@pnpm/releasing.commands 1100.4.2 → 1100.4.4

package/lib/stage/download.js

@@ -1,9 +1,11 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { PnpmError } from '@pnpm/error';
+import { createTarballFilename } from '../tarball/safeTarballFilename.js';
 import { summarizeTarball } from '../tarball/summarizeTarball.js';
 import { createStageContext } from './context.js';
 import { requireStageId } from './parsing.js';
-import { normalizePackageName, renderTarballSummary } from './rendering.js';
+import { renderTarballSummary } from './rendering.js';
 import { stageRequest } from './request.js';
 export async function stageDownload(opts, params) {
     const stageId = requireStageId(params, 'download');
@@ -15,9 +17,14 @@ export async function stageDownload(opts, params) {
     });
     const tarballData = Buffer.from(await response.arrayBuffer());
     const summary = await summarizeTarball(tarballData);
-    const filename = `${normalizePackageName(summary.name)}-${summary.version}-${stageId}.tgz`;
+    const filename = createTarballFilename({ name: summary.name, version: summary.version, suffix: stageId });
     const downloadedSummary = { ...summary, filename };
-    await fs.writeFile(path.resolve(opts.dir ?? process.cwd(), filename), tarballData);
+    const downloadDir = path.resolve(opts.dir ?? process.cwd());
+    const outputPath = path.resolve(downloadDir, filename);
+    if (path.dirname(outputPath) !== downloadDir) {
+        throw new PnpmError('INVALID_TARBALL_FILENAME', `Invalid tarball filename "${filename}".`);
+    }
+    await fs.writeFile(outputPath, tarballData);
     if (opts.json)
         return JSON.stringify({ [summary.name]: downloadedSummary }, null, 2);
     return `${renderTarballSummary(downloadedSummary)}\n${filename}`;

package/lib/stage/rendering.d.ts

@@ -1,5 +1,6 @@
 import type { PublishSummary } from '../tarball/publishSummary.js';
 import type { StageItem } from './types.js';
+export { normalizePackageName } from '../tarball/safeTarballFilename.js';
 export declare function renderStageItem(item: StageItem): string;
 export declare function renderTarballSummary(summary: PublishSummary): string;
 export declare function renderStagePublishSummary(summary: PublishSummary | {
@@ -8,4 +9,3 @@ export declare function renderStagePublishSummary(summary: PublishSummary | {
 }, opts: {
     dryRun: boolean;
 }): string;
-export declare function normalizePackageName(name: string): string;

package/lib/stage/rendering.js

@@ -1,3 +1,4 @@
+export { normalizePackageName } from '../tarball/safeTarballFilename.js';
 export function renderStageItem(item) {
     const { id, packageName, version, tag, createdAt, actor, actorType, shasum, ...rest } = item;
     return renderKeyValues({
@@ -38,9 +39,6 @@ export function renderStagePublishSummary(summary, opts) {
     }
     return `+ ${id} (staged)`;
 }
-export function normalizePackageName(name) {
-    return name.replace('@', '').replace('/', '-');
-}
 function renderKeyValues(values) {
     return Object.entries(values)
         .flatMap(([key, value]) => value == null ? [] : [`${key}: ${renderValue(value)}`])

package/lib/tarball/safeTarballFilename.d.ts

@@ -0,0 +1,8 @@
+interface CreateTarballFilenameOptions {
+    name: string;
+    version: string;
+    suffix?: string;
+}
+export declare function createTarballFilename({ name, version, suffix }: CreateTarballFilenameOptions): string;
+export declare function normalizePackageName(name: string): string;
+export {};

package/lib/tarball/safeTarballFilename.js

@@ -0,0 +1,21 @@
+import path from 'node:path';
+import { PnpmError } from '@pnpm/error';
+import { valid } from 'semver';
+import validateNpmPackageName from 'validate-npm-package-name';
+export function createTarballFilename({ name, version, suffix }) {
+    if (!validateNpmPackageName(name).validForOldPackages) {
+        throw new PnpmError('INVALID_PACKAGE_NAME', `Invalid package name "${name}".`);
+    }
+    if (!valid(version)) {
+        throw new PnpmError('INVALID_PACKAGE_VERSION', `Invalid package version "${version}".`);
+    }
+    const filename = `${normalizePackageName(name)}-${version}${suffix == null ? '' : `-${suffix}`}.tgz`;
+    if (path.basename(filename) !== filename || path.win32.basename(filename) !== filename) {
+        throw new PnpmError('INVALID_TARBALL_FILENAME', `Invalid tarball filename "${filename}".`);
+    }
+    return filename;
+}
+export function normalizePackageName(name) {
+    return name.replace('@', '').replace('/', '-');
+}
+//# sourceMappingURL=safeTarballFilename.js.map

package/lib/tarball/summarizeTarball.js

@@ -3,6 +3,7 @@ import { gunzipSync } from 'node:zlib';
 import { PnpmError } from '@pnpm/error';
 import tar from 'tar-stream';
 import { extractBundledDependencies } from './publishSummary.js';
+import { createTarballFilename } from './safeTarballFilename.js';
 /**
  * Parse a packed (gzipped or plain) tarball buffer and return the same
  * {@link PublishSummary} shape that `pnpm publish --json` emits.
@@ -66,7 +67,7 @@ export async function summarizeTarball(tarballData) {
         unpackedSize,
         shasum: createHash('sha1').update(tarballData).digest('hex'),
         integrity: `sha512-${createHash('sha512').update(tarballData).digest('base64')}`,
-        filename: `${normalizePackageName(manifest.name)}-${manifest.version}.tgz`,
+        filename: createTarballFilename({ name: manifest.name, version: manifest.version }),
         files,
         entryCount,
         bundled: bundled.size > 0 ? Array.from(bundled).sort() : extractBundledDependencies(manifest),
@@ -80,7 +81,4 @@ function maybeGunzip(tarballData) {
         return tarballData;
     }
 }
-function normalizePackageName(name) {
-    return name.replace('@', '').replace('/', '-');
-}
 //# sourceMappingURL=summarizeTarball.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/releasing.commands",
-  "version": "1100.4.2",
+  "version": "1100.4.4",
   "description": "Commands for deploy, pack, and publish",
   "keywords": [
     "pnpm",
@@ -50,36 +50,36 @@
     "validate-npm-package-name": "7.0.2",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/bins.resolver": "1100.0.6",
+    "@pnpm/bins.resolver": "1100.0.7",
     "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/cli.common-cli-options-help": "1100.0.1",
-    "@pnpm/cli.utils": "1101.0.9",
-    "@pnpm/config.reader": "1101.6.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.7",
+    "@pnpm/cli.common-cli-options-help": "1100.0.2",
+    "@pnpm/cli.utils": "1101.0.11",
+    "@pnpm/config.pick-registry-for-package": "1100.0.8",
+    "@pnpm/config.reader": "1101.8.0",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.6",
-    "@pnpm/engine.runtime.node-resolver": "1101.1.4",
-    "@pnpm/engine.runtime.commands": "1100.1.2",
-    "@pnpm/exec.pnpm-cli-runner": "1100.0.1",
-    "@pnpm/exec.lifecycle": "1100.0.15",
-    "@pnpm/fetching.directory-fetcher": "1100.0.14",
+    "@pnpm/deps.path": "1100.0.7",
+    "@pnpm/engine.runtime.commands": "1100.1.4",
+    "@pnpm/engine.runtime.node-resolver": "1101.1.6",
     "@pnpm/error": "1100.0.0",
+    "@pnpm/exec.lifecycle": "1100.0.17",
+    "@pnpm/fetching.directory-fetcher": "1100.0.16",
+    "@pnpm/exec.pnpm-cli-runner": "1100.0.1",
+    "@pnpm/fs.indexed-pkg-importer": "1100.0.13",
     "@pnpm/fs.is-empty-dir-or-nothing": "1100.0.0",
     "@pnpm/fs.packlist": "1100.0.1",
-    "@pnpm/installing.client": "1100.2.5",
-    "@pnpm/fs.indexed-pkg-importer": "1100.0.11",
-    "@pnpm/lockfile.types": "1100.0.9",
-    "@pnpm/network.auth-header": "1101.1.0",
-    "@pnpm/lockfile.fs": "1100.1.3",
-    "@pnpm/installing.commands": "1100.7.2",
+    "@pnpm/installing.client": "1100.2.7",
+    "@pnpm/lockfile.fs": "1100.1.4",
+    "@pnpm/lockfile.types": "1100.0.10",
+    "@pnpm/installing.commands": "1100.8.0",
+    "@pnpm/network.auth-header": "1101.1.1",
+    "@pnpm/network.fetch": "1100.1.2",
     "@pnpm/network.git-utils": "1100.0.1",
-    "@pnpm/releasing.exportable-manifest": "1100.1.3",
-    "@pnpm/resolving.resolver-base": "1100.4.0",
     "@pnpm/network.web-auth": "1101.1.0",
-    "@pnpm/workspace.projects-sorter": "1100.0.5",
-    "@pnpm/types": "1101.3.0",
-    "@pnpm/network.fetch": "1100.1.0",
-    "@pnpm/workspace.projects-filter": "1100.0.18"
+    "@pnpm/releasing.exportable-manifest": "1100.1.5",
+    "@pnpm/resolving.resolver-base": "1100.4.1",
+    "@pnpm/types": "1101.3.1",
+    "@pnpm/workspace.projects-filter": "1100.0.20",
+    "@pnpm/workspace.projects-sorter": "1100.0.6"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1001.0.1"
@@ -102,16 +102,16 @@
     "tar": "^7.5.15",
     "undici": "^7.26.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.13",
+    "@pnpm/assert-project": "1100.0.15",
     "@pnpm/catalogs.config": "1100.0.0",
-    "@pnpm/hooks.pnpmfile": "1100.0.12",
+    "@pnpm/hooks.pnpmfile": "1100.0.14",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.13",
-    "@pnpm/test-ipc-server": "1100.0.0",
+    "@pnpm/prepare": "1100.0.15",
+    "@pnpm/releasing.commands": "1100.4.4",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/releasing.commands": "1100.4.2",
-    "@pnpm/testing.command-defaults": "1100.0.3",
-    "@pnpm/testing.registry-mock": "1100.0.3"
+    "@pnpm/test-ipc-server": "1100.0.0",
+    "@pnpm/testing.command-defaults": "1100.0.5",
+    "@pnpm/testing.registry-mock": "1100.0.5"
   },
   "engines": {
     "node": ">=22.13"