@pnpm/deps.compliance.commands 1101.4.0 → 1101.5.0

package/lib/audit/fix.js

@@ -1,3 +1,4 @@
+import { mergePackageVersionSpecs } from '@pnpm/config.version-policy';
 import { writeSettings } from '@pnpm/config.writer';
 import { normalizeGhsaId } from '@pnpm/deps.compliance.audit';
 import { sortDirectKeys } from '@pnpm/object.key-sorting';
@@ -46,16 +47,16 @@ export function caretRangeForPatched(patchedRange) {
     return min ? `^${min.version}` : patchedRange;
 }
 export function createMinimumReleaseAgeExcludes(advisories) {
-    const excludes = new Set();
+    const specs = [];
     for (const advisory of advisories) {
         const patchedVersions = advisory.patched_versions;
         if (!patchedVersions)
             continue;
         const minVersion = semver.minVersion(patchedVersions);
-        if (minVersion) {
-            excludes.add(`${advisory.module_name}@${minVersion.version}`);
-        }
+        if (!minVersion)
+            continue;
+        specs.push(`${advisory.module_name}@${minVersion.version}`);
     }
-    return Array.from(excludes);
+    return mergePackageVersionSpecs(specs);
 }
 //# sourceMappingURL=fix.js.map

package/lib/sbom/sbom.d.ts

@@ -8,6 +8,7 @@ export type SbomCommandOptions = {
     sbomSupplier?: string;
     out?: string;
     split?: boolean;
+    excludePeers?: boolean;
 } & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'allProjectsGraph' | 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir'> & Partial<Pick<Config, 'userConfig'>>;
 export declare function rcOptionsTypes(): Record<string, unknown>;
 export declare const cliOptionsTypes: () => Record<string, unknown>;

package/lib/sbom/sbom.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import { realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { FILTERING } from '@pnpm/cli.common-cli-options-help';
 import { packageManager } from '@pnpm/cli.meta';
@@ -6,10 +7,11 @@ import { docsUrl, readProjectManifestOnly } from '@pnpm/cli.utils';
 import { types as allTypes } from '@pnpm/config.reader';
 import { WANTED_LOCKFILE } from '@pnpm/constants';
 import { isSpdxLicenseExpression, resolveLicenseFromDir } from '@pnpm/deps.compliance.license-resolver';
-import { collectSbomComponents, resolveWorkspaceDeps, serializeCycloneDx, serializeSpdx, } from '@pnpm/deps.compliance.sbom';
+import { bugsUrlFromField, collectSbomComponents, resolveWorkspaceDeps, serializeCycloneDx, serializeSpdx, } from '@pnpm/deps.compliance.sbom';
 import { PnpmError } from '@pnpm/error';
 import { getLockfileImporterId, readWantedLockfile } from '@pnpm/lockfile.fs';
 import { getStorePath } from '@pnpm/store.path';
+import { safeReadProjectManifestOnly } from '@pnpm/workspace.project-manifest-reader';
 import pLimit from 'p-limit';
 import { pick } from 'ramda';
 import { renderHelp } from 'render-help';
@@ -27,6 +29,7 @@ export const cliOptionsTypes = () => ({
     'lockfile-only': Boolean,
     out: String,
     split: Boolean,
+    'exclude-peers': Boolean,
 });
 export const shorthands = {
     D: '--dev',
@@ -87,6 +90,10 @@ export function help() {
                         description: 'Generate a separate SBOM for each matched workspace package. Outputs NDJSON to stdout, or files when combined with --out.',
                         name: '--split',
                     },
+                    {
+                        description: 'Exclude peer dependencies (and their exclusive transitive subtrees)',
+                        name: '--exclude-peers',
+                    },
                 ],
             },
             FILTERING,
@@ -195,6 +202,74 @@ async function buildSharedContext(opts) {
     }
     const rootManifestDir = opts.rootProjectManifestDir ?? opts.dir;
     const rootManifest = opts.rootProjectManifest ?? await readProjectManifestOnly(rootManifestDir);
+    const lockfileDir = opts.lockfileDir ?? opts.dir;
+    // peerDependencies are identified from the manifest, not the lockfile: with
+    // auto-install-peers they resolve into the importer's `dependencies` with no
+    // distinguishing marker. Map every walked importer to its peer names so the
+    // collector can drop them.
+    // Keyed by a Map, not a plain object: importer ids come from the lockfile
+    // (attacker-controlled in an untrusted clone), and a key like `__proto__`
+    // would corrupt a plain object's prototype.
+    let excludePeerNamesByImporter;
+    if (opts.excludePeers) {
+        const byImporter = new Map();
+        // Prefer the in-memory project graph(s): no extra filesystem reads, and
+        // reading from both graphs (not only the selected subset) covers the extra
+        // workspace packages collectSbomComponents reaches through `link:` deps, so
+        // their peers are filtered too in a filtered run.
+        const graphs = [opts.allProjectsGraph, opts.selectedProjectsGraph].filter(Boolean);
+        if (graphs.length > 0) {
+            for (const graph of graphs) {
+                for (const [projectDir, { package: project }] of Object.entries(graph)) {
+                    byImporter.set(getLockfileImporterId(lockfileDir, projectDir), peerNamesFromManifest(project.manifest));
+                }
+            }
+        }
+        else {
+            // No project graph (e.g. a single-package repo or `--lockfile-only`
+            // outside a workspace), so collectSbomComponents walks every importer in
+            // the lockfile. Resolve each importer's own manifest from disk so peers in
+            // workspace packages are dropped too, not only those in the directory pnpm
+            // ran in. safeReadProjectManifestOnly returns null (rather than throwing)
+            // for an importer whose manifest is gone (e.g. a stale lockfile), and skips
+            // the installability check that would otherwise abort the SBOM.
+            const lockfileRoot = await realpath(lockfileDir);
+            // Bound the fan-out: a large workspace can have many importers, and
+            // reading every manifest at once would spike open file descriptors.
+            const limitManifestReads = pLimit(16);
+            await Promise.all(Object.keys(lockfile.importers).map((importerId) => limitManifestReads(async () => {
+                // A crafted lockfile could carry an importer key that escapes the
+                // project, via `..` segments or a symlinked directory. Canonicalize
+                // with realpath and skip anything resolving outside the project root,
+                // so a manifest is never read from outside the tree.
+                let importerDir;
+                try {
+                    importerDir = await realpath(path.resolve(lockfileDir, importerId));
+                }
+                catch {
+                    return;
+                }
+                const rel = path.relative(lockfileRoot, importerDir);
+                if (rel !== '' && (rel.startsWith('..') || path.isAbsolute(rel)))
+                    return;
+                // safeReadProjectManifestOnly tolerates a missing manifest but still
+                // throws on a malformed one (parse error). In an untrusted clone a
+                // single junk package.json must not abort the whole SBOM, so skip it
+                // (fail-open: an unparseable importer's peers just aren't filtered).
+                let importerManifest;
+                try {
+                    importerManifest = await safeReadProjectManifestOnly(importerDir);
+                }
+                catch {
+                    return;
+                }
+                if (importerManifest) {
+                    byImporter.set(importerId, peerNamesFromManifest(importerManifest));
+                }
+            })));
+        }
+        excludePeerNamesByImporter = byImporter;
+    }
     let storeDir;
     if (!opts.lockfileOnly) {
         storeDir = await getStorePath({
@@ -203,7 +278,6 @@ async function buildSharedContext(opts) {
             pnpmHomeDir: opts.pnpmHomeDir,
         });
     }
-    const lockfileDir = opts.lockfileDir ?? opts.dir;
     const workspaceManifestsByImporterId = new Map();
     for (const graph of [opts.allProjectsGraph, opts.selectedProjectsGraph]) {
         if (!graph)
@@ -213,7 +287,7 @@ async function buildSharedContext(opts) {
         }
     }
     const rootLicense = await resolveRootLicense(rootManifest, rootManifestDir);
-    return { lockfile, rootManifest, rootManifestDir, rootLicense, storeDir, workspaceManifestsByImporterId };
+    return { lockfile, rootManifest, rootManifestDir, rootLicense, storeDir, workspaceManifestsByImporterId, excludePeerNamesByImporter };
 }
 async function generateSbomForProject(opts, serialOpts, ctx, compact) {
     const { lockfile, rootManifest, rootManifestDir, rootLicense: cachedRootLicense } = ctx;
@@ -245,6 +319,8 @@ async function generateSbomForProject(opts, serialOpts, ctx, compact) {
         ?? (singleProject ? extractRepository(rootManifest) : undefined);
     const rootDescription = manifest.description
         ?? (singleProject ? rootManifest.description : undefined);
+    const rootBugsUrl = bugsUrlFromField(manifest.bugs)
+        ?? (singleProject ? bugsUrlFromField(rootManifest.bugs) : undefined);
     const lockfileDir = opts.lockfileDir ?? opts.dir;
     const includedImporterIds = opts.selectedProjectsGraph
         ? Object.keys(opts.selectedProjectsGraph)
@@ -264,6 +340,7 @@ async function generateSbomForProject(opts, serialOpts, ctx, compact) {
         rootDescription,
         rootAuthor,
         rootRepository,
+        rootBugsUrl,
         sbomType: serialOpts.sbomType,
         include,
         registries: opts.registries,
@@ -274,6 +351,7 @@ async function generateSbomForProject(opts, serialOpts, ctx, compact) {
         virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
         workspacePackages,
         resolvedWorkspaceDeps,
+        excludePeerNamesByImporter: ctx.excludePeerNamesByImporter,
     });
     const output = serialOpts.format === 'cyclonedx'
         ? serializeCycloneDx(result, {
@@ -287,6 +365,16 @@ async function generateSbomForProject(opts, serialOpts, ctx, compact) {
         : serializeSpdx(result, { compact });
     return { output, exitCode: 0, rootName, rootVersion };
 }
+function peerNamesFromManifest(manifest) {
+    // A name declared as both a peer and a regular dependency is a real dependency
+    // the package pulls in itself, so keep it.
+    const regular = new Set([
+        ...Object.keys(manifest.dependencies ?? {}),
+        ...Object.keys(manifest.devDependencies ?? {}),
+        ...Object.keys(manifest.optionalDependencies ?? {}),
+    ]);
+    return new Set(Object.keys(manifest.peerDependencies ?? {}).filter((name) => !regular.has(name)));
+}
 function validateSbomType(value) {
     if (!value || value === 'library')
         return 'library';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.commands",
-  "version": "1101.4.0",
+  "version": "1101.5.0",
   "description": "pnpm commands for audit, licenses, and sbom",
   "keywords": [
     "pnpm",
@@ -13,9 +13,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/deps/compliance/commands"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/deps/compliance/commands"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/deps/compliance/commands#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/deps/compliance/commands#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -38,30 +38,31 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "semver": "^7.8.4",
-    "@pnpm/cli.common-cli-options-help": "1100.0.2",
-    "@pnpm/cli.command": "1100.0.1",
+    "@pnpm/cli.utils": "1101.0.13",
     "@pnpm/cli.meta": "1100.0.8",
-    "@pnpm/config.reader": "1101.10.0",
-    "@pnpm/config.writer": "1100.0.13",
-    "@pnpm/deps.compliance.license-resolver": "1100.0.0",
-    "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.compliance.audit": "1101.0.17",
-    "@pnpm/cli.utils": "1101.0.12",
-    "@pnpm/deps.compliance.license-scanner": "1100.0.20",
-    "@pnpm/deps.security.signatures": "1101.2.2",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/deps.compliance.sbom": "1100.2.0",
-    "@pnpm/installing.commands": "1100.10.0",
-    "@pnpm/lockfile.fs": "1100.1.6",
+    "@pnpm/config.reader": "1101.10.1",
     "@pnpm/config.pick-registry-for-package": "1100.0.9",
-    "@pnpm/lockfile.types": "1100.0.11",
-    "@pnpm/lockfile.walker": "1100.0.11",
-    "@pnpm/network.auth-header": "1101.1.2",
+    "@pnpm/config.writer": "1100.0.14",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/deps.compliance.audit": "1101.0.18",
+    "@pnpm/deps.compliance.license-resolver": "1100.0.0",
+    "@pnpm/deps.compliance.license-scanner": "1100.0.21",
+    "@pnpm/config.version-policy": "1100.1.6",
+    "@pnpm/deps.compliance.sbom": "1100.3.0",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/lockfile.types": "1100.0.12",
+    "@pnpm/lockfile.utils": "1100.1.0",
+    "@pnpm/lockfile.walker": "1100.0.12",
+    "@pnpm/deps.security.signatures": "1101.2.3",
+    "@pnpm/lockfile.fs": "1100.1.7",
+    "@pnpm/installing.commands": "1100.10.1",
     "@pnpm/object.key-sorting": "1100.0.1",
+    "@pnpm/store.path": "1100.0.2",
+    "@pnpm/network.auth-header": "1101.1.3",
     "@pnpm/types": "1101.3.2",
-    "@pnpm/lockfile.utils": "1100.0.13",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
-    "@pnpm/store.path": "1100.0.1"
+    "@pnpm/workspace.project-manifest-reader": "1100.0.14",
+    "@pnpm/cli.common-cli-options-help": "1100.0.2",
+    "@pnpm/cli.command": "1100.0.1"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
@@ -74,15 +75,15 @@
     "load-json-file": "^7.0.1",
     "read-yaml-file": "^3.0.0",
     "tempy": "3.0.0",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.8",
-    "@pnpm/deps.compliance.commands": "1101.4.0",
-    "@pnpm/prepare": "1100.0.16",
-    "@pnpm/testing.command-defaults": "1100.0.6",
-    "@pnpm/testing.registry-mock": "1100.0.6",
+    "@pnpm/deps.compliance.commands": "1101.5.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.9",
+    "@pnpm/prepare": "1100.0.17",
+    "@pnpm/testing.mock-agent": "1101.0.4",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/workspace.projects-filter": "1100.0.22",
-    "@pnpm/testing.mock-agent": "1101.0.3"
+    "@pnpm/workspace.projects-filter": "1100.0.23",
+    "@pnpm/testing.registry-mock": "1100.0.7",
+    "@pnpm/testing.command-defaults": "1100.0.7",
+    "@pnpm/logger": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"