chore(deps): update pnpm to v9 [security] #1022
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![descope[bot]](https://avatars.githubusercontent.com/in/211506?s=60&v=4){kind=small}
![descope-approve[bot]](https://avatars.githubusercontent.com/in/232635?s=60&v=4){kind=small}
|
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ 5 Skipped Deployments
|
|
View your CI Pipeline Execution ↗ for commit a5c9ef5.
☁️ Nx Cloud last updated this comment at |
descope
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
7dbd87f to
600f077
Compare
descope
bot
force-pushed
the
renovate/npm-pnpm-vulnerability
branch
from
600f077 to
a5c9ef5
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
8.15.9+sha512.499434c9d8fdd1a2794ebf4552b3b25c0a633abcee5bb15e7b5de90f32f47b513aca98cd5cfd001c31f0db454bc3804edccd578501e4ca293a6816166bbd9f81->9.15.0pnpm no-script global cache poisoning via overrides /
ignore-scriptsevasionCVE-2024-53866 / GHSA-vm32-9rqf-rh3r
More information
Details
Summary
pnpm seems to mishandle overrides and global cache:
This can make workspace A (even running with
ignore-scripts=true) posion global cache and execute scripts in workspace BUsers generally expect
ignore-scriptsto be sufficient to prevent immediate code execution on install (e.g. when the tree is just repacked/bundled without executing it).Here, that expectation is broken
Details
See PoC.
In it, overrides from a single run of A get leaked into e.g.
~/Library/Caches/pnpm/metadata/registry.npmjs.org/rimraf.jsonand persistently affect all other projects using the cachePoC
Postinstall code used in PoC is benign and can be inspected in https://www.npmjs.com/package/ponyhooves?activeTab=code, it's just a
console.logOn mac:
rm -rf ~/Library/Caches/pnpm ~/Library/pnpm/storeThis step is not required in general, but we'll be using a popular package for PoC that's likely cached
A/package.json:{ "name": "A", "pnpm": { "overrides": { "rimraf>glob": "npm:ponyhooves@1" } }, "dependencies": { "rimraf": "6.0.1" } }pnpm i --ignore-scripts(the flag is not required, but the point of the demo is to show that it doesn't help)B/package.json:{ "name": "B", "dependencies": { "rimraf": "6.0.1" } }pnpm iResult:
Also, that code got leaked into another project and it's lockfile now!
Impact
Global state integrity is lost via operations that one would expect to be secure, enabling subsequently running arbitrary code execution on installs
As a work-around, use separate cache and store dirs in each workspace
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
pnpm/pnpm (pnpm)
v9.15.0: pnpm 9.15Compare Source
Minor Changes
Patch Changes
pnpm update --globalshould not crash if there are no any global packages installed #7898.pnpm update --interactiveif catalogs are used.Platinum Sponsors
Gold Sponsors
v9.14.4: pnpm 9.14.4Compare Source
Patch Changes
Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.14.3: pnpm 9.14.3Compare Source
Patch Changes
packageManagerfield check ofpackage.json#7959.Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.14.2Compare Source
Patch Changes
pnpm publish --jsonshould work #8788.Platinum Sponsors
Gold Sponsors
v9.14.1Compare Source
Minor Changes
pnpm pack --jsonto print packed tarball and contents in JSON format #8765.Patch Changes
pnpm execshould print a meaningful error message when no command is provided #8752.pnpm setupshould remove the CLI from the target location before moving the new binary #8173.ERR_PNPM_TARBALL_EXTRACTerror while installing a dependency from GitHub having a slash in branch name #7697.use-node-versionsetting is used and the system has no Node.js installed #8769..npmrcfiles to their correct types. For instance,child-concurrencyshould be a number, not a string #5075.manage-package-manager-versionsis set totrue.pnpm initshould respect the--diroption #8768.Platinum Sponsors
Gold Sponsors
v9.14.0Compare Source
v9.13.2: pnpm 9.13.2Compare Source
Patch Changes
dlxprocesses.Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.13.1: pnpm 9.13.1Compare Source
Patch Changes
Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.13.0: pnpm 9.13Compare Source
Minor Changes
The
self-updatenow accepts a version specifier to install a specific version of pnpm. E.g.:or
Patch Changes
Cannot read properties of undefined (reading 'name')that is printed while trying to render the missing peer dependencies warning message #8538.Platinum Sponsors
Gold Sponsors
Silver Sponsors
Configuration
📅 Schedule: Branch creation - "" in timezone Asia/Jerusalem, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.