@pnpm/lockfile.preferred-versions 1100.0.16 → 1100.0.18

package/lib/index.js

@@ -3,14 +3,18 @@ import { getAllDependenciesFromManifest } from '@pnpm/pkg-manifest.utils';
 import { DIRECT_DEP_SELECTOR_WEIGHT, EXISTING_VERSION_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
 import getVersionSelectorType from 'version-selector-type';
 export function getPreferredVersionsFromLockfileAndManifests(snapshots, manifests) {
-    const preferredVersions = {};
+    // All maps in here are keyed by package names and specifiers coming from
+    // manifests and the lockfile — attacker-controlled inputs. Null-prototype
+    // objects make a crafted key (e.g. `__proto__`) a plain own key instead of
+    // a write through Object.prototype.
+    const preferredVersions = Object.create(null);
     for (const manifest of manifests) {
         const specs = getAllDependenciesFromManifest(manifest);
         for (const [name, spec] of Object.entries(specs)) {
             const selector = getVersionSelectorType(spec);
             if (!selector)
                 continue;
-            preferredVersions[name] = preferredVersions[name] ?? {};
+            preferredVersions[name] = preferredVersions[name] ?? Object.create(null);
             preferredVersions[name][spec] = {
                 selectorType: selector.type,
                 weight: DIRECT_DEP_SELECTOR_WEIGHT,
@@ -28,7 +32,7 @@ function addPreferredVersionsFromLockfile(snapshots, preferredVersions) {
     // with the same version in the lockfile due to peer dependency resolution. To
     // avoid inflating the weight of package versions that appear multiple times,
     // generate a map with only the unique set to iterate over.
-    const uniqueNameVersions = {};
+    const uniqueNameVersions = Object.create(null);
     for (const [depPath, snapshot] of Object.entries(snapshots)) {
         const { name, version } = nameVerFromPkgSnapshot(depPath, snapshot);
         uniqueNameVersions[name] ??= new Set();
@@ -36,7 +40,7 @@ function addPreferredVersionsFromLockfile(snapshots, preferredVersions) {
     }
     for (const [name, versions] of Object.entries(uniqueNameVersions)) {
         for (const version of versions) {
-            preferredVersions[name] ??= {};
+            preferredVersions[name] ??= Object.create(null);
             const existingSelector = preferredVersions[name][version];
             if (existingSelector == null) {
                 preferredVersions[name][version] = { selectorType: 'version', weight: EXISTING_VERSION_SELECTOR_WEIGHT };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.preferred-versions",
-  "version": "1100.0.16",
+  "version": "1100.0.18",
   "description": "Get preferred version from lockfile",
   "keywords": [
     "pnpm",
@@ -12,9 +12,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/lockfile/preferred-versions"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/lockfile/preferred-versions"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/lockfile/preferred-versions#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/lockfile/preferred-versions#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -30,13 +30,15 @@
   ],
   "dependencies": {
     "version-selector-type": "^3.0.0",
-    "@pnpm/lockfile.utils": "1100.0.13",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
+    "@pnpm/pkg-manifest.utils": "1100.2.6",
     "@pnpm/types": "1101.3.2",
-    "@pnpm/resolving.resolver-base": "1100.4.2",
-    "@pnpm/pkg-manifest.utils": "1100.2.5"
+    "@pnpm/lockfile.utils": "1100.1.1"
   },
   "devDependencies": {
-    "@pnpm/lockfile.preferred-versions": "1100.0.16"
+    "@jest/globals": "30.4.1",
+    "cross-env": "^10.1.0",
+    "@pnpm/lockfile.preferred-versions": "1100.0.18"
   },
   "engines": {
     "node": ">=22.13"
@@ -45,8 +47,9 @@
     "preset": "@pnpm/jest-config"
   },
   "scripts": {
-    "lint": "eslint \"src/**/*.ts\"",
-    "test": "pn compile",
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "test": "pn compile && pn .test",
+    ".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
     "compile": "tsgo --build && pn lint --fix"
   }
 }