@pnpm/deps.compliance.commands 1101.3.5 → 1101.5.0

package/lib/audit/fix.js

@@ -1,3 +1,4 @@
+import { mergePackageVersionSpecs } from '@pnpm/config.version-policy';
 import { writeSettings } from '@pnpm/config.writer';
 import { normalizeGhsaId } from '@pnpm/deps.compliance.audit';
 import { sortDirectKeys } from '@pnpm/object.key-sorting';
@@ -46,16 +47,16 @@ export function caretRangeForPatched(patchedRange) {
     return min ? `^${min.version}` : patchedRange;
 }
 export function createMinimumReleaseAgeExcludes(advisories) {
-    const excludes = new Set();
+    const specs = [];
     for (const advisory of advisories) {
         const patchedVersions = advisory.patched_versions;
         if (!patchedVersions)
             continue;
         const minVersion = semver.minVersion(patchedVersions);
-        if (minVersion) {
-            excludes.add(`${advisory.module_name}@${minVersion.version}`);
-        }
+        if (!minVersion)
+            continue;
+        specs.push(`${advisory.module_name}@${minVersion.version}`);
     }
-    return Array.from(excludes);
+    return mergePackageVersionSpecs(specs);
 }
 //# sourceMappingURL=fix.js.map

package/lib/sbom/sbom.d.ts

@@ -6,11 +6,15 @@ export type SbomCommandOptions = {
     lockfileOnly?: boolean;
     sbomAuthors?: string;
     sbomSupplier?: string;
-} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir'> & Partial<Pick<Config, 'userConfig'>>;
+    out?: string;
+    split?: boolean;
+    excludePeers?: boolean;
+} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'allProjectsGraph' | 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir'> & Partial<Pick<Config, 'userConfig'>>;
 export declare function rcOptionsTypes(): Record<string, unknown>;
 export declare const cliOptionsTypes: () => Record<string, unknown>;
 export declare const shorthands: Record<string, string>;
 export declare const commandNames: string[];
+export declare const recursiveByDefault = true;
 export declare function help(): string;
 export declare function handler(opts: SbomCommandOptions, _params?: string[]): Promise<{
     output: string;

package/lib/sbom/sbom.js

@@ -1,13 +1,18 @@
+import fs from 'node:fs';
+import { realpath } from 'node:fs/promises';
+import path from 'node:path';
 import { FILTERING } from '@pnpm/cli.common-cli-options-help';
 import { packageManager } from '@pnpm/cli.meta';
 import { docsUrl, readProjectManifestOnly } from '@pnpm/cli.utils';
 import { types as allTypes } from '@pnpm/config.reader';
 import { WANTED_LOCKFILE } from '@pnpm/constants';
 import { isSpdxLicenseExpression, resolveLicenseFromDir } from '@pnpm/deps.compliance.license-resolver';
-import { collectSbomComponents, serializeCycloneDx, serializeSpdx, } from '@pnpm/deps.compliance.sbom';
+import { bugsUrlFromField, collectSbomComponents, resolveWorkspaceDeps, serializeCycloneDx, serializeSpdx, } from '@pnpm/deps.compliance.sbom';
 import { PnpmError } from '@pnpm/error';
 import { getLockfileImporterId, readWantedLockfile } from '@pnpm/lockfile.fs';
 import { getStorePath } from '@pnpm/store.path';
+import { safeReadProjectManifestOnly } from '@pnpm/workspace.project-manifest-reader';
+import pLimit from 'p-limit';
 import { pick } from 'ramda';
 import { renderHelp } from 'render-help';
 export function rcOptionsTypes() {
@@ -22,12 +27,16 @@ export const cliOptionsTypes = () => ({
     'sbom-authors': String,
     'sbom-supplier': String,
     'lockfile-only': Boolean,
+    out: String,
+    split: Boolean,
+    'exclude-peers': Boolean,
 });
 export const shorthands = {
     D: '--dev',
     P: '--production',
 };
 export const commandNames = ['sbom'];
+export const recursiveByDefault = true;
 export function help() {
     return renderHelp({
         description: 'Generate a Software Bill of Materials (SBOM) for the project.',
@@ -73,6 +82,18 @@ export function help() {
                         description: 'Don\'t include "optionalDependencies"',
                         name: '--no-optional',
                     },
+                    {
+                        description: 'Write SBOM to a file instead of stdout. Use %s for the package name and %v for the version.',
+                        name: '--out <path>',
+                    },
+                    {
+                        description: 'Generate a separate SBOM for each matched workspace package. Outputs NDJSON to stdout, or files when combined with --out.',
+                        name: '--split',
+                    },
+                    {
+                        description: 'Exclude peer dependencies (and their exclusive transitive subtrees)',
+                        name: '--exclude-peers',
+                    },
                 ],
             },
             FILTERING,
@@ -83,6 +104,9 @@ export function help() {
             'pnpm sbom --sbom-format spdx',
             'pnpm sbom --sbom-format cyclonedx --lockfile-only',
             'pnpm sbom --sbom-format spdx --prod',
+            'pnpm sbom --sbom-format cyclonedx --filter ./apps/my-app',
+            'pnpm sbom --sbom-format cyclonedx --out out/%s.cdx.json',
+            'pnpm sbom --sbom-format cyclonedx --split',
         ],
     });
 }
@@ -96,73 +120,260 @@ export async function handler(opts, _params = []) {
     }
     const sbomType = validateSbomType(opts.sbomType);
     const sbomSpecVersion = validateSbomSpecVersion(opts.sbomSpecVersion, format);
+    const ctx = await buildSharedContext(opts);
+    const serialOpts = { format, sbomType, sbomSpecVersion };
+    // `%s` in --out only implies per-package output inside a workspace; in a
+    // single-project repo it is interpolated from the root component on the
+    // single-output path below.
+    const hasWorkspaceGraph = opts.selectedProjectsGraph != null || opts.allProjectsGraph != null;
+    const shouldSplit = opts.split || (opts.out != null && opts.out.includes('%s') && hasWorkspaceGraph);
+    if (shouldSplit) {
+        return handleSplit(opts, serialOpts, ctx);
+    }
+    const { output, rootName, rootVersion } = await generateSbomForProject(opts, serialOpts, ctx);
+    if (opts.out) {
+        const filePath = opts.out
+            .replaceAll('%s', sanitizePathSegment(sanitizePackageName(rootName)))
+            .replaceAll('%v', sanitizePathSegment(rootVersion));
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, output);
+        return { output: filePath, exitCode: 0 };
+    }
+    return { output, exitCode: 0 };
+}
+async function handleSplit(opts, serialOpts, ctx) {
+    const projectsGraph = opts.selectedProjectsGraph ?? opts.allProjectsGraph;
+    if (!projectsGraph) {
+        throw new PnpmError('SBOM_NO_PROJECTS', 'No workspace projects found. --split requires a workspace.');
+    }
+    if (opts.out && !opts.out.includes('%s')) {
+        throw new PnpmError('SBOM_OUT_MISSING_PLACEHOLDER', 'When using --split with --out, the path must contain %s as a placeholder for the package name.');
+    }
+    const entries = Object.entries(projectsGraph);
+    const ndjsonLines = [];
+    const files = [];
+    const writtenPaths = new Set();
+    const compact = !opts.out;
+    const createdDirs = new Set();
+    for (const [dir, entry] of entries) {
+        const manifest = entry.package.manifest;
+        if (!manifest.name)
+            continue;
+        const singleProjectGraph = { [dir]: entry };
+        // eslint-disable-next-line no-await-in-loop
+        const { output } = await generateSbomForProject({ ...opts, selectedProjectsGraph: singleProjectGraph, allProjectsGraph: undefined, split: false, out: undefined }, serialOpts, ctx, compact);
+        if (opts.out) {
+            const filePath = opts.out
+                .replaceAll('%s', sanitizePathSegment(sanitizePackageName(manifest.name)))
+                .replaceAll('%v', sanitizePathSegment(manifest.version ?? '0.0.0'));
+            // Sanitizing package names is lossy (e.g. "@a/b" and "a-b" both map to "a-b"),
+            // so two packages can resolve to the same path. Fail loudly instead of letting
+            // one SBOM silently overwrite another.
+            if (writtenPaths.has(filePath)) {
+                throw new PnpmError('SBOM_OUT_PATH_COLLISION', `Multiple workspace packages resolve to the same output path "${filePath}". Include %v in the --out pattern to disambiguate.`);
+            }
+            writtenPaths.add(filePath);
+            const fileDir = path.dirname(filePath);
+            if (!createdDirs.has(fileDir)) {
+                fs.mkdirSync(fileDir, { recursive: true });
+                createdDirs.add(fileDir);
+            }
+            fs.writeFileSync(filePath, output);
+            files.push(filePath);
+        }
+        else {
+            ndjsonLines.push(output);
+        }
+    }
+    if (opts.out) {
+        return {
+            output: `Generated ${files.length} SBOMs:\n${files.map((f) => `  ${f}`).join('\n')}`,
+            exitCode: 0,
+        };
+    }
+    return { output: ndjsonLines.join('\n'), exitCode: 0 };
+}
+async function buildSharedContext(opts) {
     const lockfile = await readWantedLockfile(opts.lockfileDir ?? opts.dir, {
         ignoreIncompatible: true,
     });
     if (lockfile == null) {
         throw new PnpmError('SBOM_NO_LOCKFILE', `No ${WANTED_LOCKFILE} found: Cannot generate SBOM without a lockfile`);
     }
+    const rootManifestDir = opts.rootProjectManifestDir ?? opts.dir;
+    const rootManifest = opts.rootProjectManifest ?? await readProjectManifestOnly(rootManifestDir);
+    const lockfileDir = opts.lockfileDir ?? opts.dir;
+    // peerDependencies are identified from the manifest, not the lockfile: with
+    // auto-install-peers they resolve into the importer's `dependencies` with no
+    // distinguishing marker. Map every walked importer to its peer names so the
+    // collector can drop them.
+    // Keyed by a Map, not a plain object: importer ids come from the lockfile
+    // (attacker-controlled in an untrusted clone), and a key like `__proto__`
+    // would corrupt a plain object's prototype.
+    let excludePeerNamesByImporter;
+    if (opts.excludePeers) {
+        const byImporter = new Map();
+        // Prefer the in-memory project graph(s): no extra filesystem reads, and
+        // reading from both graphs (not only the selected subset) covers the extra
+        // workspace packages collectSbomComponents reaches through `link:` deps, so
+        // their peers are filtered too in a filtered run.
+        const graphs = [opts.allProjectsGraph, opts.selectedProjectsGraph].filter(Boolean);
+        if (graphs.length > 0) {
+            for (const graph of graphs) {
+                for (const [projectDir, { package: project }] of Object.entries(graph)) {
+                    byImporter.set(getLockfileImporterId(lockfileDir, projectDir), peerNamesFromManifest(project.manifest));
+                }
+            }
+        }
+        else {
+            // No project graph (e.g. a single-package repo or `--lockfile-only`
+            // outside a workspace), so collectSbomComponents walks every importer in
+            // the lockfile. Resolve each importer's own manifest from disk so peers in
+            // workspace packages are dropped too, not only those in the directory pnpm
+            // ran in. safeReadProjectManifestOnly returns null (rather than throwing)
+            // for an importer whose manifest is gone (e.g. a stale lockfile), and skips
+            // the installability check that would otherwise abort the SBOM.
+            const lockfileRoot = await realpath(lockfileDir);
+            // Bound the fan-out: a large workspace can have many importers, and
+            // reading every manifest at once would spike open file descriptors.
+            const limitManifestReads = pLimit(16);
+            await Promise.all(Object.keys(lockfile.importers).map((importerId) => limitManifestReads(async () => {
+                // A crafted lockfile could carry an importer key that escapes the
+                // project, via `..` segments or a symlinked directory. Canonicalize
+                // with realpath and skip anything resolving outside the project root,
+                // so a manifest is never read from outside the tree.
+                let importerDir;
+                try {
+                    importerDir = await realpath(path.resolve(lockfileDir, importerId));
+                }
+                catch {
+                    return;
+                }
+                const rel = path.relative(lockfileRoot, importerDir);
+                if (rel !== '' && (rel.startsWith('..') || path.isAbsolute(rel)))
+                    return;
+                // safeReadProjectManifestOnly tolerates a missing manifest but still
+                // throws on a malformed one (parse error). In an untrusted clone a
+                // single junk package.json must not abort the whole SBOM, so skip it
+                // (fail-open: an unparseable importer's peers just aren't filtered).
+                let importerManifest;
+                try {
+                    importerManifest = await safeReadProjectManifestOnly(importerDir);
+                }
+                catch {
+                    return;
+                }
+                if (importerManifest) {
+                    byImporter.set(importerId, peerNamesFromManifest(importerManifest));
+                }
+            })));
+        }
+        excludePeerNamesByImporter = byImporter;
+    }
+    let storeDir;
+    if (!opts.lockfileOnly) {
+        storeDir = await getStorePath({
+            pkgRoot: opts.dir,
+            storePath: opts.storeDir,
+            pnpmHomeDir: opts.pnpmHomeDir,
+        });
+    }
+    const workspaceManifestsByImporterId = new Map();
+    for (const graph of [opts.allProjectsGraph, opts.selectedProjectsGraph]) {
+        if (!graph)
+            continue;
+        for (const [dir, entry] of Object.entries(graph)) {
+            workspaceManifestsByImporterId.set(getLockfileImporterId(lockfileDir, dir), entry.package.manifest);
+        }
+    }
+    const rootLicense = await resolveRootLicense(rootManifest, rootManifestDir);
+    return { lockfile, rootManifest, rootManifestDir, rootLicense, storeDir, workspaceManifestsByImporterId, excludePeerNamesByImporter };
+}
+async function generateSbomForProject(opts, serialOpts, ctx, compact) {
+    const { lockfile, rootManifest, rootManifestDir, rootLicense: cachedRootLicense } = ctx;
     const include = {
         dependencies: opts.production !== false,
         devDependencies: opts.dev !== false,
         optionalDependencies: opts.optional !== false,
     };
-    const manifest = await readProjectManifestOnly(opts.dir);
+    const selectedEntries = opts.selectedProjectsGraph
+        ? Object.entries(opts.selectedProjectsGraph)
+        : undefined;
+    const singleProject = selectedEntries?.length === 1
+        ? selectedEntries[0]
+        : undefined;
+    const manifest = singleProject
+        ? singleProject[1].package.manifest
+        : rootManifest;
+    const projectDir = singleProject
+        ? singleProject[0]
+        : rootManifestDir;
     const rootName = manifest.name ?? 'unknown';
     const rootVersion = manifest.version ?? '0.0.0';
-    // Keep the root in sync with transitive deps: consult manifest `license` /
-    // legacy `licenses` first, then fall back to an on-disk LICENSE file. Drop
-    // file-scanned values that aren't SPDX-valid to avoid non-compliant output.
-    const rootLicenseInfo = await resolveLicenseFromDir({ manifest, dir: opts.dir });
-    const rootLicense = rootLicenseInfo && rootLicenseInfo.name !== 'Unknown' &&
-        (!rootLicenseInfo.licenseFile || isSpdxLicenseExpression(rootLicenseInfo.name))
-        ? rootLicenseInfo.name
-        : undefined;
-    const rootAuthor = typeof manifest.author === 'string'
-        ? manifest.author
-        : manifest.author?.name;
-    const rootRepository = typeof manifest.repository === 'string'
-        ? manifest.repository
-        : manifest.repository?.url;
+    const rootLicense = singleProject
+        ? (await resolveRootLicense(manifest, projectDir) ?? cachedRootLicense)
+        : cachedRootLicense;
+    const rootAuthor = extractAuthor(manifest)
+        ?? (singleProject ? extractAuthor(rootManifest) : undefined);
+    const rootRepository = extractRepository(manifest)
+        ?? (singleProject ? extractRepository(rootManifest) : undefined);
+    const rootDescription = manifest.description
+        ?? (singleProject ? rootManifest.description : undefined);
+    const rootBugsUrl = bugsUrlFromField(manifest.bugs)
+        ?? (singleProject ? bugsUrlFromField(rootManifest.bugs) : undefined);
+    const lockfileDir = opts.lockfileDir ?? opts.dir;
     const includedImporterIds = opts.selectedProjectsGraph
         ? Object.keys(opts.selectedProjectsGraph)
-            .map((p) => getLockfileImporterId(opts.lockfileDir ?? opts.dir, p))
+            .map((p) => getLockfileImporterId(lockfileDir, p))
+        : undefined;
+    const resolvedWorkspaceDeps = opts.lockfileOnly
+        ? undefined
+        : resolveWorkspaceDeps(lockfile, includedImporterIds ?? Object.keys(lockfile.importers), include);
+    const workspacePackages = resolvedWorkspaceDeps
+        ? await buildWorkspacePackagesMap(resolvedWorkspaceDeps.additionalImporterIds, lockfileDir, ctx.workspaceManifestsByImporterId)
         : undefined;
-    let storeDir;
-    if (!opts.lockfileOnly) {
-        storeDir = await getStorePath({
-            pkgRoot: opts.dir,
-            storePath: opts.storeDir,
-            pnpmHomeDir: opts.pnpmHomeDir,
-        });
-    }
     const result = await collectSbomComponents({
         lockfile,
         rootName,
         rootVersion,
         rootLicense,
-        rootDescription: manifest.description,
+        rootDescription,
         rootAuthor,
         rootRepository,
-        sbomType,
+        rootBugsUrl,
+        sbomType: serialOpts.sbomType,
         include,
         registries: opts.registries,
-        lockfileDir: opts.lockfileDir ?? opts.dir,
+        lockfileDir,
         includedImporterIds,
         lockfileOnly: opts.lockfileOnly,
-        storeDir,
+        storeDir: ctx.storeDir,
         virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
+        workspacePackages,
+        resolvedWorkspaceDeps,
+        excludePeerNamesByImporter: ctx.excludePeerNamesByImporter,
     });
-    const output = format === 'cyclonedx'
+    const output = serialOpts.format === 'cyclonedx'
         ? serializeCycloneDx(result, {
             pnpmVersion: packageManager.version,
             lockfileOnly: opts.lockfileOnly,
             sbomAuthors: opts.sbomAuthors?.split(',').map((s) => s.trim()).filter(Boolean),
             sbomSupplier: opts.sbomSupplier,
-            specVersion: sbomSpecVersion,
+            specVersion: serialOpts.sbomSpecVersion,
+            compact,
         })
-        : serializeSpdx(result);
-    return { output, exitCode: 0 };
+        : serializeSpdx(result, { compact });
+    return { output, exitCode: 0, rootName, rootVersion };
+}
+function peerNamesFromManifest(manifest) {
+    // A name declared as both a peer and a regular dependency is a real dependency
+    // the package pulls in itself, so keep it.
+    const regular = new Set([
+        ...Object.keys(manifest.dependencies ?? {}),
+        ...Object.keys(manifest.devDependencies ?? {}),
+        ...Object.keys(manifest.optionalDependencies ?? {}),
+    ]);
+    return new Set(Object.keys(manifest.peerDependencies ?? {}).filter((name) => !regular.has(name)));
 }
 function validateSbomType(value) {
     if (!value || value === 'library')
@@ -171,8 +382,6 @@ function validateSbomType(value) {
         return 'application';
     throw new PnpmError('SBOM_INVALID_TYPE', `Invalid SBOM type "${value}". Use "library" or "application".`);
 }
-// Versions whose schema is fully covered by what we currently emit
-// (e.g. metadata.lifecycles requires CycloneDX 1.5+).
 const SUPPORTED_CYCLONEDX_SPEC_VERSIONS = ['1.5', '1.6', '1.7'];
 function validateSbomSpecVersion(value, format) {
     if (value == null)
@@ -186,4 +395,76 @@ function validateSbomSpecVersion(value, format) {
     }
     return normalized;
 }
+async function resolveRootLicense(manifest, dir) {
+    // Skip the on-disk LICENSE probing when the manifest already declares a usable
+    // SPDX license; resolveLicenseFromDir would return the same value after the scan.
+    if (typeof manifest.license === 'string' && isSpdxLicenseExpression(manifest.license)) {
+        return manifest.license;
+    }
+    const info = await resolveLicenseFromDir({ manifest, dir });
+    if (info && info.name !== 'Unknown' && (!info.licenseFile || isSpdxLicenseExpression(info.name))) {
+        return info.name;
+    }
+    return undefined;
+}
+function extractAuthor(manifest) {
+    if (typeof manifest.author === 'string')
+        return manifest.author;
+    return manifest.author?.name;
+}
+function extractRepository(manifest) {
+    if (typeof manifest.repository === 'string')
+        return manifest.repository;
+    return manifest.repository?.url;
+}
+const WORKSPACE_MANIFEST_READ_CONCURRENCY = 8;
+async function buildWorkspacePackagesMap(reachableImporterIds, lockfileDir, manifestsByImporterId) {
+    if (reachableImporterIds.length === 0)
+        return {};
+    const readManifest = pLimit(WORKSPACE_MANIFEST_READ_CONCURRENCY);
+    const entries = await Promise.all(reachableImporterIds.map((importerId) => readManifest(async () => {
+        const known = manifestsByImporterId.get(importerId);
+        const manifest = known
+            ? known
+            : isInsideDir(lockfileDir, importerId)
+                ? await readManifestSafe(path.join(lockfileDir, importerId))
+                : undefined;
+        if (!manifest?.name)
+            return null;
+        return [importerId, {
+                name: manifest.name,
+                version: manifest.version ?? '0.0.0',
+                license: typeof manifest.license === 'string' ? manifest.license : undefined,
+                description: manifest.description,
+                author: extractAuthor(manifest),
+                repository: extractRepository(manifest),
+            }];
+    })));
+    return Object.fromEntries(entries.filter((e) => e !== null));
+}
+async function readManifestSafe(dir) {
+    try {
+        return await readProjectManifestOnly(dir);
+    }
+    catch {
+        return undefined;
+    }
+}
+function sanitizePackageName(name) {
+    return name.replace(/^@/, '').replace(/\//g, '-');
+}
+function sanitizePathSegment(value) {
+    // Control characters (e.g. newlines) would produce confusing filenames and could
+    // inject extra lines into the printed `--split --out` summary; filesystem
+    // metacharacters are replaced so the value stays a single path segment.
+    // eslint-disable-next-line no-control-regex
+    const sanitized = value.replace(/[/\\:*?"<>|\x00-\x1F\x7F]/g, '-');
+    // `.`, `..`, or a blank value would let a crafted name/version escape or replace
+    // the intended output directory once interpolated into an `--out` template.
+    return sanitized === '.' || sanitized === '..' || sanitized.trim() === '' ? '-' : sanitized;
+}
+function isInsideDir(parentDir, childRelativePath) {
+    const rel = path.relative(parentDir, path.resolve(parentDir, childRelativePath));
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
 //# sourceMappingURL=sbom.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.commands",
-  "version": "1101.3.5",
+  "version": "1101.5.0",
   "description": "pnpm commands for audit, licenses, and sbom",
   "keywords": [
     "pnpm",
@@ -13,9 +13,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/deps/compliance/commands"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/deps/compliance/commands"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/deps/compliance/commands#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/deps/compliance/commands#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -34,33 +34,35 @@
     "@zkochan/table": "^2.0.1",
     "chalk": "^5.6.2",
     "memoize": "^11.0.0",
+    "p-limit": "^7.3.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "semver": "^7.8.4",
-    "@pnpm/cli.common-cli-options-help": "1100.0.2",
-    "@pnpm/cli.utils": "1101.0.12",
+    "@pnpm/cli.utils": "1101.0.13",
     "@pnpm/cli.meta": "1100.0.8",
-    "@pnpm/config.writer": "1100.0.13",
-    "@pnpm/constants": "1100.0.0",
+    "@pnpm/config.reader": "1101.10.1",
     "@pnpm/config.pick-registry-for-package": "1100.0.9",
-    "@pnpm/deps.compliance.audit": "1101.0.16",
-    "@pnpm/deps.compliance.license-scanner": "1100.0.19",
+    "@pnpm/config.writer": "1100.0.14",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/deps.compliance.audit": "1101.0.18",
     "@pnpm/deps.compliance.license-resolver": "1100.0.0",
-    "@pnpm/deps.security.signatures": "1101.2.2",
-    "@pnpm/deps.compliance.sbom": "1100.1.9",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/cli.command": "1100.0.1",
-    "@pnpm/installing.commands": "1100.9.0",
-    "@pnpm/lockfile.utils": "1100.0.13",
-    "@pnpm/lockfile.walker": "1100.0.11",
-    "@pnpm/config.reader": "1101.9.0",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
-    "@pnpm/types": "1101.3.2",
-    "@pnpm/network.auth-header": "1101.1.2",
-    "@pnpm/store.path": "1100.0.1",
+    "@pnpm/deps.compliance.license-scanner": "1100.0.21",
+    "@pnpm/config.version-policy": "1100.1.6",
+    "@pnpm/deps.compliance.sbom": "1100.3.0",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/lockfile.types": "1100.0.12",
+    "@pnpm/lockfile.utils": "1100.1.0",
+    "@pnpm/lockfile.walker": "1100.0.12",
+    "@pnpm/deps.security.signatures": "1101.2.3",
+    "@pnpm/lockfile.fs": "1100.1.7",
+    "@pnpm/installing.commands": "1100.10.1",
     "@pnpm/object.key-sorting": "1100.0.1",
-    "@pnpm/lockfile.types": "1100.0.11",
-    "@pnpm/lockfile.fs": "1100.1.5"
+    "@pnpm/store.path": "1100.0.2",
+    "@pnpm/network.auth-header": "1101.1.3",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.14",
+    "@pnpm/cli.common-cli-options-help": "1100.0.2",
+    "@pnpm/cli.command": "1100.0.1"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
@@ -73,15 +75,15 @@
     "load-json-file": "^7.0.1",
     "read-yaml-file": "^3.0.0",
     "tempy": "3.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.8",
-    "@pnpm/deps.compliance.commands": "1101.3.5",
-    "@pnpm/testing.mock-agent": "1101.0.3",
+    "@pnpm/deps.compliance.commands": "1101.5.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.9",
+    "@pnpm/prepare": "1100.0.17",
+    "@pnpm/testing.mock-agent": "1101.0.4",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/prepare": "1100.0.16",
-    "@pnpm/testing.registry-mock": "1100.0.6",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/workspace.projects-filter": "1100.0.21",
-    "@pnpm/testing.command-defaults": "1100.0.6"
+    "@pnpm/workspace.projects-filter": "1100.0.23",
+    "@pnpm/testing.registry-mock": "1100.0.7",
+    "@pnpm/testing.command-defaults": "1100.0.7",
+    "@pnpm/logger": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"