@pnpm/deps.graph-hasher 1100.2.7 → 1100.2.8

package/lib/index.js

@@ -197,9 +197,24 @@ export function calcGlobalVirtualStorePathWithSubdeps(fullPkgId, name, version,
 // Scoped: @scope/pkg/version/hash
 // Unscoped: @/pkg/version/hash
 function formatGlobalVirtualStorePath(name, version, hexDigest) {
+    // `version` is lockfile-controlled (`pkgSnapshot.version ?? parsed depPath`)
+    // and is inserted below as a raw path segment. Every global-virtual-store
+    // slot path funnels through here, and callers join the result onto
+    // `globalVirtualStoreDir` before passing it to `importPackage`, so a `..`
+    // segment in the version would let the slot escape the store root — even
+    // when the package name itself is valid (the name's own traversal is caught
+    // downstream by `safeJoinModulesDir`). Reject it at this single choke point.
+    assertNoPathTraversal(version);
     const prefix = name.startsWith('@') ? '' : '@/';
     return `${prefix}${name}/${version}/${hexDigest}`;
 }
+function assertNoPathTraversal(version) {
+    if (version.split(/[/\\]/).includes('..')) {
+        const error = new Error(`Refusing to build a virtual-store path with the traversal version segment ${JSON.stringify(version)}`);
+        error.code = 'ERR_PNPM_INVALID_DEPENDENCY_NAME';
+        throw error;
+    }
+}
 export function* iteratePkgMeta(lockfile, graph) {
     if (lockfile.packages == null) {
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.graph-hasher",
-  "version": "1100.2.7",
+  "version": "1100.2.8",
   "description": "Calculates the state of a dependency",
   "keywords": [
     "pnpm",
@@ -28,17 +28,17 @@
   ],
   "dependencies": {
     "detect-libc": "^2.1.2",
+    "@pnpm/crypto.object-hasher": "1100.0.0",
     "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/lockfile.types": "1100.0.13",
     "@pnpm/lockfile.utils": "1100.1.1",
+    "@pnpm/lockfile.types": "1100.0.13",
     "@pnpm/resolving.resolver-base": "1100.5.1",
-    "@pnpm/crypto.object-hasher": "1100.0.0",
     "@pnpm/engine.runtime.system-version": "1100.0.3",
     "@pnpm/types": "1101.3.2"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.graph-hasher": "1100.2.7"
+    "@pnpm/deps.graph-hasher": "1100.2.8"
   },
   "engines": {
     "node": ">=22.13"