pnpm 10.0.0-beta.2 → 10.0.0-beta.3

package/dist/node_modules/.modules.yaml

@@ -16,8 +16,8 @@ hoistedLocations:
   aggregate-error@3.1.0:
     - node_modules/aggregate-error
   ansi-regex@5.0.1:
-    - node_modules/strip-ansi-cjs/node_modules/ansi-regex
     - node_modules/wrap-ansi-cjs/node_modules/ansi-regex
+    - node_modules/strip-ansi-cjs/node_modules/ansi-regex
     - node_modules/string-width-cjs/node_modules/ansi-regex
   ansi-regex@6.0.1:
     - node_modules/ansi-regex
@@ -39,7 +39,7 @@ hoistedLocations:
     - node_modules/color-convert
   color-name@1.1.4:
     - node_modules/color-name
-  cross-spawn@7.0.3:
+  cross-spawn@7.0.5:
     - node_modules/cross-spawn
   debug@4.3.5:
     - node_modules/debug
@@ -113,8 +113,8 @@ hoistedLocations:
   minipass@3.3.6:
     - node_modules/minizlib/node_modules/minipass
     - node_modules/fs-minipass/node_modules/minipass
-    - node_modules/minipass-flush/node_modules/minipass
     - node_modules/minipass-pipeline/node_modules/minipass
+    - node_modules/minipass-flush/node_modules/minipass
     - node_modules/minipass-sized/node_modules/minipass
   minipass@5.0.0:
     - node_modules/tar/node_modules/minipass
@@ -202,9 +202,9 @@ included:
 injectedDeps: {}
 layoutVersion: 5
 nodeLinker: hoisted
-packageManager: pnpm@10.0.0-alpha.4
+packageManager: pnpm@10.0.0-beta.3
 pendingBuilds: []
-prunedAt: Mon, 09 Dec 2024 00:34:36 GMT
+prunedAt: Wed, 11 Dec 2024 22:35:21 GMT
 publicHoistPattern: []
 registries:
   default: https://registry.npmjs.org/

package/dist/node_modules/.pnpm/lock.yaml

@@ -4,6 +4,34 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+overrides:
+  '@yarnpkg/fslib@2': '3'
+  body-parser@<1.20.3: ^1.20.3
+  clipanion: 3.2.0-rc.6
+  cookie@<0.7.0: '>=0.7.0'
+  cross-spawn@<7.0.5: '>=7.0.5'
+  debug@<3.1.0: '>=3.1.0'
+  express@<4.20.0: ^4.20.0
+  follow-redirects@<=1.15.5: '>=1.15.6'
+  glob-parent@<5.1.2: '>=5.1.2'
+  hosted-git-info@1: npm:@pnpm/hosted-git-info@1.0.0
+  http-proxy-middleware@<2.0.7: ^2.0.7
+  istanbul-reports: npm:@zkochan/istanbul-reports
+  js-yaml@^4.0.0: npm:@zkochan/js-yaml@0.0.7
+  json5@<2.2.2: ^2.2.3
+  jsonwebtoken@<=8.5.1: '>=9.0.0'
+  nopt@5: npm:@pnpm/nopt@^0.2.1
+  path-to-regexp@<0.1.12: ^0.1.12
+  path-to-regexp@>=4.0.0 <6.3.0: '>=6.3.0'
+  path-to-regexp@>=7.0.0 <8.0.0: '>=8.0.0'
+  semver@<7.5.2: ^7.6.2
+  send@<0.19.0: ^0.19.0
+  serve-static@<1.16.0: ^1.16.0
+  socks@2: ^2.8.1
+  tough-cookie@<4.1.3: '>=4.1.3'
+  verdaccio: 5.20.1
+  yaml@<2.2.2: '>=2.2.2'
+
 importers:
 
   .:
@@ -87,8 +115,8 @@ packages:
   color-name@1.1.4:
     resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
 
-  cross-spawn@7.0.3:
-    resolution: {integrity: sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==}
+  cross-spawn@7.0.5:
+    resolution: {integrity: sha512-ZVJrKKYunU38/76t0RMOulHOnUcbU9GbpWKAOZ0mhjr7CX6FVrH+4FrAapSOekrgFQ3f/8gwMEuIft0aKq6Hug==}
     engines: {node: '>= 8'}
 
   debug@4.3.5:
@@ -475,7 +503,7 @@ snapshots:
   color-name@1.1.4:
     optional: true
 
-  cross-spawn@7.0.3:
+  cross-spawn@7.0.5:
     dependencies:
       path-key: 3.1.1
       shebang-command: 2.0.0
@@ -512,7 +540,7 @@ snapshots:
 
   foreground-child@3.2.1:
     dependencies:
-      cross-spawn: 7.0.3
+      cross-spawn: 7.0.5
       signal-exit: 4.1.0
     optional: true
 

package/dist/node_modules/.pnpm-workspace-state.json

@@ -0,0 +1,25 @@
+{
+  "lastValidatedTimestamp": 1733956521706,
+  "projects": {},
+  "pnpmfileExists": false,
+  "settings": {
+    "autoInstallPeers": true,
+    "dedupeDirectDeps": false,
+    "dedupeInjectedDeps": true,
+    "dedupePeerDependents": true,
+    "dev": true,
+    "excludeLinksFromLockfile": false,
+    "hoistPattern": [
+      "*"
+    ],
+    "hoistWorkspacePackages": true,
+    "injectWorkspacePackages": false,
+    "linkWorkspacePackages": false,
+    "nodeLinker": "hoisted",
+    "optional": true,
+    "preferWorkspacePackages": false,
+    "production": true,
+    "publicHoistPattern": []
+  },
+  "filteredInstall": false
+}

package/dist/node_modules/cross-spawn/lib/enoent.js

@@ -24,7 +24,7 @@ function hookChildProcess(cp, parsed) {
         // the command exists and emit an "error" instead
         // See https://github.com/IndigoUnited/node-cross-spawn/issues/16
         if (name === 'exit') {
-            const err = verifyENOENT(arg1, parsed, 'spawn');
+            const err = verifyENOENT(arg1, parsed);
 
             if (err) {
                 return originalEmit.call(cp, 'error', err);

package/dist/node_modules/cross-spawn/lib/util/escape.js

@@ -15,15 +15,17 @@ function escapeArgument(arg, doubleEscapeMetaChars) {
     arg = `${arg}`;
 
     // Algorithm below is based on https://qntm.org/cmd
+    // It's slightly altered to disable JS backtracking to avoid hanging on specially crafted input
+    // Please see https://github.com/moxystudio/node-cross-spawn/pull/160 for more information
 
     // Sequence of backslashes followed by a double quote:
     // double up all the backslashes and escape the double quote
-    arg = arg.replace(/(\\*)"/g, '$1$1\\"');
+    arg = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
 
     // Sequence of backslashes followed by the end of the string
     // (which will become a double quote later):
     // double up all the backslashes
-    arg = arg.replace(/(\\*)$/, '$1$1');
+    arg = arg.replace(/(?=(\\+?)?)\1$/, '$1$1');
 
     // All other backslashes occur literally
 

package/dist/node_modules/cross-spawn/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cross-spawn",
-  "version": "7.0.3",
+  "version": "7.0.5",
   "description": "Cross platform child_process#spawn and child_process#spawnSync",
   "keywords": [
     "spawn",