } from '@pnpm/deps.compliance.license-scanner';
+import { PnpmError } from '@pnpm/error';
+import { getLockfileImporterId, readWantedLockfile } from '@pnpm/lockfile.fs';
+import { getStorePath } from '@pnpm/store.path';
+import { renderLicences } from './outputRenderer.js';
+export async function licensesList(opts) {
+    const lockfile = await readWantedLockfile(opts.lockfileDir ?? opts.dir, {
+        ignoreIncompatible: true,
+    });
+    if (lockfile == null) {
+        throw new PnpmError('LICENSES_NO_LOCKFILE', `No ${WANTED_LOCKFILE} found: Cannot check a project without a lockfile`);
+    }
+    const include = {
+        dependencies: opts.production !== false,
+        devDependencies: opts.dev !== false,
+        optionalDependencies: opts.optional !== false,
+    };
+    const manifest = await readProjectManifestOnly(opts.dir);
+    const includedImporterIds = opts.selectedProjectsGraph
+        ? Object.keys(opts.selectedProjectsGraph)
+            .map((path) => getLockfileImporterId(opts.lockfileDir ?? opts.dir, path))
+        : undefined;
+    const storeDir = await getStorePath({
+        pkgRoot: opts.dir,
+        storePath: opts.storeDir,
+        pnpmHomeDir: opts.pnpmHomeDir,
+    });
+    const licensePackages = await findDependencyLicenses({
+        include,
+        lockfileDir: opts.lockfileDir ?? opts.dir,
+        storeDir,
+        virtualStoreDir: opts.virtualStoreDir ?? path.join(opts.modulesDir ?? 'node_modules', '.pnpm'),
+        virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
+        modulesDir: opts.modulesDir,
+        registries: opts.registries,
+        wantedLockfile: lockfile,
+        manifest,
+        includedImporterIds,
+        supportedArchitectures: opts.supportedArchitectures,
+    });
+    if (licensePackages.length === 0)
+        return { output: 'No licenses in packages found', exitCode: 0 };
+    return renderLicences(licensePackages, opts);
+}
+//# sourceMappingURL=licensesList.js.map

package/lib/licenses/outputRenderer.d.ts

@@ -0,0 +1,14 @@
+import type { LicensePackage } from '@pnpm/deps.compliance.license-scanner';
+import type { LicensesCommandResult } from './LicensesCommandResult.js';
+export declare function renderLicences(licensesMap: LicensePackage[], opts: {
+    long?: boolean;
+    json?: boolean;
+}): LicensesCommandResult;
+export interface LicensePackageJson {
+    name: string;
+    versions: string[];
+    license: string;
+    author?: string;
+    homepage?: string;
+    paths: Array<string | null>;
+}

package/lib/licenses/outputRenderer.js

@@ -0,0 +1,134 @@
+import { TABLE_OPTIONS } from '@pnpm/cli.utils';
+import { table } from '@zkochan/table';
+import chalk from 'chalk';
+import { groupBy, omit, pick, sortWith } from 'ramda';
+import semver from 'semver';
+function sortLicensesPackages(licensePackages) {
+    return sortWith([
+        (o1, o2) => o1.license.localeCompare(o2.license),
+    ], licensePackages);
+}
+function renderPackageName({ belongsTo, name: packageName }) {
+    switch (belongsTo) {
+        case 'devDependencies':
+            return `${packageName} ${chalk.dim('(dev)')}`;
+        case 'optionalDependencies':
+            return `${packageName} ${chalk.dim('(optional)')}`;
+        default:
+            return packageName;
+    }
+}
+function renderPackageLicense({ license }) {
+    const output = license ?? 'Unknown';
+    return output;
+}
+function renderDetails(licensePackage) {
+    const outputs = [];
+    if (licensePackage.author) {
+        outputs.push(licensePackage.author);
+    }
+    if (licensePackage.description) {
+        outputs.push(licensePackage.description);
+    }
+    if (licensePackage.homepage) {
+        outputs.push(licensePackage.homepage);
+    }
+    return outputs.join('\n');
+}
+export function renderLicences(licensesMap, opts) {
+    if (opts.json) {
+        return { output: renderLicensesJson(licensesMap), exitCode: 0 };
+    }
+    return { output: renderLicensesTable(licensesMap, opts), exitCode: 0 };
+}
+function renderLicensesJson(licensePackages) {
+    const data = licensePackages
+        .map((item) => pick(['name', 'version', 'path', 'license', 'author', 'homepage', 'description'], item));
+    const output = {};
+    const groupedByLicense = groupBy((item) => item.license, data);
+    for (const license in groupedByLicense) {
+        const outputList = [];
+        const groupedByName = groupBy((item) => item.name, groupedByLicense[license] ?? []);
+        for (const inputList of Object.values(groupedByName)) {
+            if (inputList == null)
+                continue;
+            inputList.sort((a, b) => semver.compare(a.version, b.version));
+            const versions = inputList.map((item) => item.version);
+            const paths = inputList.map((item) => item.path ?? null);
+            const lastInputItem = inputList.at(-1); // last item is chosen for its latest information
+            const outputItem = {
+                name: lastInputItem.name,
+                versions,
+                paths,
+                ...omit(['name', 'version', 'path'], lastInputItem),
+            };
+            outputList.push(outputItem);
+        }
+        output[license] = outputList;
+    }
+    return JSON.stringify(output, null, 2);
+}
+function renderLicensesTable(licensePackages, opts) {
+    const columnNames = ['Package', 'License'];
+    const columnFns = [renderPackageName, renderPackageLicense];
+    if (opts.long) {
+        columnNames.push('Details');
+        columnFns.push(renderDetails);
+    }
+    // Avoid the overhead of allocating a new array caused by calling `array.map()`
+    for (let i = 0; i < columnNames.length; i++)
+        columnNames[i] = chalk.blueBright(columnNames[i]);
+    const data = [
+        columnNames,
+        ...deduplicateLicensesPackages(sortLicensesPackages(licensePackages))
+            .map((licensePkg) => columnFns.map((fn) => fn(licensePkg))),
+    ];
+    let detailsColumnMaxWidth = 40;
+    let packageColumnMaxWidth = 0;
+    let licenseColumnMaxWidth = 0;
+    if (opts.long) {
+        // Use the package link to determine the width of the details column
+        detailsColumnMaxWidth = licensePackages.reduce((max, pkg) => Math.max(max, pkg.homepage?.length ?? 0), 0);
+        for (let i = 1; i < data.length; i++) {
+            const row = data[i];
+            const detailsLineCount = row[2].split('\n').length;
+            const linesNumber = Math.max(0, detailsLineCount - 1);
+            row[0] += '\n '.repeat(linesNumber); // Add extra spaces to the package column
+            row[1] += '\n '.repeat(linesNumber); // Add extra spaces to the license column
+            packageColumnMaxWidth = Math.max(packageColumnMaxWidth, row[0].length);
+            licenseColumnMaxWidth = Math.max(licenseColumnMaxWidth, row[1].length);
+        }
+        const remainColumnWidth = process.stdout.columns - packageColumnMaxWidth - licenseColumnMaxWidth - 20;
+        if (detailsColumnMaxWidth > remainColumnWidth) {
+            detailsColumnMaxWidth = remainColumnWidth;
+        }
+        detailsColumnMaxWidth = Math.max(detailsColumnMaxWidth, 40);
+    }
+    try {
+        return table(data, {
+            ...TABLE_OPTIONS,
+            columns: {
+                ...TABLE_OPTIONS.columns,
+                2: {
+                    width: detailsColumnMaxWidth,
+                    wrapWord: true,
+                },
+            },
+        });
+    }
+    catch {
+        // Fallback to the default table if the details column width is too large, avoiding the error
+        return table(data, TABLE_OPTIONS);
+    }
+}
+function deduplicateLicensesPackages(licensePackages) {
+    const result = [];
+    const rowEqual = (a, b) => a.name === b.name && a.license === b.license;
+    const hasRow = (row) => result.some((x) => rowEqual(row, x));
+    for (const row of licensePackages.reverse()) { // reverse + unshift to prioritize latest package description
+        if (!hasRow(row))
+            result.unshift(row);
+    }
+    return result;
+}
+//# sourceMappingURL=outputRenderer.js.map

package/lib/sbom/index.d.ts

@@ -0,0 +1,2 @@
+import * as sbom from './sbom.js';
+export { sbom };

package/lib/sbom/index.js

@@ -0,0 +1,3 @@
+import * as sbom from './sbom.js';
+export { sbom };
+//# sourceMappingURL=index.js.map

package/lib/sbom/sbom.d.ts

@@ -0,0 +1,17 @@
+import { type Config } from '@pnpm/config.reader';
+export type SbomCommandOptions = {
+    sbomFormat?: string;
+    sbomType?: string;
+    lockfileOnly?: boolean;
+    sbomAuthors?: string;
+    sbomSupplier?: string;
+} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'virtualStoreDirMaxLength'> & Partial<Pick<Config, 'userConfig'>>;
+export declare function rcOptionsTypes(): Record<string, unknown>;
+export declare const cliOptionsTypes: () => Record<string, unknown>;
+export declare const shorthands: Record<string, string>;
+export declare const commandNames: string[];
+export declare function help(): string;
+export declare function handler(opts: SbomCommandOptions, _params?: string[]): Promise<{
+    output: string;
+    exitCode: number;
+}>;

package/lib/sbom/sbom.js

@@ -0,0 +1,159 @@
+import { FILTERING } from '@pnpm/cli.common-cli-options-help';
+import { packageManager } from '@pnpm/cli.meta';
+import { docsUrl, readProjectManifestOnly } from '@pnpm/cli.utils';
+import { types as allTypes } from '@pnpm/config.reader';
+import { WANTED_LOCKFILE } from '@pnpm/constants';
+import { collectSbomComponents, serializeCycloneDx, serializeSpdx, } from '@pnpm/deps.compliance.sbom';
+import { PnpmError } from '@pnpm/error';
+import { getLockfileImporterId, readWantedLockfile } from '@pnpm/lockfile.fs';
+import { getStorePath } from '@pnpm/store.path';
+import { pick } from 'ramda';
+import { renderHelp } from 'render-help';
+export function rcOptionsTypes() {
+    return pick(['dev', 'global-dir', 'global', 'optional', 'production', 'store-dir'], allTypes);
+}
+export const cliOptionsTypes = () => ({
+    ...rcOptionsTypes(),
+    recursive: Boolean,
+    'sbom-format': String,
+    'sbom-type': String,
+    'sbom-authors': String,
+    'sbom-supplier': String,
+    'lockfile-only': Boolean,
+});
+export const shorthands = {
+    D: '--dev',
+    P: '--production',
+};
+export const commandNames = ['sbom'];
+export function help() {
+    return renderHelp({
+        description: 'Generate a Software Bill of Materials (SBOM) for the project.',
+        descriptionLists: [
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'The SBOM output format (required)',
+                        name: '--sbom-format <cyclonedx|spdx>',
+                    },
+                    {
+                        description: 'The component type for the root package (default: library)',
+                        name: '--sbom-type <library|application>',
+                    },
+                    {
+                        description: 'Only use lockfile data (skip reading from the store)',
+                        name: '--lockfile-only',
+                    },
+                    {
+                        description: 'Comma-separated list of SBOM authors (CycloneDX metadata.authors)',
+                        name: '--sbom-authors <names>',
+                    },
+                    {
+                        description: 'SBOM supplier name (CycloneDX metadata.supplier)',
+                        name: '--sbom-supplier <name>',
+                    },
+                    {
+                        description: 'Only include "dependencies" and "optionalDependencies"',
+                        name: '--prod',
+                        shortAlias: '-P',
+                    },
+                    {
+                        description: 'Only include "devDependencies"',
+                        name: '--dev',
+                        shortAlias: '-D',
+                    },
+                    {
+                        description: 'Don\'t include "optionalDependencies"',
+                        name: '--no-optional',
+                    },
+                ],
+            },
+            FILTERING,
+        ],
+        url: docsUrl('sbom'),
+        usages: [
+            'pnpm sbom --sbom-format cyclonedx',
+            'pnpm sbom --sbom-format spdx',
+            'pnpm sbom --sbom-format cyclonedx --lockfile-only',
+            'pnpm sbom --sbom-format spdx --prod',
+        ],
+    });
+}
+export async function handler(opts, _params = []) {
+    if (!opts.sbomFormat) {
+        throw new PnpmError('SBOM_NO_FORMAT', 'The --sbom-format option is required. Use --sbom-format cyclonedx or --sbom-format spdx.', { hint: help() });
+    }
+    const format = opts.sbomFormat.toLowerCase();
+    if (format !== 'cyclonedx' && format !== 'spdx') {
+        throw new PnpmError('SBOM_INVALID_FORMAT', `Invalid SBOM format "${opts.sbomFormat}". Use "cyclonedx" or "spdx".`);
+    }
+    const sbomType = validateSbomType(opts.sbomType);
+    const lockfile = await readWantedLockfile(opts.lockfileDir ?? opts.dir, {
+        ignoreIncompatible: true,
+    });
+    if (lockfile == null) {
+        throw new PnpmError('SBOM_NO_LOCKFILE', `No ${WANTED_LOCKFILE} found: Cannot generate SBOM without a lockfile`);
+    }
+    const include = {
+        dependencies: opts.production !== false,
+        devDependencies: opts.dev !== false,
+        optionalDependencies: opts.optional !== false,
+    };
+    const manifest = await readProjectManifestOnly(opts.dir);
+    const rootName = manifest.name ?? 'unknown';
+    const rootVersion = manifest.version ?? '0.0.0';
+    const rootLicense = typeof manifest.license === 'string' ? manifest.license : undefined;
+    const rootAuthor = typeof manifest.author === 'string'
+        ? manifest.author
+        : manifest.author?.name;
+    const rootRepository = typeof manifest.repository === 'string'
+        ? manifest.repository
+        : manifest.repository?.url;
+    const includedImporterIds = opts.selectedProjectsGraph
+        ? Object.keys(opts.selectedProjectsGraph)
+            .map((p) => getLockfileImporterId(opts.lockfileDir ?? opts.dir, p))
+        : undefined;
+    let storeDir;
+    if (!opts.lockfileOnly) {
+        storeDir = await getStorePath({
+            pkgRoot: opts.dir,
+            storePath: opts.storeDir,
+            pnpmHomeDir: opts.pnpmHomeDir,
+        });
+    }
+    const result = await collectSbomComponents({
+        lockfile,
+        rootName,
+        rootVersion,
+        rootLicense,
+        rootDescription: manifest.description,
+        rootAuthor,
+        rootRepository,
+        sbomType,
+        include,
+        registries: opts.registries,
+        lockfileDir: opts.lockfileDir ?? opts.dir,
+        includedImporterIds,
+        lockfileOnly: opts.lockfileOnly,
+        storeDir,
+        virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
+    });
+    const output = format === 'cyclonedx'
+        ? serializeCycloneDx(result, {
+            pnpmVersion: packageManager.version,
+            lockfileOnly: opts.lockfileOnly,
+            sbomAuthors: opts.sbomAuthors?.split(',').map((s) => s.trim()).filter(Boolean),
+            sbomSupplier: opts.sbomSupplier,
+        })
+        : serializeSpdx(result);
+    return { output, exitCode: 0 };
+}
+function validateSbomType(value) {
+    if (!value || value === 'library')
+        return 'library';
+    if (value === 'application')
+        return 'application';
+    throw new PnpmError('SBOM_INVALID_TYPE', `Invalid SBOM type "${value}". Use "library" or "application".`);
+}
+//# sourceMappingURL=sbom.js.map

package/package.json

@@ -0,0 +1,85 @@
+{
+  "name": "@pnpm/deps.compliance.commands",
+  "version": "1000.0.0",
+  "description": "pnpm commands for audit, licenses, and sbom",
+  "keywords": [
+    "pnpm",
+    "pnpm11",
+    "audit",
+    "licenses",
+    "sbom"
+  ],
+  "license": "MIT",
+  "funding": "https://opencollective.com/pnpm",
+  "repository": "https://github.com/pnpm/pnpm/tree/main/deps/compliance/commands",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/deps/compliance/commands#readme",
+  "bugs": {
+    "url": "https://github.com/pnpm/pnpm/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib",
+    "!*.map"
+  ],
+  "dependencies": {
+    "@zkochan/table": "^2.0.1",
+    "chalk": "^5.6.0",
+    "memoize": "^10.2.0",
+    "ramda": "npm:@pnpm/ramda@0.28.1",
+    "render-help": "^2.0.0",
+    "semver": "^7.7.2",
+    "@pnpm/cli.command": "1000.0.0",
+    "@pnpm/cli.common-cli-options-help": "1000.0.1",
+    "@pnpm/cli.utils": "1001.2.8",
+    "@pnpm/config.reader": "1004.4.2",
+    "@pnpm/cli.meta": "1000.0.11",
+    "@pnpm/constants": "1001.3.1",
+    "@pnpm/deps.compliance.audit": "1002.0.14",
+    "@pnpm/deps.compliance.license-scanner": "1001.0.27",
+    "@pnpm/deps.compliance.sbom": "1000.0.0-0",
+    "@pnpm/error": "1000.0.5",
+    "@pnpm/installing.commands": "1004.6.10",
+    "@pnpm/lockfile.fs": "1001.1.21",
+    "@pnpm/config.writer": "1000.0.14",
+    "@pnpm/lockfile.utils": "1003.0.3",
+    "@pnpm/lockfile.types": "1002.0.2",
+    "@pnpm/store.path": "1000.0.5",
+    "@pnpm/network.auth-header": "1000.0.6",
+    "@pnpm/types": "1000.9.0",
+    "@pnpm/lockfile.walker": "1001.0.16",
+    "@pnpm/workspace.project-manifest-reader": "1001.1.4"
+  },
+  "devDependencies": {
+    "@pnpm/registry-mock": "5.2.4",
+    "@types/ramda": "0.29.12",
+    "@types/semver": "7.7.1",
+    "@types/zkochan__table": "npm:@types/table@6.0.0",
+    "load-json-file": "^7.0.1",
+    "nock": "13.3.4",
+    "read-yaml-file": "^3.0.0",
+    "tempy": "3.0.0",
+    "@pnpm/deps.compliance.commands": "1000.0.0",
+    "@pnpm/pkg-manifest.reader": "1000.1.2",
+    "@pnpm/workspace.projects-filter": "1000.0.43",
+    "@pnpm/test-fixtures": "1000.0.0",
+    "@pnpm/prepare": "1000.0.4"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "jest": {
+    "preset": "@pnpm/jest-config/with-registry"
+  },
+  "scripts": {
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "_test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
+    "test": "pnpm run compile && pnpm run _test",
+    "compile": "tsgo --build && pnpm run lint --fix",
+    "update-responses": "node test/audit/utils/responses/update.ts"
+  }
+}