@pnpm/global.packages 1100.0.9 → 1100.0.10

package/lib/globalPackageDir.js

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import util from 'node:util';
@@ -20,9 +21,24 @@ export function resolveInstallDir(globalDir, hash) {
     }
 }
 export function createInstallDir(globalDir) {
-    const name = `${process.pid.toString(16)}-${Date.now().toString(16)}`;
-    const dir = path.join(globalDir, name);
-    fs.mkdirSync(dir, { recursive: true });
-    return dir;
+    // Ensure the parent exists, then create the per-group dir *exclusively*
+    // (no `recursive`, which would silently reuse an existing entry or follow
+    // a pre-existing symlink). The name adds random bytes on top of pid+time
+    // so it isn't predictable and can't collide within the same millisecond.
+    fs.mkdirSync(globalDir, { recursive: true });
+    for (let i = 0; i < 10; i++) {
+        const name = `${process.pid.toString(16)}-${Date.now().toString(16)}-${crypto.randomBytes(8).toString('hex')}`;
+        const dir = path.join(globalDir, name);
+        try {
+            fs.mkdirSync(dir);
+            return dir;
+        }
+        catch (err) {
+            if (util.types.isNativeError(err) && 'code' in err && err.code === 'EEXIST')
+                continue;
+            throw err;
+        }
+    }
+    throw new Error('Could not create a unique global install directory');
 }
 //# sourceMappingURL=globalPackageDir.js.map

package/lib/index.d.ts

@@ -1,3 +1,3 @@
 export { createGlobalCacheKey } from './cacheKey.js';
 export { createInstallDir, getHashLink, resolveInstallDir, } from './globalPackageDir.js';
-export { cleanOrphanedInstallDirs, findGlobalPackage, getGlobalPackageDetails, getInstalledBinNames, type GlobalPackageInfo, type InstalledGlobalPackage, scanGlobalPackages, } from './scanGlobalPackages.js';
+export { cleanOrphanedInstallDirs, findGlobalPackage, getGlobalPackageDetails, getInstalledBinNames, type GlobalPackageInfo, type InstalledGlobalPackage, isValidGlobalDependencyAlias, scanGlobalPackages, } from './scanGlobalPackages.js';

package/lib/index.js

@@ -1,4 +1,4 @@
 export { createGlobalCacheKey } from './cacheKey.js';
 export { createInstallDir, getHashLink, resolveInstallDir, } from './globalPackageDir.js';
-export { cleanOrphanedInstallDirs, findGlobalPackage, getGlobalPackageDetails, getInstalledBinNames, scanGlobalPackages, } from './scanGlobalPackages.js';
+export { cleanOrphanedInstallDirs, findGlobalPackage, getGlobalPackageDetails, getInstalledBinNames, isValidGlobalDependencyAlias, scanGlobalPackages, } from './scanGlobalPackages.js';
 //# sourceMappingURL=index.js.map

package/lib/scanGlobalPackages.d.ts

@@ -1,4 +1,5 @@
 import type { PackageManifest } from '@pnpm/types';
+export declare function isValidGlobalDependencyAlias(alias: string): boolean;
 export interface GlobalPackageInfo {
     hash: string;
     installDir: string;

package/lib/scanGlobalPackages.js

@@ -3,6 +3,43 @@ import path from 'node:path';
 import util from 'node:util';
 import { getBinsFromPackageManifest } from '@pnpm/bins.resolver';
 import { readPackageJsonFromDirRawSync, safeReadPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
+const RESERVED_ALIASES = new Set(['node_modules', 'favicon.ico']);
+const isUrlFriendly = (segment) => encodeURIComponent(segment) === segment;
+// A dependency alias from a global group's package.json becomes a directory
+// name under `node_modules` at every join site (list, conflict-check,
+// remove, update). A tampered manifest could use an alias like `../x` or an
+// absolute path to escape the install dir, so only valid npm package names
+// are trusted. This applies the same `validForOldPackages` rules that
+// `validate-npm-package-name` (and `@pnpm/fs.symlink-dependency`'s
+// `safeJoinModulesDir`) enforce — implemented inline to avoid adding a
+// dependency to this low-level package.
+export function isValidGlobalDependencyAlias(alias) {
+    if (alias.length === 0)
+        return false;
+    if (/^[._-]/.test(alias))
+        return false;
+    if (alias.trim() !== alias)
+        return false;
+    if (RESERVED_ALIASES.has(alias.toLowerCase()))
+        return false;
+    if (isUrlFriendly(alias))
+        return true;
+    const scoped = /^@([^/]+)\/([^/]+)$/.exec(alias);
+    if (scoped) {
+        const [, scope, name] = scoped;
+        return !name.startsWith('.') && isUrlFriendly(scope) && isUrlFriendly(name);
+    }
+    return false;
+}
+function pickValidDependencies(dependencies) {
+    const result = {};
+    for (const [alias, spec] of Object.entries(dependencies)) {
+        if (isValidGlobalDependencyAlias(alias)) {
+            result[alias] = spec;
+        }
+    }
+    return result;
+}
 export function scanGlobalPackages(globalDir) {
     let entries;
     try {
@@ -34,12 +71,15 @@ export function scanGlobalPackages(globalDir) {
         catch {
             continue;
         }
-        if (!pkgJson.dependencies || Object.keys(pkgJson.dependencies).length === 0)
+        if (!pkgJson.dependencies)
+            continue;
+        const dependencies = pickValidDependencies(pkgJson.dependencies);
+        if (Object.keys(dependencies).length === 0)
             continue;
         result.push({
             hash: entry.name,
             installDir,
-            dependencies: pkgJson.dependencies,
+            dependencies,
         });
     }
     return result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/global.packages",
-  "version": "1100.0.9",
+  "version": "1100.0.10",
   "description": "Utilities for managing isolated global packages",
   "keywords": [
     "pnpm",
@@ -29,13 +29,13 @@
   ],
   "dependencies": {
     "@pnpm/util.lex-comparator": "^4.0.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/types": "1101.3.2",
     "@pnpm/bins.resolver": "1100.0.8",
-    "@pnpm/crypto.hash": "1100.0.1"
+    "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/pkg-manifest.reader": "1100.0.9",
+    "@pnpm/types": "1101.3.2"
   },
   "devDependencies": {
-    "@pnpm/global.packages": "1100.0.9"
+    "@pnpm/global.packages": "1100.0.10"
   },
   "engines": {
     "node": ">=22.13"