Summary

Security boundary

• Traversal and absolute paths that resolve outside the configured patches directory are rejected before deletion.
• Parent directories are canonicalized before deletion, including the case where a nested symlink points outside and the final outside entry is itself dangling.
• The complete batch is validated before any file is removed.
• Component-aware predicates accept valid names beginning with .. while still rejecting parent traversal, Windows drive escapes, and UNC escapes.
• Valid files and symlinked patch directories whose canonical targets remain below the lockfile directory continue to work.
• A final symlink inside a valid patch directory is unlinked without following its target, including when the target is outside or dangling.

Exploit replay

Files changed

• patching/commands/src/isSubdirectory.ts performs component-aware containment checks.
• patching/commands/src/patchRemove.ts validates the full batch, canonicalizes parents, and unlinks final entries without following them.
• patching/commands/test/{isSubdirectory,patchRemove}.test.ts covers traversal, nested symlinks, dangling victims, and valid removals.

Commands run

$ pnpm --filter @pnpm/patching.commands test test/isSubdirectory.test.ts test/patchRemove.test.ts
PASS: 11 tests across 2 suites
$ pnpm --filter @pnpm/patching.commands run compile
PASS
$ git diff --check
PASS

Validation

• Focused handler and path-predicate suites: 11 passed across 2 suites.
• Package-wide ESLint: passed.
• Package TypeScript build: passed.
• Commit hooks, Commitlint, and git diff --check: passed.
• The broader integration harness was environment-blocked because it writes outside the available temporary root; focused handler tests used /private/tmp.

Patches

Compatibility

Remaining risk