pnpm 10.34.3 → 10.34.4

package/dist/pnpm.cjs

@@ -2973,7 +2973,7 @@ var require_lib4 = __commonJS({
     var load_json_file_1 = __importDefault2(require_load_json_file());
     var defaultManifest = {
       name: true ? "pnpm" : "pnpm",
-      version: true ? "10.34.3" : "0.0.0"
+      version: true ? "10.34.4" : "0.0.0"
     };
     var pkgJson;
     if (require.main == null) {
@@ -16935,8 +16935,9 @@ var require_dropUntrustedEnvExpansions = __commonJS({
       return /\$\{[^}]+\}/.test(value);
     }
     var DOCS_URL = "https://pnpm.io/npmrc";
+    var SHELL_SAFE_KEY = /^[\w@.:/-]+$/;
     function configSetExample(key) {
-      return hasEnvPlaceholder(key) ? "" : ` (for example, run: pnpm config set "${key}" <value>)`;
+      return SHELL_SAFE_KEY.test(key) ? ` (for example, run: pnpm config set "${key}" <value>)` : "";
     }
     function warnIgnoredRequestDestinationEnv(filePath, key, warnings) {
       warnings.push(`Ignored project-level request destination "${key}" in "${filePath}": environment variables are not expanded in registry or proxy URLs that come from a project .npmrc, because that file is committed to the repository and a malicious value could redirect requests or leak secrets. Move this setting to a trusted source that pnpm still expands \u2014 put it in your user-level ~/.npmrc, or set it with pnpm config set${configSetExample(key)}. If the value is not secret, you can also write it literally in the project .npmrc. See ${DOCS_URL}`);
@@ -117195,6 +117196,209 @@ var require_lib96 = __commonJS({
   }
 });
 
+// ../node_modules/.pnpm/builtins@5.1.0/node_modules/builtins/index.js
+var require_builtins2 = __commonJS({
+  "../node_modules/.pnpm/builtins@5.1.0/node_modules/builtins/index.js"(exports2, module2) {
+    "use strict";
+    var satisfies = require_satisfies();
+    var permanentModules = [
+      "assert",
+      "buffer",
+      "child_process",
+      "cluster",
+      "console",
+      "constants",
+      "crypto",
+      "dgram",
+      "dns",
+      "domain",
+      "events",
+      "fs",
+      "http",
+      "https",
+      "module",
+      "net",
+      "os",
+      "path",
+      "punycode",
+      "querystring",
+      "readline",
+      "repl",
+      "stream",
+      "string_decoder",
+      "sys",
+      "timers",
+      "tls",
+      "tty",
+      "url",
+      "util",
+      "vm",
+      "zlib"
+    ];
+    var versionLockedModules = {
+      freelist: "<6.0.0",
+      v8: ">=1.0.0",
+      process: ">=1.1.0",
+      inspector: ">=8.0.0",
+      async_hooks: ">=8.1.0",
+      http2: ">=8.4.0",
+      perf_hooks: ">=8.5.0",
+      trace_events: ">=10.0.0",
+      worker_threads: ">=12.0.0",
+      "node:test": ">=18.0.0"
+    };
+    var experimentalModules = {
+      worker_threads: ">=10.5.0",
+      wasi: ">=12.16.0",
+      diagnostics_channel: "^14.17.0 || >=15.1.0"
+    };
+    module2.exports = ({ version: version2 = process.version, experimental = false } = {}) => {
+      const builtins = [...permanentModules];
+      for (const [name, semverRange] of Object.entries(versionLockedModules)) {
+        if (version2 === "*" || satisfies(version2, semverRange)) {
+          builtins.push(name);
+        }
+      }
+      if (experimental) {
+        for (const [name, semverRange] of Object.entries(experimentalModules)) {
+          if (!builtins.includes(name) && (version2 === "*" || satisfies(version2, semverRange))) {
+            builtins.push(name);
+          }
+        }
+      }
+      return builtins;
+    };
+  }
+});
+
+// ../node_modules/.pnpm/validate-npm-package-name@5.0.0/node_modules/validate-npm-package-name/lib/index.js
+var require_lib97 = __commonJS({
+  "../node_modules/.pnpm/validate-npm-package-name@5.0.0/node_modules/validate-npm-package-name/lib/index.js"(exports2, module2) {
+    "use strict";
+    var scopedPackagePattern = new RegExp("^(?:@([^/]+?)[/])?([^/]+?)$");
+    var builtins = require_builtins2();
+    var blacklist = [
+      "node_modules",
+      "favicon.ico"
+    ];
+    function validate2(name) {
+      var warnings = [];
+      var errors = [];
+      if (name === null) {
+        errors.push("name cannot be null");
+        return done(warnings, errors);
+      }
+      if (name === void 0) {
+        errors.push("name cannot be undefined");
+        return done(warnings, errors);
+      }
+      if (typeof name !== "string") {
+        errors.push("name must be a string");
+        return done(warnings, errors);
+      }
+      if (!name.length) {
+        errors.push("name length must be greater than zero");
+      }
+      if (name.match(/^\./)) {
+        errors.push("name cannot start with a period");
+      }
+      if (name.match(/^_/)) {
+        errors.push("name cannot start with an underscore");
+      }
+      if (name.trim() !== name) {
+        errors.push("name cannot contain leading or trailing spaces");
+      }
+      blacklist.forEach(function(blacklistedName) {
+        if (name.toLowerCase() === blacklistedName) {
+          errors.push(blacklistedName + " is a blacklisted name");
+        }
+      });
+      builtins({ version: "*" }).forEach(function(builtin) {
+        if (name.toLowerCase() === builtin) {
+          warnings.push(builtin + " is a core module name");
+        }
+      });
+      if (name.length > 214) {
+        warnings.push("name can no longer contain more than 214 characters");
+      }
+      if (name.toLowerCase() !== name) {
+        warnings.push("name can no longer contain capital letters");
+      }
+      if (/[~'!()*]/.test(name.split("/").slice(-1)[0])) {
+        warnings.push(`name can no longer contain special characters ("~'!()*")`);
+      }
+      if (encodeURIComponent(name) !== name) {
+        var nameMatch = name.match(scopedPackagePattern);
+        if (nameMatch) {
+          var user = nameMatch[1];
+          var pkg = nameMatch[2];
+          if (encodeURIComponent(user) === user && encodeURIComponent(pkg) === pkg) {
+            return done(warnings, errors);
+          }
+        }
+        errors.push("name can only contain URL-friendly characters");
+      }
+      return done(warnings, errors);
+    }
+    var done = function(warnings, errors) {
+      var result2 = {
+        validForNewPackages: errors.length === 0 && warnings.length === 0,
+        validForOldPackages: errors.length === 0,
+        warnings,
+        errors
+      };
+      if (!result2.warnings.length) {
+        delete result2.warnings;
+      }
+      if (!result2.errors.length) {
+        delete result2.errors;
+      }
+      return result2;
+    };
+    module2.exports = validate2;
+  }
+});
+
+// ../config/deps-installer/lib/assertValidConfigDepName.js
+var require_assertValidConfigDepName = __commonJS({
+  "../config/deps-installer/lib/assertValidConfigDepName.js"(exports2) {
+    "use strict";
+    var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.assertValidConfigDepName = assertValidConfigDepName;
+    var error_1 = require_lib6();
+    var validate_npm_package_name_1 = __importDefault2(require_lib97());
+    function assertValidConfigDepName(name) {
+      if (!(0, validate_npm_package_name_1.default)(name).validForOldPackages) {
+        throw new error_1.PnpmError("INVALID_DEPENDENCY_NAME", `The configDependencies in pnpm-workspace.yaml contains a dependency with an invalid name: ${JSON.stringify(name)}`, {
+          hint: "A dependency name must be a valid npm package name \u2014 a single `name` or `@scope/name` consisting of URL-friendly characters, with no leading `.` or `_`, and not equal to reserved names such as `node_modules`."
+        });
+      }
+    }
+  }
+});
+
+// ../config/deps-installer/lib/assertValidConfigDepVersion.js
+var require_assertValidConfigDepVersion = __commonJS({
+  "../config/deps-installer/lib/assertValidConfigDepVersion.js"(exports2) {
+    "use strict";
+    var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.assertValidConfigDepVersion = assertValidConfigDepVersion;
+    var error_1 = require_lib6();
+    var semver_12 = __importDefault2(require_semver2());
+    function assertValidConfigDepVersion(name, version2) {
+      if (semver_12.default.valid(version2) == null) {
+        throw new error_1.PnpmError("INVALID_CONFIG_DEP_VERSION", `The config dependency "${name}" has an invalid version "${version2}"`, { hint: "A config dependency version must be an exact semver version." });
+      }
+    }
+  }
+});
+
 // ../config/deps-installer/lib/normalizeConfigDeps.js
 var require_normalizeConfigDeps = __commonJS({
   "../config/deps-installer/lib/normalizeConfigDeps.js"(exports2) {
@@ -117207,12 +117411,16 @@ var require_normalizeConfigDeps = __commonJS({
     var get_npm_tarball_url_1 = __importDefault2(require_lib96());
     var error_1 = require_lib6();
     var pick_registry_for_package_1 = require_lib44();
+    var assertValidConfigDepName_js_1 = require_assertValidConfigDepName();
+    var assertValidConfigDepVersion_js_1 = require_assertValidConfigDepVersion();
     function normalizeConfigDeps(configDependencies, opts) {
       const deps = {};
       for (const [pkgName, pkgSpec] of Object.entries(configDependencies)) {
+        (0, assertValidConfigDepName_js_1.assertValidConfigDepName)(pkgName);
         const registry = (0, pick_registry_for_package_1.pickRegistryForPackage)(opts.registries, pkgName);
         if (typeof pkgSpec === "object") {
           const { version: version2, integrity } = parseIntegrity(pkgName, pkgSpec.integrity);
+          (0, assertValidConfigDepVersion_js_1.assertValidConfigDepVersion)(pkgName, version2);
           deps[pkgName] = {
             version: version2,
             resolution: {
@@ -117224,6 +117432,7 @@ var require_normalizeConfigDeps = __commonJS({
         }
         if (typeof pkgSpec === "string") {
           const { version: version2, integrity } = parseIntegrity(pkgName, pkgSpec);
+          (0, assertValidConfigDepVersion_js_1.assertValidConfigDepVersion)(pkgName, version2);
           deps[pkgName] = {
             version: version2,
             resolution: {
@@ -124781,7 +124990,7 @@ var require_patchDocument = __commonJS({
 });
 
 // ../yaml/document-sync/lib/index.js
-var require_lib97 = __commonJS({
+var require_lib98 = __commonJS({
   "../yaml/document-sync/lib/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -124871,7 +125080,7 @@ var require_sort_keys = __commonJS({
 });
 
 // ../object/key-sorting/lib/index.js
-var require_lib98 = __commonJS({
+var require_lib99 = __commonJS({
   "../object/key-sorting/lib/index.js"(exports2) {
     "use strict";
     var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
@@ -124917,7 +125126,7 @@ var require_lib98 = __commonJS({
 });
 
 // ../workspace/manifest-writer/lib/index.js
-var require_lib99 = __commonJS({
+var require_lib100 = __commonJS({
   "../workspace/manifest-writer/lib/index.js"(exports2) {
     "use strict";
     var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
@@ -124930,11 +125139,11 @@ var require_lib99 = __commonJS({
     var util_1 = __importDefault2(require("util"));
     var workspace_read_manifest_1 = require_lib22();
     var constants_1 = require_lib5();
-    var yaml_document_sync_1 = require_lib97();
+    var yaml_document_sync_1 = require_lib98();
     var equals_1 = __importDefault2(require_equals2());
     var yaml_1 = __importDefault2(require_dist20());
     var write_file_atomic_1 = __importDefault2(require_lib14());
-    var object_key_sorting_1 = require_lib98();
+    var object_key_sorting_1 = require_lib99();
     async function writeManifestFile(dir, manifest) {
       const manifestStr = manifest.toString({
         lineWidth: 0,
@@ -125113,7 +125322,7 @@ var require_lib99 = __commonJS({
 });
 
 // ../config/config-writer/lib/index.js
-var require_lib100 = __commonJS({
+var require_lib101 = __commonJS({
   "../config/config-writer/lib/index.js"(exports2) {
     "use strict";
     var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
@@ -125122,7 +125331,7 @@ var require_lib100 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.writeSettings = writeSettings;
     var read_project_manifest_1 = require_lib17();
-    var workspace_manifest_writer_1 = require_lib99();
+    var workspace_manifest_writer_1 = require_lib100();
     var equals_1 = __importDefault2(require_equals2());
     async function writeSettings(opts) {
       if (opts.rootProjectManifest?.pnpm != null) {
@@ -125168,169 +125377,6 @@ var require_lib100 = __commonJS({
   }
 });
 
-// ../node_modules/.pnpm/builtins@5.1.0/node_modules/builtins/index.js
-var require_builtins2 = __commonJS({
-  "../node_modules/.pnpm/builtins@5.1.0/node_modules/builtins/index.js"(exports2, module2) {
-    "use strict";
-    var satisfies = require_satisfies();
-    var permanentModules = [
-      "assert",
-      "buffer",
-      "child_process",
-      "cluster",
-      "console",
-      "constants",
-      "crypto",
-      "dgram",
-      "dns",
-      "domain",
-      "events",
-      "fs",
-      "http",
-      "https",
-      "module",
-      "net",
-      "os",
-      "path",
-      "punycode",
-      "querystring",
-      "readline",
-      "repl",
-      "stream",
-      "string_decoder",
-      "sys",
-      "timers",
-      "tls",
-      "tty",
-      "url",
-      "util",
-      "vm",
-      "zlib"
-    ];
-    var versionLockedModules = {
-      freelist: "<6.0.0",
-      v8: ">=1.0.0",
-      process: ">=1.1.0",
-      inspector: ">=8.0.0",
-      async_hooks: ">=8.1.0",
-      http2: ">=8.4.0",
-      perf_hooks: ">=8.5.0",
-      trace_events: ">=10.0.0",
-      worker_threads: ">=12.0.0",
-      "node:test": ">=18.0.0"
-    };
-    var experimentalModules = {
-      worker_threads: ">=10.5.0",
-      wasi: ">=12.16.0",
-      diagnostics_channel: "^14.17.0 || >=15.1.0"
-    };
-    module2.exports = ({ version: version2 = process.version, experimental = false } = {}) => {
-      const builtins = [...permanentModules];
-      for (const [name, semverRange] of Object.entries(versionLockedModules)) {
-        if (version2 === "*" || satisfies(version2, semverRange)) {
-          builtins.push(name);
-        }
-      }
-      if (experimental) {
-        for (const [name, semverRange] of Object.entries(experimentalModules)) {
-          if (!builtins.includes(name) && (version2 === "*" || satisfies(version2, semverRange))) {
-            builtins.push(name);
-          }
-        }
-      }
-      return builtins;
-    };
-  }
-});
-
-// ../node_modules/.pnpm/validate-npm-package-name@5.0.0/node_modules/validate-npm-package-name/lib/index.js
-var require_lib101 = __commonJS({
-  "../node_modules/.pnpm/validate-npm-package-name@5.0.0/node_modules/validate-npm-package-name/lib/index.js"(exports2, module2) {
-    "use strict";
-    var scopedPackagePattern = new RegExp("^(?:@([^/]+?)[/])?([^/]+?)$");
-    var builtins = require_builtins2();
-    var blacklist = [
-      "node_modules",
-      "favicon.ico"
-    ];
-    function validate2(name) {
-      var warnings = [];
-      var errors = [];
-      if (name === null) {
-        errors.push("name cannot be null");
-        return done(warnings, errors);
-      }
-      if (name === void 0) {
-        errors.push("name cannot be undefined");
-        return done(warnings, errors);
-      }
-      if (typeof name !== "string") {
-        errors.push("name must be a string");
-        return done(warnings, errors);
-      }
-      if (!name.length) {
-        errors.push("name length must be greater than zero");
-      }
-      if (name.match(/^\./)) {
-        errors.push("name cannot start with a period");
-      }
-      if (name.match(/^_/)) {
-        errors.push("name cannot start with an underscore");
-      }
-      if (name.trim() !== name) {
-        errors.push("name cannot contain leading or trailing spaces");
-      }
-      blacklist.forEach(function(blacklistedName) {
-        if (name.toLowerCase() === blacklistedName) {
-          errors.push(blacklistedName + " is a blacklisted name");
-        }
-      });
-      builtins({ version: "*" }).forEach(function(builtin) {
-        if (name.toLowerCase() === builtin) {
-          warnings.push(builtin + " is a core module name");
-        }
-      });
-      if (name.length > 214) {
-        warnings.push("name can no longer contain more than 214 characters");
-      }
-      if (name.toLowerCase() !== name) {
-        warnings.push("name can no longer contain capital letters");
-      }
-      if (/[~'!()*]/.test(name.split("/").slice(-1)[0])) {
-        warnings.push(`name can no longer contain special characters ("~'!()*")`);
-      }
-      if (encodeURIComponent(name) !== name) {
-        var nameMatch = name.match(scopedPackagePattern);
-        if (nameMatch) {
-          var user = nameMatch[1];
-          var pkg = nameMatch[2];
-          if (encodeURIComponent(user) === user && encodeURIComponent(pkg) === pkg) {
-            return done(warnings, errors);
-          }
-        }
-        errors.push("name can only contain URL-friendly characters");
-      }
-      return done(warnings, errors);
-    }
-    var done = function(warnings, errors) {
-      var result2 = {
-        validForNewPackages: errors.length === 0 && warnings.length === 0,
-        validForOldPackages: errors.length === 0,
-        warnings,
-        errors
-      };
-      if (!result2.warnings.length) {
-        delete result2.warnings;
-      }
-      if (!result2.errors.length) {
-        delete result2.errors;
-      }
-      return result2;
-    };
-    module2.exports = validate2;
-  }
-});
-
 // ../packages/parse-wanted-dependency/lib/index.js
 var require_lib102 = __commonJS({
   "../packages/parse-wanted-dependency/lib/index.js"(exports2) {
@@ -125340,7 +125386,7 @@ var require_lib102 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.parseWantedDependency = parseWantedDependency;
-    var validate_npm_package_name_1 = __importDefault2(require_lib101());
+    var validate_npm_package_name_1 = __importDefault2(require_lib97());
     function parseWantedDependency(rawWantedDependency) {
       const versionDelimiter = rawWantedDependency.indexOf("@", 1);
       if (versionDelimiter !== -1) {
@@ -125378,7 +125424,7 @@ var require_resolveConfigDeps = __commonJS({
     exports2.resolveConfigDeps = resolveConfigDeps;
     var get_npm_tarball_url_1 = __importDefault2(require_lib96());
     var error_1 = require_lib6();
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     var fetch_1 = require_lib31();
     var npm_resolver_1 = require_lib51();
     var network_auth_header_1 = require_lib77();
@@ -139143,7 +139189,7 @@ var require_sortLockfileKeys = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.sortLockfileKeys = sortLockfileKeys;
-    var object_key_sorting_1 = require_lib98();
+    var object_key_sorting_1 = require_lib99();
     var ORDERED_KEYS = {
       resolution: 1,
       id: 2,
@@ -142024,7 +142070,7 @@ var require_approveBuilds = __commonJS({
     var enquirer_1 = require_enquirer();
     var chalk_1 = __importDefault2(require_source());
     var plugin_commands_rebuild_1 = require_lib133();
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     var getAutomaticallyIgnoredBuilds_js_1 = require_getAutomaticallyIgnoredBuilds();
     exports2.commandNames = ["approve-builds"];
     function help() {
@@ -148235,7 +148281,7 @@ var require_fix = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.fix = fix;
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     var difference_1 = __importDefault2(require_difference());
     async function fix(auditReport, opts) {
       const vulnOverrides = createOverrides(Object.values(auditReport.advisories), opts.auditConfig?.ignoreCves);
@@ -148270,7 +148316,7 @@ var require_ignore2 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.ignore = ignore;
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     var difference_1 = __importDefault2(require_difference());
     async function ignore(opts) {
       const currentCves = opts?.auditConfig?.ignoreCves ?? [];
@@ -150914,7 +150960,7 @@ var require_configSet = __commonJS({
     var error_1 = require_lib6();
     var object_property_path_1 = require_lib141();
     var run_npm_1 = require_lib142();
-    var workspace_manifest_writer_1 = require_lib99();
+    var workspace_manifest_writer_1 = require_lib100();
     var camelcase_1 = __importDefault2(require_camelcase());
     var lodash_kebabcase_1 = __importDefault2(require_lodash());
     var read_ini_file_1 = require_read_ini_file();
@@ -151049,7 +151095,7 @@ var require_configList = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.configList = configList;
     var ini_1 = require_ini3();
-    var object_key_sorting_1 = require_lib98();
+    var object_key_sorting_1 = require_lib99();
     async function configList(opts) {
       const sortedConfig = (0, object_key_sorting_1.sortDirectKeys)(opts.rawConfig);
       if (opts.json) {
@@ -163724,17 +163770,25 @@ var require_safeJoinModulesDir = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.safeJoinModulesDir = safeJoinModulesDir;
     var path_1 = __importDefault2(require("path"));
+    var validate_npm_package_name_1 = __importDefault2(require_lib97());
     function safeJoinModulesDir(modulesDir, alias) {
+      if (!(0, validate_npm_package_name_1.default)(alias).validForOldPackages) {
+        throw invalidDependencyNameError(modulesDir, alias);
+      }
       const link = path_1.default.join(modulesDir, alias);
       const resolvedDir = path_1.default.resolve(modulesDir);
       const resolvedLink = path_1.default.resolve(link);
       if (resolvedLink === resolvedDir || !resolvedLink.startsWith(resolvedDir + path_1.default.sep)) {
-        const error = new Error(`Refusing to symlink dependency outside ${modulesDir}: alias ${JSON.stringify(alias)} resolves to ${resolvedLink}`);
-        error.code = "ERR_PNPM_INVALID_DEPENDENCY_NAME";
-        throw error;
+        throw invalidDependencyNameError(modulesDir, alias, resolvedLink);
       }
       return link;
     }
+    function invalidDependencyNameError(modulesDir, alias, resolvedLink) {
+      const detail = resolvedLink ? ` (it resolves to ${resolvedLink})` : "";
+      const error = new Error(`Refusing to place a dependency under ${modulesDir} with the invalid alias ${JSON.stringify(alias)}${detail}`);
+      error.code = "ERR_PNPM_INVALID_DEPENDENCY_NAME";
+      return error;
+    }
   }
 });
 
@@ -163795,12 +163849,16 @@ var require_lib161 = __commonJS({
       return mod && mod.__esModule ? mod : { "default": mod };
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.symlinkDirectRootDependency = void 0;
+    exports2.symlinkDirectRootDependency = exports2.safeJoinModulesDir = void 0;
     exports2.symlinkDependency = symlinkDependency;
     exports2.symlinkDependencySync = symlinkDependencySync;
     var core_loggers_1 = require_lib8();
     var symlink_dir_1 = __importDefault2(require_dist18());
     var safeJoinModulesDir_js_1 = require_safeJoinModulesDir();
+    var safeJoinModulesDir_js_2 = require_safeJoinModulesDir();
+    Object.defineProperty(exports2, "safeJoinModulesDir", { enumerable: true, get: function() {
+      return safeJoinModulesDir_js_2.safeJoinModulesDir;
+    } });
     var symlinkDirectRootDependency_js_1 = require_symlinkDirectRootDependency();
     Object.defineProperty(exports2, "symlinkDirectRootDependency", { enumerable: true, get: function() {
       return symlinkDirectRootDependency_js_1.symlinkDirectRootDependency;
@@ -165347,6 +165405,7 @@ var require_lockfileToHoistedDepGraph = __commonJS({
     var package_is_installable_1 = require_lib86();
     var patching_config_1 = require_lib162();
     var read_package_json_1 = require_lib62();
+    var symlink_dependency_1 = require_lib161();
     var real_hoist_1 = require_lib164();
     var dp = __importStar3(require_lib87());
     async function lockfileToHoistedDepGraph(lockfile, currentLockfile, opts) {
@@ -165472,7 +165531,7 @@ var require_lockfileToHoistedDepGraph = __commonJS({
           });
           return;
         }
-        const dir = path_1.default.join(modules, dep.name);
+        const dir = (0, symlink_dependency_1.safeJoinModulesDir)(modules, dep.name);
         const depLocation = path_1.default.relative(opts.lockfileDir, dir);
         const resolution = (0, lockfile_utils_1.pkgSnapshotToResolution)(depPath, pkgSnapshot, opts.registries);
         let fetchResponse;
@@ -166455,7 +166514,7 @@ var require_validateDependencyAlias = __commonJS({
     exports2.isValidDependencyAlias = isValidDependencyAlias;
     exports2.assertValidDependencyAliases = assertValidDependencyAliases;
     var error_1 = require_lib6();
-    var validate_npm_package_name_1 = __importDefault2(require_lib101());
+    var validate_npm_package_name_1 = __importDefault2(require_lib97());
     function isValidDependencyAlias(alias) {
       return typeof alias === "string" && (0, validate_npm_package_name_1.default)(alias).validForOldPackages;
     }
@@ -175377,7 +175436,7 @@ var require_recursive2 = __commonJS({
     var pnpmfile_1 = require_lib104();
     var sort_packages_1 = require_lib132();
     var store_connection_manager_1 = require_lib95();
-    var workspace_manifest_writer_1 = require_lib99();
+    var workspace_manifest_writer_1 = require_lib100();
     var core_1 = require_lib172();
     var is_subdir_1 = __importDefault2(require_is_subdir());
     var mem_1 = __importDefault2(require_dist15());
@@ -175780,7 +175839,7 @@ var require_installDeps = __commonJS({
     var core_1 = require_lib172();
     var logger_1 = require_lib();
     var sort_packages_1 = require_lib132();
-    var workspace_manifest_writer_1 = require_lib99();
+    var workspace_manifest_writer_1 = require_lib100();
     var workspace_pkgs_graph_1 = require_lib109();
     var workspace_state_1 = require_lib152();
     var is_subdir_1 = __importDefault2(require_is_subdir());
@@ -176079,7 +176138,7 @@ var require_add2 = __commonJS({
     var render_help_1 = __importDefault2(require_lib111());
     var getFetchFullMetadata_js_1 = require_getFetchFullMetadata();
     var installDeps_js_1 = require_installDeps();
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     exports2.shorthands = {
       "save-catalog": "--save-catalog-name=default"
     };
@@ -176989,7 +177048,7 @@ var require_link4 = __commonJS({
     var path_1 = __importDefault2(require("path"));
     var cli_utils_1 = require_lib105();
     var common_cli_options_help_1 = require_lib118();
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     var config_1 = require_lib24();
     var types_1 = require_lib10();
     var error_1 = require_lib6();
@@ -177239,7 +177298,7 @@ var require_remove4 = __commonJS({
     var error_1 = require_lib6();
     var get_context_1 = require_lib127();
     var workspace_find_packages_1 = require_lib107();
-    var workspace_manifest_writer_1 = require_lib99();
+    var workspace_manifest_writer_1 = require_lib100();
     var manifest_utils_1 = require_lib11();
     var store_connection_manager_1 = require_lib95();
     var core_1 = require_lib172();
@@ -200367,7 +200426,7 @@ var require_pack2 = __commonJS({
     var tar_stream_1 = __importDefault2(require_tar_stream());
     var publish_js_1 = require_publish2();
     var chalk_1 = __importDefault2(require_source());
-    var validate_npm_package_name_1 = __importDefault2(require_lib101());
+    var validate_npm_package_name_1 = __importDefault2(require_lib97());
     var p_limit_12 = __importDefault2(require_p_limit());
     var common_cli_options_help_1 = require_lib118();
     var sort_packages_1 = require_lib132();
@@ -201264,7 +201323,7 @@ var require_updatePatchedDependencies = __commonJS({
     exports2.updatePatchedDependencies = updatePatchedDependencies;
     var path_1 = __importDefault2(require("path"));
     var normalize_path_1 = __importDefault2(require_normalize_path());
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     async function updatePatchedDependencies(patchedDependencies, opts) {
       const workspaceDir = opts.workspaceDir ?? opts.rootProjectManifestDir;
       for (const [patchName, patchPath] of Object.entries(patchedDependencies)) {
@@ -201496,6 +201555,23 @@ ${stderr}`);
   }
 });
 
+// ../patching/plugin-commands-patching/lib/isSubdirectory.js
+var require_isSubdirectory = __commonJS({
+  "../patching/plugin-commands-patching/lib/isSubdirectory.js"(exports2) {
+    "use strict";
+    var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.isSubdirectory = isSubdirectory;
+    var path_1 = __importDefault2(require("path"));
+    function isSubdirectory(parentDir, childPath, pathUtils = path_1.default) {
+      const relativePath = pathUtils.relative(parentDir, childPath);
+      return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${pathUtils.sep}`) && !pathUtils.isAbsolute(relativePath);
+    }
+  }
+});
+
 // ../patching/plugin-commands-patching/lib/patchRemove.js
 var require_patchRemove = __commonJS({
   "../patching/plugin-commands-patching/lib/patchRemove.js"(exports2) {
@@ -201509,8 +201585,8 @@ var require_patchRemove = __commonJS({
     exports2.cliOptionsTypes = cliOptionsTypes;
     exports2.help = help;
     exports2.handler = handler;
-    var path_1 = __importDefault2(require("path"));
     var promises_1 = __importDefault2(require("fs/promises"));
+    var path_1 = __importDefault2(require("path"));
     var cli_utils_1 = require_lib105();
     var plugin_commands_installation_1 = require_lib177();
     var config_1 = require_lib24();
@@ -201518,6 +201594,7 @@ var require_patchRemove = __commonJS({
     var render_help_1 = __importDefault2(require_lib111());
     var enquirer_1 = require_enquirer();
     var pick_1 = __importDefault2(require_pick());
+    var isSubdirectory_js_1 = require_isSubdirectory();
     var updatePatchedDependencies_js_1 = require_updatePatchedDependencies();
     function rcOptionsTypes() {
       return (0, pick_1.default)([], config_1.types);
@@ -201535,7 +201612,7 @@ var require_patchRemove = __commonJS({
     }
     async function handler(opts, params) {
       let patchesToRemove = params;
-      const patchedDependencies = opts.patchedDependencies ?? {};
+      const patchedDependencies = { ...opts.patchedDependencies };
       if (!params.length) {
         const allPatches = Object.keys(patchedDependencies);
         if (allPatches.length) {
@@ -201558,15 +201635,19 @@ var require_patchRemove = __commonJS({
           throw new error_1.PnpmError("PATCH_NOT_FOUND", `Patch "${patch}" not found in patched dependencies`);
         }
       }
-      const patchesDirs = /* @__PURE__ */ new Set();
-      await Promise.all(patchesToRemove.map(async (patch) => {
-        if (Object.hasOwn(patchedDependencies, patch)) {
-          const patchFile = patchedDependencies[patch];
-          patchesDirs.add(path_1.default.dirname(patchFile));
-          await promises_1.default.rm(patchFile, { force: true });
-          delete patchedDependencies[patch];
+      const patchRemovalContext = await getPatchRemovalContext(opts);
+      const patchesToRemoveTargets = await Promise.all(patchesToRemove.map(async (patch) => {
+        const patchFile = patchedDependencies[patch];
+        if (patchFile == null) {
+          throw new error_1.PnpmError("PATCH_NOT_FOUND", `Patch "${patch}" not found in patched dependencies`);
         }
+        return getPatchRemovalTarget(patch, patchFile, patchRemovalContext);
       }));
+      await Promise.all(patchesToRemoveTargets.map(unlinkPatchIfExists));
+      for (const { patch } of patchesToRemoveTargets) {
+        delete patchedDependencies[patch];
+      }
+      const patchesDirs = new Set(patchesToRemoveTargets.map(({ parentDir }) => parentDir));
       await Promise.all(Array.from(patchesDirs).map(async (dir) => {
         try {
           const files = await promises_1.default.readdir(dir);
@@ -201580,7 +201661,83 @@ var require_patchRemove = __commonJS({
         ...opts,
         workspaceDir: opts.workspaceDir ?? opts.rootProjectManifestDir
       });
-      return plugin_commands_installation_1.install.handler(opts);
+      return plugin_commands_installation_1.install.handler({
+        ...opts,
+        patchedDependencies
+      });
+    }
+    async function getPatchRemovalContext(opts) {
+      const lockfileDir = path_1.default.resolve(opts.lockfileDir ?? opts.dir ?? process.cwd());
+      const realLockfileDir = await promises_1.default.realpath(lockfileDir);
+      const patchesDirSetting = opts.patchesDir ?? "patches";
+      const patchesDir = path_1.default.join(lockfileDir, path_1.default.normalize(patchesDirSetting));
+      if (!(0, isSubdirectory_js_1.isSubdirectory)(lockfileDir, patchesDir)) {
+        throw new error_1.PnpmError("PATCHES_DIR_OUTSIDE_PROJECT", `The configured patches directory is outside the project: ${patchesDirSetting}`);
+      }
+      const realPatchesDir = await realpathIfExists(patchesDir);
+      if (realPatchesDir != null && !(0, isSubdirectory_js_1.isSubdirectory)(realLockfileDir, realPatchesDir)) {
+        throw new error_1.PnpmError("PATCHES_DIR_OUTSIDE_PROJECT", `The configured patches directory is outside the project: ${patchesDirSetting}`);
+      }
+      return {
+        lockfileDir,
+        patchesDir,
+        realPatchesDir
+      };
+    }
+    async function getPatchRemovalTarget(patch, patchFile, ctx) {
+      const targetPath = path_1.default.resolve(ctx.lockfileDir, patchFile);
+      if (targetPath === ctx.patchesDir || !(0, isSubdirectory_js_1.isSubdirectory)(ctx.patchesDir, targetPath)) {
+        throw new error_1.PnpmError("PATCH_FILE_OUTSIDE_PATCHES_DIR", `Patch file "${patchFile}" is outside the configured patches directory`);
+      }
+      const parentDir = path_1.default.dirname(targetPath);
+      const targetStats = await lstatIfExists(targetPath);
+      const realParentDir = await realpathIfExists(parentDir);
+      const realPatchesDir = ctx.realPatchesDir ?? await realpathIfExists(ctx.patchesDir);
+      if (realParentDir != null && realPatchesDir != null && !(0, isSubdirectory_js_1.isSubdirectory)(realPatchesDir, realParentDir)) {
+        throw new error_1.PnpmError("PATCH_FILE_OUTSIDE_PATCHES_DIR", `Patch file "${patchFile}" is outside the configured patches directory`);
+      }
+      if (targetStats?.isDirectory()) {
+        throw new error_1.PnpmError("PATCH_FILE_IS_DIRECTORY", `Patch file "${patchFile}" is a directory`);
+      }
+      return {
+        patch,
+        patchFile,
+        parentDir,
+        targetPath,
+        targetExists: targetStats != null
+      };
+    }
+    async function unlinkPatchIfExists({ targetExists, targetPath }) {
+      if (!targetExists)
+        return;
+      try {
+        await promises_1.default.unlink(targetPath);
+      } catch (err) {
+        if (isErrorWithCode(err, "ENOENT"))
+          return;
+        throw err;
+      }
+    }
+    async function lstatIfExists(targetPath) {
+      try {
+        return await promises_1.default.lstat(targetPath);
+      } catch (err) {
+        if (isErrorWithCode(err, "ENOENT"))
+          return void 0;
+        throw err;
+      }
+    }
+    async function realpathIfExists(targetPath) {
+      try {
+        return await promises_1.default.realpath(targetPath);
+      } catch (err) {
+        if (isErrorWithCode(err, "ENOENT"))
+          return void 0;
+        throw err;
+      }
+    }
+    function isErrorWithCode(err, code) {
+      return typeof err === "object" && err !== null && "code" in err && err.code === code;
     }
   }
 });
@@ -210971,7 +211128,7 @@ var require_catIndex = __commonJS({
     exports2.handler = handler;
     var client_1 = require_lib79();
     var error_1 = require_lib6();
-    var object_key_sorting_1 = require_lib98();
+    var object_key_sorting_1 = require_lib99();
     var store_path_1 = require_lib33();
     var store_cafs_1 = require_lib80();
     var parse_wanted_dependency_1 = require_lib102();
@@ -211294,7 +211451,7 @@ var require_init2 = __commonJS({
     var cli_meta_1 = require_lib4();
     var config_1 = require_lib24();
     var error_1 = require_lib6();
-    var object_key_sorting_1 = require_lib98();
+    var object_key_sorting_1 = require_lib99();
     var write_project_manifest_1 = require_lib15();
     var pick_1 = __importDefault2(require_pick());
     var render_help_1 = __importDefault2(require_lib111());