CVE-2022-26183 (published 2022-03-21T22:15Z)

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-426
cwe_name: Untrusted Search Path
description: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
extended_description: 
            This might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the product uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted product would then execute. The problem extends to any type of critical resource that the product trusts.
            Some of the most common variants of untrusted search path are:
               
                  In various UNIX and Linux-based systems, the PATH environment variable may be consulted to locate executable programs, and LD_PRELOAD may be used to locate a separate library.
                  In various Microsoft-based systems, the PATH environment variable is consulted to locate a DLL, if the DLL is not found in other paths that appear earlier in the search order.
               
         
         

Fix information:
repo_url: https://github.com/pnpm/pnpm
commit_details: repo_url: https://github.com/pnpm/pnpm
author: Zoltan Kochan
author_date: 2021-09-15 23:49:05+03:00
msg: fix: prevent binary planting attacks on Windows
repository: repo_url: https://github.com/pnpm/pnpm
repo_name: pnpm/pnpm
description: Fast, disk space efficient package manager
repo_language: TypeScript
owner: pnpm
file_changes: filename: sweet-insects-carry.md
change_type: ModificationType.ADD
diff: @@ -0,0 +1,10 @@
+---
+"@pnpm/filter-workspace-packages": patch
+"@pnpm/git-fetcher": patch
+"@pnpm/git-resolver": patch
+"@pnpm/plugin-commands-publishing": patch
+"@pnpm/plugin-commands-script-runners": patch
+"@pnpm/plugin-commands-setup": patch
+---
+
+Use safe-execa instead of execa to prevent binary planting attacks on Windows.

programming_language: Shell
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -18,7 +18,7 @@
   },
   "devDependencies": {
     "@zkochan/pkg": "0.0.0-2",
-    "execa": "^5.0.0"
+    "execa": "npm:safe-execa@^0.1.1"
   },
   "funding": "https://opencollective.com/pnpm",
   "homepage": "https://github.com/pnpm/pnpm/blob/master/packages/beta#readme",

programming_language: Shell
filename: build-artifacts.ts
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-import execa from 'execa'
+import * as execa from 'execa'
 import path from 'path'
 
 function build (target: string) {

programming_language: JavaScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -31,7 +31,7 @@
     "@pnpm/error": "workspace:2.0.0",
     "@pnpm/find-workspace-packages": "workspace:3.1.13",
     "@pnpm/matcher": "workspace:2.0.0",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "find-up": "^5.0.0",
     "is-subdir": "^1.1.1",
     "micromatch": "^4.0.2",

programming_language: Jupyter Notebook
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -32,7 +32,7 @@
     "@pnpm/fetcher-base": "workspace:11.0.3",
     "@pnpm/prepare-package": "workspace:1.0.3",
     "@zkochan/rimraf": "^2.1.1",
-    "execa": "^5.0.0"
+    "execa": "npm:safe-execa@^0.1.1"
   },
   "devDependencies": {
     "@pnpm/cafs": "workspace:3.0.7",

programming_language: CoffeeScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -33,7 +33,7 @@
   "dependencies": {
     "@pnpm/fetch": "workspace:4.1.1",
     "@pnpm/resolver-base": "workspace:8.0.4",
-    "graceful-git": "^3.0.2",
+    "graceful-git": "^3.1.2",
     "hosted-git-info": "npm:@zkochan/hosted-git-info@^4.0.2",
     "semver": "^7.3.4"
   },

programming_language: Shell
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -50,7 +50,7 @@
   "devDependencies": {
     "@pnpm/prepare": "workspace:0.0.26",
     "@types/adm-zip": "^0.4.34",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "path-name": "^1.0.0"
   }
 }

programming_language: CoffeeScript
filename: env.test.ts
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@ import path from 'path'
 import PnpmError from '@pnpm/error'
 import { tempDir } from '@pnpm/prepare'
 import { env } from '@pnpm/plugin-commands-env'
-import execa from 'execa'
+import * as execa from 'execa'
 import PATH from 'path-name'
 
 test('install Node (and npm, npx) by exact version of Node.js', async () => {

programming_language: TypeScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -37,7 +37,7 @@
     "@pnpm/plugin-commands-installation": "workspace:6.1.0",
     "@pnpm/prepare": "workspace:0.0.26",
     "@types/ramda": "0.27.39",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "strip-ansi": "^6.0.0",
     "write-yaml-file": "^4.2.0"
   },

programming_language: CoffeeScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -43,7 +43,6 @@
     "@types/sinon": "^9.0.11",
     "@types/tar": "^4.0.5",
     "cross-spawn": "^7.0.3",
-    "execa": "^5.0.0",
     "is-ci": "^3.0.0",
     "is-windows": "^1.0.2",
     "load-json-file": "^6.2.0",
@@ -67,6 +66,7 @@
     "@pnpm/types": "workspace:7.4.0",
     "@zkochan/rimraf": "^2.1.1",
     "enquirer": "^2.3.6",
+    "execa": "npm:safe-execa@^0.1.1",
     "fast-glob": "^3.2.4",
     "npm-packlist": "^2.2.2",
     "p-filter": "^2.1.0",

programming_language: CoffeeScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -39,7 +39,7 @@
     "@types/ramda": "0.27.39",
     "@types/semver": "^7.3.4",
     "@types/sinon": "^9.0.11",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "path-exists": "^4.0.0",
     "sinon": "^11.1.1",
     "write-yaml-file": "^4.2.0"

programming_language: CoffeeScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -37,7 +37,6 @@
     "@pnpm/prepare": "workspace:0.0.26",
     "@types/ramda": "0.27.39",
     "@zkochan/rimraf": "^2.1.1",
-    "execa": "^5.0.0",
     "is-windows": "^1.0.2",
     "write-yaml-file": "^4.2.0"
   },
@@ -52,6 +51,7 @@
     "@pnpm/sort-packages": "workspace:2.1.1",
     "@pnpm/store-path": "^5.0.0",
     "@pnpm/types": "workspace:7.4.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "p-limit": "^3.1.0",
     "path-exists": "^4.0.0",
     "path-name": "^1.0.0",

programming_language: CoffeeScript
filename: dlx.ts
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,7 @@ import { prepareEmpty } from '@pnpm/prepare'
 test('dlx', async () => {
   prepareEmpty()
 
-  await dlx.handler({}, ['touch', 'foo'])
+  await dlx.handler({}, ['shx', 'touch', 'foo'])
 
   expect(fs.existsSync('foo')).toBeTruthy()
 })

programming_language: TypeScript
filename: runRecursive.ts
change_type: ModificationType.MODIFY
diff: @@ -58,7 +58,7 @@ test('pnpm recursive run', async () => {
   ])
 
   const { allProjects, selectedProjectsGraph } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
@@ -130,7 +130,7 @@ test('pnpm recursive run reversed', async () => {
   ])
 
   const { allProjects, selectedProjectsGraph } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
@@ -182,7 +182,7 @@ test('pnpm recursive run concurrently', async () => {
   ])
 
   const { allProjects, selectedProjectsGraph } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
@@ -234,7 +234,7 @@ test('`pnpm recursive run` fails when run without filters and no package has the
   ])
 
   const { allProjects, selectedProjectsGraph } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
@@ -352,7 +352,7 @@ test('`pnpm recursive run` succeeds when run against a subset of packages and no
   ])
 
   const { allProjects } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
@@ -409,7 +409,7 @@ test('"pnpm run --filter <pkg>" without specifying the script name', async () =>
   ])
 
   const { allProjects } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
@@ -511,7 +511,7 @@ test('testing the bail config with "pnpm recursive run"', async () => {
   ])
 
   const { allProjects, selectedProjectsGraph } = await readProjects(process.cwd(), [])
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
@@ -592,7 +592,7 @@ test('pnpm recursive run with filtering', async () => {
     [{ namePattern: 'project-1' }],
     { workspaceDir: process.cwd() }
   )
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',
@@ -629,7 +629,7 @@ test('`pnpm recursive run` should always trust the scripts', async () => {
     },
   ])
 
-  await execa('pnpm', [
+  await execa(pnpmBin, [
     'install',
     '-r',
     '--registry',

programming_language: TypeScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -30,7 +30,7 @@
   "homepage": "https://github.com/pnpm/pnpm/blob/master/packages/plugin-commands-setup#readme",
   "dependencies": {
     "@pnpm/cli-utils": "workspace:0.6.21",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "render-help": "^1.0.1"
   },
   "funding": "https://opencollective.com/pnpm",

programming_language: CoffeeScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -41,7 +41,7 @@
     "@types/sinon": "^9.0.11",
     "@types/ssri": "^7.1.0",
     "@zkochan/rimraf": "^2.1.1",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "load-json-file": "^6.2.0",
     "path-exists": "^4.0.0",
     "sinon": "^11.1.1",

programming_language: CoffeeScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -79,7 +79,7 @@
     "delay": "^5.0.0",
     "dir-is-case-sensitive": "^2.0.0",
     "esbuild": "^0.12.0",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "exists-link": "2.0.0",
     "is-ci": "^3.0.0",
     "is-windows": "^1.0.2",

programming_language: Jupyter Notebook
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -29,7 +29,7 @@
   "dependencies": {
     "@pnpm/read-package-json": "workspace:5.0.4",
     "@zkochan/rimraf": "^2.1.1",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "preferred-pm": "^3.0.3"
   },
   "funding": "https://opencollective.com/pnpm"

programming_language: JavaScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -85,7 +85,7 @@
     "cross-spawn": "^7.0.3",
     "deep-require-cwd": "1.0.0",
     "dir-is-case-sensitive": "^2.0.0",
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "exists-link": "2.0.0",
     "is-ci": "^3.0.0",
     "is-windows": "^1.0.2",

programming_language: Jupyter Notebook
filename: pnpm-lock.yaml
change_type: ModificationType.MODIFY
diff: @@ -159,7 +159,7 @@ importers:
       '@pnpm/macos-x64': workspace:0.0.6-6.15.0
       '@pnpm/win-x64': workspace:0.0.6-6.15.0
       '@zkochan/pkg': 0.0.0-2
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
     optionalDependencies:
       '@pnpm/linux-x64': link:../artifacts/linux-x64
       '@pnpm/macos-arm64': link:../artifacts/macos-arm64
@@ -168,7 +168,7 @@ importers:
     devDependencies:
       '@pnpm/beta': 'link:'
       '@zkochan/pkg': 0.0.0-2
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
 
   packages/build-modules:
     specifiers:
@@ -625,7 +625,7 @@ importers:
       '@types/micromatch': ^4.0.1
       '@types/ramda': 0.27.39
       '@types/touch': ^3.1.1
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       find-up: ^5.0.0
       is-ci: ^3.0.0
       is-subdir: ^1.1.1
@@ -639,7 +639,7 @@ importers:
       '@pnpm/error': link:../error
       '@pnpm/find-workspace-packages': link:../find-workspace-packages
       '@pnpm/matcher': link:../matcher
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       find-up: 5.0.0
       is-subdir: 1.2.0
       micromatch: 4.0.4
@@ -744,14 +744,14 @@ importers:
       '@pnpm/prepare-package': workspace:1.0.3
       '@pnpm/types': workspace:7.4.0
       '@zkochan/rimraf': ^2.1.1
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       p-defer: ^3.0.0
       tempy: ^1.0.0
     dependencies:
       '@pnpm/fetcher-base': link:../fetcher-base
       '@pnpm/prepare-package': link:../prepare-package
       '@zkochan/rimraf': 2.1.1
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
     devDependencies:
       '@pnpm/cafs': link:../cafs
       '@pnpm/git-fetcher': 'link:'
@@ -768,14 +768,14 @@ importers:
       '@types/hosted-git-info': ^3.0.1
       '@types/is-windows': ^1.0.0
       '@types/semver': ^7.3.4
-      graceful-git: ^3.0.2
+      graceful-git: ^3.1.2
       hosted-git-info: npm:@zkochan/hosted-git-info@^4.0.2
       is-windows: ^1.0.2
       semver: ^7.3.4
     dependencies:
       '@pnpm/fetch': link:../fetch
       '@pnpm/resolver-base': link:../resolver-base
-      graceful-git: 3.0.2
+      graceful-git: 3.1.2
       hosted-git-info: /@zkochan/hosted-git-info/4.0.2
       semver: 7.3.5
     devDependencies:
@@ -1788,7 +1788,7 @@ importers:
       '@types/adm-zip': ^0.4.34
       '@zkochan/cmd-shim': ^5.1.3
       adm-zip: ^0.5.5
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       load-json-file: ^6.2.0
       path-name: ^1.0.0
       rename-overwrite: ^4.0.0
@@ -1818,7 +1818,7 @@ importers:
       '@pnpm/plugin-commands-env': 'link:'
       '@pnpm/prepare': link:../../privatePackages/prepare
       '@types/adm-zip': 0.4.34
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       path-name: 1.0.0
 
   packages/plugin-commands-import:
@@ -2002,7 +2002,7 @@ importers:
       '@pnpm/prepare': workspace:0.0.26
       '@pnpm/types': workspace:7.4.0
       '@types/ramda': 0.27.39
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       ramda: ^0.27.1
       render-help: ^1.0.1
       strip-ansi: ^6.0.0
@@ -2024,7 +2024,7 @@ importers:
       '@pnpm/plugin-commands-listing': 'link:'
       '@pnpm/prepare': link:../../privatePackages/prepare
       '@types/ramda': 0.27.39
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       strip-ansi: 6.0.0
       write-yaml-file: 4.2.0
 
@@ -2120,7 +2120,7 @@ importers:
       '@zkochan/rimraf': ^2.1.1
       cross-spawn: ^7.0.3
       enquirer: ^2.3.6
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       fast-glob: ^3.2.4
       is-ci: ^3.0.0
       is-windows: ^1.0.2
@@ -2151,6 +2151,7 @@ importers:
       '@pnpm/types': link:../types
       '@zkochan/rimraf': 2.1.1
       enquirer: 2.3.6
+      execa: /safe-execa/0.1.1
       fast-glob: 3.2.7
       npm-packlist: 2.2.2
       p-filter: 2.1.0
@@ -2171,7 +2172,6 @@ importers:
       '@types/sinon': 9.0.11
       '@types/tar': 4.0.5
       cross-spawn: 7.0.3
-      execa: 5.1.1
       is-ci: 3.0.0
       is-windows: 1.0.2
       load-json-file: 6.2.0
@@ -2210,7 +2210,7 @@ importers:
       '@zkochan/npm-package-arg': ^2.0.1
       camelcase-keys: ^6.2.2
       dependency-path: workspace:8.0.4
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       graph-sequencer: 2.0.0
       load-json-file: ^6.2.0
       mem: ^8.0.0
@@ -2262,7 +2262,7 @@ importers:
       '@types/ramda': 0.27.39
       '@types/semver': 7.3.8
       '@types/sinon': 9.0.11
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       path-exists: 4.0.0
       sinon: 11.1.2
       write-yaml-file: 4.2.0
@@ -2285,7 +2285,7 @@ importers:
       '@pnpm/types': workspace:7.4.0
       '@types/ramda': 0.27.39
       '@zkochan/rimraf': ^2.1.1
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       is-windows: ^1.0.2
       p-limit: ^3.1.0
       path-exists: ^4.0.0
@@ -2305,6 +2305,7 @@ importers:
       '@pnpm/sort-packages': link:../sort-packages
       '@pnpm/store-path': 5.0.0
       '@pnpm/types': link:../types
+      execa: /safe-execa/0.1.1
       p-limit: 3.1.0
       path-exists: 4.0.0
       path-name: 1.0.0
@@ -2318,7 +2319,6 @@ importers:
       '@pnpm/prepare': link:../../privatePackages/prepare
       '@types/ramda': 0.27.39
       '@zkochan/rimraf': 2.1.1
-      execa: 5.1.1
       is-windows: 1.0.2
       write-yaml-file: 4.2.0
 
@@ -2377,11 +2377,11 @@ importers:
       '@pnpm/logger': ^4.0.0
       '@pnpm/plugin-commands-setup': 'link:'
       '@pnpm/prepare': workspace:0.0.26
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       render-help: ^1.0.1
     dependencies:
       '@pnpm/cli-utils': link:../cli-utils
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       render-help: 1.0.2
     devDependencies:
       '@pnpm/logger': 4.0.0
@@ -2416,7 +2416,7 @@ importers:
       archy: ^1.0.0
       dependency-path: workspace:8.0.4
       dint: ^5.1.0
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       load-json-file: ^6.2.0
       p-filter: ^2.1.0
       path-exists: ^4.0.0
@@ -2456,7 +2456,7 @@ importers:
       '@types/sinon': 9.0.11
       '@types/ssri': 7.1.1
       '@zkochan/rimraf': 2.1.1
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       load-json-file: 6.2.0
       path-exists: 4.0.0
       sinon: 11.1.2
@@ -2525,7 +2525,7 @@ importers:
       delay: ^5.0.0
       dir-is-case-sensitive: ^2.0.0
       esbuild: ^0.12.0
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       exists-link: 2.0.0
       is-ci: ^3.0.0
       is-windows: ^1.0.2
@@ -2617,7 +2617,7 @@ importers:
       delay: 5.0.0
       dir-is-case-sensitive: 2.0.0
       esbuild: 0.12.24
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       exists-link: 2.0.0
       is-ci: 3.0.0
       is-windows: 1.0.2
@@ -2670,12 +2670,12 @@ importers:
       '@pnpm/prepare-package': 'link:'
       '@pnpm/read-package-json': workspace:5.0.4
       '@zkochan/rimraf': ^2.1.1
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       preferred-pm: ^3.0.3
     dependencies:
       '@pnpm/read-package-json': link:../read-package-json
       '@zkochan/rimraf': 2.1.1
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       preferred-pm: 3.0.3
     devDependencies:
       '@pnpm/prepare-package': 'link:'
@@ -3046,7 +3046,7 @@ importers:
       deep-require-cwd: 1.0.0
       dependency-path: workspace:8.0.4
       dir-is-case-sensitive: ^2.0.0
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       exists-link: 2.0.0
       graph-sequencer: 2.0.0
       is-ci: ^3.0.0
@@ -3146,7 +3146,7 @@ importers:
       cross-spawn: 7.0.3
       deep-require-cwd: 1.0.0
       dir-is-case-sensitive: 2.0.0
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       exists-link: 2.0.0
       is-ci: 3.0.0
       is-windows: 1.0.2
@@ -3372,10 +3372,10 @@ importers:
 
   utils/scripts:
     specifiers:
-      execa: ^5.0.0
+      execa: npm:safe-execa@^0.1.1
       make-empty-dir: ^2.0.0
     dependencies:
-      execa: 5.1.1
+      execa: /safe-execa/0.1.1
       make-empty-dir: 2.0.0
 
   utils/tsconfig:
@@ -4431,15 +4431,15 @@ packages:
       load-json-file: 6.2.0
     dev: true
 
-  /@pnpm/cli-utils/0.6.17_@pnpm+logger@4.0.0:
-    resolution: {integrity: sha512-4zsKAifcdt8rf66+GE6tpLwTwdPLU9TfeTxSbHSzqZwnFhCxUCN0FzuI+vv7RUOaxTS9D1wcTHIjtoqJCUbb4g==}
+  /@pnpm/cli-utils/0.6.21_@pnpm+logger@4.0.0:
+    resolution: {integrity: sha512-G0/YvHfNB+umbrEwJz6Pmd6GMxpm1xDsSeGaEu/aM/Ex31OzhiSZ8XOaIQiU160he/z3kGs9ySOPZDxhRJeLcQ==}
     engines: {node: '>=12.17'}
     peerDependencies:
       '@pnpm/logger': ^4.0.0
     dependencies:
       '@pnpm/cli-meta': 2.0.0
-      '@pnpm/config': 12.4.7
-      '@pnpm/default-reporter': 8.1.12_@pnpm+logger@4.0.0
+      '@pnpm/config': 12.5.0
+      '@pnpm/default-reporter': 8.2.1_@pnpm+logger@4.0.0
       '@pnpm/error': 2.0.0
       '@pnpm/logger': 4.0.0
       '@pnpm/manifest-utils': 2.0.4_@pnpm+logger@4.0.0
@@ -4456,13 +4456,13 @@ packages:
       chalk: 4.1.2
     dev: false
 
-  /@pnpm/config/12.4.7:
-    resolution: {integrity: sha512-Y0yE/lYzJyNGdZFjmc1lzk/tECG+XRXi0CAVrroJIbwrCspmtuoLewSbujXj/49G2Eti0p520/OuWI9o/xbvgg==}
+  /@pnpm/config/12.5.0:
+    resolution: {integrity: sha512-xN+rCE0JkOu5rxgIGRUjpunJB1tn6SzINp7eLyat0v+slpuccweXIoPYKUt6QTDjJR2CRJHrWZ9lfG+zA8BYuQ==}
     engines: {node: '>=12.17'}
     dependencies:
       '@pnpm/constants': 5.0.0
       '@pnpm/error': 2.0.0
-      '@pnpm/global-bin-dir': 2.0.0
+      '@pnpm/global-bin-dir': 3.0.0
       '@pnpm/types': 7.4.0
       '@zkochan/npm-conf': 2.0.2
       camelcase: 6.2.0
@@ -4488,16 +4488,16 @@ packages:
       '@pnpm/types': 7.4.0
     dev: true
 
-  /@pnpm/default-reporter/8.1.12_@pnpm+logger@4.0.0:
-    resolution: {integrity: sha512-ZSgH5yyGKmRkJLfFHJ4ptxoNiUrLhEUxh9Ff67s978D97/DEWdg/DjwFx5TToCvPW9l7cT5Zo0nP+npbvmdQjQ==}
+  /@pnpm/default-reporter/8.2.1_@pnpm+logger@4.0.0:
+    resolution: {integrity: sha512-4yusyK4dGyk8kDJaVP1yCdsgSJnB7lS/9BSXLVh0iD2hrOwEMBKO6yBhEynuOVBYbGTcWxZ9BahnFMvrQGAS+w==}
     engines: {node: '>=12.17'}
     dependencies:
-      '@pnpm/config': 12.4.7
+      '@pnpm/config': 12.5.0
       '@pnpm/core-loggers': 6.0.4_@pnpm+logger@4.0.0
       '@pnpm/error': 2.0.0
       '@pnpm/types': 7.4.0
       ansi-diff: 1.1.1
-      boxen: 5.0.1
+      boxen: 5.1.1
       chalk: 4.1.2
       normalize-path: 3.0.0
       pretty-bytes: 5.6.0
@@ -4543,11 +4543,11 @@ packages:
       find-up: 5.0.0
     dev: true
 
-  /@pnpm/find-workspace-packages/3.1.9_@pnpm+logger@4.0.0:
-    resolution: {integrity: sha512-N2xJqnux0cFhyvWxxE0oO0b26xJa0GyfsZI0qBVjzUb9m5kpPPahmSqYIECQTWmEfhxQeqbvgyTsVfmUmLV99A==}
+  /@pnpm/find-workspace-packages/3.1.13_@pnpm+logger@4.0.0:
+    resolution: {integrity: sha512-WqqmNhlIv7utYie+gIAmho23bFPehKT08o2Jkg2n79Tz9rRCxXxyKqaPaUPObamClTgqDrZPEGVTxx7wbeOBpA==}
     engines: {node: '>=12.17'}
     dependencies:
-      '@pnpm/cli-utils': 0.6.17_@pnpm+logger@4.0.0
+      '@pnpm/cli-utils': 0.6.21_@pnpm+logger@4.0.0
       '@pnpm/constants': 5.0.0
       '@pnpm/types': 7.4.0
       find-packages: 8.0.5
@@ -4556,8 +4556,8 @@ packages:
       - '@pnpm/logger'
     dev: true
 
-  /@pnpm/global-bin-dir/2.0.0:
-    resolution: {integrity: sha512-TNV0RbtiNx/NfiB8iJfttySUwiadJx2kQb/yHbaCAXx3KGOKSgfA2mh+Lr4o40wIgOx7ROuoKZ0iVxYfq0jevA==}
+  /@pnpm/global-bin-dir/3.0.0:
+    resolution: {integrity: sha512-48Hw1JGftIO84o41Pm1+1kIulnFL0ca5VGPIQ+A1q1l3IVlxp2LnCX3424p+XIGG54US4pEQ7kMQaXhZBEBqbQ==}
     engines: {node: '>=12.17'}
     dependencies:
       '@pnpm/error': 2.0.0
@@ -4596,7 +4596,7 @@ packages:
     hasBin: true
     dependencies:
       '@pnpm/find-workspace-dir': 3.0.1
-      '@pnpm/find-workspace-packages': 3.1.9_@pnpm+logger@4.0.0
+      '@pnpm/find-workspace-packages': 3.1.13_@pnpm+logger@4.0.0
       '@pnpm/logger': 4.0.0
       '@pnpm/types': 7.4.0
       load-json-file: 6.2.0
@@ -5435,6 +5435,13 @@ packages:
       string-width: 4.2.2
     dev: false
 
+  /@zkochan/which/2.0.3:
+    resolution: {integrity: sha512-C1ReN7vt2/2O0fyTsx5xnbQuxBrmG5NMSbcIkPKCCfCTJgpZBsuRYzFXHj3nVq8vTfK7vxHUmzfCpSHgO7j4rg==}
+    engines: {node: '>= 8'}
+    hasBin: true
+    dependencies:
+      isexe: 2.0.0
+
   /JSONStream/1.3.5:
     resolution: {integrity: sha512-E+iruNOY8VV9s4JEbe1aNEm6MiszPRr/UfcHMz0TQh1BXSxHK+ASV1R6W4HpjBhSeS+54PIsAMCBmwD06LLsqQ==}
     hasBin: true
@@ -6267,6 +6274,21 @@ packages:
       type-fest: 0.20.2
       widest-line: 3.1.0
       wrap-ansi: 7.0.0
+    dev: false
+
+  /boxen/5.1.1:
+    resolution: {integrity: sha512-JtIQYts08AFAYGF4eSh3pUt3NQkYV/e75pRtQmAVTLNWR/1L7Bsswxlgzgk8nmLEM+gFszsIlA9BgD3XnSqp3g==}
+    engines: {node: '>=10'}
+    dependencies:
+      ansi-align: 3.0.0
+      camelcase: 6.2.0
+      chalk: 4.1.2
+      cli-boxes: 2.2.1
+      string-width: 4.2.2
+      type-fest: 0.20.2
+      widest-line: 3.1.0
+      wrap-ansi: 7.0.0
+    dev: true
 
   /brace-expansion/1.1.11:
     resolution: {integrity: sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==}
@@ -8003,7 +8025,7 @@ packages:
       merge-stream: 2.0.0
       npm-run-path: 4.0.1
       onetime: 5.1.2
-      signal-exit: 3.0.3
+      signal-exit: 3.0.4
       strip-final-newline: 2.0.0
 
   /exists-link/2.0.0:
@@ -8755,12 +8777,12 @@ packages:
   /graceful-fs/4.2.8:
     resolution: {integrity: sha512-qkIilPUYcNhJpd33n0GBXTB1MMPp14TxEsEs0pTrsSVucApsYzW5V+Q8Qxhik6KU3evy+qkAAowTByymK0avdg==}
 
-  /graceful-git/3.0.2:
-    resolution: {integrity: sha512-fZ5zG+uT3zRqpRU7kXEUQkbRfIK66JRLfV528Glm703gr/qVfF0zppqC4ksuO1fLmlxBNAxLqQUfhF/vAriMtQ==}
+  /graceful-git/3.1.2:
+    resolution: {integrity: sha512-Xyh9Y43yA23/KQ16mpwO4zkzVGUAXyzuSVZQxw9ddQklssIYIY0el24VYfJBFhyCWGriZPRAB2nCgsDizqna9g==}
     engines: {node: '>=10'}
     dependencies:
-      execa: 5.1.1
       retry: 0.12.0
+      safe-execa: 0.1.1
     dev: false
 
   /graceful-readlink/1.0.1:
@@ -8799,7 +8821,7 @@ packages:
       source-map: 0.6.1
       wordwrap: 1.0.0
     optionalDependencies:
-      uglify-js: 3.14.1
+      uglify-js: 3.14.2
     dev: true
 
   /har-schema/2.0.0:
@@ -12922,6 +12944,14 @@ packages:
   /safe-buffer/5.2.1:
     resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
 
+  /safe-execa/0.1.1:
+    resolution: {integrity: sha512-2KPID7iC4AMoJVozDPtcLGV+7LdpE0sR1hPkJUCaEnRsiYSZH2wgOFvxZ9UOtj1r8hNk8pVWn1tgmaEyyFZ4NA==}
+    engines: {node: '>=12'}
+    dependencies:
+      '@zkochan/which': 2.0.3
+      execa: 5.1.1
+      path-name: 1.0.0
+
   /safe-regex/1.1.0:
     resolution: {integrity: sha1-QKNmnzsHfR6UPURinhV91IAjvy4=}
     dependencies:
@@ -13105,6 +13135,9 @@ packages:
   /signal-exit/3.0.3:
     resolution: {integrity: sha512-VUJ49FC8U1OxwZLxIbTTrDvLnf/6TDgxZcK8wxR8zs13xpx7xbG60ndBlhNrFi2EMuFRoeDoJO7wthSLq42EjA==}
 
+  /signal-exit/3.0.4:
+    resolution: {integrity: sha512-rqYhcAnZ6d/vTPGghdrw7iumdcbXpsk1b8IG/rz+VWV51DM0p7XCtMoJ3qhPLIbp3tvyt3pKRbaaEMZYpHto8Q==}
+
   /signed-varint/2.0.1:
     resolution: {integrity: sha1-UKmYnafJjCxh2tEZvJdHDvhSgSk=}
     dependencies:
@@ -14194,8 +14227,8 @@ packages:
     hasBin: true
     dev: true
 
-  /uglify-js/3.14.1:
-    resolution: {integrity: sha512-JhS3hmcVaXlp/xSo3PKY5R0JqKs5M3IV+exdLHW99qKvKivPO4Z8qbej6mte17SOPqAOVMjt/XGgWacnFSzM3g==}
+  /uglify-js/3.14.2:
+    resolution: {integrity: sha512-rtPMlmcO4agTUfz10CbgJ1k6UAoXM2gWb3GoMPPZB/+/Ackf8lNWk11K4rYi2D0apgoFRLtQOZhb+/iGNJq26A==}
     engines: {node: '>=0.8.0'}
     hasBin: true
     requiresBuild: true

programming_language: CoffeeScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
   "version": "0.0.0",
   "private": true,
   "dependencies": {
-    "execa": "^5.0.0",
+    "execa": "npm:safe-execa@^0.1.1",
     "make-empty-dir": "^2.0.0"
   }
 }

programming_language: TypeScript
filename: copy-artifacts.ts
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 import fs from 'fs'
-import execa from 'execa'
+import * as execa from 'execa'
 import path from 'path'
 import makeEmptyDir from 'make-empty-dir'
 

programming_language: JavaScript