pnpm-shield 1.0.0 → 1.0.1

package/lib/checks.js

@@ -159,9 +159,16 @@ function runChecks(cwd) {
       }
 
       // C11 — packageManager
+      const hasDevEngine = pkg.devEngines && pkg.devEngines.packageManager;
+      
       if (pkg.packageManager && pkg.packageManager.startsWith('pnpm@')) {
-        results.push(makeResult('pass', 'HIGH', `packageManager = "${pkg.packageManager}"`,
-          'Corepack can enforce this and block npm/yarn', '', null, 'package_manager_field'));
+        if (hasDevEngine) {
+          results.push(makeResult('warn', 'HIGH', 'Legacy devEngines.packageManager conflicts with packageManager', '',
+            'pnpm warns and ignores packageManager. Run auto-fix to clean it.', 'packageManager', 'package_manager_field'));
+        } else {
+          results.push(makeResult('pass', 'HIGH', `packageManager = "${pkg.packageManager}"`,
+            'Corepack can enforce this and block npm/yarn', '', null, 'package_manager_field'));
+        }
       } else {
         results.push(makeResult('fail', 'HIGH',
           `packageManager field is ${pkg.packageManager ? `"${pkg.packageManager}"` : 'absent'}`, '',

package/lib/fixes.js

@@ -70,6 +70,13 @@ const FIXERS = {
       catch { return '9.0.0'; }
     })();
     pkg.packageManager = `pnpm@${version}`;
+    
+    // Clean up deprecated pnpm devEngines field to prevent warnings
+    if (pkg.devEngines && pkg.devEngines.packageManager) {
+      delete pkg.devEngines.packageManager;
+      if (Object.keys(pkg.devEngines).length === 0) delete pkg.devEngines;
+    }
+    
     fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
     console.log(`  ${c.green}✔ Set packageManager=pnpm@${version} in package.json${c.reset}`);
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pnpm-shield",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Supply chain attack protection audit tool for pnpm projects",
   "keywords": [
     "pnpm",
@@ -16,7 +16,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/manuxstack/pnpm-shield.git"
+    "url": "git+https://github.com/manuxstack/pnpm-shield.git"
   },
   "license": "MIT",
   "author": "manuxstack",