@pnpm/lockfile.utils 1004.0.5 → 1004.0.6

package/lib/assertRegistryShapedResolution.d.ts

@@ -0,0 +1,17 @@
+import { type PackageSnapshot } from '@pnpm/lockfile.types';
+/**
+ * Matches the known git-host tarball download endpoints. Schemes and
+ * hostnames are case-insensitive, so the URL is matched against a lowercased
+ * copy: a tampered `https://CODELOAD.GITHUB.COM/...` must not slip past as a
+ * non-git-hosted (and therefore registry-trusted) tarball. Only the
+ * lowercased copy is inspected; the original URL is never rewritten.
+ */
+export declare function isGitHostedTarballUrl(url: string): boolean;
+/**
+ * A registry-style depPath (name@semver) must be backed by a registry-shaped
+ * resolution: the allowBuild policy derives a trusted package identity from
+ * that key shape, which is only sound while this invariant holds. The check
+ * is offline and runs wherever a lockfile entry is materialized into a
+ * fetchable resolution or its scripts are about to run.
+ */
+export declare function assertRegistryShapedResolution(depPath: string, pkgSnapshot: PackageSnapshot): void;

package/lib/assertRegistryShapedResolution.js

@@ -0,0 +1,102 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isGitHostedTarballUrl = isGitHostedTarballUrl;
+exports.assertRegistryShapedResolution = assertRegistryShapedResolution;
+const error_1 = require("@pnpm/error");
+const dp = __importStar(require("@pnpm/dependency-path"));
+/**
+ * Matches the known git-host tarball download endpoints. Schemes and
+ * hostnames are case-insensitive, so the URL is matched against a lowercased
+ * copy: a tampered `https://CODELOAD.GITHUB.COM/...` must not slip past as a
+ * non-git-hosted (and therefore registry-trusted) tarball. Only the
+ * lowercased copy is inspected; the original URL is never rewritten.
+ */
+function isGitHostedTarballUrl(url) {
+    const lowerUrl = url.toLowerCase();
+    return (lowerUrl.startsWith('https://codeload.github.com/') ||
+        lowerUrl.startsWith('https://bitbucket.org/') ||
+        lowerUrl.startsWith('https://gitlab.com/')) && lowerUrl.includes('tar.gz');
+}
+/**
+ * A registry-style depPath (name@semver) must be backed by a registry-shaped
+ * resolution: the allowBuild policy derives a trusted package identity from
+ * that key shape, which is only sound while this invariant holds. The check
+ * is offline and runs wherever a lockfile entry is materialized into a
+ * fetchable resolution or its scripts are about to run.
+ */
+function assertRegistryShapedResolution(depPath, pkgSnapshot) {
+    const { name, version, nonSemverVersion } = dp.parse(depPath);
+    if (name == null || version == null || nonSemverVersion != null)
+        return;
+    if (isRegistryShapedResolution(pkgSnapshot.resolution))
+        return;
+    throw new error_1.PnpmError('RESOLUTION_SHAPE_MISMATCH', `Cannot use the lockfile entry of "${depPath}": its registry-style dependency path is backed by a non-registry resolution.`, { hint: 'The lockfile may be corrupted or have been tampered with. Restore it from a trusted source, or delete it and re-run installation without --frozen-lockfile to regenerate.' });
+}
+function isRegistryShapedResolution(resolution) {
+    if (resolution == null)
+        return true;
+    if (typeof resolution !== 'object')
+        return false;
+    const { type, gitHosted, tarball, variants } = resolution;
+    if (type === 'variations') {
+        return Array.isArray(variants) && variants.every((variant) => isRegistryShapedResolution(variant?.resolution));
+    }
+    if (type != null)
+        return false;
+    // Plain tarball / registry resolution. The lockfile is parsed from YAML
+    // without schema validation, so the `gitHosted` flag is not trustworthy on
+    // its own: a tampered entry could set a non-boolean (dodging a strict
+    // `=== true`) or an explicit `false` on a git-host URL (the loader only
+    // backfills the flag when absent). Treat any non-boolean flag as git-hosted
+    // and gate on the URL so the verdict never depends on the flag alone.
+    if (gitHosted != null && (typeof gitHosted !== 'boolean' || gitHosted))
+        return false;
+    // A registry resolution reconstructs its tarball URL from name+version, so
+    // an absent/empty `tarball` is registry-shaped. When a URL with a scheme is
+    // present it must be an http(s) artifact: a `file:` tarball under a
+    // name@semver key is a local artifact that a package-name rule must not
+    // approve.
+    if (typeof tarball === 'string' && tarball !== '') {
+        if (hasUrlScheme(tarball)) {
+            if (!/^https?:\/\//i.test(tarball))
+                return false;
+            if (isGitHostedTarballUrl(tarball))
+                return false;
+        }
+        else if (tarball.startsWith('/') || tarball.startsWith('\\')) {
+            // Protocol-relative and path-absolute forms (`//host`, `/\host`, ...)
+            // can escape the configured registry host when resolved as a URL.
+            return false;
+        }
+        // A scheme-less relative path is resolved against the configured
+        // registry, so it cannot point off-registry.
+    }
+    return true;
+}
+function hasUrlScheme(url) {
+    return /^[a-z][a-z0-9+.-]*:/i.test(url);
+}
+//# sourceMappingURL=assertRegistryShapedResolution.js.map

package/lib/assertRegistryShapedResolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertRegistryShapedResolution.js","sourceRoot":"","sources":["../src/assertRegistryShapedResolution.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAWA,sDAOC;AASD,wEAQC;AAnCD,uCAAuC;AAEvC,0DAA2C;AAE3C;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAE,GAAW;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IAClC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,8BAA8B,CAAC;QACnD,QAAQ,CAAC,UAAU,CAAC,wBAAwB,CAAC;QAC7C,QAAQ,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAC3C,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,8BAA8B,CAAE,OAAe,EAAE,WAA4B;IAC3F,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC7D,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,gBAAgB,IAAI,IAAI;QAAE,OAAM;IACvE,IAAI,0BAA0B,CAAC,WAAW,CAAC,UAAU,CAAC;QAAE,OAAM;IAC9D,MAAM,IAAI,iBAAS,CAAC,2BAA2B,EAC7C,qCAAqC,OAAO,+EAA+E,EAC3H,EAAE,IAAI,EAAE,2KAA2K,EAAE,CACtL,CAAA;AACH,CAAC;AAED,SAAS,0BAA0B,CAAE,UAAmB;IACtD,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAChD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,UAK9C,CAAA;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAC9C,CAAC,OAAO,EAAE,EAAE,CAAC,0BAA0B,CAAE,OAAoC,EAAE,UAAU,CAAC,CAC3F,CAAA;IACH,CAAC;IACD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,KAAK,CAAA;IAC9B,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,wEAAwE;IACxE,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IACpF,2EAA2E;IAC3E,4EAA4E;IAC5E,oEAAoE;IACpE,wEAAwE;IACxE,WAAW;IACX,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;YAChD,IAAI,qBAAqB,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;QAClD,CAAC;aAAM,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,sEAAsE;YACtE,kEAAkE;YAClE,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iEAAiE;QACjE,6CAA6C;IAC/C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,YAAY,CAAE,GAAW;IAChC,OAAO,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACzC,CAAC"}

package/lib/index.d.ts

@@ -1,4 +1,5 @@
 import { refToRelative } from '@pnpm/dependency-path';
+export { assertRegistryShapedResolution, isGitHostedTarballUrl } from './assertRegistryShapedResolution.js';
 export { nameVerFromPkgSnapshot } from './nameVerFromPkgSnapshot.js';
 export { packageIdFromSnapshot } from './packageIdFromSnapshot.js';
 export { packageIsIndependent } from './packageIsIndependent.js';

package/lib/index.js

@@ -14,8 +14,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getPkgShortId = exports.refIsLocalDirectory = exports.refIsLocalTarball = exports.pkgSnapshotToResolution = exports.packageIsIndependent = exports.packageIdFromSnapshot = exports.nameVerFromPkgSnapshot = void 0;
+exports.getPkgShortId = exports.refIsLocalDirectory = exports.refIsLocalTarball = exports.pkgSnapshotToResolution = exports.packageIsIndependent = exports.packageIdFromSnapshot = exports.nameVerFromPkgSnapshot = exports.isGitHostedTarballUrl = exports.assertRegistryShapedResolution = void 0;
 const dependency_path_1 = require("@pnpm/dependency-path");
+var assertRegistryShapedResolution_js_1 = require("./assertRegistryShapedResolution.js");
+Object.defineProperty(exports, "assertRegistryShapedResolution", { enumerable: true, get: function () { return assertRegistryShapedResolution_js_1.assertRegistryShapedResolution; } });
+Object.defineProperty(exports, "isGitHostedTarballUrl", { enumerable: true, get: function () { return assertRegistryShapedResolution_js_1.isGitHostedTarballUrl; } });
 var nameVerFromPkgSnapshot_js_1 = require("./nameVerFromPkgSnapshot.js");
 Object.defineProperty(exports, "nameVerFromPkgSnapshot", { enumerable: true, get: function () { return nameVerFromPkgSnapshot_js_1.nameVerFromPkgSnapshot; } });
 var packageIdFromSnapshot_js_1 = require("./packageIdFromSnapshot.js");

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,2DAAqD;AAErD,yEAAoE;AAA3D,mIAAA,sBAAsB,OAAA;AAC/B,uEAAkE;AAAzD,iIAAA,qBAAqB,OAAA;AAC9B,qEAAgE;AAAvD,+HAAA,oBAAoB,OAAA;AAC7B,2EAAsE;AAA7D,qIAAA,uBAAuB,OAAA;AAChC,+DAA+E;AAAtE,yHAAA,iBAAiB,OAAA;AAAE,2HAAA,mBAAmB,OAAA;AAC/C,uDAAoC;AAEpC,6BAA6B;AAChB,QAAA,aAAa,GAAG,+BAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,2DAAqD;AAErD,yFAA2G;AAAlG,mJAAA,8BAA8B,OAAA;AAAE,0IAAA,qBAAqB,OAAA;AAC9D,yEAAoE;AAA3D,mIAAA,sBAAsB,OAAA;AAC/B,uEAAkE;AAAzD,iIAAA,qBAAqB,OAAA;AAC9B,qEAAgE;AAAvD,+HAAA,oBAAoB,OAAA;AAC7B,2EAAsE;AAA7D,qIAAA,uBAAuB,OAAA;AAChC,+DAA+E;AAAtE,yHAAA,iBAAiB,OAAA;AAAE,2HAAA,mBAAmB,OAAA;AAC/C,uDAAoC;AAEpC,6BAA6B;AAChB,QAAA,aAAa,GAAG,+BAAa,CAAA"}

package/lib/pkgSnapshotToResolution.js

@@ -7,8 +7,10 @@ exports.pkgSnapshotToResolution = pkgSnapshotToResolution;
 const url_1 = __importDefault(require("url"));
 const error_1 = require("@pnpm/error");
 const get_npm_tarball_url_1 = __importDefault(require("get-npm-tarball-url"));
+const assertRegistryShapedResolution_js_1 = require("./assertRegistryShapedResolution.js");
 const nameVerFromPkgSnapshot_js_1 = require("./nameVerFromPkgSnapshot.js");
 function pkgSnapshotToResolution(depPath, pkgSnapshot, registries) {
+    (0, assertRegistryShapedResolution_js_1.assertRegistryShapedResolution)(depPath, pkgSnapshot);
     const resolution = pkgSnapshot.resolution;
     // Tarball-shaped resolutions (no `type` field) must carry `integrity`,
     // except where the URL itself anchors the bytes:

package/lib/pkgSnapshotToResolution.js.map

@@ -1 +1 @@
-{"version":3,"file":"pkgSnapshotToResolution.js","sourceRoot":"","sources":["../src/pkgSnapshotToResolution.ts"],"names":[],"mappings":";;;;;AAQA,0DAgEC;AAxED,8CAAqB;AACrB,uCAAuC;AAIvC,8EAAkD;AAClD,2EAAoE;AAEpE,SAAgB,uBAAuB,CACrC,OAAe,EACf,WAA4B,EAC5B,UAAsB;IAEtB,MAAM,UAAU,GAAG,WAAW,CAAC,UAA+B,CAAA;IAC9D,uEAAuE;IACvE,iDAAiD;IACjD,oEAAoE;IACpE,sDAAsD;IACtD,uEAAuE;IACvE,sEAAsE;IACtE,oEAAoE;IACpE,2DAA2D;IAC3D,qEAAqE;IACrE,oEAAoE;IACpE,2DAA2D;IAC3D,IACE,UAAU,CAAC,IAAI,IAAI,IAAI;QACvB,UAAU,CAAC,SAAS,IAAI,IAAI;QAC5B,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,UAAU,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,IAAI,IAAI,qBAAqB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,iBAAS,CAAC,2BAA2B,EAC7C,2BAA2B,OAAO,+FAA+F,EACjI,EAAE,IAAI,EAAE,2KAA2K,EAAE,CACtL,CAAA;IACH,CAAC;IACD,IACE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC;QACvC,UAAU,CAAC,SAAS,KAAK,IAAI,EAC7B,CAAC;QACD,OAAO,WAAW,CAAC,UAAwB,CAAA;IAC7C,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAA,kDAAsB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACtE,IAAI,QAAQ,GAAW,EAAE,CAAA;IACzB,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpB,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAA;IAC/B,CAAC;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,CAAE,WAAW,CAAC,UAAgC,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IAChC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,IAAI,aAAG,CAAC,GAAG,CAAE,WAAW,CAAC,UAAgC,CAAC,OAAO,EACzE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CACnD,CAAC,QAAQ,EAAE,CAAA;IACd,CAAC;IACD,OAAO;QACL,GAAG,WAAW,CAAC,UAAU;QACzB,OAAO;KACM,CAAA;IAEf,SAAS,UAAU,CAAE,QAAgB;QACnC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,iDAAiD,OAAO,EAAE,CAAC,CAAA;QAC7E,CAAC;QACD,OAAO,IAAA,6BAAgB,EAAC,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IACtD,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,6CAA6C;AAC7C,SAAS,qBAAqB,CAAE,GAAW;IACzC,OAAO,CACL,GAAG,CAAC,UAAU,CAAC,8BAA8B,CAAC;QAC9C,GAAG,CAAC,UAAU,CAAC,wBAAwB,CAAC;QACxC,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC,CACtC,CAAA;AACH,CAAC"}
+{"version":3,"file":"pkgSnapshotToResolution.js","sourceRoot":"","sources":["../src/pkgSnapshotToResolution.ts"],"names":[],"mappings":";;;;;AASA,0DAiEC;AA1ED,8CAAqB;AACrB,uCAAuC;AAIvC,8EAAkD;AAClD,2FAAoF;AACpF,2EAAoE;AAEpE,SAAgB,uBAAuB,CACrC,OAAe,EACf,WAA4B,EAC5B,UAAsB;IAEtB,IAAA,kEAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACpD,MAAM,UAAU,GAAG,WAAW,CAAC,UAA+B,CAAA;IAC9D,uEAAuE;IACvE,iDAAiD;IACjD,oEAAoE;IACpE,sDAAsD;IACtD,uEAAuE;IACvE,sEAAsE;IACtE,oEAAoE;IACpE,2DAA2D;IAC3D,qEAAqE;IACrE,oEAAoE;IACpE,2DAA2D;IAC3D,IACE,UAAU,CAAC,IAAI,IAAI,IAAI;QACvB,UAAU,CAAC,SAAS,IAAI,IAAI;QAC5B,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,UAAU,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,IAAI,IAAI,qBAAqB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,iBAAS,CAAC,2BAA2B,EAC7C,2BAA2B,OAAO,+FAA+F,EACjI,EAAE,IAAI,EAAE,2KAA2K,EAAE,CACtL,CAAA;IACH,CAAC;IACD,IACE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC;QACvC,UAAU,CAAC,SAAS,KAAK,IAAI,EAC7B,CAAC;QACD,OAAO,WAAW,CAAC,UAAwB,CAAA;IAC7C,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAA,kDAAsB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACtE,IAAI,QAAQ,GAAW,EAAE,CAAA;IACzB,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpB,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAA;IAC/B,CAAC;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,CAAE,WAAW,CAAC,UAAgC,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IAChC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,IAAI,aAAG,CAAC,GAAG,CAAE,WAAW,CAAC,UAAgC,CAAC,OAAO,EACzE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CACnD,CAAC,QAAQ,EAAE,CAAA;IACd,CAAC;IACD,OAAO;QACL,GAAG,WAAW,CAAC,UAAU;QACzB,OAAO;KACM,CAAA;IAEf,SAAS,UAAU,CAAE,QAAgB;QACnC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,iDAAiD,OAAO,EAAE,CAAC,CAAA;QAC7E,CAAC;QACD,OAAO,IAAA,6BAAgB,EAAC,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IACtD,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,6CAA6C;AAC7C,SAAS,qBAAqB,CAAE,GAAW;IACzC,OAAO,CACL,GAAG,CAAC,UAAU,CAAC,8BAA8B,CAAC;QAC9C,GAAG,CAAC,UAAU,CAAC,wBAAwB,CAAC;QACxC,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC,CACtC,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.utils",
-  "version": "1004.0.5",
+  "version": "1004.0.6",
   "description": "Utils for dealing with pnpm-lock.yaml",
   "keywords": [
     "pnpm",
@@ -28,18 +28,18 @@
   "dependencies": {
     "get-npm-tarball-url": "^2.1.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "@pnpm/dependency-path": "1001.1.10",
-    "@pnpm/resolver-base": "1005.4.2",
     "@pnpm/error": "1000.1.0",
-    "@pnpm/lockfile.types": "1002.1.1",
-    "@pnpm/types": "1001.3.0"
+    "@pnpm/dependency-path": "1001.1.11",
+    "@pnpm/lockfile.types": "1002.1.2",
+    "@pnpm/resolver-base": "1005.4.3",
+    "@pnpm/types": "1001.3.1"
   },
   "devDependencies": {
     "@types/ramda": "0.29.12",
     "tempy": "^1.0.1",
     "write-yaml-file": "^5.0.0",
     "yaml-tag": "1.1.0",
-    "@pnpm/lockfile.utils": "1004.0.5"
+    "@pnpm/lockfile.utils": "1004.0.6"
   },
   "engines": {
     "node": ">=18.12"