@pnpm/fetching.binary-fetcher 1102.0.2 → 1102.0.4

package/CHANGELOG.md

@@ -0,0 +1,253 @@
+# @pnpm/fetching.binary-fetcher
+
+## 1102.0.4
+
+### Patch Changes
+
+- Updated `adm-zip` to prevent crafted ZIP archives from causing excessive memory allocation.
+
+## 1102.0.3
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/fetching.fetcher-base@1100.2.2
+
+## 1102.0.2
+
+### Patch Changes
+
+- @pnpm/fetching.fetcher-base@1100.2.1
+- @pnpm/worker@1100.2.3
+
+## 1102.0.1
+
+### Patch Changes
+
+- Updated dependencies [bae694f]
+- Updated dependencies [852d537]
+  - @pnpm/fetching.fetcher-base@1100.2.0
+  - @pnpm/error@1100.0.1
+  - @pnpm/store.index@1100.2.1
+  - @pnpm/worker@1100.2.2
+
+## 1102.0.0
+
+### Patch Changes
+
+- Updated dependencies [61810aa]
+- Updated dependencies [681b593]
+- Updated dependencies [a31faa7]
+  - @pnpm/store.index@1100.2.0
+  - @pnpm/worker@1100.2.0
+  - @pnpm/fetching.types@1100.0.2
+  - @pnpm/fetching.fetcher-base@1100.1.9
+
+## 1101.0.10
+
+### Patch Changes
+
+- Updated dependencies [089484a]
+  - @pnpm/worker@1100.1.10
+  - @pnpm/fetching.fetcher-base@1100.1.8
+
+## 1101.0.9
+
+### Patch Changes
+
+- Updated dependencies [3b76b8e]
+  - @pnpm/worker@1100.1.9
+  - @pnpm/fetching.fetcher-base@1100.1.7
+
+## 1101.0.8
+
+### Patch Changes
+
+- Updated dependencies [aa6149d]
+  - @pnpm/worker@1100.1.8
+  - @pnpm/fetching.fetcher-base@1100.1.6
+
+## 1101.0.7
+
+### Patch Changes
+
+- @pnpm/fetching.fetcher-base@1100.1.5
+- @pnpm/worker@1100.1.7
+
+## 1101.0.6
+
+### Patch Changes
+
+- @pnpm/fetching.fetcher-base@1100.1.4
+- @pnpm/worker@1100.1.6
+
+## 1101.0.5
+
+### Patch Changes
+
+- @pnpm/fetching.fetcher-base@1100.1.3
+- @pnpm/worker@1100.1.4
+
+## 1101.0.4
+
+### Patch Changes
+
+- Updated dependencies [0c67cb5]
+  - @pnpm/store.index@1100.1.0
+  - @pnpm/worker@1100.1.3
+
+## 1101.0.3
+
+### Patch Changes
+
+- @pnpm/fetching.fetcher-base@1100.1.2
+- @pnpm/worker@1100.1.2
+
+## 1101.0.2
+
+### Patch Changes
+
+- Updated dependencies [184ce26]
+  - @pnpm/fetching.fetcher-base@1100.1.1
+  - @pnpm/fetching.types@1100.0.1
+  - @pnpm/worker@1100.1.1
+
+## 1101.0.1
+
+### Patch Changes
+
+- dd23d19: Fix Windows Node.js runtime installs still extracting bundled `npm`, `npx`, and `corepack` when the archive contains explicit directory entries. `extractZipToTarget` now skips directory entries: AdmZip's `extractEntryTo` for a directory recurses over every descendant internally, which bypassed the `ignoreEntry` filter and re-materialized the files the filter was supposed to drop. File extraction creates parent directories implicitly, so skipping directory entries doesn't regress the install layout.
+
+## 1101.0.0
+
+### Minor Changes
+
+- 421317c: Installing a Node.js runtime via `node@runtime:<version>` (including `pnpm env use` and `pnpm runtime set node`) no longer extracts the bundled `npm`, `npx`, and `corepack` from the Node.js archive. This cuts roughly half of the files pnpm has to hash, write to the CAS, and link during installation, making runtime installs noticeably faster. Users who still need `npm` can install it as a separate package.
+
+### Patch Changes
+
+- Updated dependencies [421317c]
+  - @pnpm/fetching.fetcher-base@1100.1.0
+  - @pnpm/worker@1100.1.0
+
+## 1100.0.2
+
+### Patch Changes
+
+- @pnpm/fetching.fetcher-base@1100.0.2
+- @pnpm/worker@1100.0.2
+
+## 1100.0.1
+
+### Patch Changes
+
+- @pnpm/fetching.fetcher-base@1100.0.1
+- @pnpm/worker@1100.0.1
+
+## 1003.0.0
+
+### Major Changes
+
+- 491a84f: This package is now pure ESM.
+- 7d2fd48: Node.js v18, 19, 20, and 21 support discontinued.
+
+### Minor Changes
+
+- 96704a1: Renamed `rawConfig` to `authConfig` on the `Config` interface. This field now only contains auth/registry data from `.npmrc` files. Non-auth settings are no longer written to it.
+
+  Added `nodeDownloadMirrors` setting to configure custom Node.js download mirrors in `pnpm-workspace.yaml`:
+
+  ```yaml
+  nodeDownloadMirrors:
+    release: https://my-mirror.example.com/download/release/
+    nightly: https://my-mirror.example.com/download/nightly/
+  ```
+
+  Replaced `rawConfig: object` with `userAgent?: string` in lifecycle hook options. Removed unused `rawConfig` from fetcher and prepare-package options.
+
+  Removed support for the npm `init-module` setting. Custom init scripts via `.pnpm-init.js` are no longer executed by `pnpm init`.
+
+### Patch Changes
+
+- 3bf5e21: Runtime dependencies (node, bun, deno) are now added to the store with a package.json file.
+- 260899d: Fix path traversal vulnerability in binary fetcher ZIP extraction
+
+  - Validate ZIP entry paths before extraction to prevent writing files outside target directory
+  - Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix
+  - Both attack vectors now throw `ERR_PNPM_PATH_TRAVERSAL` error
+
+- 50fbeca: fix: preserve bundled `node_modules` from Node.js Windows zip so that npm/npx shims are created correctly on Windows.
+
+  The Windows Node.js distribution places npm inside a root-level `node_modules/` directory of the zip archive. `addFilesFromDir` was skipping root-level `node_modules` (to avoid treating a package's own npm dependencies as part of its content), which caused the bundled npm to be missing after installation. This prevented `pnpm env use` from creating the npm and npx shims on Windows.
+
+  Added an `includeNodeModules` option to `addFilesFromDir` and set it to `true` in the binary fetcher so that the complete Node.js distribution, including its bundled npm, is preserved.
+
+- Updated dependencies [e2e0a32]
+- Updated dependencies [7cec347]
+- Updated dependencies [491a84f]
+- Updated dependencies [50fbeca]
+- Updated dependencies [ba065f6]
+- Updated dependencies [3bf5e21]
+- Updated dependencies [bb8baa7]
+- Updated dependencies [ee9fe58]
+- Updated dependencies [7d2fd48]
+- Updated dependencies [56a59df]
+- Updated dependencies [780af09]
+- Updated dependencies [6c480a4]
+- Updated dependencies [4893853]
+- Updated dependencies [b7f0f21]
+- Updated dependencies [831f574]
+- Updated dependencies [98a0410]
+  - @pnpm/worker@1001.0.0
+  - @pnpm/fetching.types@1001.0.0
+  - @pnpm/fetching.fetcher-base@1002.0.0
+  - @pnpm/error@1001.0.0
+  - @pnpm/store.index@1000.0.0
+
+## 1002.0.0
+
+### Patch Changes
+
+- Updated dependencies [8993f68]
+  - @pnpm/worker@1000.3.0
+  - @pnpm/fetcher-base@1001.0.2
+
+## 1001.0.0
+
+### Patch Changes
+
+- Updated dependencies [06d2160]
+  - @pnpm/worker@1000.2.0
+
+## 1000.0.3
+
+### Patch Changes
+
+- @pnpm/error@1000.0.5
+- @pnpm/worker@1000.1.13
+
+## 1000.0.2
+
+### Patch Changes
+
+- @pnpm/fetcher-base@1001.0.1
+- @pnpm/worker@1000.1.12
+
+## 1000.0.1
+
+### Patch Changes
+
+- 2b0d35f: `@pnpm/worker` should always be a peer dependency.
+
+## 1000.0.0
+
+### Major Changes
+
+- d1edf73: Added support for binary fetcher.
+
+### Patch Changes
+
+- Updated dependencies [d1edf73]
+  - @pnpm/fetcher-base@1001.0.0
+  - @pnpm/error@1000.0.4
+  - @pnpm/worker@1000.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/fetching.binary-fetcher",
-  "version": "1102.0.2",
+  "version": "1102.0.4",
   "description": "A fetcher for binary archives",
   "keywords": [
     "pnpm",
@@ -27,25 +27,25 @@
     "!*.map"
   ],
   "dependencies": {
-    "adm-zip": "^0.5.17",
-    "is-subdir": "^2.0.0",
-    "rename-overwrite": "^7.0.1",
-    "ssri": "13.0.1",
-    "tempy": "3.0.0",
     "@pnpm/error": "1100.0.1",
+    "@pnpm/fetching.fetcher-base": "1100.2.2",
     "@pnpm/fetching.types": "1100.0.2",
     "@pnpm/store.index": "1100.2.1",
-    "@pnpm/fetching.fetcher-base": "1100.2.1"
+    "adm-zip": "^0.6.0",
+    "is-subdir": "^2.0.0",
+    "rename-overwrite": "^7.0.1",
+    "ssri": "13.0.1",
+    "tempy": "3.0.0"
   },
   "peerDependencies": {
-    "@pnpm/worker": "^1100.2.3"
+    "@pnpm/worker": "^1100.2.5"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
+    "@pnpm/fetching.binary-fetcher": "1102.0.4",
     "@types/adm-zip": "^0.5.8",
     "@types/ssri": "^7.1.5",
-    "tempy": "3.0.0",
-    "@pnpm/fetching.binary-fetcher": "1102.0.2"
+    "tempy": "3.0.0"
   },
   "engines": {
     "node": ">=22.13"

package/lib/index.d.ts

@@ -1,38 +0,0 @@
-import type { BinaryFetcher, FetchFunction } from '@pnpm/fetching.fetcher-base';
-import type { FetchFromRegistry } from '@pnpm/fetching.types';
-import type { StoreIndex } from '@pnpm/store.index';
-export interface CreateBinaryFetcherOptions {
-    fetch: FetchFromRegistry;
-    fetchFromRemoteTarball: FetchFunction;
-    storeIndex: StoreIndex;
-    offline?: boolean;
-    /**
-     * Per-package-name regex sources (compatible with `new RegExp(pattern)`) matching file
-     * paths inside the downloaded archive that should be skipped during extraction.
-     * The lookup key is `pkg.name`. For zip archives, paths are matched relative to the
-     * archive's top-level directory (i.e. after the `prefix` has been stripped).
-     */
-    archiveFilters?: Record<string, string>;
-}
-export declare function createBinaryFetcher(ctx: CreateBinaryFetcherOptions): {
-    binary: BinaryFetcher;
-};
-export interface AssetInfo {
-    url: string;
-    integrity: string;
-    basename: string;
-    /**
-     * Regex matched against each zip entry's path relative to the archive's top-level basename.
-     * Matching entries are skipped during extraction.
-     */
-    ignoreEntry?: RegExp;
-}
-/**
- * Downloads and unpacks a zip file containing a binary asset.
- *
- * @param fetchFromRegistry - Function to fetch resources from registry
- * @param assetInfo - Information about the binary asset
- * @param targetDir - Directory where the binary asset should be installed
- * @throws {PnpmError} When integrity verification fails or extraction fails
- */
-export declare function downloadAndUnpackZip(fetchFromRegistry: FetchFromRegistry, assetInfo: AssetInfo, targetDir: string): Promise<void>;