@pnpm/global.packages 1100.0.9 → 1100.0.11

package/CHANGELOG.md

@@ -0,0 +1,157 @@
+# @pnpm/global.packages
+
+## 1100.0.11
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/bins.resolver@1100.0.9
+  - @pnpm/pkg-manifest.reader@1100.0.10
+  - @pnpm/types@1101.4.0
+
+## 1100.0.10
+
+### Patch Changes
+
+- be6505a: Hardened global package management:
+
+  - On Windows, removing or updating a global package now also cleans up the `node.exe` flavor of a bin, so a stale `node.exe` no longer survives on `PATH` after uninstall, and a new global install no longer silently overwrites an existing `node.exe`.
+  - `pnpm add -g pnpm@<version>` (and `@pnpm/exe@<version>`) is now rejected like the bare `pnpm` form, pointing to `pnpm self-update`.
+  - Dependency aliases read from a global package's manifest are validated before being joined onto `node_modules` paths, preventing a tampered manifest from escaping the install directory.
+  - Each global install group is created in its own freshly-made directory (no longer reusing a colliding or pre-existing path).
+  - Removing or updating a global package no longer unlinks a bin that belongs to a different globally installed package.
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.9
+
+### Patch Changes
+
+- @pnpm/pkg-manifest.reader@1100.0.9
+- @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.8
+
+### Patch Changes
+
+- a31faa7: Updated dependency ranges. Notably:
+
+  - `@pnpm/logger` peer dependency range moved to `^1100.0.0`.
+  - `msgpackr` 1.11.8 → 2.0.4 (store index files remain byte-compatible in both directions).
+  - `open` ^7.4.2 → ^11.0.0, `memoize` ^10 → ^11, `cli-truncate` ^5 → ^6, `pidtree` ^0.6 → ^1.
+  - `@yarnpkg/core` 4.5.0 → 4.8.0, `@rushstack/worker-pool` 0.7.7 → 0.7.18, `@cyclonedx/cyclonedx-library` 10.0.0 → 10.1.0, `@pnpm/config.nerf-dart` ^1 → ^2, `@pnpm/log.group` 3.0.2 → 4.0.1, `@pnpm/util.lex-comparator` ^3 → ^4.
+
+- Updated dependencies [681b593]
+  - @pnpm/types@1101.3.2
+  - @pnpm/bins.resolver@1100.0.8
+  - @pnpm/pkg-manifest.reader@1100.0.8
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.7
+
+### Patch Changes
+
+- Updated dependencies [230df57]
+- Updated dependencies [bf1b731]
+  - @pnpm/bins.resolver@1100.0.7
+  - @pnpm/types@1101.3.1
+  - @pnpm/pkg-manifest.reader@1100.0.7
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.6
+
+### Patch Changes
+
+- Updated dependencies [a017bf3]
+  - @pnpm/types@1101.3.0
+  - @pnpm/bins.resolver@1100.0.6
+  - @pnpm/pkg-manifest.reader@1100.0.6
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.5
+
+### Patch Changes
+
+- Updated dependencies [35d2355]
+  - @pnpm/types@1101.2.0
+  - @pnpm/bins.resolver@1100.0.5
+  - @pnpm/pkg-manifest.reader@1100.0.5
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.4
+
+### Patch Changes
+
+- Updated dependencies [64afc92]
+  - @pnpm/types@1101.1.1
+  - @pnpm/bins.resolver@1100.0.4
+  - @pnpm/pkg-manifest.reader@1100.0.4
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.3
+
+### Patch Changes
+
+- Updated dependencies [b61e268]
+  - @pnpm/types@1101.1.0
+  - @pnpm/bins.resolver@1100.0.3
+  - @pnpm/pkg-manifest.reader@1100.0.3
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.2
+
+### Patch Changes
+
+- Updated dependencies [184ce26]
+  - @pnpm/pkg-manifest.reader@1100.0.2
+  - @pnpm/bins.resolver@1100.0.2
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.1
+
+### Patch Changes
+
+- Updated dependencies [ff28085]
+  - @pnpm/types@1101.0.0
+  - @pnpm/bins.resolver@1100.0.1
+  - @pnpm/pkg-manifest.reader@1100.0.1
+  - @pnpm/crypto.hash@1100.0.0
+
+## 1000.0.0
+
+### Minor Changes
+
+- fd511e4: Isolated global packages. Each globally installed package (or group of packages installed together) now gets its own isolated installation directory with its own `package.json`, `node_modules/`, and lockfile. This prevents global packages from interfering with each other through peer dependency conflicts, hoisting changes, or version resolution shifts.
+
+  Key changes:
+
+  - `pnpm add -g <pkg>` creates an isolated installation in `{pnpmHomeDir}/global/v11/{hash}/`
+  - `pnpm remove -g <pkg>` removes the entire installation group containing the package
+  - `pnpm update -g [pkg]` re-installs packages in new isolated directories
+  - `pnpm list -g` scans isolated directories to show all installed global packages
+  - `pnpm install -g` (no args) is no longer supported; use `pnpm add -g <pkg>` instead
+
+### Patch Changes
+
+- Updated dependencies [449dacf]
+- Updated dependencies [76718b3]
+- Updated dependencies [a8f016c]
+- Updated dependencies [cc1b8e3]
+- Updated dependencies [491a84f]
+- Updated dependencies [13855ac]
+- Updated dependencies [d7b8be4]
+- Updated dependencies [7d2fd48]
+- Updated dependencies [efb48dc]
+- Updated dependencies [cb367b9]
+- Updated dependencies [7b1c189]
+- Updated dependencies [8ffb1a7]
+- Updated dependencies [05fb1ae]
+- Updated dependencies [71de2b3]
+- Updated dependencies [10bc391]
+- Updated dependencies [2df8b71]
+- Updated dependencies [15549a9]
+- Updated dependencies [cc7c0d2]
+- Updated dependencies [efb48dc]
+  - @pnpm/bins.resolver@1001.0.0
+  - @pnpm/types@1001.0.0
+  - @pnpm/pkg-manifest.reader@1001.0.0
+  - @pnpm/crypto.hash@1001.0.0

package/lib/globalPackageDir.js

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import util from 'node:util';
@@ -20,9 +21,24 @@ export function resolveInstallDir(globalDir, hash) {
     }
 }
 export function createInstallDir(globalDir) {
-    const name = `${process.pid.toString(16)}-${Date.now().toString(16)}`;
-    const dir = path.join(globalDir, name);
-    fs.mkdirSync(dir, { recursive: true });
-    return dir;
+    // Ensure the parent exists, then create the per-group dir *exclusively*
+    // (no `recursive`, which would silently reuse an existing entry or follow
+    // a pre-existing symlink). The name adds random bytes on top of pid+time
+    // so it isn't predictable and can't collide within the same millisecond.
+    fs.mkdirSync(globalDir, { recursive: true });
+    for (let i = 0; i < 10; i++) {
+        const name = `${process.pid.toString(16)}-${Date.now().toString(16)}-${crypto.randomBytes(8).toString('hex')}`;
+        const dir = path.join(globalDir, name);
+        try {
+            fs.mkdirSync(dir);
+            return dir;
+        }
+        catch (err) {
+            if (util.types.isNativeError(err) && 'code' in err && err.code === 'EEXIST')
+                continue;
+            throw err;
+        }
+    }
+    throw new Error('Could not create a unique global install directory');
 }
 //# sourceMappingURL=globalPackageDir.js.map

package/lib/index.d.ts

@@ -1,3 +1,3 @@
 export { createGlobalCacheKey } from './cacheKey.js';
 export { createInstallDir, getHashLink, resolveInstallDir, } from './globalPackageDir.js';
-export { cleanOrphanedInstallDirs, findGlobalPackage, getGlobalPackageDetails, getInstalledBinNames, type GlobalPackageInfo, type InstalledGlobalPackage, scanGlobalPackages, } from './scanGlobalPackages.js';
+export { cleanOrphanedInstallDirs, findGlobalPackage, getGlobalPackageDetails, getInstalledBinNames, type GlobalPackageInfo, type InstalledGlobalPackage, isValidGlobalDependencyAlias, scanGlobalPackages, } from './scanGlobalPackages.js';

package/lib/index.js

@@ -1,4 +1,4 @@
 export { createGlobalCacheKey } from './cacheKey.js';
 export { createInstallDir, getHashLink, resolveInstallDir, } from './globalPackageDir.js';
-export { cleanOrphanedInstallDirs, findGlobalPackage, getGlobalPackageDetails, getInstalledBinNames, scanGlobalPackages, } from './scanGlobalPackages.js';
+export { cleanOrphanedInstallDirs, findGlobalPackage, getGlobalPackageDetails, getInstalledBinNames, isValidGlobalDependencyAlias, scanGlobalPackages, } from './scanGlobalPackages.js';
 //# sourceMappingURL=index.js.map

package/lib/scanGlobalPackages.d.ts

@@ -1,4 +1,5 @@
 import type { PackageManifest } from '@pnpm/types';
+export declare function isValidGlobalDependencyAlias(alias: string): boolean;
 export interface GlobalPackageInfo {
     hash: string;
     installDir: string;

package/lib/scanGlobalPackages.js

@@ -3,6 +3,43 @@ import path from 'node:path';
 import util from 'node:util';
 import { getBinsFromPackageManifest } from '@pnpm/bins.resolver';
 import { readPackageJsonFromDirRawSync, safeReadPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
+const RESERVED_ALIASES = new Set(['node_modules', 'favicon.ico']);
+const isUrlFriendly = (segment) => encodeURIComponent(segment) === segment;
+// A dependency alias from a global group's package.json becomes a directory
+// name under `node_modules` at every join site (list, conflict-check,
+// remove, update). A tampered manifest could use an alias like `../x` or an
+// absolute path to escape the install dir, so only valid npm package names
+// are trusted. This applies the same `validForOldPackages` rules that
+// `validate-npm-package-name` (and `@pnpm/fs.symlink-dependency`'s
+// `safeJoinModulesDir`) enforce — implemented inline to avoid adding a
+// dependency to this low-level package.
+export function isValidGlobalDependencyAlias(alias) {
+    if (alias.length === 0)
+        return false;
+    if (/^[._-]/.test(alias))
+        return false;
+    if (alias.trim() !== alias)
+        return false;
+    if (RESERVED_ALIASES.has(alias.toLowerCase()))
+        return false;
+    if (isUrlFriendly(alias))
+        return true;
+    const scoped = /^@([^/]+)\/([^/]+)$/.exec(alias);
+    if (scoped) {
+        const [, scope, name] = scoped;
+        return !name.startsWith('.') && isUrlFriendly(scope) && isUrlFriendly(name);
+    }
+    return false;
+}
+function pickValidDependencies(dependencies) {
+    const result = {};
+    for (const [alias, spec] of Object.entries(dependencies)) {
+        if (isValidGlobalDependencyAlias(alias)) {
+            result[alias] = spec;
+        }
+    }
+    return result;
+}
 export function scanGlobalPackages(globalDir) {
     let entries;
     try {
@@ -34,12 +71,15 @@ export function scanGlobalPackages(globalDir) {
         catch {
             continue;
         }
-        if (!pkgJson.dependencies || Object.keys(pkgJson.dependencies).length === 0)
+        if (!pkgJson.dependencies)
+            continue;
+        const dependencies = pickValidDependencies(pkgJson.dependencies);
+        if (Object.keys(dependencies).length === 0)
             continue;
         result.push({
             hash: entry.name,
             installDir,
-            dependencies: pkgJson.dependencies,
+            dependencies,
         });
     }
     return result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/global.packages",
-  "version": "1100.0.9",
+  "version": "1100.0.11",
   "description": "Utilities for managing isolated global packages",
   "keywords": [
     "pnpm",
@@ -28,14 +28,14 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/util.lex-comparator": "^4.0.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/types": "1101.3.2",
-    "@pnpm/bins.resolver": "1100.0.8",
-    "@pnpm/crypto.hash": "1100.0.1"
+    "@pnpm/bins.resolver": "1100.0.9",
+    "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/pkg-manifest.reader": "1100.0.10",
+    "@pnpm/types": "1101.4.0",
+    "@pnpm/util.lex-comparator": "^4.0.1"
   },
   "devDependencies": {
-    "@pnpm/global.packages": "1100.0.9"
+    "@pnpm/global.packages": "1100.0.11"
   },
   "engines": {
     "node": ">=22.13"