pnpm 10.34.3 → 10.34.5

package/dist/pnpm.cjs

@@ -2973,7 +2973,7 @@ var require_lib4 = __commonJS({
     var load_json_file_1 = __importDefault2(require_load_json_file());
     var defaultManifest = {
       name: true ? "pnpm" : "pnpm",
-      version: true ? "10.34.3" : "0.0.0"
+      version: true ? "10.34.5" : "0.0.0"
     };
     var pkgJson;
     if (require.main == null) {
@@ -16935,8 +16935,9 @@ var require_dropUntrustedEnvExpansions = __commonJS({
       return /\$\{[^}]+\}/.test(value);
     }
     var DOCS_URL = "https://pnpm.io/npmrc";
+    var SHELL_SAFE_KEY = /^[\w@.:/-]+$/;
     function configSetExample(key) {
-      return hasEnvPlaceholder(key) ? "" : ` (for example, run: pnpm config set "${key}" <value>)`;
+      return SHELL_SAFE_KEY.test(key) ? ` (for example, run: pnpm config set "${key}" <value>)` : "";
     }
     function warnIgnoredRequestDestinationEnv(filePath, key, warnings) {
       warnings.push(`Ignored project-level request destination "${key}" in "${filePath}": environment variables are not expanded in registry or proxy URLs that come from a project .npmrc, because that file is committed to the repository and a malicious value could redirect requests or leak secrets. Move this setting to a trusted source that pnpm still expands \u2014 put it in your user-level ~/.npmrc, or set it with pnpm config set${configSetExample(key)}. If the value is not secret, you can also write it literally in the project .npmrc. See ${DOCS_URL}`);
@@ -18362,7 +18363,7 @@ var require_getOptionsFromRootManifest = __commonJS({
       }
       return settings;
     }
-    var REQUEST_DESTINATION_SCALAR_KEYS = /* @__PURE__ */ new Set(["registry"]);
+    var REQUEST_DESTINATION_SCALAR_KEYS = /* @__PURE__ */ new Set(["registry", "httpProxy", "httpsProxy", "noProxy", "proxy", "noproxy"]);
     function replaceEnvInSettings(settings) {
       const newSettings = {};
       for (const [key, value] of Object.entries(settings)) {
@@ -61551,6 +61552,10 @@ var require_nodeReleaseKeys = __commonJS({
       {
         fingerprint: "5BE8A3F6C8A5C01D106C0AD820B1A390B168D356",
         armoredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmDMEaGA63BYJKwYBBAHaRw8BAQdAo/yU+MutacFmmn0CEX495goNrBxR24235XLM\ncvHYjfq0L0FudG9pbmUgZHUgSGFtZWwgPGR1aGFtZWxhbnRvaW5lMTk5NUBnbWFp\nbC5jb20+iI4EExYKADYWIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCaGA63AIbAwQL\nCQgHBBUKCQgFFgIDAQACHgUCF4AACgkQILGjkLFo01afgwEA/sLHqsj7ml2vyDoT\nKDPE8n9a80ZOh14OfnlOe0cCZA8BAMEOOk7QFI69DIlV1nMiqcFCqQFoSzBU2LkI\nR17p/j4NtDNBbnRvaW5lIGR1IEhhbWVsIDxhbnRvaW5lLmR1aGFtZWxAcGxhdGZv\ncm1hdGljLmRldj6IjgQTFgoANhYhBFvoo/bIpcAdEGwK2CCxo5CxaNNWBQJpsCMx\nAhsDBAsJCAcEFQoJCAUWAgMBAAIeAQIXgAAKCRAgsaOQsWjTVr/sAPwIBsG8g6ND\nzoNRTX1wPKBvfZg1NP7tYCyM5sxQfrpuLAEA05AhG4xBILfhL/f0pqR5jXfxg6gz\nT6WfeVeS6zeHZwe4OARoYDrcEgorBgEEAZdVAQUBAQdAQVmtih8AO3ryBQMR/22x\nWHVKLjAbCiH2cMxNH+iy1RQDAQgHiHgEGBYKACAWIQRb6KP2yKXAHRBsCtggsaOQ\nsWjTVgUCaGA63AIbDAAKCRAgsaOQsWjTVu8oAP9Bc+QY+9FikX3YvMgWAqiDlVOy\no0y6UIZGBMSQlF80wAD/d34LqtVIVe9oe5NO3xA75+6Ew8tGeAjUq/ovagr5dAU=\n=JsVv\n-----END PGP PUBLIC KEY BLOCK-----\n"
+      },
+      {
+        fingerprint: "655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD",
+        armoredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmDMEakIjcxYJKwYBBAHaRw8BAQdAYRFWvBCAd9dDjKTePuAvvzAWxhvojAXco0m4\n2AMh/MC0H1N0ZXdhcnQgWCBBZGRpc29uIDxzeGFAaWJtLmNvbT6ImQQTFgoAQRYh\nBGVfO1wfs/qNGgymveSn0jK5NtL9BQJqQiNzAhsDBQkDwmcABQsJCAcCAiICBhUK\nCQgLAgQWAgMBAh4HAheAAAoJEOSn0jK5NtL9FOEBAMpIjknm4fnEQvTmIlzy0kDu\nVplF4HR78+lBef2i4590AP9i82wtP4pH1/vynoSBMkCauFIPmF1c9MYLFF0f53zq\nArg4BGpCI3MSCisGAQQBl1UBBQEBB0AVa1WJ4P8ir/M7NaCGrX7PDs0QU9qzpzme\na5TZ44b/YgMBCAeIfgQYFgoAJhYhBGVfO1wfs/qNGgymveSn0jK5NtL9BQJqQiNz\nAhsMBQkDwmcAAAoJEOSn0jK5NtL9EzYA/Arr4hbKLaU6OUjAVbH7HGLEl0HSvxE8\n5lEgWfuNbqOtAQCF9UT0wQEfiIj2R358Ce62zV43w2yaD8Xu0M/S+hz8AQ==\n=DcLq\n-----END PGP PUBLIC KEY BLOCK-----\n"
       }
     ];
   }
@@ -117195,6 +117200,209 @@ var require_lib96 = __commonJS({
   }
 });
 
+// ../node_modules/.pnpm/builtins@5.1.0/node_modules/builtins/index.js
+var require_builtins2 = __commonJS({
+  "../node_modules/.pnpm/builtins@5.1.0/node_modules/builtins/index.js"(exports2, module2) {
+    "use strict";
+    var satisfies = require_satisfies();
+    var permanentModules = [
+      "assert",
+      "buffer",
+      "child_process",
+      "cluster",
+      "console",
+      "constants",
+      "crypto",
+      "dgram",
+      "dns",
+      "domain",
+      "events",
+      "fs",
+      "http",
+      "https",
+      "module",
+      "net",
+      "os",
+      "path",
+      "punycode",
+      "querystring",
+      "readline",
+      "repl",
+      "stream",
+      "string_decoder",
+      "sys",
+      "timers",
+      "tls",
+      "tty",
+      "url",
+      "util",
+      "vm",
+      "zlib"
+    ];
+    var versionLockedModules = {
+      freelist: "<6.0.0",
+      v8: ">=1.0.0",
+      process: ">=1.1.0",
+      inspector: ">=8.0.0",
+      async_hooks: ">=8.1.0",
+      http2: ">=8.4.0",
+      perf_hooks: ">=8.5.0",
+      trace_events: ">=10.0.0",
+      worker_threads: ">=12.0.0",
+      "node:test": ">=18.0.0"
+    };
+    var experimentalModules = {
+      worker_threads: ">=10.5.0",
+      wasi: ">=12.16.0",
+      diagnostics_channel: "^14.17.0 || >=15.1.0"
+    };
+    module2.exports = ({ version: version2 = process.version, experimental = false } = {}) => {
+      const builtins = [...permanentModules];
+      for (const [name, semverRange] of Object.entries(versionLockedModules)) {
+        if (version2 === "*" || satisfies(version2, semverRange)) {
+          builtins.push(name);
+        }
+      }
+      if (experimental) {
+        for (const [name, semverRange] of Object.entries(experimentalModules)) {
+          if (!builtins.includes(name) && (version2 === "*" || satisfies(version2, semverRange))) {
+            builtins.push(name);
+          }
+        }
+      }
+      return builtins;
+    };
+  }
+});
+
+// ../node_modules/.pnpm/validate-npm-package-name@5.0.0/node_modules/validate-npm-package-name/lib/index.js
+var require_lib97 = __commonJS({
+  "../node_modules/.pnpm/validate-npm-package-name@5.0.0/node_modules/validate-npm-package-name/lib/index.js"(exports2, module2) {
+    "use strict";
+    var scopedPackagePattern = new RegExp("^(?:@([^/]+?)[/])?([^/]+?)$");
+    var builtins = require_builtins2();
+    var blacklist = [
+      "node_modules",
+      "favicon.ico"
+    ];
+    function validate2(name) {
+      var warnings = [];
+      var errors = [];
+      if (name === null) {
+        errors.push("name cannot be null");
+        return done(warnings, errors);
+      }
+      if (name === void 0) {
+        errors.push("name cannot be undefined");
+        return done(warnings, errors);
+      }
+      if (typeof name !== "string") {
+        errors.push("name must be a string");
+        return done(warnings, errors);
+      }
+      if (!name.length) {
+        errors.push("name length must be greater than zero");
+      }
+      if (name.match(/^\./)) {
+        errors.push("name cannot start with a period");
+      }
+      if (name.match(/^_/)) {
+        errors.push("name cannot start with an underscore");
+      }
+      if (name.trim() !== name) {
+        errors.push("name cannot contain leading or trailing spaces");
+      }
+      blacklist.forEach(function(blacklistedName) {
+        if (name.toLowerCase() === blacklistedName) {
+          errors.push(blacklistedName + " is a blacklisted name");
+        }
+      });
+      builtins({ version: "*" }).forEach(function(builtin) {
+        if (name.toLowerCase() === builtin) {
+          warnings.push(builtin + " is a core module name");
+        }
+      });
+      if (name.length > 214) {
+        warnings.push("name can no longer contain more than 214 characters");
+      }
+      if (name.toLowerCase() !== name) {
+        warnings.push("name can no longer contain capital letters");
+      }
+      if (/[~'!()*]/.test(name.split("/").slice(-1)[0])) {
+        warnings.push(`name can no longer contain special characters ("~'!()*")`);
+      }
+      if (encodeURIComponent(name) !== name) {
+        var nameMatch = name.match(scopedPackagePattern);
+        if (nameMatch) {
+          var user = nameMatch[1];
+          var pkg = nameMatch[2];
+          if (encodeURIComponent(user) === user && encodeURIComponent(pkg) === pkg) {
+            return done(warnings, errors);
+          }
+        }
+        errors.push("name can only contain URL-friendly characters");
+      }
+      return done(warnings, errors);
+    }
+    var done = function(warnings, errors) {
+      var result2 = {
+        validForNewPackages: errors.length === 0 && warnings.length === 0,
+        validForOldPackages: errors.length === 0,
+        warnings,
+        errors
+      };
+      if (!result2.warnings.length) {
+        delete result2.warnings;
+      }
+      if (!result2.errors.length) {
+        delete result2.errors;
+      }
+      return result2;
+    };
+    module2.exports = validate2;
+  }
+});
+
+// ../config/deps-installer/lib/assertValidConfigDepName.js
+var require_assertValidConfigDepName = __commonJS({
+  "../config/deps-installer/lib/assertValidConfigDepName.js"(exports2) {
+    "use strict";
+    var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.assertValidConfigDepName = assertValidConfigDepName;
+    var error_1 = require_lib6();
+    var validate_npm_package_name_1 = __importDefault2(require_lib97());
+    function assertValidConfigDepName(name) {
+      if (!(0, validate_npm_package_name_1.default)(name).validForOldPackages) {
+        throw new error_1.PnpmError("INVALID_DEPENDENCY_NAME", `The configDependencies in pnpm-workspace.yaml contains a dependency with an invalid name: ${JSON.stringify(name)}`, {
+          hint: "A dependency name must be a valid npm package name \u2014 a single `name` or `@scope/name` consisting of URL-friendly characters, with no leading `.` or `_`, and not equal to reserved names such as `node_modules`."
+        });
+      }
+    }
+  }
+});
+
+// ../config/deps-installer/lib/assertValidConfigDepVersion.js
+var require_assertValidConfigDepVersion = __commonJS({
+  "../config/deps-installer/lib/assertValidConfigDepVersion.js"(exports2) {
+    "use strict";
+    var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.assertValidConfigDepVersion = assertValidConfigDepVersion;
+    var error_1 = require_lib6();
+    var semver_12 = __importDefault2(require_semver2());
+    function assertValidConfigDepVersion(name, version2) {
+      if (semver_12.default.valid(version2) == null) {
+        throw new error_1.PnpmError("INVALID_CONFIG_DEP_VERSION", `The config dependency "${name}" has an invalid version "${version2}"`, { hint: "A config dependency version must be an exact semver version." });
+      }
+    }
+  }
+});
+
 // ../config/deps-installer/lib/normalizeConfigDeps.js
 var require_normalizeConfigDeps = __commonJS({
   "../config/deps-installer/lib/normalizeConfigDeps.js"(exports2) {
@@ -117207,12 +117415,16 @@ var require_normalizeConfigDeps = __commonJS({
     var get_npm_tarball_url_1 = __importDefault2(require_lib96());
     var error_1 = require_lib6();
     var pick_registry_for_package_1 = require_lib44();
+    var assertValidConfigDepName_js_1 = require_assertValidConfigDepName();
+    var assertValidConfigDepVersion_js_1 = require_assertValidConfigDepVersion();
     function normalizeConfigDeps(configDependencies, opts) {
       const deps = {};
       for (const [pkgName, pkgSpec] of Object.entries(configDependencies)) {
+        (0, assertValidConfigDepName_js_1.assertValidConfigDepName)(pkgName);
         const registry = (0, pick_registry_for_package_1.pickRegistryForPackage)(opts.registries, pkgName);
         if (typeof pkgSpec === "object") {
           const { version: version2, integrity } = parseIntegrity(pkgName, pkgSpec.integrity);
+          (0, assertValidConfigDepVersion_js_1.assertValidConfigDepVersion)(pkgName, version2);
           deps[pkgName] = {
             version: version2,
             resolution: {
@@ -117224,6 +117436,7 @@ var require_normalizeConfigDeps = __commonJS({
         }
         if (typeof pkgSpec === "string") {
           const { version: version2, integrity } = parseIntegrity(pkgName, pkgSpec);
+          (0, assertValidConfigDepVersion_js_1.assertValidConfigDepVersion)(pkgName, version2);
           deps[pkgName] = {
             version: version2,
             resolution: {
@@ -124781,7 +124994,7 @@ var require_patchDocument = __commonJS({
 });
 
 // ../yaml/document-sync/lib/index.js
-var require_lib97 = __commonJS({
+var require_lib98 = __commonJS({
   "../yaml/document-sync/lib/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -124871,7 +125084,7 @@ var require_sort_keys = __commonJS({
 });
 
 // ../object/key-sorting/lib/index.js
-var require_lib98 = __commonJS({
+var require_lib99 = __commonJS({
   "../object/key-sorting/lib/index.js"(exports2) {
     "use strict";
     var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
@@ -124917,7 +125130,7 @@ var require_lib98 = __commonJS({
 });
 
 // ../workspace/manifest-writer/lib/index.js
-var require_lib99 = __commonJS({
+var require_lib100 = __commonJS({
   "../workspace/manifest-writer/lib/index.js"(exports2) {
     "use strict";
     var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
@@ -124930,11 +125143,11 @@ var require_lib99 = __commonJS({
     var util_1 = __importDefault2(require("util"));
     var workspace_read_manifest_1 = require_lib22();
     var constants_1 = require_lib5();
-    var yaml_document_sync_1 = require_lib97();
+    var yaml_document_sync_1 = require_lib98();
     var equals_1 = __importDefault2(require_equals2());
     var yaml_1 = __importDefault2(require_dist20());
     var write_file_atomic_1 = __importDefault2(require_lib14());
-    var object_key_sorting_1 = require_lib98();
+    var object_key_sorting_1 = require_lib99();
     async function writeManifestFile(dir, manifest) {
       const manifestStr = manifest.toString({
         lineWidth: 0,
@@ -125113,7 +125326,7 @@ var require_lib99 = __commonJS({
 });
 
 // ../config/config-writer/lib/index.js
-var require_lib100 = __commonJS({
+var require_lib101 = __commonJS({
   "../config/config-writer/lib/index.js"(exports2) {
     "use strict";
     var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
@@ -125122,7 +125335,7 @@ var require_lib100 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.writeSettings = writeSettings;
     var read_project_manifest_1 = require_lib17();
-    var workspace_manifest_writer_1 = require_lib99();
+    var workspace_manifest_writer_1 = require_lib100();
     var equals_1 = __importDefault2(require_equals2());
     async function writeSettings(opts) {
       if (opts.rootProjectManifest?.pnpm != null) {
@@ -125168,169 +125381,6 @@ var require_lib100 = __commonJS({
   }
 });
 
-// ../node_modules/.pnpm/builtins@5.1.0/node_modules/builtins/index.js
-var require_builtins2 = __commonJS({
-  "../node_modules/.pnpm/builtins@5.1.0/node_modules/builtins/index.js"(exports2, module2) {
-    "use strict";
-    var satisfies = require_satisfies();
-    var permanentModules = [
-      "assert",
-      "buffer",
-      "child_process",
-      "cluster",
-      "console",
-      "constants",
-      "crypto",
-      "dgram",
-      "dns",
-      "domain",
-      "events",
-      "fs",
-      "http",
-      "https",
-      "module",
-      "net",
-      "os",
-      "path",
-      "punycode",
-      "querystring",
-      "readline",
-      "repl",
-      "stream",
-      "string_decoder",
-      "sys",
-      "timers",
-      "tls",
-      "tty",
-      "url",
-      "util",
-      "vm",
-      "zlib"
-    ];
-    var versionLockedModules = {
-      freelist: "<6.0.0",
-      v8: ">=1.0.0",
-      process: ">=1.1.0",
-      inspector: ">=8.0.0",
-      async_hooks: ">=8.1.0",
-      http2: ">=8.4.0",
-      perf_hooks: ">=8.5.0",
-      trace_events: ">=10.0.0",
-      worker_threads: ">=12.0.0",
-      "node:test": ">=18.0.0"
-    };
-    var experimentalModules = {
-      worker_threads: ">=10.5.0",
-      wasi: ">=12.16.0",
-      diagnostics_channel: "^14.17.0 || >=15.1.0"
-    };
-    module2.exports = ({ version: version2 = process.version, experimental = false } = {}) => {
-      const builtins = [...permanentModules];
-      for (const [name, semverRange] of Object.entries(versionLockedModules)) {
-        if (version2 === "*" || satisfies(version2, semverRange)) {
-          builtins.push(name);
-        }
-      }
-      if (experimental) {
-        for (const [name, semverRange] of Object.entries(experimentalModules)) {
-          if (!builtins.includes(name) && (version2 === "*" || satisfies(version2, semverRange))) {
-            builtins.push(name);
-          }
-        }
-      }
-      return builtins;
-    };
-  }
-});
-
-// ../node_modules/.pnpm/validate-npm-package-name@5.0.0/node_modules/validate-npm-package-name/lib/index.js
-var require_lib101 = __commonJS({
-  "../node_modules/.pnpm/validate-npm-package-name@5.0.0/node_modules/validate-npm-package-name/lib/index.js"(exports2, module2) {
-    "use strict";
-    var scopedPackagePattern = new RegExp("^(?:@([^/]+?)[/])?([^/]+?)$");
-    var builtins = require_builtins2();
-    var blacklist = [
-      "node_modules",
-      "favicon.ico"
-    ];
-    function validate2(name) {
-      var warnings = [];
-      var errors = [];
-      if (name === null) {
-        errors.push("name cannot be null");
-        return done(warnings, errors);
-      }
-      if (name === void 0) {
-        errors.push("name cannot be undefined");
-        return done(warnings, errors);
-      }
-      if (typeof name !== "string") {
-        errors.push("name must be a string");
-        return done(warnings, errors);
-      }
-      if (!name.length) {
-        errors.push("name length must be greater than zero");
-      }
-      if (name.match(/^\./)) {
-        errors.push("name cannot start with a period");
-      }
-      if (name.match(/^_/)) {
-        errors.push("name cannot start with an underscore");
-      }
-      if (name.trim() !== name) {
-        errors.push("name cannot contain leading or trailing spaces");
-      }
-      blacklist.forEach(function(blacklistedName) {
-        if (name.toLowerCase() === blacklistedName) {
-          errors.push(blacklistedName + " is a blacklisted name");
-        }
-      });
-      builtins({ version: "*" }).forEach(function(builtin) {
-        if (name.toLowerCase() === builtin) {
-          warnings.push(builtin + " is a core module name");
-        }
-      });
-      if (name.length > 214) {
-        warnings.push("name can no longer contain more than 214 characters");
-      }
-      if (name.toLowerCase() !== name) {
-        warnings.push("name can no longer contain capital letters");
-      }
-      if (/[~'!()*]/.test(name.split("/").slice(-1)[0])) {
-        warnings.push(`name can no longer contain special characters ("~'!()*")`);
-      }
-      if (encodeURIComponent(name) !== name) {
-        var nameMatch = name.match(scopedPackagePattern);
-        if (nameMatch) {
-          var user = nameMatch[1];
-          var pkg = nameMatch[2];
-          if (encodeURIComponent(user) === user && encodeURIComponent(pkg) === pkg) {
-            return done(warnings, errors);
-          }
-        }
-        errors.push("name can only contain URL-friendly characters");
-      }
-      return done(warnings, errors);
-    }
-    var done = function(warnings, errors) {
-      var result2 = {
-        validForNewPackages: errors.length === 0 && warnings.length === 0,
-        validForOldPackages: errors.length === 0,
-        warnings,
-        errors
-      };
-      if (!result2.warnings.length) {
-        delete result2.warnings;
-      }
-      if (!result2.errors.length) {
-        delete result2.errors;
-      }
-      return result2;
-    };
-    module2.exports = validate2;
-  }
-});
-
 // ../packages/parse-wanted-dependency/lib/index.js
 var require_lib102 = __commonJS({
   "../packages/parse-wanted-dependency/lib/index.js"(exports2) {
@@ -125340,7 +125390,7 @@ var require_lib102 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.parseWantedDependency = parseWantedDependency;
-    var validate_npm_package_name_1 = __importDefault2(require_lib101());
+    var validate_npm_package_name_1 = __importDefault2(require_lib97());
     function parseWantedDependency(rawWantedDependency) {
       const versionDelimiter = rawWantedDependency.indexOf("@", 1);
       if (versionDelimiter !== -1) {
@@ -125378,7 +125428,7 @@ var require_resolveConfigDeps = __commonJS({
     exports2.resolveConfigDeps = resolveConfigDeps;
     var get_npm_tarball_url_1 = __importDefault2(require_lib96());
     var error_1 = require_lib6();
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     var fetch_1 = require_lib31();
     var npm_resolver_1 = require_lib51();
     var network_auth_header_1 = require_lib77();
@@ -139086,6 +139136,7 @@ var require_lib120 = __commonJS({
           deps: _calcDepGraphHash(/* @__PURE__ */ new Set(), depPath)
         };
         const hexDigest = (0, crypto_object_hasher_1.hashObjectWithoutSorting)(state, { encoding: "hex" });
+        assertNoPathTraversal(version2);
         const prefix = name.startsWith("@") ? "" : "@/";
         yield {
           hash: `${prefix}${name}/${version2}/${hexDigest}`,
@@ -139093,6 +139144,13 @@ var require_lib120 = __commonJS({
         };
       }
     }
+    function assertNoPathTraversal(version2) {
+      if (version2.split(/[/\\]/).includes("..")) {
+        const error = new Error(`Refusing to build a virtual-store path with the traversal version segment ${JSON.stringify(version2)}`);
+        error.code = "ERR_PNPM_INVALID_DEPENDENCY_NAME";
+        throw error;
+      }
+    }
     function lockfileToDepGraph(lockfile) {
       const graph = {};
       if (lockfile.packages != null) {
@@ -139143,7 +139201,7 @@ var require_sortLockfileKeys = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.sortLockfileKeys = sortLockfileKeys;
-    var object_key_sorting_1 = require_lib98();
+    var object_key_sorting_1 = require_lib99();
     var ORDERED_KEYS = {
       resolution: 1,
       id: 2,
@@ -142024,7 +142082,7 @@ var require_approveBuilds = __commonJS({
     var enquirer_1 = require_enquirer();
     var chalk_1 = __importDefault2(require_source());
     var plugin_commands_rebuild_1 = require_lib133();
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     var getAutomaticallyIgnoredBuilds_js_1 = require_getAutomaticallyIgnoredBuilds();
     exports2.commandNames = ["approve-builds"];
     function help() {
@@ -148235,7 +148293,7 @@ var require_fix = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.fix = fix;
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     var difference_1 = __importDefault2(require_difference());
     async function fix(auditReport, opts) {
       const vulnOverrides = createOverrides(Object.values(auditReport.advisories), opts.auditConfig?.ignoreCves);
@@ -148270,7 +148328,7 @@ var require_ignore2 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.ignore = ignore;
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     var difference_1 = __importDefault2(require_difference());
     async function ignore(opts) {
       const currentCves = opts?.auditConfig?.ignoreCves ?? [];
@@ -150914,7 +150972,7 @@ var require_configSet = __commonJS({
     var error_1 = require_lib6();
     var object_property_path_1 = require_lib141();
     var run_npm_1 = require_lib142();
-    var workspace_manifest_writer_1 = require_lib99();
+    var workspace_manifest_writer_1 = require_lib100();
     var camelcase_1 = __importDefault2(require_camelcase());
     var lodash_kebabcase_1 = __importDefault2(require_lodash());
     var read_ini_file_1 = require_read_ini_file();
@@ -151049,7 +151107,7 @@ var require_configList = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.configList = configList;
     var ini_1 = require_ini3();
-    var object_key_sorting_1 = require_lib98();
+    var object_key_sorting_1 = require_lib99();
     async function configList(opts) {
       const sortedConfig = (0, object_key_sorting_1.sortDirectKeys)(opts.rawConfig);
       if (opts.json) {
@@ -159847,8 +159905,124 @@ var require_lib157 = __commonJS({
   }
 });
 
-// ../node_modules/.pnpm/@yarnpkg+pnp@4.0.8/node_modules/@yarnpkg/pnp/lib/index.js
+// ../fs/symlink-dependency/lib/safeJoinModulesDir.js
+var require_safeJoinModulesDir = __commonJS({
+  "../fs/symlink-dependency/lib/safeJoinModulesDir.js"(exports2) {
+    "use strict";
+    var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.safeJoinModulesDir = safeJoinModulesDir;
+    var path_1 = __importDefault2(require("path"));
+    var validate_npm_package_name_1 = __importDefault2(require_lib97());
+    function safeJoinModulesDir(modulesDir, alias) {
+      if (!(0, validate_npm_package_name_1.default)(alias).validForOldPackages) {
+        throw invalidDependencyNameError(modulesDir, alias);
+      }
+      const link = path_1.default.join(modulesDir, alias);
+      const resolvedDir = path_1.default.resolve(modulesDir);
+      const resolvedLink = path_1.default.resolve(link);
+      if (resolvedLink === resolvedDir || !resolvedLink.startsWith(resolvedDir + path_1.default.sep)) {
+        throw invalidDependencyNameError(modulesDir, alias, resolvedLink);
+      }
+      return link;
+    }
+    function invalidDependencyNameError(modulesDir, alias, resolvedLink) {
+      const detail = resolvedLink ? ` (it resolves to ${resolvedLink})` : "";
+      const error = new Error(`Refusing to place a dependency under ${modulesDir} with the invalid alias ${JSON.stringify(alias)}${detail}`);
+      error.code = "ERR_PNPM_INVALID_DEPENDENCY_NAME";
+      return error;
+    }
+  }
+});
+
+// ../fs/symlink-dependency/lib/symlinkDirectRootDependency.js
+var require_symlinkDirectRootDependency = __commonJS({
+  "../fs/symlink-dependency/lib/symlinkDirectRootDependency.js"(exports2) {
+    "use strict";
+    var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.symlinkDirectRootDependency = symlinkDirectRootDependency;
+    var fs_1 = require("fs");
+    var util_1 = __importDefault2(require("util"));
+    var core_loggers_1 = require_lib8();
+    var symlink_dir_1 = __importDefault2(require_dist18());
+    var safeJoinModulesDir_js_1 = require_safeJoinModulesDir();
+    var DEP_TYPE_BY_DEPS_FIELD_NAME = {
+      dependencies: "prod",
+      devDependencies: "dev",
+      optionalDependencies: "optional"
+    };
+    async function symlinkDirectRootDependency(dependencyLocation, destModulesDir, importAs, opts) {
+      let destModulesDirReal;
+      try {
+        destModulesDirReal = await fs_1.promises.realpath(destModulesDir);
+      } catch (err) {
+        if (util_1.default.types.isNativeError(err) && "code" in err && err.code === "ENOENT") {
+          await fs_1.promises.mkdir(destModulesDir, { recursive: true });
+          destModulesDirReal = await fs_1.promises.realpath(destModulesDir);
+        } else {
+          throw err;
+        }
+      }
+      const dest = (0, safeJoinModulesDir_js_1.safeJoinModulesDir)(destModulesDirReal, importAs);
+      const { reused } = await (0, symlink_dir_1.default)(dependencyLocation, dest);
+      if (reused)
+        return;
+      core_loggers_1.rootLogger.debug({
+        added: {
+          dependencyType: opts.fromDependenciesField && DEP_TYPE_BY_DEPS_FIELD_NAME[opts.fromDependenciesField],
+          linkedFrom: dependencyLocation,
+          name: importAs,
+          realName: opts.linkedPackage.name,
+          version: opts.linkedPackage.version
+        },
+        prefix: opts.prefix
+      });
+    }
+  }
+});
+
+// ../fs/symlink-dependency/lib/index.js
 var require_lib158 = __commonJS({
+  "../fs/symlink-dependency/lib/index.js"(exports2) {
+    "use strict";
+    var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.symlinkDirectRootDependency = exports2.safeJoinModulesDir = void 0;
+    exports2.symlinkDependency = symlinkDependency;
+    exports2.symlinkDependencySync = symlinkDependencySync;
+    var core_loggers_1 = require_lib8();
+    var symlink_dir_1 = __importDefault2(require_dist18());
+    var safeJoinModulesDir_js_1 = require_safeJoinModulesDir();
+    var safeJoinModulesDir_js_2 = require_safeJoinModulesDir();
+    Object.defineProperty(exports2, "safeJoinModulesDir", { enumerable: true, get: function() {
+      return safeJoinModulesDir_js_2.safeJoinModulesDir;
+    } });
+    var symlinkDirectRootDependency_js_1 = require_symlinkDirectRootDependency();
+    Object.defineProperty(exports2, "symlinkDirectRootDependency", { enumerable: true, get: function() {
+      return symlinkDirectRootDependency_js_1.symlinkDirectRootDependency;
+    } });
+    async function symlinkDependency(dependencyRealLocation, destModulesDir, importAs) {
+      const link = (0, safeJoinModulesDir_js_1.safeJoinModulesDir)(destModulesDir, importAs);
+      core_loggers_1.linkLogger.debug({ target: dependencyRealLocation, link });
+      return (0, symlink_dir_1.default)(dependencyRealLocation, link);
+    }
+    function symlinkDependencySync(dependencyRealLocation, destModulesDir, importAs) {
+      const link = (0, safeJoinModulesDir_js_1.safeJoinModulesDir)(destModulesDir, importAs);
+      core_loggers_1.linkLogger.debug({ target: dependencyRealLocation, link });
+      return symlink_dir_1.default.sync(dependencyRealLocation, link);
+    }
+  }
+});
+
+// ../node_modules/.pnpm/@yarnpkg+pnp@4.0.8/node_modules/@yarnpkg/pnp/lib/index.js
+var require_lib159 = __commonJS({
   "../node_modules/.pnpm/@yarnpkg+pnp@4.0.8/node_modules/@yarnpkg/pnp/lib/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -163319,7 +163493,7 @@ ${candidates.map((candidate) => `Not found: ${getPathForDisplay(candidate)}
 });
 
 // ../lockfile/lockfile-to-pnp/lib/index.js
-var require_lib159 = __commonJS({
+var require_lib160 = __commonJS({
   "../lockfile/lockfile-to-pnp/lib/index.js"(exports2) {
     "use strict";
     var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
@@ -163331,8 +163505,9 @@ var require_lib159 = __commonJS({
     var fs_1 = require("fs");
     var path_1 = __importDefault2(require("path"));
     var lockfile_utils_1 = require_lib122();
+    var symlink_dependency_1 = require_lib158();
     var dependency_path_1 = require_lib87();
-    var pnp_1 = require_lib158();
+    var pnp_1 = require_lib159();
     var normalize_path_1 = __importDefault2(require_normalize_path());
     async function writePnpFile(lockfile, opts) {
       const packageRegistry = lockfileToPackageRegistry(lockfile, opts);
@@ -163389,7 +163564,8 @@ var require_lib159 = __commonJS({
           packageStore = /* @__PURE__ */ new Map();
           packageRegistry.set(name, packageStore);
         }
-        let packageLocation = (0, normalize_path_1.default)(path_1.default.relative(opts.lockfileDir, path_1.default.join(opts.virtualStoreDir, (0, dependency_path_1.depPathToFilename)(relDepPath, opts.virtualStoreDirMaxLength), "node_modules", name)));
+        const pkgModulesDir = path_1.default.join(opts.virtualStoreDir, (0, dependency_path_1.depPathToFilename)(relDepPath, opts.virtualStoreDirMaxLength), "node_modules");
+        let packageLocation = (0, normalize_path_1.default)(path_1.default.relative(opts.lockfileDir, (0, symlink_dependency_1.safeJoinModulesDir)(pkgModulesDir, name)));
         if (!packageLocation.startsWith("../")) {
           packageLocation = `./${packageLocation}`;
         }
@@ -163702,7 +163878,7 @@ var require_prune2 = __commonJS({
 });
 
 // ../pkg-manager/modules-cleaner/lib/index.js
-var require_lib160 = __commonJS({
+var require_lib161 = __commonJS({
   "../pkg-manager/modules-cleaner/lib/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -163714,110 +163890,6 @@ var require_lib160 = __commonJS({
   }
 });
 
-// ../fs/symlink-dependency/lib/safeJoinModulesDir.js
-var require_safeJoinModulesDir = __commonJS({
-  "../fs/symlink-dependency/lib/safeJoinModulesDir.js"(exports2) {
-    "use strict";
-    var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.safeJoinModulesDir = safeJoinModulesDir;
-    var path_1 = __importDefault2(require("path"));
-    function safeJoinModulesDir(modulesDir, alias) {
-      const link = path_1.default.join(modulesDir, alias);
-      const resolvedDir = path_1.default.resolve(modulesDir);
-      const resolvedLink = path_1.default.resolve(link);
-      if (resolvedLink === resolvedDir || !resolvedLink.startsWith(resolvedDir + path_1.default.sep)) {
-        const error = new Error(`Refusing to symlink dependency outside ${modulesDir}: alias ${JSON.stringify(alias)} resolves to ${resolvedLink}`);
-        error.code = "ERR_PNPM_INVALID_DEPENDENCY_NAME";
-        throw error;
-      }
-      return link;
-    }
-  }
-});
-
-// ../fs/symlink-dependency/lib/symlinkDirectRootDependency.js
-var require_symlinkDirectRootDependency = __commonJS({
-  "../fs/symlink-dependency/lib/symlinkDirectRootDependency.js"(exports2) {
-    "use strict";
-    var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.symlinkDirectRootDependency = symlinkDirectRootDependency;
-    var fs_1 = require("fs");
-    var util_1 = __importDefault2(require("util"));
-    var core_loggers_1 = require_lib8();
-    var symlink_dir_1 = __importDefault2(require_dist18());
-    var safeJoinModulesDir_js_1 = require_safeJoinModulesDir();
-    var DEP_TYPE_BY_DEPS_FIELD_NAME = {
-      dependencies: "prod",
-      devDependencies: "dev",
-      optionalDependencies: "optional"
-    };
-    async function symlinkDirectRootDependency(dependencyLocation, destModulesDir, importAs, opts) {
-      let destModulesDirReal;
-      try {
-        destModulesDirReal = await fs_1.promises.realpath(destModulesDir);
-      } catch (err) {
-        if (util_1.default.types.isNativeError(err) && "code" in err && err.code === "ENOENT") {
-          await fs_1.promises.mkdir(destModulesDir, { recursive: true });
-          destModulesDirReal = await fs_1.promises.realpath(destModulesDir);
-        } else {
-          throw err;
-        }
-      }
-      const dest = (0, safeJoinModulesDir_js_1.safeJoinModulesDir)(destModulesDirReal, importAs);
-      const { reused } = await (0, symlink_dir_1.default)(dependencyLocation, dest);
-      if (reused)
-        return;
-      core_loggers_1.rootLogger.debug({
-        added: {
-          dependencyType: opts.fromDependenciesField && DEP_TYPE_BY_DEPS_FIELD_NAME[opts.fromDependenciesField],
-          linkedFrom: dependencyLocation,
-          name: importAs,
-          realName: opts.linkedPackage.name,
-          version: opts.linkedPackage.version
-        },
-        prefix: opts.prefix
-      });
-    }
-  }
-});
-
-// ../fs/symlink-dependency/lib/index.js
-var require_lib161 = __commonJS({
-  "../fs/symlink-dependency/lib/index.js"(exports2) {
-    "use strict";
-    var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.symlinkDirectRootDependency = void 0;
-    exports2.symlinkDependency = symlinkDependency;
-    exports2.symlinkDependencySync = symlinkDependencySync;
-    var core_loggers_1 = require_lib8();
-    var symlink_dir_1 = __importDefault2(require_dist18());
-    var safeJoinModulesDir_js_1 = require_safeJoinModulesDir();
-    var symlinkDirectRootDependency_js_1 = require_symlinkDirectRootDependency();
-    Object.defineProperty(exports2, "symlinkDirectRootDependency", { enumerable: true, get: function() {
-      return symlinkDirectRootDependency_js_1.symlinkDirectRootDependency;
-    } });
-    async function symlinkDependency(dependencyRealLocation, destModulesDir, importAs) {
-      const link = (0, safeJoinModulesDir_js_1.safeJoinModulesDir)(destModulesDir, importAs);
-      core_loggers_1.linkLogger.debug({ target: dependencyRealLocation, link });
-      return (0, symlink_dir_1.default)(dependencyRealLocation, link);
-    }
-    function symlinkDependencySync(dependencyRealLocation, destModulesDir, importAs) {
-      const link = (0, safeJoinModulesDir_js_1.safeJoinModulesDir)(destModulesDir, importAs);
-      core_loggers_1.linkLogger.debug({ target: dependencyRealLocation, link });
-      return symlink_dir_1.default.sync(dependencyRealLocation, link);
-    }
-  }
-});
-
 // ../pkg-manager/headless/lib/linkHoistedModules.js
 var require_linkHoistedModules = __commonJS({
   "../pkg-manager/headless/lib/linkHoistedModules.js"(exports2) {
@@ -164240,6 +164312,7 @@ var require_lockfileToDepGraph = __commonJS({
     var logger_1 = require_lib();
     var package_is_installable_1 = require_lib86();
     var patching_config_1 = require_lib162();
+    var symlink_dependency_1 = require_lib158();
     var dp = __importStar3(require_lib87());
     var path_exists_1 = __importDefault2(require_path_exists2());
     var equals_1 = __importDefault2(require_equals2());
@@ -164325,7 +164398,7 @@ var require_lockfileToDepGraph = __commonJS({
           const depIsPresent = !isDirectoryDep && currentPackages[depPath] && (0, equals_1.default)(currentPackages[depPath].dependencies, pkgSnapshot.dependencies);
           const depIntegrityIsUnchanged = isIntegrityEqual(pkgSnapshot.resolution, currentPackages[depPath]?.resolution);
           const modules = path_1.default.join(opts.virtualStoreDir, dirNameInVirtualStore, "node_modules");
-          const dir = path_1.default.join(modules, pkgName);
+          const dir = (0, symlink_dependency_1.safeJoinModulesDir)(modules, pkgName);
           locationByDepPath[depPath] = dir;
           if (isDirectoryDep) {
             injectionTargetsByDepPath.set(depPath, [dir]);
@@ -165347,6 +165420,7 @@ var require_lockfileToHoistedDepGraph = __commonJS({
     var package_is_installable_1 = require_lib86();
     var patching_config_1 = require_lib162();
     var read_package_json_1 = require_lib62();
+    var symlink_dependency_1 = require_lib158();
     var real_hoist_1 = require_lib164();
     var dp = __importStar3(require_lib87());
     async function lockfileToHoistedDepGraph(lockfile, currentLockfile, opts) {
@@ -165472,7 +165546,7 @@ var require_lockfileToHoistedDepGraph = __commonJS({
           });
           return;
         }
-        const dir = path_1.default.join(modules, dep.name);
+        const dir = (0, symlink_dependency_1.safeJoinModulesDir)(modules, dep.name);
         const depLocation = path_1.default.relative(opts.lockfileDir, dir);
         const resolution = (0, lockfile_utils_1.pkgSnapshotToResolution)(depPath, pkgSnapshot, opts.registries);
         let fetchResponse;
@@ -165588,7 +165662,7 @@ var require_linkDirectDeps = __commonJS({
     var fs_1 = __importDefault2(require("fs"));
     var path_1 = __importDefault2(require("path"));
     var core_loggers_1 = require_lib8();
-    var symlink_dependency_1 = require_lib161();
+    var symlink_dependency_1 = require_lib158();
     var omit_1 = __importDefault2(require_omit());
     var read_modules_dir_1 = require_lib69();
     var rimraf_1 = __importDefault2(require_rimraf());
@@ -165763,15 +165837,15 @@ var require_lib166 = __commonJS({
     var lifecycle_1 = require_lib72();
     var link_bins_1 = require_lib70();
     var lockfile_fs_1 = require_lib124();
-    var lockfile_to_pnp_1 = require_lib159();
+    var lockfile_to_pnp_1 = require_lib160();
     var lockfile_utils_1 = require_lib122();
     var extendProjectsWithTargetDirs_js_1 = require_extendProjectsWithTargetDirs();
     var logger_1 = require_lib();
-    var modules_cleaner_1 = require_lib160();
+    var modules_cleaner_1 = require_lib161();
     var modules_yaml_1 = require_lib117();
     var read_package_json_1 = require_lib62();
     var read_project_manifest_1 = require_lib17();
-    var symlink_dependency_1 = require_lib161();
+    var symlink_dependency_1 = require_lib158();
     var types_1 = require_lib10();
     var dp = __importStar3(require_lib87());
     var worker_1 = require_lib74();
@@ -166455,7 +166529,7 @@ var require_validateDependencyAlias = __commonJS({
     exports2.isValidDependencyAlias = isValidDependencyAlias;
     exports2.assertValidDependencyAliases = assertValidDependencyAliases;
     var error_1 = require_lib6();
-    var validate_npm_package_name_1 = __importDefault2(require_lib101());
+    var validate_npm_package_name_1 = __importDefault2(require_lib97());
     function isValidDependencyAlias(alias) {
       return typeof alias === "string" && (0, validate_npm_package_name_1.default)(alias).validForOldPackages;
     }
@@ -170039,6 +170113,7 @@ var require_resolvePeers = __commonJS({
     var semver_12 = __importDefault2(require_semver2());
     var semverUtils = __importStar3(require_semverUtils());
     var dependency_path_1 = require_lib87();
+    var symlink_dependency_1 = require_lib158();
     var partition_1 = __importDefault2(require_partition4());
     var pick_1 = __importDefault2(require_pick());
     var mergePeers_js_1 = require_mergePeers();
@@ -170422,7 +170497,7 @@ var require_resolvePeers = __commonJS({
         const peerDependencies = { ...resolvedPackage.peerDependencies };
         if (!ctx.depGraph[depPath] || ctx.depGraph[depPath].depth > node.depth) {
           const modules = path_1.default.join(ctx.virtualStoreDir, (0, dependency_path_1.depPathToFilename)(depPath, ctx.virtualStoreDirMaxLength), "node_modules");
-          const dir = path_1.default.join(modules, resolvedPackage.name);
+          const dir = (0, symlink_dependency_1.safeJoinModulesDir)(modules, resolvedPackage.name);
           const transitivePeerDependencies = /* @__PURE__ */ new Set();
           for (const unknownPeer of allResolvedPeers.keys()) {
             if (!peerDependencies[unknownPeer]) {
@@ -171348,6 +171423,7 @@ var require_lib169 = __commonJS({
     var manifest_utils_1 = require_lib11();
     var patching_config_1 = require_lib162();
     var read_package_json_1 = require_lib62();
+    var symlink_dependency_1 = require_lib158();
     var types_1 = require_lib10();
     var difference_1 = __importDefault2(require_difference());
     var zipWith_1 = __importDefault2(require_zipWith2());
@@ -171647,7 +171723,7 @@ var require_lib169 = __commonJS({
         const node = graph[depPath];
         Object.assign(node, {
           modules,
-          dir: path_1.default.join(modules, node.name)
+          dir: (0, symlink_dependency_1.safeJoinModulesDir)(modules, node.name)
         });
       }
       return graph;
@@ -173182,8 +173258,8 @@ var require_link3 = __commonJS({
     var pkg_manager_direct_dep_linker_1 = require_lib165();
     var hoist_1 = require_lib157();
     var logger_1 = require_lib();
-    var modules_cleaner_1 = require_lib160();
-    var symlink_dependency_1 = require_lib161();
+    var modules_cleaner_1 = require_lib161();
+    var symlink_dependency_1 = require_lib158();
     var worker_1 = require_lib74();
     var p_limit_12 = __importDefault2(require_p_limit());
     var path_exists_1 = __importDefault2(require_path_exists2());
@@ -173988,7 +174064,7 @@ var require_install = __commonJS({
     var lifecycle_1 = require_lib72();
     var link_bins_1 = require_lib70();
     var lockfile_fs_1 = require_lib124();
-    var lockfile_to_pnp_1 = require_lib159();
+    var lockfile_to_pnp_1 = require_lib160();
     var lockfile_verification_1 = require_lib147();
     var lockfile_preferred_versions_1 = require_lib167();
     var logger_1 = require_lib();
@@ -175377,7 +175453,7 @@ var require_recursive2 = __commonJS({
     var pnpmfile_1 = require_lib104();
     var sort_packages_1 = require_lib132();
     var store_connection_manager_1 = require_lib95();
-    var workspace_manifest_writer_1 = require_lib99();
+    var workspace_manifest_writer_1 = require_lib100();
     var core_1 = require_lib172();
     var is_subdir_1 = __importDefault2(require_is_subdir());
     var mem_1 = __importDefault2(require_dist15());
@@ -175780,7 +175856,7 @@ var require_installDeps = __commonJS({
     var core_1 = require_lib172();
     var logger_1 = require_lib();
     var sort_packages_1 = require_lib132();
-    var workspace_manifest_writer_1 = require_lib99();
+    var workspace_manifest_writer_1 = require_lib100();
     var workspace_pkgs_graph_1 = require_lib109();
     var workspace_state_1 = require_lib152();
     var is_subdir_1 = __importDefault2(require_is_subdir());
@@ -176079,7 +176155,7 @@ var require_add2 = __commonJS({
     var render_help_1 = __importDefault2(require_lib111());
     var getFetchFullMetadata_js_1 = require_getFetchFullMetadata();
     var installDeps_js_1 = require_installDeps();
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     exports2.shorthands = {
       "save-catalog": "--save-catalog-name=default"
     };
@@ -176989,7 +177065,7 @@ var require_link4 = __commonJS({
     var path_1 = __importDefault2(require("path"));
     var cli_utils_1 = require_lib105();
     var common_cli_options_help_1 = require_lib118();
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     var config_1 = require_lib24();
     var types_1 = require_lib10();
     var error_1 = require_lib6();
@@ -177239,7 +177315,7 @@ var require_remove4 = __commonJS({
     var error_1 = require_lib6();
     var get_context_1 = require_lib127();
     var workspace_find_packages_1 = require_lib107();
-    var workspace_manifest_writer_1 = require_lib99();
+    var workspace_manifest_writer_1 = require_lib100();
     var manifest_utils_1 = require_lib11();
     var store_connection_manager_1 = require_lib95();
     var core_1 = require_lib172();
@@ -191849,6 +191925,7 @@ var require_verifyPnpmEngineIdentity = __commonJS({
     var lockfile_fs_1 = require_lib124();
     var network_auth_header_1 = require_lib77();
     var pick_registry_for_package_1 = require_lib44();
+    var semver_12 = __importDefault2(require_semver2());
     var npmSigningKeys_js_1 = require_npmSigningKeys();
     function getNpmSigningKeys() {
       return npmSigningKeys_js_1.NPM_SIGNING_KEYS.map((k) => ({ ...k }));
@@ -191879,8 +191956,8 @@ var require_verifyPnpmEngineIdentity = __commonJS({
     }
     function collectEnginePackagesToVerify(lockfile, stageDir, targetPkgName, version2, registries) {
       const toVerify = [engineComponentToVerify(lockfile, registries, targetPkgName, version2)];
-      if (targetPkgName === "@pnpm/exe") {
-        const optionalDeps = lockfile.packages?.[`@pnpm/exe@${version2}`]?.optionalDependencies ?? {};
+      if (targetPkgName === "@pnpm/exe" || semver_12.default.major(version2) >= 12) {
+        const optionalDeps = lockfile.packages?.[`${targetPkgName}@${version2}`]?.optionalDependencies ?? {};
         for (const [name, platformVersion] of Object.entries(optionalDeps)) {
           if (!fs_1.default.existsSync(path_1.default.join(stageDir, "node_modules", name)))
             continue;
@@ -192016,6 +192093,10 @@ var require_installPnpmToTools = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.installPnpmToTools = installPnpmToTools;
+    exports2.pnpmPackageNameToInstall = pnpmPackageNameToInstall;
+    exports2.linkExePlatformBinary = linkExePlatformBinary;
+    exports2.exePlatformPkgDirNames = exePlatformPkgDirNames;
+    exports2.safeWrapperBinNames = safeWrapperBinNames;
     var fs_1 = __importDefault2(require("fs"));
     var path_1 = __importDefault2(require("path"));
     var cli_meta_1 = require_lib4();
@@ -192029,8 +192110,8 @@ var require_installPnpmToTools = __commonJS({
     var verifyPnpmEngineIdentity_js_1 = require_verifyPnpmEngineIdentity();
     async function installPnpmToTools(pnpmVersion, opts) {
       const currentPkgName = (0, cli_meta_1.getCurrentPackageName)();
-      const targetPkgName = currentPkgName === "@pnpm/exe" && process.platform === "darwin" && process.arch === "x64" && semver_12.default.major(pnpmVersion) >= 11 ? "pnpm" : currentPkgName;
-      if (targetPkgName !== currentPkgName) {
+      const targetPkgName = pnpmPackageNameToInstall(pnpmVersion, currentPkgName);
+      if (targetPkgName !== currentPkgName && semver_12.default.major(pnpmVersion) < 12) {
         (0, logger_1.globalWarn)(`Switching from @pnpm/exe to the "pnpm" npm package because @pnpm/exe v${pnpmVersion} no longer ships a binary for Intel macOS (darwin-x64). The new "pnpm" install requires Node.js to be available on PATH. See https://github.com/pnpm/pnpm/issues/11423.`);
       }
       const dir = (0, tools_path_1.getToolDirPath)({
@@ -192084,10 +192165,10 @@ var require_installPnpmToTools = __commonJS({
             pnpm_config_pm_on_fail: "ignore"
           }
         });
-        if (targetPkgName === "@pnpm/exe") {
-          linkExePlatformBinary(stage);
-        }
         await (0, verifyPnpmEngineIdentity_js_1.verifyPnpmEngineIdentity)(stage, targetPkgName, pnpmVersion, opts);
+        if (targetPkgName === "@pnpm/exe" || semver_12.default.major(pnpmVersion) >= 12) {
+          linkExePlatformBinary(stage, targetPkgName);
+        }
         symlink_dir_1.default.sync(stage, dir);
       } catch (err) {
         try {
@@ -192102,16 +192183,85 @@ var require_installPnpmToTools = __commonJS({
         binDir
       };
     }
-    function linkExePlatformBinary(stageDir) {
-      const platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "macos" : process.platform;
-      const arch = platform === "win" && process.arch === "ia32" ? "x86" : process.arch;
-      const executable = platform === "win" ? "pnpm.exe" : "pnpm";
-      const platformPkgDir = path_1.default.join(stageDir, "node_modules", "@pnpm", `${platform}-${arch}`);
-      const src = path_1.default.join(platformPkgDir, executable);
-      if (!fs_1.default.existsSync(src))
+    function pnpmPackageNameToInstall(pnpmVersion, currentPkgName) {
+      const major = semver_12.default.major(pnpmVersion);
+      if (major >= 12)
+        return "pnpm";
+      if (currentPkgName === "@pnpm/exe" && process.platform === "darwin" && process.arch === "x64" && major >= 11) {
+        return "pnpm";
+      }
+      return currentPkgName;
+    }
+    function linkExePlatformBinary(stageDir, wrapperPkgName) {
+      const wrapperDir = path_1.default.join(stageDir, "node_modules", ...wrapperPkgName.split("/"));
+      if (!fs_1.default.existsSync(wrapperDir))
+        return;
+      const scopeDir = path_1.default.join(stageDir, "node_modules", "@pnpm");
+      const isWin = process.platform === "win32";
+      const executable = isWin ? "pnpm.exe" : "pnpm";
+      let src;
+      for (const dirName of exePlatformPkgDirNames(process.platform, process.arch)) {
+        const candidate = path_1.default.join(scopeDir, dirName, executable);
+        if (fs_1.default.existsSync(candidate)) {
+          src = candidate;
+          break;
+        }
+      }
+      if (src == null)
         return;
-      const exePkgDir = path_1.default.join(stageDir, "node_modules", "@pnpm", "exe");
-      const dest = path_1.default.join(exePkgDir, executable);
+      if (!isWin) {
+        forceLink(src, path_1.default.join(wrapperDir, "pnpm"));
+        return;
+      }
+      const wrapperPkgJsonPath = path_1.default.join(wrapperDir, "package.json");
+      const wrapperPkg = JSON.parse(fs_1.default.readFileSync(wrapperPkgJsonPath, "utf8"));
+      const bin = typeof wrapperPkg.bin === "object" && wrapperPkg.bin != null ? wrapperPkg.bin : { pnpm: "pnpm" };
+      for (const name of safeWrapperBinNames(wrapperDir, bin)) {
+        forceLink(src, path_1.default.join(wrapperDir, `${name}.exe`));
+        forceLink(src, path_1.default.join(wrapperDir, name));
+        bin[name] = `${name}.exe`;
+      }
+      wrapperPkg.bin = bin;
+      const tempPkgJsonPath = `${wrapperPkgJsonPath}.pnpm-tmp`;
+      try {
+        fs_1.default.writeFileSync(tempPkgJsonPath, JSON.stringify(wrapperPkg, null, 2));
+        fs_1.default.renameSync(tempPkgJsonPath, wrapperPkgJsonPath);
+      } catch (err) {
+        try {
+          fs_1.default.rmSync(tempPkgJsonPath, { force: true });
+        } catch {
+        }
+        throw err;
+      }
+    }
+    function exePlatformPkgDirNames(platform, arch) {
+      switch (platform) {
+        case "win32": {
+          const legacyArch = arch === "ia32" ? "x86" : arch;
+          return [`win-${legacyArch}`, `exe.win32-${arch}`];
+        }
+        case "darwin":
+          return [`macos-${arch}`, `exe.darwin-${arch}`];
+        case "linux":
+          return [
+            `linux-${arch}`,
+            // legacy glibc
+            `linuxstatic-${arch}`,
+            // legacy musl
+            `exe.linux-${arch}`,
+            // v12 glibc
+            `exe.linux-${arch}-musl`
+            // v12 musl
+          ];
+        default:
+          return [`${platform}-${arch}`, `exe.${platform}-${arch}`];
+      }
+    }
+    function safeWrapperBinNames(wrapperDir, bin) {
+      const resolvedWrapperDir = path_1.default.resolve(wrapperDir);
+      return Object.keys(bin).filter((name) => path_1.default.dirname(path_1.default.resolve(wrapperDir, name)) === resolvedWrapperDir);
+    }
+    function forceLink(src, dest) {
       try {
         fs_1.default.unlinkSync(dest);
       } catch (err) {
@@ -192121,13 +192271,6 @@ var require_installPnpmToTools = __commonJS({
       }
       fs_1.default.linkSync(src, dest);
       fs_1.default.chmodSync(dest, 493);
-      if (platform === "win") {
-        const exePkgJsonPath = path_1.default.join(exePkgDir, "package.json");
-        const exePkg = JSON.parse(fs_1.default.readFileSync(exePkgJsonPath, "utf8"));
-        fs_1.default.writeFileSync(path_1.default.join(exePkgDir, "pnpm"), "This file intentionally left blank");
-        exePkg.bin.pnpm = "pnpm.exe";
-        fs_1.default.writeFileSync(exePkgJsonPath, JSON.stringify(exePkg, null, 2));
-      }
     }
   }
 });
@@ -192276,13 +192419,25 @@ var require_lib181 = __commonJS({
       return result2;
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.selfUpdate = exports2.verifyPnpmEngineIdentity = exports2.getNpmSigningKeys = exports2.installPnpmToTools = void 0;
+    exports2.selfUpdate = exports2.verifyPnpmEngineIdentity = exports2.getNpmSigningKeys = exports2.safeWrapperBinNames = exports2.exePlatformPkgDirNames = exports2.linkExePlatformBinary = exports2.pnpmPackageNameToInstall = exports2.installPnpmToTools = void 0;
     var selfUpdate = __importStar3(require_selfUpdate());
     exports2.selfUpdate = selfUpdate;
     var installPnpmToTools_js_1 = require_installPnpmToTools();
     Object.defineProperty(exports2, "installPnpmToTools", { enumerable: true, get: function() {
       return installPnpmToTools_js_1.installPnpmToTools;
     } });
+    Object.defineProperty(exports2, "pnpmPackageNameToInstall", { enumerable: true, get: function() {
+      return installPnpmToTools_js_1.pnpmPackageNameToInstall;
+    } });
+    Object.defineProperty(exports2, "linkExePlatformBinary", { enumerable: true, get: function() {
+      return installPnpmToTools_js_1.linkExePlatformBinary;
+    } });
+    Object.defineProperty(exports2, "exePlatformPkgDirNames", { enumerable: true, get: function() {
+      return installPnpmToTools_js_1.exePlatformPkgDirNames;
+    } });
+    Object.defineProperty(exports2, "safeWrapperBinNames", { enumerable: true, get: function() {
+      return installPnpmToTools_js_1.safeWrapperBinNames;
+    } });
     var verifyPnpmEngineIdentity_js_1 = require_verifyPnpmEngineIdentity();
     Object.defineProperty(exports2, "getNpmSigningKeys", { enumerable: true, get: function() {
       return verifyPnpmEngineIdentity_js_1.getNpmSigningKeys;
@@ -200367,7 +200522,7 @@ var require_pack2 = __commonJS({
     var tar_stream_1 = __importDefault2(require_tar_stream());
     var publish_js_1 = require_publish2();
     var chalk_1 = __importDefault2(require_source());
-    var validate_npm_package_name_1 = __importDefault2(require_lib101());
+    var validate_npm_package_name_1 = __importDefault2(require_lib97());
     var p_limit_12 = __importDefault2(require_p_limit());
     var common_cli_options_help_1 = require_lib118();
     var sort_packages_1 = require_lib132();
@@ -201264,7 +201419,7 @@ var require_updatePatchedDependencies = __commonJS({
     exports2.updatePatchedDependencies = updatePatchedDependencies;
     var path_1 = __importDefault2(require("path"));
     var normalize_path_1 = __importDefault2(require_normalize_path());
-    var config_config_writer_1 = require_lib100();
+    var config_config_writer_1 = require_lib101();
     async function updatePatchedDependencies(patchedDependencies, opts) {
       const workspaceDir = opts.workspaceDir ?? opts.rootProjectManifestDir;
       for (const [patchName, patchPath] of Object.entries(patchedDependencies)) {
@@ -201496,6 +201651,23 @@ ${stderr}`);
   }
 });
 
+// ../patching/plugin-commands-patching/lib/isSubdirectory.js
+var require_isSubdirectory = __commonJS({
+  "../patching/plugin-commands-patching/lib/isSubdirectory.js"(exports2) {
+    "use strict";
+    var __importDefault2 = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.isSubdirectory = isSubdirectory;
+    var path_1 = __importDefault2(require("path"));
+    function isSubdirectory(parentDir, childPath, pathUtils = path_1.default) {
+      const relativePath = pathUtils.relative(parentDir, childPath);
+      return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${pathUtils.sep}`) && !pathUtils.isAbsolute(relativePath);
+    }
+  }
+});
+
 // ../patching/plugin-commands-patching/lib/patchRemove.js
 var require_patchRemove = __commonJS({
   "../patching/plugin-commands-patching/lib/patchRemove.js"(exports2) {
@@ -201509,8 +201681,8 @@ var require_patchRemove = __commonJS({
     exports2.cliOptionsTypes = cliOptionsTypes;
     exports2.help = help;
     exports2.handler = handler;
-    var path_1 = __importDefault2(require("path"));
     var promises_1 = __importDefault2(require("fs/promises"));
+    var path_1 = __importDefault2(require("path"));
     var cli_utils_1 = require_lib105();
     var plugin_commands_installation_1 = require_lib177();
     var config_1 = require_lib24();
@@ -201518,6 +201690,7 @@ var require_patchRemove = __commonJS({
     var render_help_1 = __importDefault2(require_lib111());
     var enquirer_1 = require_enquirer();
     var pick_1 = __importDefault2(require_pick());
+    var isSubdirectory_js_1 = require_isSubdirectory();
     var updatePatchedDependencies_js_1 = require_updatePatchedDependencies();
     function rcOptionsTypes() {
       return (0, pick_1.default)([], config_1.types);
@@ -201535,7 +201708,7 @@ var require_patchRemove = __commonJS({
     }
     async function handler(opts, params) {
       let patchesToRemove = params;
-      const patchedDependencies = opts.patchedDependencies ?? {};
+      const patchedDependencies = { ...opts.patchedDependencies };
       if (!params.length) {
         const allPatches = Object.keys(patchedDependencies);
         if (allPatches.length) {
@@ -201558,15 +201731,19 @@ var require_patchRemove = __commonJS({
           throw new error_1.PnpmError("PATCH_NOT_FOUND", `Patch "${patch}" not found in patched dependencies`);
         }
       }
-      const patchesDirs = /* @__PURE__ */ new Set();
-      await Promise.all(patchesToRemove.map(async (patch) => {
-        if (Object.hasOwn(patchedDependencies, patch)) {
-          const patchFile = patchedDependencies[patch];
-          patchesDirs.add(path_1.default.dirname(patchFile));
-          await promises_1.default.rm(patchFile, { force: true });
-          delete patchedDependencies[patch];
+      const patchRemovalContext = await getPatchRemovalContext(opts);
+      const patchesToRemoveTargets = await Promise.all(patchesToRemove.map(async (patch) => {
+        const patchFile = patchedDependencies[patch];
+        if (patchFile == null) {
+          throw new error_1.PnpmError("PATCH_NOT_FOUND", `Patch "${patch}" not found in patched dependencies`);
         }
+        return getPatchRemovalTarget(patch, patchFile, patchRemovalContext);
       }));
+      await Promise.all(patchesToRemoveTargets.map(unlinkPatchIfExists));
+      for (const { patch } of patchesToRemoveTargets) {
+        delete patchedDependencies[patch];
+      }
+      const patchesDirs = new Set(patchesToRemoveTargets.map(({ parentDir }) => parentDir));
       await Promise.all(Array.from(patchesDirs).map(async (dir) => {
         try {
           const files = await promises_1.default.readdir(dir);
@@ -201580,7 +201757,83 @@ var require_patchRemove = __commonJS({
         ...opts,
         workspaceDir: opts.workspaceDir ?? opts.rootProjectManifestDir
       });
-      return plugin_commands_installation_1.install.handler(opts);
+      return plugin_commands_installation_1.install.handler({
+        ...opts,
+        patchedDependencies
+      });
+    }
+    async function getPatchRemovalContext(opts) {
+      const lockfileDir = path_1.default.resolve(opts.lockfileDir ?? opts.dir ?? process.cwd());
+      const realLockfileDir = await promises_1.default.realpath(lockfileDir);
+      const patchesDirSetting = opts.patchesDir ?? "patches";
+      const patchesDir = path_1.default.join(lockfileDir, path_1.default.normalize(patchesDirSetting));
+      if (!(0, isSubdirectory_js_1.isSubdirectory)(lockfileDir, patchesDir)) {
+        throw new error_1.PnpmError("PATCHES_DIR_OUTSIDE_PROJECT", `The configured patches directory is outside the project: ${patchesDirSetting}`);
+      }
+      const realPatchesDir = await realpathIfExists(patchesDir);
+      if (realPatchesDir != null && !(0, isSubdirectory_js_1.isSubdirectory)(realLockfileDir, realPatchesDir)) {
+        throw new error_1.PnpmError("PATCHES_DIR_OUTSIDE_PROJECT", `The configured patches directory is outside the project: ${patchesDirSetting}`);
+      }
+      return {
+        lockfileDir,
+        patchesDir,
+        realPatchesDir
+      };
+    }
+    async function getPatchRemovalTarget(patch, patchFile, ctx) {
+      const targetPath = path_1.default.resolve(ctx.lockfileDir, patchFile);
+      if (targetPath === ctx.patchesDir || !(0, isSubdirectory_js_1.isSubdirectory)(ctx.patchesDir, targetPath)) {
+        throw new error_1.PnpmError("PATCH_FILE_OUTSIDE_PATCHES_DIR", `Patch file "${patchFile}" is outside the configured patches directory`);
+      }
+      const parentDir = path_1.default.dirname(targetPath);
+      const targetStats = await lstatIfExists(targetPath);
+      const realParentDir = await realpathIfExists(parentDir);
+      const realPatchesDir = ctx.realPatchesDir ?? await realpathIfExists(ctx.patchesDir);
+      if (realParentDir != null && realPatchesDir != null && !(0, isSubdirectory_js_1.isSubdirectory)(realPatchesDir, realParentDir)) {
+        throw new error_1.PnpmError("PATCH_FILE_OUTSIDE_PATCHES_DIR", `Patch file "${patchFile}" is outside the configured patches directory`);
+      }
+      if (targetStats?.isDirectory()) {
+        throw new error_1.PnpmError("PATCH_FILE_IS_DIRECTORY", `Patch file "${patchFile}" is a directory`);
+      }
+      return {
+        patch,
+        patchFile,
+        parentDir,
+        targetPath,
+        targetExists: targetStats != null
+      };
+    }
+    async function unlinkPatchIfExists({ targetExists, targetPath }) {
+      if (!targetExists)
+        return;
+      try {
+        await promises_1.default.unlink(targetPath);
+      } catch (err) {
+        if (isErrorWithCode(err, "ENOENT"))
+          return;
+        throw err;
+      }
+    }
+    async function lstatIfExists(targetPath) {
+      try {
+        return await promises_1.default.lstat(targetPath);
+      } catch (err) {
+        if (isErrorWithCode(err, "ENOENT"))
+          return void 0;
+        throw err;
+      }
+    }
+    async function realpathIfExists(targetPath) {
+      try {
+        return await promises_1.default.realpath(targetPath);
+      } catch (err) {
+        if (isErrorWithCode(err, "ENOENT"))
+          return void 0;
+        throw err;
+      }
+    }
+    function isErrorWithCode(err, code) {
+      return typeof err === "object" && err !== null && "code" in err && err.code === code;
     }
   }
 });
@@ -210971,7 +211224,7 @@ var require_catIndex = __commonJS({
     exports2.handler = handler;
     var client_1 = require_lib79();
     var error_1 = require_lib6();
-    var object_key_sorting_1 = require_lib98();
+    var object_key_sorting_1 = require_lib99();
     var store_path_1 = require_lib33();
     var store_cafs_1 = require_lib80();
     var parse_wanted_dependency_1 = require_lib102();
@@ -211294,7 +211547,7 @@ var require_init2 = __commonJS({
     var cli_meta_1 = require_lib4();
     var config_1 = require_lib24();
     var error_1 = require_lib6();
-    var object_key_sorting_1 = require_lib98();
+    var object_key_sorting_1 = require_lib99();
     var write_project_manifest_1 = require_lib15();
     var pick_1 = __importDefault2(require_pick());
     var render_help_1 = __importDefault2(require_lib111());