chore(): update pnpm to v9.15.0 [security] #1437
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
renovate
bot
added
automerge
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
#2142 Bundle Size — 5.64MiB (0%).63f8609(current) vs 64b2b9c dev#2099(baseline) Warning Bundle contains 5 duplicate packages – View duplicate packages Bundle metrics
|
| Current #2142 |
Baseline #2099 |
|
|---|---|---|
 Initial JS |
3.05MiB |
3.05MiB |
| Initial CSS |
9.7KiB |
9.7KiB |
 Cache Invalidation |
20.13% |
24.05% |
| Chunks |
67 |
67 |
| Assets |
80 |
80 |
| Modules |
2016 |
2016 |
| Duplicate Modules |
361 |
361 |
| Duplicate Code |
10.01% |
10.01% |
| Packages |
159 |
159 |
| Duplicate Packages |
5 |
5 |
Bundle size by type no changes
| Current #2142 |
Baseline #2099 |
|
|---|---|---|
| JS |
4.4MiB |
4.4MiB |
| Other |
1.13MiB |
1.13MiB |
| Fonts |
94.54KiB |
94.54KiB |
| CSS |
9.7KiB |
9.7KiB |
| IMG |
8.57KiB |
8.57KiB |
Bundle analysis report Branch renovate/npm-pnpm-vulnerability Project dashboard
Generated by RelativeCI Documentation Report issue
📦 Next.js Bundle Analysis for @weareinreach/appThis analysis was generated by the Next.js Bundle Analysis action. 🤖 This PR introduced no changes to the JavaScript bundle! 🙌 |
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
6750125 to
bfc362a
Compare
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
bfc362a to
28e0adc
Compare
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
28e0adc to
aa92107
Compare
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
aa92107 to
f629d74
Compare
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
f629d74 to
adee2ac
Compare
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
adee2ac to
d63a9fb
Compare
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
d63a9fb to
9b6db37
Compare
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
9b6db37 to
83037a5
Compare
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
83037a5 to
222969c
Compare
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
222969c to
dc36742
Compare
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
dc36742 to
d11ef98
Compare
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
d11ef98 to
a824921
Compare
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
a824921 to
63f8609
Compare
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
9.12.2->9.15.0^9.0.0->^9.15.0pnpm no-script global cache poisoning via overrides /
ignore-scriptsevasionCVE-2024-53866 / GHSA-vm32-9rqf-rh3r
More information
Details
Summary
pnpm seems to mishandle overrides and global cache:
This can make workspace A (even running with
ignore-scripts=true) posion global cache and execute scripts in workspace BUsers generally expect
ignore-scriptsto be sufficient to prevent immediate code execution on install (e.g. when the tree is just repacked/bundled without executing it).Here, that expectation is broken
Details
See PoC.
In it, overrides from a single run of A get leaked into e.g.
~/Library/Caches/pnpm/metadata/registry.npmjs.org/rimraf.jsonand persistently affect all other projects using the cachePoC
Postinstall code used in PoC is benign and can be inspected in https://www.npmjs.com/package/ponyhooves?activeTab=code, it's just a
console.logOn mac:
rm -rf ~/Library/Caches/pnpm ~/Library/pnpm/storeThis step is not required in general, but we'll be using a popular package for PoC that's likely cached
A/package.json:{ "name": "A", "pnpm": { "overrides": { "rimraf>glob": "npm:ponyhooves@1" } }, "dependencies": { "rimraf": "6.0.1" } }pnpm i --ignore-scripts(the flag is not required, but the point of the demo is to show that it doesn't help)B/package.json:{ "name": "B", "dependencies": { "rimraf": "6.0.1" } }pnpm iResult:
Also, that code got leaked into another project and it's lockfile now!
Impact
Global state integrity is lost via operations that one would expect to be secure, enabling subsequently running arbitrary code execution on installs
As a work-around, use separate cache and store dirs in each workspace
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
pnpm/pnpm (pnpm)
v9.15.0Compare Source
v9.14.4Compare Source
v9.14.3Compare Source
v9.14.2Compare Source
Patch Changes
pnpm publish --jsonshould work #8788.Platinum Sponsors
Gold Sponsors
v9.14.1Compare Source
Minor Changes
pnpm pack --jsonto print packed tarball and contents in JSON format #8765.Patch Changes
pnpm execshould print a meaningful error message when no command is provided #8752.pnpm setupshould remove the CLI from the target location before moving the new binary #8173.ERR_PNPM_TARBALL_EXTRACTerror while installing a dependency from GitHub having a slash in branch name #7697.use-node-versionsetting is used and the system has no Node.js installed #8769..npmrcfiles to their correct types. For instance,child-concurrencyshould be a number, not a string #5075.manage-package-manager-versionsis set totrue.pnpm initshould respect the--diroption #8768.Platinum Sponsors
Gold Sponsors
v9.14.0Compare Source
v9.13.2: pnpm 9.13.2Compare Source
Patch Changes
dlxprocesses.Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.13.1: pnpm 9.13.1Compare Source
Patch Changes
Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.13.0: pnpm 9.13Compare Source
Minor Changes
The
self-updatenow accepts a version specifier to install a specific version of pnpm. E.g.:or
Patch Changes
Cannot read properties of undefined (reading 'name')that is printed while trying to render the missing peer dependencies warning message #8538.Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.12.3Compare Source
Patch Changes
node_modules, when typing "n" in the prompt that asks whether to removenode_modulesbefore installation #8655.manage-package-manager-versions=trueis set and the.toolsdirectory is corrupt.crypto.hash, when available, for improved performance #8629.package.jsonat the root of the workspace #8667.manage-package-manager-versionsis set totrue, errors spawning a self-managed version ofpnpmwill now be shown (instead of being silent).Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.