@pnpm/exec.prepare-package 1100.0.15 → 1100.0.16

package/lib/index.d.ts

@@ -2,6 +2,7 @@ import type { AllowBuild } from '@pnpm/types';
 export interface PreparePackageOptions {
     allowBuild?: AllowBuild;
     ignoreScripts?: boolean;
+    pkgResolutionId: string;
     unsafePerm?: boolean;
     userAgent?: string;
 }

package/lib/index.js

@@ -23,12 +23,16 @@ export async function preparePackage(opts, gitRootDir, subDir) {
     if (opts.ignoreScripts)
         return { shouldBeBuilt: true, pkgDir };
     // Check if the package is allowed to run build scripts
-    // If allowBuild is undefined or returns false, block the build
-    if (!opts.allowBuild?.(manifest.name, manifest.version)) {
+    // If allowBuild is undefined or returns false, block the build.
+    // The depPath is synthesized from the resolution id rather than read from
+    // a lockfile; resolution ids of git and tarball artifacts are never
+    // semver-shaped, so the policy derives an untrusted package identity.
+    const depPath = `${manifest.name}@${opts.pkgResolutionId}`;
+    if (!opts.allowBuild?.(depPath)) {
         throw new PnpmError('GIT_DEP_PREPARE_NOT_ALLOWED', `The git-hosted package "${manifest.name}@${manifest.version}" needs to execute build scripts but is not in the "allowBuilds" allowlist.`, {
             hint: `Add the package to "allowBuilds" in your project's pnpm-workspace.yaml to allow it to run scripts. For example:
 allowBuilds:
-  ${manifest.name}: true`,
+  ${depPath}: true`,
         });
     }
     const pm = (await preferredPM(gitRootDir))?.name ?? 'npm';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/exec.prepare-package",
-  "version": "1100.0.15",
+  "version": "1100.0.16",
   "description": "Prepares a Git-hosted package",
   "keywords": [
     "pnpm",
@@ -31,17 +31,17 @@
     "execa": "npm:safe-execa@0.3.0",
     "preferred-pm": "^5.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "@pnpm/exec.lifecycle": "1100.0.15",
-    "@pnpm/pkg-manifest.reader": "1100.0.6",
-    "@pnpm/types": "1101.3.0",
-    "@pnpm/error": "1100.0.0"
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/exec.lifecycle": "1100.0.16",
+    "@pnpm/pkg-manifest.reader": "1100.0.7",
+    "@pnpm/types": "1101.3.1"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "@types/ramda": "0.31.1",
     "load-json-file": "^7.0.1",
-    "@pnpm/prepare": "1100.0.13",
-    "@pnpm/exec.prepare-package": "1100.0.15",
+    "@pnpm/exec.prepare-package": "1100.0.16",
+    "@pnpm/prepare": "1100.0.14",
     "@pnpm/test-fixtures": "1100.0.0",
     "@pnpm/test-ipc-server": "1100.0.0"
   },