[Snyk] Security upgrade @pnpm/audit from 1001.0.2 to 1002.0.0

[fraxken]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-18313070	828

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[fraxken]

This is a major version upgrade for a core pnpm package. While a specific changelog for @pnpm/audit from v1001 to v1002 is not available, the version jump corresponds with the breaking changes introduced in the main pnpm v11 release, which significantly altered how auditing is configured and executed.

Potential Breaking Changes:

• Configuration Schema: The way audit settings are defined in pnpm-workspace.yaml has changed. The top-level auditLevel and auditConfig settings are deprecated in favor of a new audit object.
• Ignoring Vulnerabilities: The mechanism for ignoring advisories has changed from using CVEs (auditConfig.ignoreCves) to using GitHub Advisory IDs (audit.ignore).
• New API Endpoint: The underlying pnpm audit command now queries a different registry security endpoint, which may affect results or compatibility with private registries.

Recommendation:
Review your pnpm-workspace.yaml file and update any audit-related configurations to the new format. Specifically, migrate any auditConfig.ignoreCves to the new audit.ignore format using GHSA IDs and move auditLevel under the new audit object. Test the pnpm audit command after upgrading to ensure it functions as expected with your registry and configuration.

Source: pnpm v11 Release Notes, pnpm audit documentation

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​pnpm/​audit@​1001.0.2 ⏵ 1002.0.0	+13			+1

View full report