@pnpm/lockfile.fs 1100.1.7 → 1100.1.9

package/lib/envLockfile.js

@@ -1,12 +1,10 @@
-import { promises as fs } from 'node:fs';
 import path from 'node:path';
-import util from 'node:util';
 import { LOCKFILE_VERSION, WANTED_LOCKFILE } from '@pnpm/constants';
 import yaml from 'js-yaml';
 import writeFileAtomic from 'write-file-atomic';
 import { sortLockfileKeys } from './sortLockfileKeys.js';
 import { lockfileYamlDump } from './write.js';
-import { extractMainDocument, streamReadFirstYamlDocument } from './yamlDocuments.js';
+import { extractMainDocument, readLockfileToStringNoFollow, streamReadFirstYamlDocument } from './yamlDocuments.js';
 export function createEnvLockfile() {
     return {
         lockfileVersion: LOCKFILE_VERSION,
@@ -55,17 +53,8 @@ export async function writeEnvLockfile(rootDir, lockfile) {
     const lockfilePath = path.join(rootDir, WANTED_LOCKFILE);
     const sorted = sortLockfileKeys(lockfile);
     const envYaml = lockfileYamlDump(sorted);
-    // Read existing main lockfile document to preserve it
-    let mainDoc = '';
-    try {
-        const existing = await fs.readFile(lockfilePath, 'utf8');
-        mainDoc = extractMainDocument(existing);
-    }
-    catch (err) {
-        if (!(util.types.isNativeError(err) && 'code' in err && err.code === 'ENOENT')) {
-            throw err;
-        }
-    }
+    const existing = await readLockfileToStringNoFollow(lockfilePath);
+    const mainDoc = existing == null ? '' : extractMainDocument(existing);
     const combined = `---\n${envYaml}\n---\n${mainDoc}`;
     return writeFileAtomic(lockfilePath, combined);
 }

package/lib/yamlDocuments.d.ts

@@ -7,6 +7,7 @@ export declare const YAML_DOCUMENT_START = "---\n";
  * Returns null if the file doesn't exist or doesn't start with "---\n".
  */
 export declare function streamReadFirstYamlDocument(filePath: string, readBufferSize?: number): Promise<string | null>;
+export declare function readLockfileToStringNoFollow(filePath: string): Promise<string | null>;
 /**
  * Extracts the main lockfile content (second YAML document) from a combined string.
  * If the file starts with "---\n", returns the content after the separator.

package/lib/yamlDocuments.js

@@ -1,10 +1,13 @@
-import { open } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { lstat, open } from 'node:fs/promises';
 import { StringDecoder } from 'node:string_decoder';
 import util from 'node:util';
+import { PnpmError } from '@pnpm/error';
 import stripBom from 'strip-bom';
 export const YAML_DOCUMENT_SEPARATOR = '\n---\n';
 export const YAML_DOCUMENT_START = '---\n';
 const READ_BUFFER_SIZE = 64 * 1024;
+const LOCKFILE_READ_FLAGS = constants.O_RDONLY | (process.platform === 'win32' ? 0 : constants.O_NOFOLLOW);
 /**
  * Reads the first YAML document from a multi-document YAML file using streaming.
  * The file must start with "---\n" to indicate it contains an env lockfile document.
@@ -16,7 +19,7 @@ export async function streamReadFirstYamlDocument(filePath, readBufferSize = REA
     let buffer = '';
     let firstChunk = true;
     try {
-        fileHandle = await open(filePath, 'r');
+        fileHandle = await openLockfileNoFollow(filePath);
         const decoder = new StringDecoder('utf8');
         const readBuffer = Buffer.allocUnsafe(normalizeReadBufferSize(readBufferSize));
         let position = 0;
@@ -60,6 +63,52 @@ export async function streamReadFirstYamlDocument(filePath, readBufferSize = REA
         await fileHandle?.close().catch(() => { });
     }
 }
+export async function readLockfileToStringNoFollow(filePath) {
+    let fileHandle;
+    try {
+        fileHandle = await openLockfileNoFollow(filePath);
+        return await fileHandle.readFile('utf8');
+    }
+    catch (err) {
+        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ENOENT') {
+            return null;
+        }
+        throw err;
+    }
+    finally {
+        await fileHandle?.close().catch(() => { });
+    }
+}
+async function openLockfileNoFollow(filePath) {
+    await ensureLockfileIsNotSymlink(filePath);
+    try {
+        return await open(filePath, LOCKFILE_READ_FLAGS);
+    }
+    catch (err) {
+        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ELOOP') {
+            throw symlinkedLockfileError(filePath);
+        }
+        throw err;
+    }
+}
+async function ensureLockfileIsNotSymlink(filePath) {
+    let stat;
+    try {
+        stat = await lstat(filePath);
+    }
+    catch (err) {
+        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ENOENT') {
+            return;
+        }
+        throw err;
+    }
+    if (stat.isSymbolicLink()) {
+        throw symlinkedLockfileError(filePath);
+    }
+}
+function symlinkedLockfileError(filePath) {
+    return new PnpmError('LOCKFILE_IS_SYMLINK', `Refusing to read or write symlinked lockfile at ${filePath}`);
+}
 function canRejectDocumentStart(buffer) {
     if (buffer.length < YAML_DOCUMENT_START.length)
         return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.fs",
-  "version": "1100.1.7",
+  "version": "1100.1.9",
   "description": "Read/write pnpm-lock.yaml files",
   "keywords": [
     "pnpm",
@@ -37,14 +37,14 @@
     "semver": "^7.8.4",
     "strip-bom": "^5.0.0",
     "write-file-atomic": "^7.0.1",
-    "@pnpm/constants": "1100.0.0",
     "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/lockfile.types": "1100.0.12",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/lockfile.merger": "1100.0.13",
+    "@pnpm/lockfile.utils": "1100.1.1",
+    "@pnpm/network.git-utils": "1100.0.2",
     "@pnpm/error": "1100.0.1",
     "@pnpm/object.key-sorting": "1100.0.1",
-    "@pnpm/lockfile.merger": "1100.0.12",
-    "@pnpm/lockfile.utils": "1100.1.0",
-    "@pnpm/network.git-utils": "1100.0.2",
+    "@pnpm/lockfile.types": "1100.0.13",
     "@pnpm/types": "1101.3.2"
   },
   "peerDependencies": {
@@ -60,7 +60,7 @@
     "tempy": "3.0.0",
     "write-yaml-file": "^6.0.0",
     "yaml-tag": "1.1.0",
-    "@pnpm/lockfile.fs": "1100.1.7",
+    "@pnpm/lockfile.fs": "1100.1.9",
     "@pnpm/logger": "1100.0.0"
   },
   "engines": {