@pnpm/pkg-manifest.utils 1100.1.2 → 1100.1.3

package/lib/convertEnginesRuntimeToDependencies.js

@@ -19,8 +19,17 @@ export function convertEnginesRuntimeToDependencies(manifest, enginesFieldName,
             globalWarn(`Installation of ${runtimeName} versions is not supported in WebContainer`);
         }
         else {
-            manifest[dependenciesFieldName] ??= {};
-            manifest[dependenciesFieldName][runtimeName] = `runtime:${runtime.version}`;
+            const deps = (manifest[dependenciesFieldName] ??= {});
+            // Use Object.defineProperty so a future RUNTIME_NAMES entry that
+            // happens to match an inherited property name (`__proto__`,
+            // `constructor`, `prototype`) becomes a regular own data property
+            // instead of altering Object.prototype.
+            Object.defineProperty(deps, runtimeName, {
+                value: `runtime:${runtime.version}`,
+                enumerable: true,
+                writable: true,
+                configurable: true,
+            });
         }
     }
 }

package/lib/updateProjectManifestObject.js

@@ -32,15 +32,15 @@ export async function updateProjectManifestObject(prefix, packageManifest, packa
             const spec = packageSpec.bareSpecifier ?? findSpec(packageSpec.alias, packageManifest);
             if (spec) {
                 packageManifest[packageSpec.saveType] = packageManifest[packageSpec.saveType] ?? {};
-                packageManifest[packageSpec.saveType][packageSpec.alias] = spec;
+                defineDepEntry(packageManifest[packageSpec.saveType], packageSpec.alias, spec);
                 for (const deptype of DEPENDENCIES_FIELDS) {
                     if (deptype !== packageSpec.saveType) {
-                        delete packageManifest[deptype]?.[packageSpec.alias];
+                        deleteDepEntry(packageManifest[deptype], packageSpec.alias);
                     }
                 }
                 if (packageSpec.peer === true) {
                     packageManifest.peerDependencies = packageManifest.peerDependencies ?? {};
-                    packageManifest.peerDependencies[packageSpec.alias] = getPeerSpecifier(spec, packageSpec.resolvedVersion, packageSpec.pinnedVersion);
+                    defineDepEntry(packageManifest.peerDependencies, packageSpec.alias, getPeerSpecifier(spec, packageSpec.resolvedVersion, packageSpec.pinnedVersion));
                 }
             }
         }
@@ -48,7 +48,7 @@ export async function updateProjectManifestObject(prefix, packageManifest, packa
             const usedDepType = guessDependencyType(packageSpec.alias, packageManifest) ?? 'dependencies';
             if (usedDepType !== 'peerDependencies') {
                 packageManifest[usedDepType] = packageManifest[usedDepType] ?? {};
-                packageManifest[usedDepType][packageSpec.alias] = packageSpec.bareSpecifier;
+                defineDepEntry(packageManifest[usedDepType], packageSpec.alias, packageSpec.bareSpecifier);
             }
         }
     }
@@ -60,10 +60,40 @@ export async function updateProjectManifestObject(prefix, packageManifest, packa
 }
 function findSpec(alias, manifest) {
     const foundDepType = guessDependencyType(alias, manifest);
-    return foundDepType && manifest[foundDepType][alias];
+    if (foundDepType == null)
+        return undefined;
+    const deps = manifest[foundDepType];
+    return Object.hasOwn(deps, alias) ? deps[alias] : undefined;
 }
 export function guessDependencyType(alias, manifest) {
-    return DEPENDENCIES_OR_PEER_FIELDS
-        .find((depField) => manifest[depField]?.[alias] === '' || Boolean(manifest[depField]?.[alias]));
+    return DEPENDENCIES_OR_PEER_FIELDS.find((depField) => {
+        const deps = manifest[depField];
+        if (deps == null || !Object.hasOwn(deps, alias))
+            return false;
+        return deps[alias] === '' || Boolean(deps[alias]);
+    });
+}
+/**
+ * Write a dependency entry without risking prototype pollution: even when the
+ * alias matches a name like `__proto__`, `Object.defineProperty` creates a
+ * regular own data property rather than reaching through the setter.
+ */
+function defineDepEntry(target, alias, value) {
+    Object.defineProperty(target, alias, {
+        value,
+        enumerable: true,
+        writable: true,
+        configurable: true,
+    });
+}
+/**
+ * Mirror of `defineDepEntry` for deletes. The `Object.hasOwn` guard keeps the
+ * `delete` from reaching into the prototype chain when the alias matches an
+ * inherited property like `constructor`.
+ */
+function deleteDepEntry(target, alias) {
+    if (target != null && Object.hasOwn(target, alias)) {
+        delete target[alias];
+    }
 }
 //# sourceMappingURL=updateProjectManifestObject.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/pkg-manifest.utils",
-  "version": "1100.1.2",
+  "version": "1100.1.3",
   "description": "Utils for dealing with package manifest",
   "keywords": [
     "pnpm",
@@ -25,10 +25,10 @@
   ],
   "dependencies": {
     "semver": "^7.7.2",
-    "@pnpm/core-loggers": "1100.0.2",
-    "@pnpm/error": "1100.0.0",
     "@pnpm/deps.peer-range": "1100.0.1",
-    "@pnpm/types": "1101.1.0"
+    "@pnpm/core-loggers": "1100.0.2",
+    "@pnpm/types": "1101.1.0",
+    "@pnpm/error": "1100.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -36,8 +36,8 @@
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "@types/semver": "7.7.1",
-    "@pnpm/pkg-manifest.utils": "1100.1.2",
-    "@pnpm/logger": "1100.0.0"
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/pkg-manifest.utils": "1100.1.3"
   },
   "engines": {
     "node": ">=22.13"