pnpm 8.15.7 → 8.15.8

package/dist/node_modules/.modules.yaml

@@ -181,7 +181,7 @@ hoistedLocations:
     - node_modules/string_decoder
   strip-ansi@6.0.1:
     - node_modules/strip-ansi
-  tar@6.2.0:
+  tar@6.2.1:
     - node_modules/tar
   unique-filename@2.0.1:
     - node_modules/unique-filename
@@ -206,9 +206,9 @@ included:
 injectedDeps: {}
 layoutVersion: 5
 nodeLinker: hoisted
-packageManager: pnpm@9.0.0-rc.0
+packageManager: pnpm@9.1.0-0
 pendingBuilds: []
-prunedAt: Sat, 13 Apr 2024 16:15:15 GMT
+prunedAt: Mon, 29 Apr 2024 23:45:28 GMT
 publicHoistPattern:
   - '*eslint*'
   - '*prettier*'
@@ -217,3 +217,4 @@ registries:
 skipped: []
 storeDir: /home/runner/setup-pnpm/node_modules/.bin/store/v3
 virtualStoreDir: .pnpm
+virtualStoreDirMaxLength: 120

package/dist/node_modules/.pnpm/lock.yaml

@@ -58,6 +58,7 @@ overrides:
   tough-cookie@<4.1.3: '>=4.1.3'
   ts-api-utils: 1.0.0
   socks: 2.7.3
+  tar@6: ^6.2.1
 
 importers:
 
@@ -413,8 +414,8 @@ packages:
     resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
     engines: {node: '>=8'}
 
-  tar@6.2.0:
-    resolution: {integrity: sha512-/Wo7DcT0u5HUV486xg675HtjNd3BXZ6xDbzsCUZPt5iw8bTQ63bP0Raut3mvro9u+CUyq7YQd8Cx55fsZXxqLQ==}
+  tar@6.2.1:
+    resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
     engines: {node: '>=10'}
 
   unique-filename@2.0.1:
@@ -530,7 +531,7 @@ snapshots:
       promise-inflight: 1.0.1
       rimraf: 3.0.2
       ssri: 9.0.1
-      tar: 6.2.0
+      tar: 6.2.1
       unique-filename: 2.0.1
     transitivePeerDependencies:
       - bluebird
@@ -794,7 +795,7 @@ snapshots:
       npmlog: 6.0.2
       rimraf: 3.0.2
       semver: 7.5.4
-      tar: 6.2.0
+      tar: 6.2.1
       which: 2.0.2
     transitivePeerDependencies:
       - bluebird
@@ -911,7 +912,7 @@ snapshots:
       ansi-regex: 5.0.1
     optional: true
 
-  tar@6.2.0:
+  tar@6.2.1:
     dependencies:
       chownr: 2.0.0
       fs-minipass: 2.1.0

package/dist/node_modules/tar/lib/unpack.js

@@ -48,6 +48,7 @@ const crypto = require('crypto')
 const getFlag = require('./get-write-flag.js')
 const platform = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform
 const isWindows = platform === 'win32'
+const DEFAULT_MAX_DEPTH = 1024
 
 // Unlinks on Windows are not atomic.
 //
@@ -181,6 +182,12 @@ class Unpack extends Parser {
     this.processGid = (this.preserveOwner || this.setOwner) && process.getgid ?
       process.getgid() : null
 
+    // prevent excessively deep nesting of subfolders
+    // set to `Infinity` to remove this restriction
+    this.maxDepth = typeof opt.maxDepth === 'number'
+      ? opt.maxDepth
+      : DEFAULT_MAX_DEPTH
+
     // mostly just for testing, but useful in some cases.
     // Forcibly trigger a chown on every entry, no matter what
     this.forceChown = opt.forceChown === true
@@ -238,13 +245,13 @@ class Unpack extends Parser {
   }
 
   [CHECKPATH] (entry) {
+    const p = normPath(entry.path)
+    const parts = p.split('/')
+
     if (this.strip) {
-      const parts = normPath(entry.path).split('/')
       if (parts.length < this.strip) {
         return false
       }
-      entry.path = parts.slice(this.strip).join('/')
-
       if (entry.type === 'Link') {
         const linkparts = normPath(entry.linkpath).split('/')
         if (linkparts.length >= this.strip) {
@@ -253,11 +260,21 @@ class Unpack extends Parser {
           return false
         }
       }
+      parts.splice(0, this.strip)
+      entry.path = parts.join('/')
+    }
+
+    if (isFinite(this.maxDepth) && parts.length > this.maxDepth) {
+      this.warn('TAR_ENTRY_ERROR', 'path excessively deep', {
+        entry,
+        path: p,
+        depth: parts.length,
+        maxDepth: this.maxDepth,
+      })
+      return false
     }
 
     if (!this.preservePaths) {
-      const p = normPath(entry.path)
-      const parts = p.split('/')
       if (parts.includes('..') || isWindows && /^[a-z]:\.\.$/i.test(parts[0])) {
         this.warn('TAR_ENTRY_ERROR', `path contains '..'`, {
           entry,

package/dist/node_modules/tar/package.json

@@ -2,7 +2,7 @@
   "author": "GitHub Inc.",
   "name": "tar",
   "description": "tar for node",
-  "version": "6.2.0",
+  "version": "6.2.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/isaacs/node-tar.git"

package/dist/pnpm.cjs

@@ -3295,7 +3295,7 @@ var require_lib4 = __commonJS({
     var load_json_file_1 = __importDefault3(require_load_json_file());
     var defaultManifest = {
       name: true ? "pnpm" : "pnpm",
-      version: true ? "8.15.7" : "0.0.0"
+      version: true ? "8.15.8" : "0.0.0"
     };
     var pkgJson;
     if (require.main == null) {
@@ -85885,9 +85885,9 @@ var require_lib56 = __commonJS({
   }
 });
 
-// ../node_modules/.pnpm/@rushstack+worker-pool@0.4.9_@types+node@20.5.1/node_modules/@rushstack/worker-pool/lib/WorkerPool.js
+// ../node_modules/.pnpm/@rushstack+worker-pool@0.4.9_@types+node@18.19.31/node_modules/@rushstack/worker-pool/lib/WorkerPool.js
 var require_WorkerPool = __commonJS({
-  "../node_modules/.pnpm/@rushstack+worker-pool@0.4.9_@types+node@20.5.1/node_modules/@rushstack/worker-pool/lib/WorkerPool.js"(exports2) {
+  "../node_modules/.pnpm/@rushstack+worker-pool@0.4.9_@types+node@18.19.31/node_modules/@rushstack/worker-pool/lib/WorkerPool.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.WorkerPool = exports2.WORKER_ID_SYMBOL = void 0;
@@ -103242,10 +103242,19 @@ var require_runLifecycleHook = __commonJS({
     var npm_lifecycle_1 = __importDefault3(require_npm_lifecycle());
     var error_1 = require_lib8();
     var fs_1 = require("fs");
+    var is_windows_1 = __importDefault3(require_is_windows());
     function noop() {
     }
     async function runLifecycleHook(stage, manifest, opts) {
       const optional = opts.optional === true;
+      if (opts.scriptShell != null && isWindowsBatchFile(opts.scriptShell)) {
+        throw new error_1.PnpmError("ERR_PNPM_INVALID_SCRIPT_SHELL_WINDOWS", "Cannot spawn .bat or .cmd as a script shell.", {
+          hint: `The .npmrc script-shell option was configured to a .bat or .cmd file. These cannot be used as a script shell reliably.
+
+Please unset the script-shell option, or configure it to a .exe instead.
+`
+        });
+      }
       const m = { _id: getId(manifest), ...manifest };
       m.scripts = { ...m.scripts };
       if (stage === "start" && !m.scripts.start) {
@@ -103334,6 +103343,10 @@ var require_runLifecycleHook = __commonJS({
     function getId(manifest) {
       return `${manifest.name ?? ""}@${manifest.version ?? ""}`;
     }
+    function isWindowsBatchFile(scriptShell) {
+      const scriptShellLower = scriptShell.toLowerCase();
+      return (0, is_windows_1.default)() && (scriptShellLower.endsWith(".cmd") || scriptShellLower.endsWith(".bat"));
+    }
   }
 });
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pnpm",
   "description": "Fast, disk space efficient package manager",
-  "version": "8.15.7",
+  "version": "8.15.8",
   "bin": {
     "pnpm": "bin/pnpm.cjs",
     "pnpx": "bin/pnpx.cjs"