@pnpm/installing.env-installer 1101.1.8 → 1102.0.1

package/lib/assertValidConfigDepVersion.d.ts

@@ -0,0 +1 @@
+export declare function assertValidConfigDepVersion(name: string, version: string): void;

package/lib/assertValidConfigDepVersion.js

@@ -0,0 +1,11 @@
+import { PnpmError } from '@pnpm/error';
+import semver from 'semver';
+// A config-dep version becomes a store path segment (`<name>/<version>/<hash>`),
+// so reject non-semver values to keep a traversal-shaped version from escaping
+// the store root.
+export function assertValidConfigDepVersion(name, version) {
+    if (semver.valid(version) == null) {
+        throw new PnpmError('INVALID_CONFIG_DEP_VERSION', `The config dependency "${name}" has an invalid version "${version}"`, { hint: 'A config dependency version must be an exact semver version.' });
+    }
+}
+//# sourceMappingURL=assertValidConfigDepVersion.js.map

package/lib/index.d.ts

@@ -2,3 +2,4 @@ export { installConfigDeps, type InstallConfigDepsOpts } from './installConfigDe
 export { resolveAndInstallConfigDeps, type ResolveAndInstallConfigDepsOpts } from './resolveAndInstallConfigDeps.js';
 export { resolveConfigDeps, type ResolveConfigDepsOpts } from './resolveConfigDeps.js';
 export { isPackageManagerResolved, resolvePackageManagerIntegrities, type ResolvePackageManagerIntegritiesOpts } from './resolvePackageManagerIntegrities.js';
+export { verifyEnvLockfile } from './verifyEnvLockfile.js';

package/lib/index.js

@@ -2,4 +2,5 @@ export { installConfigDeps } from './installConfigDeps.js';
 export { resolveAndInstallConfigDeps } from './resolveAndInstallConfigDeps.js';
 export { resolveConfigDeps } from './resolveConfigDeps.js';
 export { isPackageManagerResolved, resolvePackageManagerIntegrities } from './resolvePackageManagerIntegrities.js';
+export { verifyEnvLockfile } from './verifyEnvLockfile.js';
 //# sourceMappingURL=index.js.map

package/lib/installConfigDeps.js

@@ -11,6 +11,7 @@ import { rimraf } from '@zkochan/rimraf';
 import getNpmTarballUrl from 'get-npm-tarball-url';
 import { symlinkDir } from 'symlink-dir';
 import { migrateConfigDepsToLockfile } from './migrateConfigDeps.js';
+import { verifyEnvLockfile } from './verifyEnvLockfile.js';
 /**
  * Install config dependencies using the env lockfile.
  * Accepts either a EnvLockfile directly (from resolveConfigDeps) or
@@ -109,12 +110,14 @@ export async function installConfigDeps(configDepsOrLockfile, opts) {
 async function normalizeForInstall(configDepsOrLockfile, opts) {
     // If it's a EnvLockfile object (has lockfileVersion), use it directly
     if (isEnvLockfile(configDepsOrLockfile)) {
+        verifyEnvLockfile(configDepsOrLockfile);
         return normalizeFromLockfile(configDepsOrLockfile, opts.registries);
     }
     // It's ConfigDependencies from workspace manifest.
     // Try to read the env lockfile first.
     const envLockfile = await readEnvLockfile(opts.rootDir);
     if (envLockfile) {
+        verifyEnvLockfile(envLockfile);
         return normalizeFromLockfile(envLockfile, opts.registries);
     }
     // No env lockfile yet — migrate from old inline integrity format

package/lib/migrateConfigDeps.js

@@ -1,10 +1,11 @@
 import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { writeSettings } from '@pnpm/config.writer';
 import { PnpmError } from '@pnpm/error';
-import { createEnvLockfile, writeEnvLockfile } from '@pnpm/lockfile.fs';
+import { createEnvLockfile } from '@pnpm/lockfile.fs';
 import { toLockfileResolution } from '@pnpm/lockfile.utils';
 import getNpmTarballUrl from 'get-npm-tarball-url';
 import { parseIntegrity } from './parseIntegrity.js';
+import { writeVerifiedEnvLockfile } from './writeVerifiedEnvLockfile.js';
 /**
  * Migrates old-format configDependencies (with inline integrity in pnpm-workspace.yaml)
  * to the new pnpm-lock.yaml format.
@@ -14,6 +15,9 @@ import { parseIntegrity } from './parseIntegrity.js';
  */
 export async function migrateConfigDepsToLockfile(configDeps, opts) {
     const envLockfile = createEnvLockfile();
+    // Null-prototype so a `__proto__` name lands as an own key verifyEnvLockfile
+    // sees, not a silent prototype mutation.
+    envLockfile.importers['.'].configDependencies = Object.create(null);
     const cleanSpecifiers = {};
     const normalizedDeps = {};
     for (const [pkgName, pkgSpec] of Object.entries(configDeps)) {
@@ -64,17 +68,14 @@ export async function migrateConfigDepsToLockfile(configDeps, opts) {
             };
         }
     }
-    // Write the new env lockfile and clean up workspace manifest
-    await Promise.all([
-        writeEnvLockfile(opts.rootDir, envLockfile),
-        writeSettings({
-            rootProjectManifestDir: opts.rootDir,
-            workspaceDir: opts.rootDir,
-            updatedSettings: {
-                configDependencies: cleanSpecifiers,
-            },
-        }),
-    ]);
+    await writeVerifiedEnvLockfile(opts.rootDir, envLockfile);
+    await writeSettings({
+        rootProjectManifestDir: opts.rootDir,
+        workspaceDir: opts.rootDir,
+        updatedSettings: {
+            configDependencies: cleanSpecifiers,
+        },
+    });
     return normalizedDeps;
 }
 //# sourceMappingURL=migrateConfigDeps.js.map

package/lib/resolveAndInstallConfigDeps.js

@@ -1,6 +1,6 @@
 import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { PnpmError } from '@pnpm/error';
-import { createEnvLockfile, readEnvLockfile, writeEnvLockfile, } from '@pnpm/lockfile.fs';
+import { createEnvLockfile, readEnvLockfile, } from '@pnpm/lockfile.fs';
 import { toLockfileResolution } from '@pnpm/lockfile.utils';
 import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
 import { createFetchFromRegistry } from '@pnpm/network.fetch';
@@ -10,6 +10,7 @@ import { installConfigDeps } from './installConfigDeps.js';
 import { parseIntegrity } from './parseIntegrity.js';
 import { pruneEnvLockfile } from './pruneEnvLockfile.js';
 import { resolveOptionalSubdeps } from './resolveOptionalSubdeps.js';
+import { writeVerifiedEnvLockfile } from './writeVerifiedEnvLockfile.js';
 /**
  * Resolves any config dependencies that are missing from the env lockfile,
  * then installs all config dependencies.
@@ -71,7 +72,7 @@ export async function resolveAndInstallConfigDeps(configDeps, opts) {
     }
     if (depsToResolve.length === 0) {
         if (lockfileChanged) {
-            await writeEnvLockfile(opts.rootDir, envLockfile);
+            await writeVerifiedEnvLockfile(opts.rootDir, envLockfile);
         }
         await installConfigDeps(envLockfile, opts);
         return;
@@ -111,7 +112,7 @@ export async function resolveAndInstallConfigDeps(configDeps, opts) {
         envLockfile.snapshots[pkgKey] = optionalSubdeps ? { optionalDependencies: optionalSubdeps } : {};
     }));
     pruneEnvLockfile(envLockfile);
-    await writeEnvLockfile(opts.rootDir, envLockfile);
+    await writeVerifiedEnvLockfile(opts.rootDir, envLockfile);
     await installConfigDeps(envLockfile, opts);
 }
 //# sourceMappingURL=resolveAndInstallConfigDeps.js.map

package/lib/resolveConfigDeps.js

@@ -1,7 +1,7 @@
 import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { writeSettings } from '@pnpm/config.writer';
 import { PnpmError } from '@pnpm/error';
-import { createEnvLockfile, readEnvLockfile, writeEnvLockfile, } from '@pnpm/lockfile.fs';
+import { createEnvLockfile, readEnvLockfile, } from '@pnpm/lockfile.fs';
 import { toLockfileResolution } from '@pnpm/lockfile.utils';
 import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
 import { createFetchFromRegistry } from '@pnpm/network.fetch';
@@ -10,6 +10,7 @@ import { parseWantedDependency } from '@pnpm/resolving.parse-wanted-dependency';
 import { installConfigDeps } from './installConfigDeps.js';
 import { pruneEnvLockfile } from './pruneEnvLockfile.js';
 import { resolveOptionalSubdeps } from './resolveOptionalSubdeps.js';
+import { writeVerifiedEnvLockfile } from './writeVerifiedEnvLockfile.js';
 export async function resolveConfigDeps(configDeps, opts) {
     if (opts.frozenLockfile) {
         throw new PnpmError('FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE', 'Cannot resolve configDependencies with "frozen-lockfile" because the lockfile is not up to date');
@@ -56,17 +57,15 @@ export async function resolveConfigDeps(configDeps, opts) {
         envLockfile.snapshots[pkgKey] = optionalSubdeps ? { optionalDependencies: optionalSubdeps } : {};
     }));
     pruneEnvLockfile(envLockfile);
-    await Promise.all([
-        writeSettings({
-            ...opts,
-            rootProjectManifestDir: opts.rootDir,
-            workspaceDir: opts.rootDir,
-            updatedSettings: {
-                configDependencies: configDependencySpecifiers,
-            },
-        }),
-        writeEnvLockfile(opts.rootDir, envLockfile),
-    ]);
+    await writeVerifiedEnvLockfile(opts.rootDir, envLockfile);
+    await writeSettings({
+        ...opts,
+        rootProjectManifestDir: opts.rootDir,
+        workspaceDir: opts.rootDir,
+        updatedSettings: {
+            configDependencies: configDependencySpecifiers,
+        },
+    });
     await installConfigDeps(envLockfile, opts);
 }
 /**

package/lib/resolvePackageManagerIntegrities.js

@@ -1,7 +1,8 @@
-import { convertToLockfileFile, createEnvLockfile, readEnvLockfile, writeEnvLockfile } from '@pnpm/lockfile.fs';
+import { convertToLockfileFile, createEnvLockfile, readEnvLockfile } from '@pnpm/lockfile.fs';
 import { pruneSharedLockfile } from '@pnpm/lockfile.pruner';
 import { convertToLockfileEnvObject } from './pruneEnvLockfile.js';
 import { resolveManifestDependencies } from './resolveManifestDependencies.js';
+import { writeVerifiedEnvLockfile } from './writeVerifiedEnvLockfile.js';
 /**
  * Checks if the wanted pnpm version integrities are already fully resolved in the env lockfile.
  */
@@ -58,7 +59,7 @@ export async function resolvePackageManagerIntegrities(pnpmVersion, opts) {
         envLockfile.packages = prunedFile.packages ?? {};
         envLockfile.snapshots = prunedFile.snapshots ?? {};
         if (save) {
-            await writeEnvLockfile(opts.rootDir, envLockfile);
+            await writeVerifiedEnvLockfile(opts.rootDir, envLockfile);
         }
     }
     return envLockfile;

package/lib/verifyEnvLockfile.d.ts

@@ -0,0 +1,2 @@
+import type { EnvLockfile } from '@pnpm/lockfile.fs';
+export declare function verifyEnvLockfile(envLockfile: EnvLockfile): void;

package/lib/verifyEnvLockfile.js

@@ -0,0 +1,24 @@
+import { assertValidDependencyAliases } from '@pnpm/installing.deps-resolver';
+import { assertValidConfigDepVersion } from './assertValidConfigDepVersion.js';
+// Offline structural gate for the env lockfile, mirroring the alias/shape
+// checks `verifyLockfileResolutions` runs over the main lockfile. Config
+// dependency and optional-subdependency names and versions become store path
+// segments, so reject any that isn't a valid npm name / exact semver before a
+// path is built from them.
+export function verifyEnvLockfile(envLockfile) {
+    const configDeps = envLockfile.importers['.']?.configDependencies;
+    assertValidDependencyAliases(configDeps, 'The configDependencies in pnpm-lock.yaml');
+    if (configDeps == null)
+        return;
+    for (const [name, { version }] of Object.entries(configDeps)) {
+        assertValidConfigDepVersion(name, version);
+        const optionalDeps = envLockfile.snapshots[`${name}@${version}`]?.optionalDependencies;
+        if (optionalDeps == null)
+            continue;
+        assertValidDependencyAliases(optionalDeps, `The optionalDependencies of config dependency "${name}" in pnpm-lock.yaml`);
+        for (const [subdepName, subdepVersion] of Object.entries(optionalDeps)) {
+            assertValidConfigDepVersion(subdepName, subdepVersion);
+        }
+    }
+}
+//# sourceMappingURL=verifyEnvLockfile.js.map

package/lib/writeVerifiedEnvLockfile.d.ts

@@ -0,0 +1,2 @@
+import { type EnvLockfile } from '@pnpm/lockfile.fs';
+export declare function writeVerifiedEnvLockfile(rootDir: string, envLockfile: EnvLockfile): Promise<void>;

package/lib/writeVerifiedEnvLockfile.js

@@ -0,0 +1,9 @@
+import { writeEnvLockfile } from '@pnpm/lockfile.fs';
+import { verifyEnvLockfile } from './verifyEnvLockfile.js';
+// Persist an env lockfile only after verifying it, so no code path can write
+// one carrying an invalid config-dependency name or version.
+export async function writeVerifiedEnvLockfile(rootDir, envLockfile) {
+    verifyEnvLockfile(envLockfile);
+    await writeEnvLockfile(rootDir, envLockfile);
+}
+//# sourceMappingURL=writeVerifiedEnvLockfile.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.env-installer",
-  "version": "1101.1.8",
+  "version": "1102.0.1",
   "description": "Installer for configurational dependencies",
   "keywords": [
     "pnpm",
@@ -30,43 +30,43 @@
   "dependencies": {
     "@zkochan/rimraf": "^4.0.0",
     "get-npm-tarball-url": "^2.1.0",
-    "semver": "^7.8.1",
+    "semver": "^7.8.4",
     "symlink-dir": "^10.0.1",
+    "@pnpm/config.package-is-installable": "1100.0.11",
+    "@pnpm/config.writer": "1100.0.13",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/config.writer": "1100.0.12",
-    "@pnpm/core-loggers": "1100.2.0",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/installing.deps-resolver": "1100.2.2",
+    "@pnpm/core-loggers": "1100.2.1",
+    "@pnpm/deps.graph-hasher": "1100.2.5",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/lockfile.fs": "1100.1.4",
-    "@pnpm/config.pick-registry-for-package": "1100.0.8",
-    "@pnpm/network.auth-header": "1101.1.1",
-    "@pnpm/lockfile.utils": "1100.0.12",
-    "@pnpm/lockfile.pruner": "1100.0.10",
-    "@pnpm/config.package-is-installable": "1100.0.10",
-    "@pnpm/lockfile.types": "1100.0.10",
+    "@pnpm/installing.deps-resolver": "1100.2.4",
+    "@pnpm/lockfile.fs": "1100.1.6",
+    "@pnpm/lockfile.pruner": "1100.0.11",
+    "@pnpm/lockfile.utils": "1100.0.13",
+    "@pnpm/lockfile.types": "1100.0.11",
+    "@pnpm/network.auth-header": "1101.1.2",
+    "@pnpm/pkg-manifest.reader": "1100.0.8",
+    "@pnpm/resolving.npm-resolver": "1102.0.1",
+    "@pnpm/network.fetch": "1100.1.3",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.7",
-    "@pnpm/store.controller-types": "1100.1.4",
-    "@pnpm/types": "1101.3.1",
-    "@pnpm/store.controller": "1101.0.13",
-    "@pnpm/network.fetch": "1100.1.2",
-    "@pnpm/deps.graph-hasher": "1100.2.4",
-    "@pnpm/resolving.npm-resolver": "1101.5.2"
+    "@pnpm/store.controller-types": "1100.1.5",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/store.controller": "1102.0.1",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/config.pick-registry-for-package": "1100.0.9"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1",
-    "@pnpm/worker": "^1100.1.11"
+    "@pnpm/logger": "^1100.0.0",
+    "@pnpm/worker": "^1100.2.1"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
     "@types/semver": "7.7.1",
     "load-json-file": "^7.0.1",
     "read-yaml-file": "^3.0.0",
-    "@pnpm/installing.env-installer": "1101.1.8",
-    "@pnpm/prepare": "1100.0.15",
-    "@pnpm/testing.temp-store": "1100.1.8",
-    "@pnpm/testing.registry-mock": "1100.0.5"
+    "@pnpm/installing.env-installer": "1102.0.1",
+    "@pnpm/prepare": "1100.0.16",
+    "@pnpm/testing.temp-store": "1100.1.10",
+    "@pnpm/testing.registry-mock": "1100.0.6"
   },
   "engines": {
     "node": ">=22.13"