CVE-2022-26183: Untrusted Search Path (CWE-426)
value: PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
CWE description: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CVSS v3 base score: 8.8
Published: 2022-03-21T22:15Z
Repository: https://github.com/pnpm/pnpm
Language: JSON
Files changed: .changeset/sweet-insects-carry.md, packages/beta/package.json, packages/beta/scripts/build-artifacts.ts, packages/filter-workspace-packages/package.json, packages/git-fetcher/package.json, packages/git-resolver/package.json, packages/plugin-commands-env/package.json, packages/plugin-commands-env/test/env.test.ts, packages/plugin-commands-listing/package.json, packages/plugin-commands-publishing/package.json, packages/plugin-commands-rebuild/package.json, packages/plugin-commands-script-runners/package.json, packages/plugin-commands-script-runners/test/dlx.ts, packages/plugin-commands-script-runners/test/runRecursive.ts, packages/plugin-commands-setup/package.json, packages/plugin-commands-store/package.json, packages/pnpm/package.json, packages/prepare-package/package.json, packages/supi/package.json, pnpm-lock.yaml, utils/scripts/package.json, utils/scripts/src/copy-artifacts.ts
Commit date: 2021-09-16 12:10:46 +0300
Commit message: fix: prevent binary planting attacks on Windows

Diff: diff --git a/.changeset/sweet-insects-carry.md b/.changeset/sweet-insects-carry.md
new file mode 100644
index 000000000..383505536
--- /dev/null
+++ b/.changeset/sweet-insects-carry.md
@@ -0,0 +1,10 @@
+---
+"@pnpm/filter-workspace-packages": patch
+"@pnpm/git-fetcher": patch
+"@pnpm/git-resolver": patch
+"@pnpm/plugin-commands-publishing": patch
+"@pnpm/plugin-commands-script-runners": patch
+"@pnpm/plugin-commands-setup": patch
+---
+
+Use safe-execa instead of execa to prevent binary planting attacks on Windows.
diff --git a/packages/beta/package.json b/packages/beta/package.json
index 19ac59b55..97fba50f4 100644
--- a/packages/beta/package.json
+++ b/packages/beta/package.json
@@ -16,11 +16,11 @@
     "@pnpm/macos-x64": "workspace:0.0.6-6.15.0",
     "@pnpm/win-x64": "workspace:0.0.6-6.15.0"
   },
   "devDependencies": {
     "@zkochan/pkg": "0.0.0-2",
-    "execa": "^5.0.0"
+    "execa": "npm:safe-execa@^0.1.1"
   },
   "funding": "https://opencollective.com/pnpm",
   "homepage": "https://github.com/pnpm/pnpm/blob/master/packages/beta#readme",
   "license": "MIT",
   "preferGlobal": true,
diff --git a/packages/beta/scripts/build-artifacts.ts b/packages/beta/scripts/build-artifacts.ts
index bfd2ad837..515ef458a 100644
--- a/packages/beta/scripts/build-artifacts.ts
+++ b/packages/beta/scripts/build-artifacts.ts
@@ -1,6 +1,6 @@
-import execa from 'execa'
+import * as execa from 'execa'
 import path from 'path'
 
 function build (target: string) {
   execa.sync('pkg', ['../pnpm/dist/pnpm.cjs', `--out-path=../artifacts/${target}`, `--targets=node14-${target}`], {
     cwd: path.join(__dirname, '..'),
diff --git a/packages/filter-workspace-packages/package.json b/packages/filter-workspace-packages/package.json
index 4808ceb46..404353caf 100644
--- a/packages/filter-workspace-packages/package.json
+++ b/packages/filter-workspace-packages/package.json
@@ -29,11 +29,11 @@
   "homepage": "https://github.com/pnpm/pnpm/blob/master/packages/filter-workspace-packages#readme",
   "dependencies": {
     "@pnpm/error": "workspace:2.0.0",
     "@pnpm/find-workspace-packages": "workspace:3.1.13",
     "@pnpm/matcher": "workspace:2.0.0",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "find-up": "^5.0.0",
     "is-subdir": "^1.1.1",
     "micromatch": "^4.0.2",
     "pkgs-graph": "workspace:6.1.2",
     "ramda": "^0.27.1"
diff --git a/packages/git-fetcher/package.json b/packages/git-fetcher/package.json
index 8fea6560e..be36e2ab8 100644
--- a/packages/git-fetcher/package.json
+++ b/packages/git-fetcher/package.json
@@ -30,11 +30,11 @@
   "homepage": "https://github.com/pnpm/pnpm/blob/master/packages/git-fetcher#readme",
   "dependencies": {
     "@pnpm/fetcher-base": "workspace:11.0.3",
     "@pnpm/prepare-package": "workspace:1.0.3",
     "@zkochan/rimraf": "^2.1.1",
-    "execa": "^5.0.0"
+    "execa": "npm:safe-execa@^0.1.1"
   },
   "devDependencies": {
     "@pnpm/cafs": "workspace:3.0.7",
     "@pnpm/package-store": "workspace:12.0.15",
     "@pnpm/types": "workspace:7.4.0",
diff --git a/packages/git-resolver/package.json b/packages/git-resolver/package.json
index 5c6bf1f3b..7a8e44bac 100644
--- a/packages/git-resolver/package.json
+++ b/packages/git-resolver/package.json
@@ -31,11 +31,11 @@
   },
   "homepage": "https://github.com/pnpm/pnpm/blob/master/packages/git-resolver#readme",
   "dependencies": {
     "@pnpm/fetch": "workspace:4.1.1",
     "@pnpm/resolver-base": "workspace:8.0.4",
-    "graceful-git": "^3.0.2",
+    "graceful-git": "^3.1.2",
     "hosted-git-info": "npm:@zkochan/hosted-git-info@^4.0.2",
     "semver": "^7.3.4"
   },
   "devDependencies": {
     "@types/hosted-git-info": "^3.0.1",
diff --git a/packages/plugin-commands-env/package.json b/packages/plugin-commands-env/package.json
index af69f4ba7..30a1e5be3 100644
--- a/packages/plugin-commands-env/package.json
+++ b/packages/plugin-commands-env/package.json
@@ -48,9 +48,9 @@
   },
   "funding": "https://opencollective.com/pnpm",
   "devDependencies": {
     "@pnpm/prepare": "workspace:0.0.26",
     "@types/adm-zip": "^0.4.34",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "path-name": "^1.0.0"
   }
 }
diff --git a/packages/plugin-commands-env/test/env.test.ts b/packages/plugin-commands-env/test/env.test.ts
index 6f484265d..01797b00d 100644
--- a/packages/plugin-commands-env/test/env.test.ts
+++ b/packages/plugin-commands-env/test/env.test.ts
@@ -1,11 +1,11 @@
 import fs from 'fs'
 import path from 'path'
 import PnpmError from '@pnpm/error'
 import { tempDir } from '@pnpm/prepare'
 import { env } from '@pnpm/plugin-commands-env'
-import execa from 'execa'
+import * as execa from 'execa'
 import PATH from 'path-name'
 
 test('install Node (and npm, npx) by exact version of Node.js', async () => {
   tempDir()
 
diff --git a/packages/plugin-commands-listing/package.json b/packages/plugin-commands-listing/package.json
index 1c205311e..bac0b5fed 100644
--- a/packages/plugin-commands-listing/package.json
+++ b/packages/plugin-commands-listing/package.json
@@ -35,11 +35,11 @@
     "@pnpm/filter-workspace-packages": "workspace:4.1.15",
     "@pnpm/logger": "^4.0.0",
     "@pnpm/plugin-commands-installation": "workspace:6.1.0",
     "@pnpm/prepare": "workspace:0.0.26",
     "@types/ramda": "0.27.39",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "strip-ansi": "^6.0.0",
     "write-yaml-file": "^4.2.0"
   },
   "dependencies": {
     "@pnpm/cli-utils": "workspace:0.6.21",
diff --git a/packages/plugin-commands-publishing/package.json b/packages/plugin-commands-publishing/package.json
index 2101c3397..0fb27c23a 100644
--- a/packages/plugin-commands-publishing/package.json
+++ b/packages/plugin-commands-publishing/package.json
@@ -41,11 +41,10 @@
     "@types/proxyquire": "^1.3.28",
     "@types/ramda": "0.27.39",
     "@types/sinon": "^9.0.11",
     "@types/tar": "^4.0.5",
     "cross-spawn": "^7.0.3",
-    "execa": "^5.0.0",
     "is-ci": "^3.0.0",
     "is-windows": "^1.0.2",
     "load-json-file": "^6.2.0",
     "path-exists": "^4.0.0",
     "tar": "^6.1.4",
@@ -65,10 +64,11 @@
     "@pnpm/run-npm": "workspace:3.1.0",
     "@pnpm/sort-packages": "workspace:2.1.1",
     "@pnpm/types": "workspace:7.4.0",
     "@zkochan/rimraf": "^2.1.1",
     "enquirer": "^2.3.6",
+    "execa": "npm:safe-execa@^0.1.1",
     "fast-glob": "^3.2.4",
     "npm-packlist": "^2.2.2",
     "p-filter": "^2.1.0",
     "ramda": "^0.27.1",
     "realpath-missing": "^1.1.0",
diff --git a/packages/plugin-commands-rebuild/package.json b/packages/plugin-commands-rebuild/package.json
index 2fde58642..a48df7671 100644
--- a/packages/plugin-commands-rebuild/package.json
+++ b/packages/plugin-commands-rebuild/package.json
@@ -37,11 +37,11 @@
     "@pnpm/prepare": "workspace:0.0.26",
     "@pnpm/test-fixtures": "workspace:*",
     "@types/ramda": "0.27.39",
     "@types/semver": "^7.3.4",
     "@types/sinon": "^9.0.11",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "path-exists": "^4.0.0",
     "sinon": "^11.1.1",
     "write-yaml-file": "^4.2.0"
   },
   "dependencies": {
diff --git a/packages/plugin-commands-script-runners/package.json b/packages/plugin-commands-script-runners/package.json
index cd40d6abb..0b0ba0255 100644
--- a/packages/plugin-commands-script-runners/package.json
+++ b/packages/plugin-commands-script-runners/package.json
@@ -35,11 +35,10 @@
     "@pnpm/filter-workspace-packages": "workspace:4.1.15",
     "@pnpm/logger": "^4.0.0",
     "@pnpm/prepare": "workspace:0.0.26",
     "@types/ramda": "0.27.39",
     "@zkochan/rimraf": "^2.1.1",
-    "execa": "^5.0.0",
     "is-windows": "^1.0.2",
     "write-yaml-file": "^4.2.0"
   },
   "dependencies": {
     "@pnpm/cli-utils": "workspace:0.6.21",
@@ -50,10 +49,11 @@
     "@pnpm/lifecycle": "workspace:11.0.4",
     "@pnpm/read-project-manifest": "workspace:2.0.5",
     "@pnpm/sort-packages": "workspace:2.1.1",
     "@pnpm/store-path": "^5.0.0",
     "@pnpm/types": "workspace:7.4.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "p-limit": "^3.1.0",
     "path-exists": "^4.0.0",
     "path-name": "^1.0.0",
     "ramda": "^0.27.1",
     "realpath-missing": "^1.1.0",
diff --git a/packages/plugin-commands-script-runners/test/dlx.ts b/packages/plugin-commands-script-runners/test/dlx.ts
index 93c50c663..4e835c49c 100644
--- a/packages/plugin-commands-script-runners/test/dlx.ts
+++ b/packages/plugin-commands-script-runners/test/dlx.ts
@@ -3,11 +3,11 @@ import { dlx } from '@pnpm/plugin-commands-script-runners'
 import { prepareEmpty } from '@pnpm/prepare'
 
 test('dlx', async () => {
   prepareEmpty()
 
-  await dlx.handler({}, ['touch', 'foo'])
+  await dlx.handler({}, ['shx', 'touch', 'foo'])
 
   expect(fs.existsSync('foo')).toBeTruthy()
 })
 
 test('dlx --package <pkg1> [--package <pkg2>]', async () => {
diff --git a/packages/plugin-commands-script-runners/test/runRecursive.ts b/packages/plugin-commands-script-runners/test/runRecursive.ts
index cc90b08be..2094cd8b7 100644
--- a/packages/plugin-commands-script-runners/test/runRecursive.ts
+++ b/packages/plugin-commands-script-runners/test/runRecursive.ts
@@ -56,11 +56,11 @@ test('pnpm recursive run', async () => {
       dependencies: {},
     },
   ])
 
   const { allProjects, selectedProjectsGraph } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
     REGISTRY,
     '--store-dir',
@@ -128,11 +128,11 @@ test('pnpm recursive run reversed', async () => {
       dependencies: {},
     },
   ])
 
   const { allProjects, selectedProjectsGraph } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
     REGISTRY,
     '--store-dir',
@@ -180,11 +180,11 @@ test('pnpm recursive run concurrently', async () => {
       },
     },
   ])
 
   const { allProjects, selectedProjectsGraph } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
     REGISTRY,
     '--store-dir',
@@ -232,11 +232,11 @@ test('`pnpm recursive run` fails when run without filters and no package has the
       version: '1.0.0',
     },
   ])
 
   const { allProjects, selectedProjectsGraph } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
     REGISTRY,
     '--store-dir',
@@ -350,11 +350,11 @@ test('`pnpm recursive run` succeeds when run against a subset of packages and no
       version: '1.0.0',
     },
   ])
 
   const { allProjects } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
     REGISTRY,
     '--store-dir',
@@ -407,11 +407,11 @@ test('"pnpm run --filter <pkg>" without specifying the script name', async () =>
       version: '1.0.0',
     },
   ])
 
   const { allProjects } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
     REGISTRY,
     '--store-dir',
@@ -509,11 +509,11 @@ test('testing the bail config with "pnpm recursive run"', async () => {
       },
     },
   ])
 
   const { allProjects, selectedProjectsGraph } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
     REGISTRY,
     '--store-dir',
@@ -590,11 +590,11 @@ test('pnpm recursive run with filtering', async () => {
   const { selectedProjectsGraph } = await filterPkgsBySelectorObjects(
     allProjects,
     [{ namePattern: 'project-1' }],
     { workspaceDir: process.cwd() }
   )
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
     REGISTRY,
     '--store-dir',
@@ -627,11 +627,11 @@ test('`pnpm recursive run` should always trust the scripts', async () => {
         build: 'node -e "process.stdout.write(\'project\')" | json-append ../output.json',
       },
     },
   ])
 
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
     REGISTRY,
     '--store-dir',
diff --git a/packages/plugin-commands-setup/package.json b/packages/plugin-commands-setup/package.json
index df4eecce8..a43eabc5b 100644
--- a/packages/plugin-commands-setup/package.json
+++ b/packages/plugin-commands-setup/package.json
@@ -28,11 +28,11 @@
     "url": "https://github.com/pnpm/pnpm/issues"
   },
   "homepage": "https://github.com/pnpm/pnpm/blob/master/packages/plugin-commands-setup#readme",
   "dependencies": {
     "@pnpm/cli-utils": "workspace:0.6.21",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "render-help": "^1.0.1"
   },
   "funding": "https://opencollective.com/pnpm",
   "peerDependencies": {
     "@pnpm/logger": "^4.0.0"
diff --git a/packages/plugin-commands-store/package.json b/packages/plugin-commands-store/package.json
index 29a97c3d1..bf5556f7b 100644
--- a/packages/plugin-commands-store/package.json
+++ b/packages/plugin-commands-store/package.json
@@ -39,11 +39,11 @@
     "@types/archy": "0.0.31",
     "@types/ramda": "0.27.39",
     "@types/sinon": "^9.0.11",
     "@types/ssri": "^7.1.0",
     "@zkochan/rimraf": "^2.1.1",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "load-json-file": "^6.2.0",
     "path-exists": "^4.0.0",
     "sinon": "^11.1.1",
     "ssri": "^8.0.1",
     "tempy": "^1.0.0"
diff --git a/packages/pnpm/package.json b/packages/pnpm/package.json
index 899e14ce6..f6c941fd5 100644
--- a/packages/pnpm/package.json
+++ b/packages/pnpm/package.json
@@ -77,11 +77,11 @@
     "cross-var-no-babel": "^1.2.0",
     "deep-require-cwd": "1.0.0",
     "delay": "^5.0.0",
     "dir-is-case-sensitive": "^2.0.0",
     "esbuild": "^0.12.0",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "exists-link": "2.0.0",
     "is-ci": "^3.0.0",
     "is-windows": "^1.0.2",
     "load-json-file": "^6.2.0",
     "loud-rejection": "^2.2.0",
diff --git a/packages/prepare-package/package.json b/packages/prepare-package/package.json
index fbdf73537..221ea89f4 100644
--- a/packages/prepare-package/package.json
+++ b/packages/prepare-package/package.json
@@ -27,10 +27,10 @@
   },
   "homepage": "https://github.com/pnpm/pnpm/blob/master/packages/prepare-package#readme",
   "dependencies": {
     "@pnpm/read-package-json": "workspace:5.0.4",
     "@zkochan/rimraf": "^2.1.1",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "preferred-pm": "^3.0.3"
   },
   "funding": "https://opencollective.com/pnpm"
 }
diff --git a/packages/supi/package.json b/packages/supi/package.json
index daa16aba7..c242e4db8 100644
--- a/packages/supi/package.json
+++ b/packages/supi/package.json
@@ -83,11 +83,11 @@
     "@types/sinon": "^9.0.11",
     "anonymous-npm-registry-client": "0.1.2",
     "cross-spawn": "^7.0.3",
     "deep-require-cwd": "1.0.0",
     "dir-is-case-sensitive": "^2.0.0",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "exists-link": "2.0.0",
     "is-ci": "^3.0.0",
     "is-windows": "^1.0.2",
     "ncp": "^2.0.0",
     "nock": "12.0.3",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 32302ff60..02e33a8f1 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -157,20 +157,20 @@ importers:
       '@pnpm/linux-x64': workspace:0.0.6-6.15.0
       '@pnpm/macos-arm64': workspace:0.0.6-6.15.0
       '@pnpm/macos-x64': workspace:0.0.6-6.15.0
       '@pnpm/win-x64': workspace:0.0.6-6.15.0
       '@zkochan/pkg': 0.0.0-2
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
     optionalDependencies:
       '@pnpm/linux-x64': link:../artifacts/linux-x64
       '@pnpm/macos-arm64': link:../artifacts/macos-arm64
       '@pnpm/macos-x64': link:../artifacts/macos-x64
       '@pnpm/win-x64': link:../artifacts/win-x64
     devDependencies:
       '@pnpm/beta': 'link:'
       '@zkochan/pkg': 0.0.0-2
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
 
   packages/build-modules:
     specifiers:
       '@pnpm/build-modules': 'link:'
       '@pnpm/constants': workspace:5.0.0
@@ -623,11 +623,11 @@ importers:
       '@types/is-ci': ^3.0.0
       '@types/is-windows': ^1.0.0
       '@types/micromatch': ^4.0.1
       '@types/ramda': 0.27.39
       '@types/touch': ^3.1.1
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       find-up: ^5.0.0
       is-ci: ^3.0.0
       is-subdir: ^1.1.1
       is-windows: ^1.0.2
       micromatch: ^4.0.2
@@ -637,11 +637,11 @@ importers:
       touch: 3.1.0
     dependencies:
       '@pnpm/error': link:../error
       '@pnpm/find-workspace-packages': link:../find-workspace-packages
       '@pnpm/matcher': link:../matcher
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       find-up: 5.0.0
       is-subdir: 1.2.0
       micromatch: 4.0.4
       pkgs-graph: link:../pkgs-graph
       ramda: 0.27.1
@@ -742,18 +742,18 @@ importers:
       '@pnpm/git-fetcher': 'link:'
       '@pnpm/package-store': workspace:12.0.15
       '@pnpm/prepare-package': workspace:1.0.3
       '@pnpm/types': workspace:7.4.0
       '@zkochan/rimraf': ^2.1.1
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       p-defer: ^3.0.0
       tempy: ^1.0.0
     dependencies:
       '@pnpm/fetcher-base': link:../fetcher-base
       '@pnpm/prepare-package': link:../prepare-package
       '@zkochan/rimraf': 2.1.1
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
     devDependencies:
       '@pnpm/cafs': link:../cafs
       '@pnpm/git-fetcher': 'link:'
       '@pnpm/package-store': link:../package-store
       '@pnpm/types': link:../types
@@ -766,18 +766,18 @@ importers:
       '@pnpm/git-resolver': 'link:'
       '@pnpm/resolver-base': workspace:8.0.4
       '@types/hosted-git-info': ^3.0.1
       '@types/is-windows': ^1.0.0
       '@types/semver': ^7.3.4
-      graceful-git: ^3.0.2
+      graceful-git: ^3.1.2
       hosted-git-info: npm:@zkochan/hosted-git-info@^4.0.2
       is-windows: ^1.0.2
       semver: ^7.3.4
     dependencies:
       '@pnpm/fetch': link:../fetch
       '@pnpm/resolver-base': link:../resolver-base
-      graceful-git: 3.0.2
+      graceful-git: 3.1.2
       hosted-git-info: /@zkochan/hosted-git-info/4.0.2
       semver: 7.3.5
     devDependencies:
       '@pnpm/git-resolver': 'link:'
       '@types/hosted-git-info': 3.0.2
@@ -1786,11 +1786,11 @@ importers:
       '@pnpm/store-path': ^5.0.0
       '@pnpm/tarball-fetcher': workspace:9.3.6
       '@types/adm-zip': ^0.4.34
       '@zkochan/cmd-shim': ^5.1.3
       adm-zip: ^0.5.5
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       load-json-file: ^6.2.0
       path-name: ^1.0.0
       rename-overwrite: ^4.0.0
       render-help: ^1.0.1
       semver: ^7.3.4
@@ -1816,11 +1816,11 @@ importers:
       write-json-file: 4.3.0
     devDependencies:
       '@pnpm/plugin-commands-env': 'link:'
       '@pnpm/prepare': link:../../privatePackages/prepare
       '@types/adm-zip': 0.4.34
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       path-name: 1.0.0
 
   packages/plugin-commands-import:
     specifiers:
       '@pnpm/assert-project': workspace:*
@@ -2000,11 +2000,11 @@ importers:
       '@pnpm/plugin-commands-installation': workspace:6.1.0
       '@pnpm/plugin-commands-listing': 'link:'
       '@pnpm/prepare': workspace:0.0.26
       '@pnpm/types': workspace:7.4.0
       '@types/ramda': 0.27.39
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       ramda: ^0.27.1
       render-help: ^1.0.1
       strip-ansi: ^6.0.0
       write-yaml-file: ^4.2.0
     dependencies:
@@ -2022,11 +2022,11 @@ importers:
       '@pnpm/logger': 4.0.0
       '@pnpm/plugin-commands-installation': link:../plugin-commands-installation
       '@pnpm/plugin-commands-listing': 'link:'
       '@pnpm/prepare': link:../../privatePackages/prepare
       '@types/ramda': 0.27.39
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       strip-ansi: 6.0.0
       write-yaml-file: 4.2.0
 
   packages/plugin-commands-outdated:
     specifiers:
@@ -2118,11 +2118,11 @@ importers:
       '@types/sinon': ^9.0.11
       '@types/tar': ^4.0.5
       '@zkochan/rimraf': ^2.1.1
       cross-spawn: ^7.0.3
       enquirer: ^2.3.6
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       fast-glob: ^3.2.4
       is-ci: ^3.0.0
       is-windows: ^1.0.2
       load-json-file: ^6.2.0
       npm-packlist: ^2.2.2
@@ -2149,10 +2149,11 @@ importers:
       '@pnpm/run-npm': link:../run-npm
       '@pnpm/sort-packages': link:../sort-packages
       '@pnpm/types': link:../types
       '@zkochan/rimraf': 2.1.1
       enquirer: 2.3.6
+      execa: /safe-execa/0.1.1
       fast-glob: 3.2.7
       npm-packlist: 2.2.2
       p-filter: 2.1.0
       ramda: 0.27.1
       realpath-missing: 1.1.0
@@ -2169,11 +2170,10 @@ importers:
       '@types/proxyquire': 1.3.28
       '@types/ramda': 0.27.39
       '@types/sinon': 9.0.11
       '@types/tar': 4.0.5
       cross-spawn: 7.0.3
-      execa: 5.1.1
       is-ci: 3.0.0
       is-windows: 1.0.2
       load-json-file: 6.2.0
       path-exists: 4.0.0
       tar: 6.1.11
@@ -2208,11 +2208,11 @@ importers:
       '@types/semver': ^7.3.4
       '@types/sinon': ^9.0.11
       '@zkochan/npm-package-arg': ^2.0.1
       camelcase-keys: ^6.2.2
       dependency-path: workspace:8.0.4
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       graph-sequencer: 2.0.0
       load-json-file: ^6.2.0
       mem: ^8.0.0
       p-limit: ^3.1.0
       path-exists: ^4.0.0
@@ -2260,11 +2260,11 @@ importers:
       '@pnpm/prepare': link:../../privatePackages/prepare
       '@pnpm/test-fixtures': link:../../privatePackages/test-fixtures
       '@types/ramda': 0.27.39
       '@types/semver': 7.3.8
       '@types/sinon': 9.0.11
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       path-exists: 4.0.0
       sinon: 11.1.2
       write-yaml-file: 4.2.0
 
   packages/plugin-commands-script-runners:
@@ -2283,11 +2283,11 @@ importers:
       '@pnpm/sort-packages': workspace:2.1.1
       '@pnpm/store-path': ^5.0.0
       '@pnpm/types': workspace:7.4.0
       '@types/ramda': 0.27.39
       '@zkochan/rimraf': ^2.1.1
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       is-windows: ^1.0.2
       p-limit: ^3.1.0
       path-exists: ^4.0.0
       path-name: ^1.0.0
       ramda: ^0.27.1
@@ -2303,10 +2303,11 @@ importers:
       '@pnpm/lifecycle': link:../lifecycle
       '@pnpm/read-project-manifest': link:../read-project-manifest
       '@pnpm/sort-packages': link:../sort-packages
       '@pnpm/store-path': 5.0.0
       '@pnpm/types': link:../types
+      execa: /safe-execa/0.1.1
       p-limit: 3.1.0
       path-exists: 4.0.0
       path-name: 1.0.0
       ramda: 0.27.1
       realpath-missing: 1.1.0
@@ -2316,11 +2317,10 @@ importers:
       '@pnpm/logger': 4.0.0
       '@pnpm/plugin-commands-script-runners': 'link:'
       '@pnpm/prepare': link:../../privatePackages/prepare
       '@types/ramda': 0.27.39
       '@zkochan/rimraf': 2.1.1
-      execa: 5.1.1
       is-windows: 1.0.2
       write-yaml-file: 4.2.0
 
   packages/plugin-commands-server:
     specifiers:
@@ -2375,15 +2375,15 @@ importers:
     specifiers:
       '@pnpm/cli-utils': workspace:0.6.21
       '@pnpm/logger': ^4.0.0
       '@pnpm/plugin-commands-setup': 'link:'
       '@pnpm/prepare': workspace:0.0.26
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       render-help: ^1.0.1
     dependencies:
       '@pnpm/cli-utils': link:../cli-utils
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       render-help: 1.0.2
     devDependencies:
       '@pnpm/logger': 4.0.0
       '@pnpm/plugin-commands-setup': 'link:'
       '@pnpm/prepare': link:../../privatePackages/prepare
@@ -2414,11 +2414,11 @@ importers:
       '@types/ssri': ^7.1.0
       '@zkochan/rimraf': ^2.1.1
       archy: ^1.0.0
       dependency-path: workspace:8.0.4
       dint: ^5.1.0
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       load-json-file: ^6.2.0
       p-filter: ^2.1.0
       path-exists: ^4.0.0
       ramda: ^0.27.1
       render-help: ^1.0.1
@@ -2454,11 +2454,11 @@ importers:
       '@types/archy': 0.0.31
       '@types/ramda': 0.27.39
       '@types/sinon': 9.0.11
       '@types/ssri': 7.1.1
       '@zkochan/rimraf': 2.1.1
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       load-json-file: 6.2.0
       path-exists: 4.0.0
       sinon: 11.1.2
       ssri: 8.0.1
       tempy: 1.0.1
@@ -2523,11 +2523,11 @@ importers:
       cross-var-no-babel: ^1.2.0
       deep-require-cwd: 1.0.0
       delay: ^5.0.0
       dir-is-case-sensitive: ^2.0.0
       esbuild: ^0.12.0
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       exists-link: 2.0.0
       is-ci: ^3.0.0
       is-windows: ^1.0.2
       load-json-file: ^6.2.0
       loud-rejection: ^2.2.0
@@ -2615,11 +2615,11 @@ importers:
       cross-var-no-babel: 1.2.0
       deep-require-cwd: 1.0.0
       delay: 5.0.0
       dir-is-case-sensitive: 2.0.0
       esbuild: 0.12.24
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       exists-link: 2.0.0
       is-ci: 3.0.0
       is-windows: 1.0.2
       load-json-file: 6.2.0
       loud-rejection: 2.2.0
@@ -2668,16 +2668,16 @@ importers:
   packages/prepare-package:
     specifiers:
       '@pnpm/prepare-package': 'link:'
       '@pnpm/read-package-json': workspace:5.0.4
       '@zkochan/rimraf': ^2.1.1
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       preferred-pm: ^3.0.3
     dependencies:
       '@pnpm/read-package-json': link:../read-package-json
       '@zkochan/rimraf': 2.1.1
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       preferred-pm: 3.0.3
     devDependencies:
       '@pnpm/prepare-package': 'link:'
 
   packages/prune-lockfile:
@@ -3044,11 +3044,11 @@ importers:
       anonymous-npm-registry-client: 0.1.2
       cross-spawn: ^7.0.3
       deep-require-cwd: 1.0.0
       dependency-path: workspace:8.0.4
       dir-is-case-sensitive: ^2.0.0
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       exists-link: 2.0.0
       graph-sequencer: 2.0.0
       is-ci: ^3.0.0
       is-inner-link: ^4.0.0
       is-subdir: ^1.1.1
@@ -3144,11 +3144,11 @@ importers:
       '@types/sinon': 9.0.11
       anonymous-npm-registry-client: 0.1.2
       cross-spawn: 7.0.3
       deep-require-cwd: 1.0.0
       dir-is-case-sensitive: 2.0.0
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       exists-link: 2.0.0
       is-ci: 3.0.0
       is-windows: 1.0.2
       ncp: 2.0.0
       nock: 12.0.3
@@ -3370,14 +3370,14 @@ importers:
       remark-stringify: 7.0.4_unified@8.4.2
       unified: 8.4.2
 
   utils/scripts:
     specifiers:
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       make-empty-dir: ^2.0.0
     dependencies:
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       make-empty-dir: 2.0.0
 
   utils/tsconfig:
     specifiers:
       '@pnpm/tsconfig': 'link:'
@@ -4429,19 +4429,19 @@ packages:
     engines: {node: '>=12.17'}
     dependencies:
       load-json-file: 6.2.0
     dev: true
 
-  /@pnpm/cli-utils/0.6.17_@pnpm+logger@4.0.0:
-    resolution: {integrity: sha512-4zsKAifcdt8rf66+GE6tpLwTwdPLU9TfeTxSbHSzqZwnFhCxUCN0FzuI+vv7RUOaxTS9D1wcTHIjtoqJCUbb4g==}
+  /@pnpm/cli-utils/0.6.21_@pnpm+logger@4.0.0:
+    resolution: {integrity: sha512-G0/YvHfNB+umbrEwJz6Pmd6GMxpm1xDsSeGaEu/aM/Ex31OzhiSZ8XOaIQiU160he/z3kGs9ySOPZDxhRJeLcQ==}
     engines: {node: '>=12.17'}
     peerDependencies:
       '@pnpm/logger': ^4.0.0
     dependencies:
       '@pnpm/cli-meta': 2.0.0
-      '@pnpm/config': 12.4.7
-      '@pnpm/default-reporter': 8.1.12_@pnpm+logger@4.0.0
+      '@pnpm/config': 12.5.0
+      '@pnpm/default-reporter': 8.2.1_@pnpm+logger@4.0.0
       '@pnpm/error': 2.0.0
       '@pnpm/logger': 4.0.0
       '@pnpm/manifest-utils': 2.0.4_@pnpm+logger@4.0.0
       '@pnpm/package-is-installable': 5.0.4_@pnpm+logger@4.0.0
       '@pnpm/read-project-manifest': 2.0.5
@@ -4454,17 +4454,17 @@ packages:
     engines: {node: '>=10'}
     dependencies:
       chalk: 4.1.2
     dev: false
 
-  /@pnpm/config/12.4.7:
-    resolution: {integrity: sha512-Y0yE/lYzJyNGdZFjmc1lzk/tECG+XRXi0CAVrroJIbwrCspmtuoLewSbujXj/49G2Eti0p520/OuWI9o/xbvgg==}
+  /@pnpm/config/12.5.0:
+    resolution: {integrity: sha512-xN+rCE0JkOu5rxgIGRUjpunJB1tn6SzINp7eLyat0v+slpuccweXIoPYKUt6QTDjJR2CRJHrWZ9lfG+zA8BYuQ==}
     engines: {node: '>=12.17'}
     dependencies:
       '@pnpm/constants': 5.0.0
       '@pnpm/error': 2.0.0
-      '@pnpm/global-bin-dir': 2.0.0
+      '@pnpm/global-bin-dir': 3.0.0
       '@pnpm/types': 7.4.0
       '@zkochan/npm-conf': 2.0.2
       camelcase: 6.2.0
       can-write-to-dir: 1.1.1
       is-subdir: 1.2.0
@@ -4486,20 +4486,20 @@ packages:
     dependencies:
       '@pnpm/logger': 4.0.0
       '@pnpm/types': 7.4.0
     dev: true
 
-  /@pnpm/default-reporter/8.1.12_@pnpm+logger@4.0.0:
-    resolution: {integrity: sha512-ZSgH5yyGKmRkJLfFHJ4ptxoNiUrLhEUxh9Ff67s978D97/DEWdg/DjwFx5TToCvPW9l7cT5Zo0nP+npbvmdQjQ==}
+  /@pnpm/default-reporter/8.2.1_@pnpm+logger@4.0.0:
+    resolution: {integrity: sha512-4yusyK4dGyk8kDJaVP1yCdsgSJnB7lS/9BSXLVh0iD2hrOwEMBKO6yBhEynuOVBYbGTcWxZ9BahnFMvrQGAS+w==}
     engines: {node: '>=12.17'}
     dependencies:
-      '@pnpm/config': 12.4.7
+      '@pnpm/config': 12.5.0
       '@pnpm/core-loggers': 6.0.4_@pnpm+logger@4.0.0
       '@pnpm/error': 2.0.0
       '@pnpm/types': 7.4.0
       ansi-diff: 1.1.1
-      boxen: 5.0.1
+      boxen: 5.1.1
       chalk: 4.1.2
       normalize-path: 3.0.0
       pretty-bytes: 5.6.0
       pretty-ms: 7.0.1
       ramda: 0.27.1
@@ -4541,25 +4541,25 @@ packages:
     dependencies:
       '@pnpm/error': 2.0.0
       find-up: 5.0.0
     dev: true
 
-  /@pnpm/find-workspace-packages/3.1.9_@pnpm+logger@4.0.0:
-    resolution: {integrity: sha512-N2xJqnux0cFhyvWxxE0oO0b26xJa0GyfsZI0qBVjzUb9m5kpPPahmSqYIECQTWmEfhxQeqbvgyTsVfmUmLV99A==}
+  /@pnpm/find-workspace-packages/3.1.13_@pnpm+logger@4.0.0:
+    resolution: {integrity: sha512-WqqmNhlIv7utYie+gIAmho23bFPehKT08o2Jkg2n79Tz9rRCxXxyKqaPaUPObamClTgqDrZPEGVTxx7wbeOBpA==}
     engines: {node: '>=12.17'}
     dependencies:
-      '@pnpm/cli-utils': 0.6.17_@pnpm+logger@4.0.0
+      '@pnpm/cli-utils': 0.6.21_@pnpm+logger@4.0.0
       '@pnpm/constants': 5.0.0
       '@pnpm/types': 7.4.0
       find-packages: 8.0.5
       read-yaml-file: 2.1.0
     transitivePeerDependencies:
       - '@pnpm/logger'
     dev: true
 
-  /@pnpm/global-bin-dir/2.0.0:
-    resolution: {integrity: sha512-TNV0RbtiNx/NfiB8iJfttySUwiadJx2kQb/yHbaCAXx3KGOKSgfA2mh+Lr4o40wIgOx7ROuoKZ0iVxYfq0jevA==}
+  /@pnpm/global-bin-dir/3.0.0:
+    resolution: {integrity: sha512-48Hw1JGftIO84o41Pm1+1kIulnFL0ca5VGPIQ+A1q1l3IVlxp2LnCX3424p+XIGG54US4pEQ7kMQaXhZBEBqbQ==}
     engines: {node: '>=12.17'}
     dependencies:
       '@pnpm/error': 2.0.0
       can-write-to-dir: 1.1.1
       path-name: 1.0.0
@@ -4594,11 +4594,11 @@ packages:
     resolution: {integrity: sha512-b5jlKMHow2tKouspQujk01EMXYeyddLbuTZHao5riVq6gNJ/flXCsEd88m53JbUaiYXsnzrZ7EJQwpTZSrjuvQ==}
     engines: {node: '>=10.12'}
     hasBin: true
     dependencies:
       '@pnpm/find-workspace-dir': 3.0.1
-      '@pnpm/find-workspace-packages': 3.1.9_@pnpm+logger@4.0.0
+      '@pnpm/find-workspace-packages': 3.1.13_@pnpm+logger@4.0.0
       '@pnpm/logger': 4.0.0
       '@pnpm/types': 7.4.0
       load-json-file: 6.2.0
       meow: 10.1.1
       print-diff: 1.0.0
@@ -5433,10 +5433,17 @@ packages:
       ajv: 6.12.6
       lodash: 4.17.21
       string-width: 4.2.2
     dev: false
 
+  /@zkochan/which/2.0.3:
+    resolution: {integrity: sha512-C1ReN7vt2/2O0fyTsx5xnbQuxBrmG5NMSbcIkPKCCfCTJgpZBsuRYzFXHj3nVq8vTfK7vxHUmzfCpSHgO7j4rg==}
+    engines: {node: '>= 8'}
+    hasBin: true
+    dependencies:
+      isexe: 2.0.0
+
   /JSONStream/1.3.5:
     resolution: {integrity: sha512-E+iruNOY8VV9s4JEbe1aNEm6MiszPRr/UfcHMz0TQh1BXSxHK+ASV1R6W4HpjBhSeS+54PIsAMCBmwD06LLsqQ==}
     hasBin: true
     dependencies:
       jsonparse: 1.3.1
@@ -6265,10 +6272,25 @@ packages:
       cli-boxes: 2.2.1
       string-width: 4.2.2
       type-fest: 0.20.2
       widest-line: 3.1.0
       wrap-ansi: 7.0.0
+    dev: false
+
+  /boxen/5.1.1:
+    resolution: {integrity: sha512-JtIQYts08AFAYGF4eSh3pUt3NQkYV/e75pRtQmAVTLNWR/1L7Bsswxlgzgk8nmLEM+gFszsIlA9BgD3XnSqp3g==}
+    engines: {node: '>=10'}
+    dependencies:
+      ansi-align: 3.0.0
+      camelcase: 6.2.0
+      chalk: 4.1.2
+      cli-boxes: 2.2.1
+      string-width: 4.2.2
+      type-fest: 0.20.2
+      widest-line: 3.1.0
+      wrap-ansi: 7.0.0
+    dev: true
 
   /brace-expansion/1.1.11:
     resolution: {integrity: sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==}
     dependencies:
       balanced-match: 1.0.2
@@ -8001,11 +8023,11 @@ packages:
       human-signals: 2.1.0
       is-stream: 2.0.1
       merge-stream: 2.0.0
       npm-run-path: 4.0.1
       onetime: 5.1.2
-      signal-exit: 3.0.3
+      signal-exit: 3.0.4
       strip-final-newline: 2.0.0
 
   /exists-link/2.0.0:
     resolution: {integrity: sha1-+7H6YzLnVm5Iivh+wUSuDQPASs8=}
     engines: {node: '>= 4'}
@@ -8753,16 +8775,16 @@ packages:
     dev: true
 
   /graceful-fs/4.2.8:
     resolution: {integrity: sha512-qkIilPUYcNhJpd33n0GBXTB1MMPp14TxEsEs0pTrsSVucApsYzW5V+Q8Qxhik6KU3evy+qkAAowTByymK0avdg==}
 
-  /graceful-git/3.0.2:
-    resolution: {integrity: sha512-fZ5zG+uT3zRqpRU7kXEUQkbRfIK66JRLfV528Glm703gr/qVfF0zppqC4ksuO1fLmlxBNAxLqQUfhF/vAriMtQ==}
+  /graceful-git/3.1.2:
+    resolution: {integrity: sha512-Xyh9Y43yA23/KQ16mpwO4zkzVGUAXyzuSVZQxw9ddQklssIYIY0el24VYfJBFhyCWGriZPRAB2nCgsDizqna9g==}
     engines: {node: '>=10'}
     dependencies:
-      execa: 5.1.1
       retry: 0.12.0
+      safe-execa: 0.1.1
     dev: false
 
   /graceful-readlink/1.0.1:
     resolution: {integrity: sha1-TK+tdrxi8C+gObL5Tpo906ORpyU=}
     dev: true
@@ -8797,11 +8819,11 @@ packages:
       minimist: 1.2.5
       neo-async: 2.6.2
       source-map: 0.6.1
       wordwrap: 1.0.0
     optionalDependencies:
-      uglify-js: 3.14.1
+      uglify-js: 3.14.2
     dev: true
 
   /har-schema/2.0.0:
     resolution: {integrity: sha1-qUwiJOvKwEeCoNkDVSHyRzW37JI=}
     engines: {node: '>=4'}
@@ -12920,10 +12942,18 @@ packages:
     resolution: {integrity: sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==}
 
   /safe-buffer/5.2.1:
     resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
 
+  /safe-execa/0.1.1:
+    resolution: {integrity: sha512-2KPID7iC4AMoJVozDPtcLGV+7LdpE0sR1hPkJUCaEnRsiYSZH2wgOFvxZ9UOtj1r8hNk8pVWn1tgmaEyyFZ4NA==}
+    engines: {node: '>=12'}
+    dependencies:
+      '@zkochan/which': 2.0.3
+      execa: 5.1.1
+      path-name: 1.0.0
+
   /safe-regex/1.1.0:
     resolution: {integrity: sha1-QKNmnzsHfR6UPURinhV91IAjvy4=}
     dependencies:
       ret: 0.1.15
     dev: true
@@ -13103,10 +13133,13 @@ packages:
       object-inspect: 1.11.0
 
   /signal-exit/3.0.3:
     resolution: {integrity: sha512-VUJ49FC8U1OxwZLxIbTTrDvLnf/6TDgxZcK8wxR8zs13xpx7xbG60ndBlhNrFi2EMuFRoeDoJO7wthSLq42EjA==}
 
+  /signal-exit/3.0.4:
+    resolution: {integrity: sha512-rqYhcAnZ6d/vTPGghdrw7iumdcbXpsk1b8IG/rz+VWV51DM0p7XCtMoJ3qhPLIbp3tvyt3pKRbaaEMZYpHto8Q==}
+
   /signed-varint/2.0.1:
     resolution: {integrity: sha1-UKmYnafJjCxh2tEZvJdHDvhSgSk=}
     dependencies:
       varint: 5.0.0
     dev: false
@@ -14192,12 +14225,12 @@ packages:
     resolution: {integrity: sha512-DqQgihaQ9cUrskJo9kIyW/+g0Vxsk8cDtZ52a3NGh0YNTfpUSArXSohyUGnvbPazEPLu398C0UxmKSOrPumUzA==}
     engines: {node: '>=4.2.0'}
     hasBin: true
     dev: true
 
-  /uglify-js/3.14.1:
-    resolution: {integrity: sha512-JhS3hmcVaXlp/xSo3PKY5R0JqKs5M3IV+exdLHW99qKvKivPO4Z8qbej6mte17SOPqAOVMjt/XGgWacnFSzM3g==}
+  /uglify-js/3.14.2:
+    resolution: {integrity: sha512-rtPMlmcO4agTUfz10CbgJ1k6UAoXM2gWb3GoMPPZB/+/Ackf8lNWk11K4rYi2D0apgoFRLtQOZhb+/iGNJq26A==}
     engines: {node: '>=0.8.0'}
     hasBin: true
     requiresBuild: true
     dev: true
     optional: true
diff --git a/utils/scripts/package.json b/utils/scripts/package.json
index 8b5988d26..c94183114 100644
--- a/utils/scripts/package.json
+++ b/utils/scripts/package.json
@@ -1,9 +1,9 @@
 {
   "name": "@pnpm/scripts",
   "version": "0.0.0",
   "private": true,
   "dependencies": {
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "make-empty-dir": "^2.0.0"
   }
 }
diff --git a/utils/scripts/src/copy-artifacts.ts b/utils/scripts/src/copy-artifacts.ts
index 3d1f31286..3f143433a 100644
--- a/utils/scripts/src/copy-artifacts.ts
+++ b/utils/scripts/src/copy-artifacts.ts
@@ -1,7 +1,7 @@
 import fs from 'fs'
-import execa from 'execa'
+import * as execa from 'execa'
 import path from 'path'
 import makeEmptyDir from 'make-empty-dir'
 
 const repoRoot = path.join(__dirname, '../../..')
 const dest = path.join(repoRoot, 'dist')

Vulnerable code:     "execa": "^5.0.0"
import execa from 'execa'
    "execa": "^5.0.0",
    "execa": "^5.0.0"
    "graceful-git": "^3.0.2",
    "execa": "^5.0.0",
import execa from 'execa'
    "execa": "^5.0.0",
    "execa": "^5.0.0",
    "execa": "^5.0.0",
    "execa": "^5.0.0",
  await dlx.handler({}, ['touch', 'foo'])
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
  await execa('pnpm', [
    "execa": "^5.0.0",
    "execa": "^5.0.0",
    "execa": "^5.0.0",
    "execa": "^5.0.0",
    "execa": "^5.0.0",
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      graceful-git: ^3.0.2
      graceful-git: 3.0.2
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
      execa: ^5.0.0
      execa: 5.1.1
  /@pnpm/cli-utils/0.6.17_@pnpm+logger@4.0.0:
    resolution: {integrity: sha512-4zsKAifcdt8rf66+GE6tpLwTwdPLU9TfeTxSbHSzqZwnFhCxUCN0FzuI+vv7RUOaxTS9D1wcTHIjtoqJCUbb4g==}
      '@pnpm/config': 12.4.7
      '@pnpm/default-reporter': 8.1.12_@pnpm+logger@4.0.0
  /@pnpm/config/12.4.7:
    resolution: {integrity: sha512-Y0yE/lYzJyNGdZFjmc1lzk/tECG+XRXi0CAVrroJIbwrCspmtuoLewSbujXj/49G2Eti0p520/OuWI9o/xbvgg==}
      '@pnpm/global-bin-dir': 2.0.0
  /@pnpm/default-reporter/8.1.12_@pnpm+logger@4.0.0:
    resolution: {integrity: sha512-ZSgH5yyGKmRkJLfFHJ4ptxoNiUrLhEUxh9Ff67s978D97/DEWdg/DjwFx5TToCvPW9l7cT5Zo0nP+npbvmdQjQ==}
      '@pnpm/config': 12.4.7
      boxen: 5.0.1
  /@pnpm/find-workspace-packages/3.1.9_@pnpm+logger@4.0.0:
    resolution: {integrity: sha512-N2xJqnux0cFhyvWxxE0oO0b26xJa0GyfsZI0qBVjzUb9m5kpPPahmSqYIECQTWmEfhxQeqbvgyTsVfmUmLV99A==}
      '@pnpm/cli-utils': 0.6.17_@pnpm+logger@4.0.0
  /@pnpm/global-bin-dir/2.0.0:
    resolution: {integrity: sha512-TNV0RbtiNx/NfiB8iJfttySUwiadJx2kQb/yHbaCAXx3KGOKSgfA2mh+Lr4o40wIgOx7ROuoKZ0iVxYfq0jevA==}
      '@pnpm/find-workspace-packages': 3.1.9_@pnpm+logger@4.0.0
      signal-exit: 3.0.3
  /graceful-git/3.0.2:
    resolution: {integrity: sha512-fZ5zG+uT3zRqpRU7kXEUQkbRfIK66JRLfV528Glm703gr/qVfF0zppqC4ksuO1fLmlxBNAxLqQUfhF/vAriMtQ==}
      execa: 5.1.1
      uglify-js: 3.14.1
  /uglify-js/3.14.1:
    resolution: {integrity: sha512-JhS3hmcVaXlp/xSo3PKY5R0JqKs5M3IV+exdLHW99qKvKivPO4Z8qbej6mte17SOPqAOVMjt/XGgWacnFSzM3g==}
    "execa": "^5.0.0",
import execa from 'execa'
Fixed code: ---
"@pnpm/filter-workspace-packages": patch
"@pnpm/git-fetcher": patch
"@pnpm/git-resolver": patch
"@pnpm/plugin-commands-publishing": patch
"@pnpm/plugin-commands-script-runners": patch
"@pnpm/plugin-commands-setup": patch
---

Use safe-execa instead of execa to prevent binary planting attacks on Windows.
    "execa": "npm:safe-execa@^0.1.1"
import * as execa from 'execa'
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1"
    "graceful-git": "^3.1.2",
    "execa": "npm:safe-execa@^0.1.1",
import * as execa from 'execa'
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
  await dlx.handler({}, ['shx', 'touch', 'foo'])
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
  await execa(pnpmBin, [
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
    "execa": "npm:safe-execa@^0.1.1",
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      graceful-git: ^3.1.2
      graceful-git: 3.1.2
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
      execa: npm:safe-execa@^0.1.1
      execa: /safe-execa/0.1.1
  /@pnpm/cli-utils/0.6.21_@pnpm+logger@4.0.0:
    resolution: {integrity: sha512-G0/YvHfNB+umbrEwJz6Pmd6GMxpm1xDsSeGaEu/aM/Ex31OzhiSZ8XOaIQiU160he/z3kGs9ySOPZDxhRJeLcQ==}
      '@pnpm/config': 12.5.0
      '@pnpm/default-reporter': 8.2.1_@pnpm+logger@4.0.0
  /@pnpm/config/12.5.0:
    resolution: {integrity: sha512-xN+rCE0JkOu5rxgIGRUjpunJB1tn6SzINp7eLyat0v+slpuccweXIoPYKUt6QTDjJR2CRJHrWZ9lfG+zA8BYuQ==}
      '@pnpm/global-bin-dir': 3.0.0
  /@pnpm/default-reporter/8.2.1_@pnpm+logger@4.0.0:
    resolution: {integrity: sha512-4yusyK4dGyk8kDJaVP1yCdsgSJnB7lS/9BSXLVh0iD2hrOwEMBKO6yBhEynuOVBYbGTcWxZ9BahnFMvrQGAS+w==}
      '@pnpm/config': 12.5.0
      boxen: 5.1.1
  /@pnpm/find-workspace-packages/3.1.13_@pnpm+logger@4.0.0:
    resolution: {integrity: sha512-WqqmNhlIv7utYie+gIAmho23bFPehKT08o2Jkg2n79Tz9rRCxXxyKqaPaUPObamClTgqDrZPEGVTxx7wbeOBpA==}
      '@pnpm/cli-utils': 0.6.21_@pnpm+logger@4.0.0
  /@pnpm/global-bin-dir/3.0.0:
    resolution: {integrity: sha512-48Hw1JGftIO84o41Pm1+1kIulnFL0ca5VGPIQ+A1q1l3IVlxp2LnCX3424p+XIGG54US4pEQ7kMQaXhZBEBqbQ==}
      '@pnpm/find-workspace-packages': 3.1.13_@pnpm+logger@4.0.0
  /@zkochan/which/2.0.3:
    resolution: {integrity: sha512-C1ReN7vt2/2O0fyTsx5xnbQuxBrmG5NMSbcIkPKCCfCTJgpZBsuRYzFXHj3nVq8vTfK7vxHUmzfCpSHgO7j4rg==}
    engines: {node: '>= 8'}
    hasBin: true
    dependencies:
      isexe: 2.0.0

    dev: false

  /boxen/5.1.1:
    resolution: {integrity: sha512-JtIQYts08AFAYGF4eSh3pUt3NQkYV/e75pRtQmAVTLNWR/1L7Bsswxlgzgk8nmLEM+gFszsIlA9BgD3XnSqp3g==}
    engines: {node: '>=10'}
    dependencies:
      ansi-align: 3.0.0
      camelcase: 6.2.0
      chalk: 4.1.2
      cli-boxes: 2.2.1
      string-width: 4.2.2
      type-fest: 0.20.2
      widest-line: 3.1.0
      wrap-ansi: 7.0.0
    dev: true
      signal-exit: 3.0.4
  /graceful-git/3.1.2:
    resolution: {integrity: sha512-Xyh9Y43yA23/KQ16mpwO4zkzVGUAXyzuSVZQxw9ddQklssIYIY0el24VYfJBFhyCWGriZPRAB2nCgsDizqna9g==}
      safe-execa: 0.1.1
      uglify-js: 3.14.2
  /safe-execa/0.1.1:
    resolution: {integrity: sha512-2KPID7iC4AMoJVozDPtcLGV+7LdpE0sR1hPkJUCaEnRsiYSZH2wgOFvxZ9UOtj1r8hNk8pVWn1tgmaEyyFZ4NA==}
    engines: {node: '>=12'}
    dependencies:
      '@zkochan/which': 2.0.3
      execa: 5.1.1
      path-name: 1.0.0

  /signal-exit/3.0.4:
    resolution: {integrity: sha512-rqYhcAnZ6d/vTPGghdrw7iumdcbXpsk1b8IG/rz+VWV51DM0p7XCtMoJ3qhPLIbp3tvyt3pKRbaaEMZYpHto8Q==}

  /uglify-js/3.14.2:
    resolution: {integrity: sha512-rtPMlmcO4agTUfz10CbgJ1k6UAoXM2gWb3GoMPPZB/+/Ackf8lNWk11K4rYi2D0apgoFRLtQOZhb+/iGNJq26A==}
    "execa": "npm:safe-execa@^0.1.1",
import * as execa from 'execa'