@pnpm/releasing.commands 1100.5.1 → 1100.5.3

package/lib/deploy/deploy.js

@@ -12,6 +12,7 @@ import { install } from '@pnpm/installing.commands';
 import { getLockfileImporterId, readWantedLockfile, writeWantedLockfile } from '@pnpm/lockfile.fs';
 import { globalWarn, logger } from '@pnpm/logger';
 import { rimraf } from '@zkochan/rimraf';
+import { isSubdir } from 'is-subdir';
 import { pick } from 'ramda';
 import { renderHelp } from 'render-help';
 import { writeYamlFile } from 'write-yaml-file';
@@ -91,14 +92,35 @@ export async function handler(opts, params) {
     const selectedProject = selectedProjects[0].package;
     const deployDirParam = params[0];
     const deployDir = path.isAbsolute(deployDirParam) ? deployDirParam : path.join(opts.dir, deployDirParam);
+    validateDeployTarget(deployDir, {
+        dir: opts.dir,
+        force: opts.force,
+        projectDir: selectedProject.rootDir,
+        workspaceDir: opts.workspaceDir,
+    });
+    const normalizedDeployDir = path.resolve(deployDir);
+    const normalizedWorkspaceDir = path.resolve(opts.workspaceDir);
+    const workspaceChildTarget = isChildPath(normalizedDeployDir, normalizedWorkspaceDir);
+    if (workspaceChildTarget) {
+        createWorkspaceChildTargetParents(normalizedWorkspaceDir, normalizedDeployDir);
+    }
     if (!isEmptyDirOrNothing(deployDir)) {
         if (!opts.force) {
             throw new PnpmError('DEPLOY_DIR_NOT_EMPTY', `Deploy path ${deployDir} is not empty`);
         }
         logger.warn({ message: 'using --force, deleting deploy path', prefix: deployDir });
     }
+    if (workspaceChildTarget) {
+        validateWorkspaceChildTargetComponents(normalizedWorkspaceDir, normalizedDeployDir);
+    }
     await rimraf(deployDir);
-    await fs.promises.mkdir(deployDir, { recursive: true });
+    if (workspaceChildTarget) {
+        createWorkspaceChildTargetParents(normalizedWorkspaceDir, normalizedDeployDir);
+        createWorkspaceChildTargetDir(normalizedWorkspaceDir, normalizedDeployDir);
+    }
+    else {
+        await fs.promises.mkdir(deployDir, { recursive: true });
+    }
     const includeOnlyPackageFiles = !opts.deployAllFiles;
     await copyProject(selectedProject.rootDir, deployDir, { includeOnlyPackageFiles });
     if (opts.sharedWorkspaceLockfile) {
@@ -181,6 +203,114 @@ async function copyProject(src, dest, opts) {
     const importPkg = createIndexedPkgImporter('clone-or-copy');
     importPkg(dest, { filesMap, force: true, resolvedFrom: 'local-dir' });
 }
+function validateDeployTarget(deployDir, opts) {
+    const normalizedDeployDir = path.resolve(deployDir);
+    const workspaceDir = path.resolve(opts.workspaceDir);
+    const projectDir = path.resolve(opts.projectDir);
+    const dir = path.resolve(opts.dir);
+    if (samePath(normalizedDeployDir, workspaceDir)) {
+        throw unsafeDeployTarget(normalizedDeployDir, 'target is the workspace root');
+    }
+    if (isAncestorPath(normalizedDeployDir, workspaceDir)) {
+        throw unsafeDeployTarget(normalizedDeployDir, 'target contains the workspace root');
+    }
+    if (samePath(normalizedDeployDir, projectDir)) {
+        throw unsafeDeployTarget(normalizedDeployDir, 'target is the selected project root');
+    }
+    if (isAncestorPath(normalizedDeployDir, projectDir)) {
+        throw unsafeDeployTarget(normalizedDeployDir, 'target contains the selected project');
+    }
+    if (samePath(normalizedDeployDir, dir)) {
+        throw unsafeDeployTarget(normalizedDeployDir, 'target is the current directory');
+    }
+    if (isAncestorPath(normalizedDeployDir, dir)) {
+        throw unsafeDeployTarget(normalizedDeployDir, 'target contains the current directory');
+    }
+    if (opts.force && !isChildPath(normalizedDeployDir, workspaceDir)) {
+        throw unsafeDeployTarget(normalizedDeployDir, 'target is outside the workspace');
+    }
+    if (isChildPath(normalizedDeployDir, workspaceDir)) {
+        validateWorkspaceChildTargetComponents(workspaceDir, normalizedDeployDir);
+    }
+}
+function validateWorkspaceChildTargetComponents(workspaceDir, deployDir) {
+    const relative = path.relative(workspaceDir, deployDir);
+    let current = workspaceDir;
+    for (const component of relative.split(path.sep)) {
+        if (!component)
+            continue;
+        current = path.join(current, component);
+        let stat;
+        try {
+            stat = fs.lstatSync(current);
+        }
+        catch (error) {
+            if (isENOENT(error))
+                return;
+            throw error;
+        }
+        if (stat.isSymbolicLink()) {
+            throw unsafeDeployTarget(current, 'target path contains a symlink');
+        }
+    }
+}
+function createWorkspaceChildTargetParents(workspaceDir, deployDir) {
+    const parent = path.dirname(deployDir);
+    const relative = path.relative(workspaceDir, parent);
+    let current = workspaceDir;
+    for (const component of relative.split(path.sep)) {
+        if (!component)
+            continue;
+        current = path.join(current, component);
+        createWorkspaceChildTargetComponent(current);
+    }
+}
+function createWorkspaceChildTargetDir(workspaceDir, deployDir) {
+    try {
+        fs.mkdirSync(deployDir);
+    }
+    catch (error) {
+        if (isEEXIST(error)) {
+            throw unsafeDeployTarget(deployDir, 'target changed during deploy preparation');
+        }
+        throw error;
+    }
+    validateWorkspaceChildTargetComponents(workspaceDir, deployDir);
+}
+function createWorkspaceChildTargetComponent(component) {
+    try {
+        fs.mkdirSync(component);
+    }
+    catch (error) {
+        if (!isEEXIST(error))
+            throw error;
+    }
+    const stat = fs.lstatSync(component);
+    if (stat.isSymbolicLink()) {
+        throw unsafeDeployTarget(component, 'target path contains a symlink');
+    }
+    if (!stat.isDirectory()) {
+        throw unsafeDeployTarget(component, 'target path contains a non-directory');
+    }
+}
+function unsafeDeployTarget(deployDir, reason) {
+    return new PnpmError('INVALID_DEPLOY_TARGET', `Refusing to deploy to unsafe target ${deployDir}: ${reason}`);
+}
+function samePath(left, right) {
+    return path.normalize(left) === path.normalize(right);
+}
+function isAncestorPath(parent, child) {
+    return isChildPath(child, parent);
+}
+function isChildPath(child, parent) {
+    return !samePath(child, parent) && isSubdir(parent, child);
+}
+function isENOENT(error) {
+    return typeof error === 'object' && error != null && 'code' in error && error.code === 'ENOENT';
+}
+function isEEXIST(error) {
+    return typeof error === 'object' && error != null && 'code' in error && error.code === 'EEXIST';
+}
 async function deployFromSharedLockfile(opts, selectedProject, deployDir) {
     if (!opts.injectWorkspacePackages) {
         throw new PnpmError('DEPLOY_NONINJECTED_WORKSPACE', 'By default, starting from pnpm v10, we only deploy from workspaces that have "inject-workspace-packages=true" set', {

package/lib/pack-app/packApp.js

@@ -94,6 +94,13 @@ export async function handler(opts, params) {
     if (!entryPath) {
         throw new PnpmError('PACK_APP_MISSING_ENTRY', '"pnpm pack-app" requires a CJS entry file — pass --entry <path> or set "pnpm.app.entry" in package.json.');
     }
+    // `entry` may come from a repo-controlled package.json, so reject absolute
+    // paths and `..` traversal before touching the filesystem: the entry's
+    // contents get embedded into the produced executable, so an escaping path
+    // could exfiltrate a host file (e.g. an SSH key) into a distributable binary.
+    if (pathEscapesProject(entryPath)) {
+        throw new PnpmError('PACK_APP_ENTRY_OUTSIDE_PROJECT', `The entry path "${entryPath}" resolves outside the project directory.`, { hint: 'The entry must be a relative path inside the project directory, not an absolute path or one that escapes via "..".' });
+    }
     const resolvedEntry = path.resolve(opts.dir, entryPath);
     let entryStat;
     try {
@@ -105,6 +112,12 @@ export async function handler(opts, params) {
     if (!entryStat.isFile()) {
         throw new PnpmError('PACK_APP_ENTRY_NOT_FILE', `Entry path must be a regular file: ${resolvedEntry}`);
     }
+    // Defense in depth against a same-name symlink that points out of the
+    // project: resolve symlinks and require the real path to stay within the
+    // (also symlink-resolved) project directory.
+    if (!isWithinDir(resolvedEntry, opts.dir)) {
+        throw new PnpmError('PACK_APP_ENTRY_OUTSIDE_PROJECT', `The entry path "${entryPath}" resolves outside the project directory.`, { hint: 'The entry must be a relative path inside the project directory, not an absolute path or one that escapes via "..".' });
+    }
     const cliTargets = opts.target == null
         ? undefined
         : Array.isArray(opts.target) ? opts.target : [opts.target];
@@ -118,9 +131,29 @@ export async function handler(opts, params) {
     // masked by later problems (missing package.json name, registry lookup, etc.).
     const runtimeSpec = opts.runtime ?? project.app?.runtime ?? `node@${process.version.slice(1)}`;
     const { version: requestedNodeSpec } = parseRuntime(runtimeSpec);
-    const outputDir = path.resolve(opts.dir, opts.outputDir ?? project.app?.outputDir ?? 'dist-app');
+    // `outputDir` is likewise repo-controllable; reject absolute paths and `..`
+    // traversal so build artifacts cannot be written outside the project directory.
+    const outputDirRaw = opts.outputDir ?? project.app?.outputDir ?? 'dist-app';
+    if (pathEscapesProject(outputDirRaw)) {
+        throw new PnpmError('PACK_APP_OUTPUT_DIR_OUTSIDE_PROJECT', `The output directory "${outputDirRaw}" resolves outside the project directory.`, { hint: 'The output directory must be a relative path inside the project directory, not an absolute path or one that escapes via "..".' });
+    }
+    const outputDir = path.resolve(opts.dir, outputDirRaw);
     await mkdir(outputDir, { recursive: true });
+    // Defense in depth against a symlinked output directory that points out of
+    // the project: the lexical check above can't see through a symlink, so
+    // re-check containment once the real path exists.
+    if (!isWithinDir(outputDir, opts.dir)) {
+        throw new PnpmError('PACK_APP_OUTPUT_DIR_OUTSIDE_PROJECT', `The output directory "${outputDirRaw}" resolves outside the project directory.`, { hint: 'The output directory must be a relative path inside the project directory, not an absolute path or one that escapes via "..".' });
+    }
     const outputName = validateOutputName(opts.outputName ?? project.app?.outputName ?? deriveOutputNameFromPackage(project, opts.dir));
+    // Reject a pre-existing symlink (or any non-regular file) at any target's
+    // final output path before downloading anything: a repo could commit
+    // `dist-app/<target>/<name>` as a symlink pointing outside the project, and
+    // `node --build-sea` would follow it to overwrite an arbitrary file. The
+    // directory containment checks above do not cover the leaf file.
+    for (const target of targets) {
+        rejectNonRegularOutputFile(path.join(outputDir, target.raw, outputFileName(outputName, target.platform)));
+    }
     const fetch = createFetchFromRegistry(opts);
     const buildRoot = path.join(opts.pnpmHomeDir, 'pack-app');
     // Resolve the embedded target version first so the builder can be pinned to
@@ -147,9 +180,16 @@ export async function handler(opts, params) {
         const targetOutputDir = path.join(outputDir, target.raw);
         // eslint-disable-next-line no-await-in-loop
         await mkdir(targetOutputDir, { recursive: true });
-        const outputFile = target.platform === 'win32'
-            ? path.join(targetOutputDir, `${outputName}.exe`)
-            : path.join(targetOutputDir, outputName);
+        // A repo could symlink `dist-app/<target>` out of the project even when
+        // `dist-app` itself is contained; re-check the real path before any
+        // binary is written into it.
+        if (!isWithinDir(targetOutputDir, opts.dir)) {
+            throw new PnpmError('PACK_APP_OUTPUT_DIR_OUTSIDE_PROJECT', `The output directory "${targetOutputDir}" resolves outside the project directory.`, { hint: 'The output directory must be a relative path inside the project directory, not an absolute path or one that escapes via "..".' });
+        }
+        const outputFile = path.join(targetOutputDir, outputFileName(outputName, target.platform));
+        // Re-check the leaf path right before the build in case it became a
+        // symlink after the upfront pass.
+        rejectNonRegularOutputFile(outputFile);
         const seaConfig = {
             main: resolvedEntry,
             output: outputFile,
@@ -175,7 +215,7 @@ export async function handler(opts, params) {
             await rm(tmpConfigDir, { recursive: true, force: true }).catch(() => { });
         }
         // eslint-disable-next-line no-await-in-loop
-        await adHocSignMacBinary(target, outputFile);
+        await adHocSignMacBinary(target, outputFile, opts.dir);
         results.push(`  ${target.raw}: ${outputFile} (Node.js ${resolvedTargetVersion})`);
     }
     return `Built ${targets.length} executable${targets.length === 1 ? '' : 's'}:\n${results.join('\n')}`;
@@ -408,6 +448,53 @@ function deriveOutputNameFromPackage(project, dir) {
 function isObject(value) {
     return value != null && typeof value === 'object' && !Array.isArray(value);
 }
+// `entry` and `outputDir` can come from a repo-controlled package.json, so a
+// malicious repo must not be able to read/write outside the project via an
+// absolute path or `..` traversal. An absolute path replaces the base on join;
+// a `..` segment climbs out. Checked lexically before any filesystem access so
+// the failure is fast and side-effect-free.
+function pathEscapesProject(rawPath) {
+    // `path.parse().root` is non-empty for any host-rooted form: a POSIX
+    // absolute path (`/x`), and on Windows also the drive-relative (`C:x`) and
+    // root-relative (`\x`) forms that `path.isAbsolute()` reports as relative
+    // yet still resolve outside the project. Platform-specific, matching the
+    // pacquet port (which rejects `Component::RootDir` / `Component::Prefix`).
+    if (path.parse(rawPath).root !== '')
+        return true;
+    return rawPath.split(/[/\\]/).includes('..');
+}
+// Defense in depth beyond `pathEscapesProject`: resolve symlinks and require
+// the real target to stay inside the (also symlink-resolved) project dir, so a
+// same-name symlink pointing out of the project is caught even though the
+// lexical join looked contained. Fails closed on any realpath error.
+function isWithinDir(target, dir) {
+    let realDir;
+    let realTarget;
+    try {
+        realDir = fs.realpathSync(dir);
+        realTarget = fs.realpathSync(target);
+    }
+    catch {
+        return false;
+    }
+    const rel = path.relative(realDir, realTarget);
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+// The on-disk file name of the produced executable for a target: a bare name
+// on POSIX, suffixed with `.exe` on Windows.
+function outputFileName(outputName, platform) {
+    return platform === 'win32' ? `${outputName}.exe` : outputName;
+}
+// Refuse to write to `outputFile` when it already exists and is not a regular
+// file — most importantly a symlink, which `node --build-sea` would follow to
+// overwrite a file outside the project. `lstatSync` does not traverse the final
+// component, so a symlink reports `isFile() === false`. A missing path is fine.
+function rejectNonRegularOutputFile(outputFile) {
+    const existing = fs.lstatSync(outputFile, { throwIfNoEntry: false });
+    if (existing && !existing.isFile()) {
+        throw new PnpmError('PACK_APP_OUTPUT_FILE_NOT_REGULAR', `The output file "${outputFile}" already exists and is not a regular file (e.g. a symlink); refusing to write through it.`, { hint: 'Remove the existing path, or choose a different --output-name or --output-dir.' });
+    }
+}
 /**
  * SEA injection invalidates the existing code signature on macOS binaries, so
  * the output must be re-signed. Native macOS hosts use `codesign`; Linux hosts
@@ -415,16 +502,20 @@ function isObject(value) {
  * available ad-hoc signer, so we refuse to produce an unsigned output silently
  * and tell the user to re-sign on macOS or Linux.
  */
-async function adHocSignMacBinary(target, outputFile) {
+async function adHocSignMacBinary(target, outputFile, dir) {
     if (target.platform !== 'darwin')
         return;
     if (process.platform === 'darwin') {
-        await execa('codesign', ['--sign', '-', outputFile], { stdio: 'inherit' });
+        // `codesign` is a macOS system tool; spawn it by absolute path so a
+        // repo-controlled `node_modules/.bin/codesign` on PATH can't be run in its
+        // place.
+        await execa('/usr/bin/codesign', ['--sign', '-', outputFile], { stdio: 'inherit' });
         return;
     }
     if (process.platform === 'linux') {
+        const ldid = resolveTrustedSigner('ldid', dir, outputFile);
         try {
-            await execa('ldid', ['-S', outputFile], { stdio: 'inherit' });
+            await execa(ldid, ['-S', outputFile], { stdio: 'inherit' });
         }
         catch {
             throw new PnpmError('PACK_APP_MACOS_SIGN_FAILED', `Cross-compiled macOS binary at ${outputFile} could not be ad-hoc signed with "ldid".`, { hint: 'Install ldid (https://github.com/ProcursusTeam/ldid) or re-sign the binary on macOS with "codesign --sign - <file>".' });
@@ -433,4 +524,35 @@ async function adHocSignMacBinary(target, outputFile) {
     }
     throw new PnpmError('PACK_APP_MACOS_SIGN_UNSUPPORTED_HOST', `Cannot ad-hoc sign the macOS binary at ${outputFile} on a ${process.platform} host.`, { hint: 'Build macOS targets on a macOS or Linux host, or re-sign the produced binary yourself with "codesign --sign -" on macOS.' });
 }
+// Resolve an external signer (`ldid`) to an absolute path via PATH, skipping
+// any match that resolves inside the project directory — a repo could ship
+// `node_modules/.bin/ldid` and, if that directory is on the developer's PATH,
+// get an attacker-controlled binary executed when packaging a darwin target.
+// Returns the first match outside the project, or throws PACK_APP_MACOS_SIGN_FAILED.
+function resolveTrustedSigner(name, dir, outputFile) {
+    for (const entry of (process.env.PATH ?? '').split(path.delimiter)) {
+        if (entry === '')
+            continue;
+        const candidate = path.join(entry, name);
+        let stat;
+        try {
+            stat = fs.statSync(candidate);
+        }
+        catch {
+            continue;
+        }
+        if (!stat.isFile())
+            continue;
+        if (isWithinDir(candidate, dir))
+            continue;
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+        }
+        catch {
+            continue;
+        }
+        return candidate;
+    }
+    throw new PnpmError('PACK_APP_MACOS_SIGN_FAILED', `Cross-compiled macOS binary at ${outputFile} could not be ad-hoc signed with "ldid".`, { hint: 'Install ldid (https://github.com/ProcursusTeam/ldid) or re-sign the binary on macOS with "codesign --sign - <file>".' });
+}
 //# sourceMappingURL=packApp.js.map

package/lib/publish/pack.d.ts

@@ -4,7 +4,7 @@ export declare function rcOptionsTypes(): Record<string, unknown>;
 export declare function cliOptionsTypes(): Record<string, unknown>;
 export declare const commandNames: string[];
 export declare function help(): string;
-export type PackOptions = Pick<UniversalOptions, 'dir'> & Pick<Config, 'catalogs' | 'ignoreScripts' | 'embedReadme' | 'packGzipLevel' | 'nodeLinker' | 'skipManifestObfuscation' | 'userAgent'> & Partial<Pick<Config, 'extraBinPaths' | 'extraEnv' | 'recursive' | 'workspaceConcurrency' | 'workspaceDir'>> & Partial<Pick<ConfigContext, 'hooks' | 'selectedProjectsGraph'>> & {
+export type PackOptions = Pick<UniversalOptions, 'dir'> & Pick<Config, 'catalogs' | 'ignoreScripts' | 'embedReadme' | 'packGzipLevel' | 'nodeLinker' | 'skipManifestObfuscation' | 'userAgent'> & Partial<Pick<Config, 'extraBinPaths' | 'extraEnv' | 'recursive' | 'workspaceConcurrency' | 'workspaceDir'>> & Partial<Pick<ConfigContext, 'hooks' | 'selectedProjectsGraph' | 'allProjectsGraph' | 'prodAllProjectsGraph' | 'prodOnlySelectedProjectDirs'>> & {
     argv: {
         original: string[];
     };

package/lib/publish/pack.js

@@ -9,7 +9,7 @@ import { PnpmError } from '@pnpm/error';
 import { packlist } from '@pnpm/fs.packlist';
 import { logger } from '@pnpm/logger';
 import { createExportableManifest } from '@pnpm/releasing.exportable-manifest';
-import { sortProjects } from '@pnpm/workspace.projects-sorter';
+import { sortFilteredProjects } from '@pnpm/workspace.projects-sorter';
 import chalk from 'chalk';
 import pLimit from 'p-limit';
 import { pick } from 'ramda';
@@ -104,7 +104,12 @@ export async function handler(opts) {
                 prefix: opts.dir,
             });
         }
-        const chunks = sortProjects(selectedProjectsGraph);
+        const chunks = sortFilteredProjects({
+            selectedProjectsGraph,
+            allProjectsGraph: opts.allProjectsGraph,
+            prodAllProjectsGraph: opts.prodAllProjectsGraph,
+            prodOnlySelectedProjectDirs: opts.prodOnlySelectedProjectDirs,
+        });
         const limitPack = pLimit(getWorkspaceConcurrency(opts.workspaceConcurrency));
         const resolvedOpts = { ...opts };
         if (opts.out) {
@@ -215,16 +220,44 @@ export async function api(opts) {
     const filesMap = Object.fromEntries(files.map((file) => [`package/${file}`, path.join(dir, file)]));
     // cspell:disable-next-line
     if (opts.workspaceDir != null && dir !== opts.workspaceDir && !files.some((file) => /LICEN[CS]E(?:\..+)?/i.test(file))) {
-        const licenses = await glob([LICENSE_GLOB], { cwd: opts.workspaceDir, expandDirectories: false });
-        for (const license of licenses) {
-            filesMap[`package/${license}`] = path.join(opts.workspaceDir, license);
-        }
+        const { workspaceDir } = opts;
+        const licenses = await glob([LICENSE_GLOB], { cwd: workspaceDir, expandDirectories: false });
+        await Promise.all(licenses.map(async (license) => {
+            const licensePath = path.join(workspaceDir, license);
+            // Only inject a regular file. A symlink could point outside the workspace and leak its
+            // target's bytes into the published tarball, so `lstat()` (which does not follow symlinks)
+            // rejects it — matching pacquet's inject_workspace_license.
+            const stats = await fs.promises.lstat(licensePath);
+            if (stats.isFile()) {
+                filesMap[`package/${license}`] = licensePath;
+            }
+        }));
     }
     const destDir = packDestination
         ? (path.isAbsolute(packDestination) ? packDestination : path.join(dir, packDestination ?? '.'))
         : dir;
     if (!opts.dryRun) {
         await fs.promises.mkdir(destDir, { recursive: true });
+    }
+    // Derive `contents` and `unpackedSize` from `filesMap` (the full set of tar entries) rather than
+    // from `files` (the packlist subset) so that:
+    //   - workspace LICENSE files appended to `filesMap` after the packlist call are included; and
+    //   - `package.yaml` / `package.json5` entries are reported under the name they actually have in
+    //     the tar (`package.json`), since `packPkg()` rewrites them.
+    // The `stat()` pass must run before `postpack`, which may delete prepack-generated files that
+    // were packed. See https://github.com/pnpm/pnpm/issues/12775.
+    const sizes = await Promise.all(Object.entries(filesMap).map(async ([name, source]) => {
+        if (isManifestEntry(name)) {
+            return Buffer.byteLength(JSON.stringify(publishManifest, null, 2));
+        }
+        const stat = await fs.promises.stat(source);
+        return stat.size;
+    }));
+    const unpackedSize = sizes.reduce((acc, size) => acc + size, 0);
+    const packedContents = Array.from(new Set(Object.keys(filesMap).map((name) => isManifestEntry(name)
+        ? 'package.json'
+        : name.replace(/^package\//, '')))).sort((a, b) => a.localeCompare(b, 'en'));
+    if (!opts.dryRun) {
         await packPkg({
             destFile: path.join(destDir, tarballName),
             filesMap,
@@ -248,22 +281,6 @@ export async function api(opts) {
     else {
         packedTarballPath = path.relative(opts.dir, path.join(dir, tarballName));
     }
-    // Derive `contents` and `unpackedSize` from `filesMap` (the full set of tar entries) rather than
-    // from `files` (the packlist subset) so that:
-    //   - workspace LICENSE files appended to `filesMap` after the packlist call are included; and
-    //   - `package.yaml` / `package.json5` entries are reported under the name they actually have in
-    //     the tar (`package.json`), since `packPkg()` rewrites them.
-    const sizes = await Promise.all(Object.entries(filesMap).map(async ([name, source]) => {
-        if (/^package\/package\.(?:json|json5|yaml)$/.test(name)) {
-            return Buffer.byteLength(JSON.stringify(publishManifest, null, 2));
-        }
-        const stat = await fs.promises.stat(source);
-        return stat.size;
-    }));
-    const unpackedSize = sizes.reduce((acc, size) => acc + size, 0);
-    const packedContents = Array.from(new Set(Object.keys(filesMap).map((name) => /^package\/package\.(?:json|json5|yaml)$/.test(name)
-        ? 'package.json'
-        : name.replace(/^package\//, '')))).sort((a, b) => a.localeCompare(b, 'en'));
     return {
         publishedManifest: publishManifest,
         contents: packedContents,
@@ -271,6 +288,12 @@ export async function api(opts) {
         unpackedSize,
     };
 }
+// True when a `package/<path>` tar key names the package manifest, which is
+// packed as a single serialized `package/package.json` entry and reported as
+// `package.json` in the contents listing regardless of the source file name.
+function isManifestEntry(name) {
+    return name === 'package/package.json' || name === 'package/package.json5' || name === 'package/package.yaml';
+}
 function stripBuildMetadata(version) {
     const plusIndex = version.indexOf('+');
     return plusIndex === -1 ? version : version.slice(0, plusIndex);
@@ -294,7 +317,7 @@ async function packPkg(opts) {
     await Promise.all(Object.entries(filesMap).map(async ([name, source]) => {
         const isExecutable = bins.some((bin) => path.relative(bin, source) === '');
         const mode = isExecutable ? 0o755 : 0o644;
-        if (/^package\/package\.(?:json|json5|yaml)$/.test(name)) {
+        if (isManifestEntry(name)) {
             pack.entry({ mode, mtime, name: 'package/package.json' }, JSON.stringify(manifest, null, 2));
             return;
         }

package/lib/publish/recursivePublish.d.ts

@@ -1,6 +1,6 @@
 import type { Config, ConfigContext } from '@pnpm/config.reader';
 import type { PublishPackedPkgOptions, PublishSummary } from './publishPackedPkg.js';
-export type PublishRecursiveOpts = Required<Pick<Config, 'bin' | 'cacheDir' | 'dir' | 'pnpmHomeDir' | 'configByUri' | 'registries' | 'workspaceDir'>> & Required<Pick<ConfigContext, 'cliOptions'>> & Partial<Pick<Config, 'tag' | 'ca' | 'catalogs' | 'cert' | 'fetchTimeout' | 'force' | 'dryRun' | 'extraBinPaths' | 'extraEnv' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'key' | 'httpProxy' | 'httpsProxy' | 'localAddress' | 'lockfileDir' | 'noProxy' | 'npmPath' | 'offline' | 'strictSsl' | 'unsafePerm' | 'userAgent' | 'verifyStoreIntegrity'>> & Partial<Pick<ConfigContext, 'selectedProjectsGraph'>> & {
+export type PublishRecursiveOpts = Required<Pick<Config, 'bin' | 'cacheDir' | 'dir' | 'pnpmHomeDir' | 'configByUri' | 'registries' | 'workspaceDir'>> & Required<Pick<ConfigContext, 'cliOptions'>> & Partial<Pick<Config, 'tag' | 'ca' | 'catalogs' | 'cert' | 'fetchTimeout' | 'force' | 'dryRun' | 'extraBinPaths' | 'extraEnv' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'key' | 'httpProxy' | 'httpsProxy' | 'localAddress' | 'lockfileDir' | 'noProxy' | 'npmPath' | 'offline' | 'strictSsl' | 'unsafePerm' | 'userAgent' | 'verifyStoreIntegrity'>> & Partial<Pick<ConfigContext, 'selectedProjectsGraph' | 'allProjectsGraph' | 'prodAllProjectsGraph' | 'prodOnlySelectedProjectDirs'>> & {
     access?: 'public' | 'restricted';
     argv: {
         original: string[];

package/lib/publish/recursivePublish.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { createResolver } from '@pnpm/installing.client';
 import { logger } from '@pnpm/logger';
-import { sortProjects } from '@pnpm/workspace.projects-sorter';
+import { sortFilteredProjects } from '@pnpm/workspace.projects-sorter';
 import pFilter from 'p-filter';
 import { pick } from 'ramda';
 import { writeJsonFile } from 'write-json-file';
@@ -55,7 +55,7 @@ export async function recursivePublish(opts) {
         if (opts.cliOptions['otp']) {
             appendedArgs.push(`--otp=${opts.cliOptions['otp']}`);
         }
-        const chunks = sortProjects(opts.selectedProjectsGraph);
+        const chunks = sortFilteredProjects(opts);
         const tag = opts.tag ?? 'latest';
         if (opts.batch) {
             const sortedPkgs = chunks

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/releasing.commands",
-  "version": "1100.5.1",
+  "version": "1100.5.3",
   "description": "Commands for deploy, pack, and publish",
   "keywords": [
     "pnpm",
@@ -10,9 +10,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/releasing/commands"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/releasing/commands"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/releasing/commands#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/releasing/commands#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -35,6 +35,7 @@
     "ci-info": "^4.4.0",
     "detect-libc": "^2.1.2",
     "execa": "npm:safe-execa@0.3.0",
+    "is-subdir": "^2.0.0",
     "libnpmpublish": "^11.2.0",
     "normalize-path": "^3.0.0",
     "normalize-registry-url": "2.0.1",
@@ -51,35 +52,35 @@
     "validate-npm-package-name": "7.0.2",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/cli.utils": "1101.0.12",
-    "@pnpm/cli.common-cli-options-help": "1100.0.2",
-    "@pnpm/config.reader": "1101.10.0",
-    "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/constants": "1100.0.0",
+    "@pnpm/bins.resolver": "1100.0.8",
     "@pnpm/config.pick-registry-for-package": "1100.0.9",
+    "@pnpm/config.reader": "1101.11.0",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/cli.common-cli-options-help": "1100.0.2",
     "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/engine.runtime.commands": "1100.1.6",
-    "@pnpm/engine.runtime.node-resolver": "1101.1.8",
-    "@pnpm/fetching.directory-fetcher": "1100.0.17",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/exec.lifecycle": "1100.1.0",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/engine.runtime.commands": "1100.1.8",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/engine.runtime.node-resolver": "1101.1.10",
+    "@pnpm/exec.lifecycle": "1100.1.2",
+    "@pnpm/fetching.directory-fetcher": "1100.0.19",
+    "@pnpm/cli.utils": "1101.0.13",
     "@pnpm/exec.pnpm-cli-runner": "1100.0.1",
-    "@pnpm/fs.is-empty-dir-or-nothing": "1100.0.0",
-    "@pnpm/fs.indexed-pkg-importer": "1100.0.15",
-    "@pnpm/installing.commands": "1100.10.0",
-    "@pnpm/lockfile.fs": "1100.1.6",
-    "@pnpm/installing.client": "1100.2.9",
+    "@pnpm/fs.indexed-pkg-importer": "1100.0.17",
     "@pnpm/fs.packlist": "1100.0.1",
-    "@pnpm/lockfile.types": "1100.0.11",
-    "@pnpm/network.fetch": "1100.1.3",
+    "@pnpm/installing.client": "1100.2.11",
+    "@pnpm/installing.commands": "1100.10.2",
+    "@pnpm/fs.is-empty-dir-or-nothing": "1100.0.0",
+    "@pnpm/lockfile.fs": "1100.1.8",
+    "@pnpm/network.fetch": "1100.1.4",
+    "@pnpm/lockfile.types": "1100.0.13",
+    "@pnpm/network.auth-header": "1101.1.3",
     "@pnpm/network.git-utils": "1100.0.2",
-    "@pnpm/network.auth-header": "1101.1.2",
-    "@pnpm/network.web-auth": "1101.1.1",
-    "@pnpm/releasing.exportable-manifest": "1100.1.7",
+    "@pnpm/releasing.exportable-manifest": "1100.1.9",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
+    "@pnpm/network.web-auth": "1101.2.0",
     "@pnpm/types": "1101.3.2",
-    "@pnpm/workspace.projects-sorter": "1100.0.7",
-    "@pnpm/resolving.resolver-base": "1100.4.2",
-    "@pnpm/bins.resolver": "1100.0.8"
+    "@pnpm/workspace.projects-sorter": "1100.0.8"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
@@ -102,17 +103,17 @@
     "tar": "^7.5.15",
     "undici": "^7.27.2",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.16",
-    "@pnpm/hooks.pnpmfile": "1100.0.15",
-    "@pnpm/releasing.commands": "1100.5.1",
+    "@pnpm/assert-project": "1100.0.18",
+    "@pnpm/catalogs.config": "1100.0.2",
+    "@pnpm/hooks.pnpmfile": "1100.0.17",
+    "@pnpm/prepare": "1100.0.18",
+    "@pnpm/releasing.commands": "1100.5.3",
+    "@pnpm/logger": "1100.0.0",
     "@pnpm/test-fixtures": "1100.0.0",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/prepare": "1100.0.16",
-    "@pnpm/catalogs.config": "1100.0.1",
-    "@pnpm/testing.command-defaults": "1100.0.6",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/testing.registry-mock": "1100.0.6",
-    "@pnpm/workspace.projects-filter": "1100.0.22"
+    "@pnpm/testing.command-defaults": "1100.0.8",
+    "@pnpm/testing.registry-mock": "1100.0.8",
+    "@pnpm/workspace.projects-filter": "1100.0.24"
   },
   "engines": {
     "node": ">=22.13"