Fast, disk space efficient package manager
This report presents the forensic synthetic code analysis of pnpm/pnpm, a Rust project with 35,775 GitHub stars. SynthScan v2.0 examined 882,559 lines of code across 4541 source files, recording 2345 pattern matches distributed across 12 syntactic categories. The overall adjusted score of 2.7 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 2345 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | deny.toml | 21 | unmaintained = "workspace" | COMMENT |
| LOW | deny.toml | 41 | # feature does not enable either, so the affected code is unreachable in | COMMENT |
| LOW | rustfmt.toml | 1 | # Make Rust more readable given most people have wide screens nowadays. | COMMENT |
| LOW | .pr_agent.toml | 41 | # the /improve tool (see pr_commands and push_commands), so approval is re-checked | COMMENT |
| LOW | dylint.toml | 1 | # Dylint configuration. cargo-dylint reads `[workspace.metadata.dylint]` | COMMENT |
| LOW | dylint.toml | 21 | # to a `let` internally before the match, so the expression is | COMMENT |
| LOW | pnpm-workspace.yaml | 61 | # The Rust CLI wrapper is the workspace package `pacquet` (published to npm as | COMMENT |
| LOW | shell/resolve-pr-conflicts.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …lling/deps-resolver/test/resolveDependencyTree.test.ts | 201 | const exactResolution = tResolutions.find(({ bareSpecifier }) => bareSpecifier === '1.0.0') | COMMENT |
| LOW | …/installing/deps-resolver/src/linkPathToPeerVersion.ts | 1 | // Converts a link: path into a stable, filename-safe token used as the | COMMENT |
| LOW | pnpm11/installing/deps-resolver/src/resolvePeers.ts | 201 | // A provider whose tree position was pruned from the traversal (its parent | COMMENT |
| LOW | pnpm11/installing/deps-resolver/src/index.ts | 181 | } = await resolveDependencyTree(projectsToResolve, opts) | COMMENT |
| LOW | pnpm11/installing/deps-installer/test/catalogs.ts | 901 | // this should be the case even if pnpm-workspace.yaml still has | COMMENT |
| LOW | pnpm11/installing/deps-installer/test/catalogs.ts | 1581 | describe('update', () => { | COMMENT |
| LOW | pnpm11/installing/deps-installer/test/link.ts | 81 | // const projects = prepare(t, [ | COMMENT |
| LOW | pnpm11/installing/deps-installer/test/link.ts | 101 | // }, | COMMENT |
| LOW | …ing/deps-installer/test/install/injectLocalPackages.ts | 2021 | // it to the filesMap; the importer's fast path then wiped the target before | COMMENT |
| LOW | …eps-installer/src/install/verifyLockfileResolutions.ts | 321 | ) | COMMENT |
| LOW | pnpm11/installing/deps-installer/src/install/index.ts | 381 | // | COMMENT |
| LOW | …pm11/installing/env-installer/src/installConfigDeps.ts | 61 | const configDepPath = path.join(configModulesDir, pkgName) | COMMENT |
| LOW | pnpm11/installing/commands/src/runPacquet.ts | 121 | } | COMMENT |
| LOW | pnpm11/installing/commands/src/installDeps.ts | 221 | // pacquet consumes. Threaded through both the workspace recursive | COMMENT |
| LOW | pnpm11/config/reader/src/loadNpmrcFiles.ts | 121 | // URL-scoped auth/registry settings supplied via `npm_config_//…` and | COMMENT |
| LOW | pnpm11/config/reader/src/loadNpmrcFiles.ts | 201 | localPrefix, | COMMENT |
| LOW | pnpm11/config/reader/src/loadNpmrcFiles.ts | 381 | // * auth keys — `_authToken` etc. Pinned to prevent credential leaks. npm | COMMENT |
| LOW | pnpm11/config/reader/src/loadNpmrcFiles.ts | 521 | } | COMMENT |
| LOW | pnpm11/__fixtures__/pnpm-workspace.yaml | 21 | COMMENT | |
| LOW | …ures__/multiple-scripts-error-exit/pnpm-workspace.yaml | 1 | # This fixture exercises child-process cleanup when `pnpm run` exits, not | COMMENT |
| LOW | pnpm11/resolving/local-resolver/README.md | 21 | resolveFromLocal({bareSpecifier: './example-package'}, {prefix: process.cwd()}) | COMMENT |
| LOW | pnpm11/resolving/npm-resolver/README.md | 41 | // "ava": "^0.0.4" | COMMENT |
| LOW | pnpm11/resolving/npm-resolver/test/publishedBy.test.ts | 361 | // would rethrow ERR_PNPM_MISSING_TIME under what used to be | COMMENT |
| LOW | …olving/npm-resolver/src/createNpmResolutionVerifier.ts | 281 | canTrustPastCheck: (cached) => { | COMMENT |
| LOW | …olving/npm-resolver/src/createNpmResolutionVerifier.ts | 481 | name: string | COMMENT |
| LOW | pnpm11/resolving/npm-resolver/src/pickPackage.ts | 401 | // fire again on the next install. Without this, a mirror older | COMMENT |
| LOW | pnpm11/workspace/projects-graph/README.md | 41 | // dependencies: ['/home/zkochan/src/bar'], | COMMENT |
| LOW | pnpm11/__typings__/index.d.ts | 1 | /// <reference path="local.d.ts" /> | COMMENT |
| LOW | pnpm11/pnpm/bundle-deps.ts | 1 | import fs from 'node:fs' | COMMENT |
| LOW | pnpm11/pnpm/bundle-deps.ts | 21 | // This is used to include certain dependencies like node-gyp out of the box | COMMENT |
| LOW | pnpm11/pnpm/bundle-deps.ts | 41 | // │ ├── pnpm-lock.yaml │ | COMMENT |
| LOW | pnpm11/pnpm/artifacts/exe/setup.js | 21 | // Only treat ERR_MODULE_NOT_FOUND as "platform package not installed". | COMMENT |
| LOW | pnpm11/pnpm/artifacts/exe/setup.js | 61 | COMMENT | |
| LOW | pnpm11/pnpm/test/packageManagerCheck.test.ts | 741 | // which proxies pnpm to npmjs. They fail between a release commit and the | COMMENT |
| LOW | pnpm11/pnpm/test/configurationalDependencies.test.ts | 221 | COMMENT | |
| LOW | pnpm11/pnpm/test/install/global.ts | 161 | const pkgPath = findGlobalPkg(globalPkgDir(pnpmHome), '@pnpm.e2e/postinstall-calls-pnpm') | COMMENT |
| LOW | pnpm11/cli/default-reporter/src/reportError.ts | 501 | `, | COMMENT |
| LOW | pnpm11/cli/default-reporter/src/index.ts | 81 | complete () {}, // eslint-disable-line:no-empty | COMMENT |
| LOW | …er/src/reporterForClient/reportLockfileVerification.ts | 61 | // time is clamped at zero so a clock that moved backwards between the | COMMENT |
| LOW | pnpm11/cli/parse-cli-args/src/index.ts | 141 | } | COMMENT |
| LOW | pnpm11/benchmarks/bench.sh | 1 | #!/bin/bash | COMMENT |
| LOW | pnpm11/__utils__/scripts/src/bump.ts | 1 | // Applies the pending release plan, then runs the meta-updater to mirror the | COMMENT |
| LOW | pnpm11/__utils__/jest-config/jest.transform.js | 21 | }) | COMMENT |
| LOW | pnpm11/exec/lifecycle/src/runLifecycleHook.ts | 41 | // be spawned without the "shell: true" option. | COMMENT |
| LOW | pnpm11/exec/commands/src/dlx.ts | 201 | // the other link stay. The current process should yield. | COMMENT |
| LOW | pnpm11/deps/security/signatures/src/verifySignatures.ts | 261 | COMMENT | |
| LOW | pnpm11/deps/status/src/checkDepsStatus.ts | 961 | COMMENT | |
| LOW | pnpm11/deps/compliance/sbom/src/getPkgMetadata.ts | 121 | if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return undefined | COMMENT |
| LOW | …pm11/deps/compliance/audit/src/lockfileToAuditIndex.ts | 201 | const reachableVulnerabilities = createReachableVulnerabilitiesGetter(lockfile, vulnerableNames, includeOptDeps) | COMMENT |
| LOW | pnpm11/deps/compliance/commands/src/sbom/sbom.ts | 341 | // reading from both graphs (not only the selected subset) covers the extra | COMMENT |
| LOW | …pm11/deps/inspection/tree-builder/test/getTree.test.ts | 481 | ]) | COMMENT |
| LOW | pnpm11/deps/inspection/outdated/src/outdated.ts | 201 | // even when its manifest specifier is a plain semver range (e.g. a | COMMENT |
| 1716 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | pnpm11/crypto/object-hasher/src/index.ts | 44 | export function hashObjectNullableWithPrefix (object: Record<string, unknown> | undefined): PrefixedHash | undefined { | CODE |
| LOW | pnpm11/crypto/shasums-file/src/index.ts | 28 | export async function fetchVerifiedNodeShasumsFile ( | CODE |
| LOW | pnpm11/crypto/shasums-file/src/index.ts | 66 | export function pickFileChecksumFromShasumsFile (body: string, fileName: string): string { | CODE |
| LOW | pnpm11/crypto/hash/src/index.ts | 19 | export async function createHashFromMultipleFiles (files: string[]): Promise<string> { | CODE |
| LOW | …lling/deps-resolver/test/updateProjectManifest.test.ts | 269 | function aliaslessWantedDependency (bareSpecifier: string, optional = false): WantedDependency { | CODE |
| LOW | …lling/deps-resolver/test/resolveDependencyTree.test.ts | 372 | function createLockfileWithTPinning (): LockfileObject { | CODE |
| LOW | …/installing/deps-resolver/src/resolveDependencyTree.ts | 386 | function dedupeSameAliasDirectDeps (directDeps: PkgAddressOrLink[], wantedDependencies: Array<WantedDependency & { isNew | CODE |
| LOW | …lling/deps-resolver/src/wantedDepIsLocallyAvailable.ts | 7 | export function wantedDepIsLocallyAvailable ( | CODE |
| LOW | …lling/deps-resolver/src/wantedDepIsLocallyAvailable.ts | 21 | function pickMatchingLocalVersionOrNull ( | CODE |
| LOW | …nstalling/deps-resolver/src/validateDependencyAlias.ts | 15 | export function assertValidDependencyAliases ( | CODE |
| LOW | pnpm11/installing/deps-resolver/src/hoistPeers.ts | 78 | export function getHoistableOptionalPeers ( | CODE |
| LOW | pnpm11/installing/deps-resolver/src/resolvePeers.ts | 1059 | function parentPkgsHaveSingleOccurrence (parentPkgs: Record<string, ParentPkgInfo>): boolean { | CODE |
| LOW | …ing/deps-resolver/src/replaceVersionInBareSpecifier.ts | 3 | export function replaceVersionInBareSpecifier ( | CODE |
| LOW | pnpm11/installing/deps-resolver/src/index.ts | 426 | async function waitTillAllFetchingsFinish (): Promise<void> { | CODE |
| LOW | pnpm11/installing/deps-resolver/src/index.ts | 448 | function treeHasLockedPeerContexts (dependenciesTree: DependenciesTree<ResolvedPackage>): boolean { | CODE |
| LOW | pnpm11/installing/deps-resolver/src/index.ts | 455 | function addDirectDependenciesToLockfile ( | CODE |
| LOW | pnpm11/installing/deps-resolver/src/index.ts | 554 | function getAliasToDependencyTypeMap (manifest: ProjectManifest): Record<string, DependenciesField> { | CODE |
| LOW | …pm11/installing/deps-resolver/src/toResolveImporter.ts | 142 | function getPreferredVersionsFromPackage ( | CODE |
| LOW | …pm11/installing/deps-resolver/src/toResolveImporter.ts | 150 | function getVersionSpecsByRealNames (deps: Dependencies): VersionSpecsByRealNames { | CODE |
| LOW | …/installing/deps-resolver/src/updateProjectManifest.ts | 76 | function isWorkspaceLocalPathSpecifier (bareSpecifier: string): boolean { | CODE |
| LOW | …/installing/deps-resolver/src/getWantedDependencies.ts | 53 | function getWantedDependenciesFromGivenSet ( | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 567 | async function resolveDependenciesOfImporters ( | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 690 | async function resolveDependenciesOfImporterDependency ( | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 740 | function filterMissingPeersFromPkgAddresses ( | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 940 | async function resolveDependenciesOfDependency ( | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 1105 | function wantedDependencyMatchesUpdateTarget ( | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 1118 | export function createNodeIdForLinkedLocalPkg (lockfileDir: string, pkgDir: string): NodeId { | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 1162 | async function waitForPackageResolutionTurn (ctx: ResolutionContext, depth: number): Promise<void> { | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 1168 | function hasActivePackageResolutionBeforeDepth (ctx: ResolutionContext, depth: number): boolean { | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 1246 | function compareChildrenResolutionOwners (owner1: ChildrenResolutionOwner, owner2: ChildrenResolutionOwner): number { | CODE |
| LOW⚡ | …11/installing/deps-resolver/src/resolveDependencies.ts | 1257 | function createMissingPeersOfChildren (): MissingPeersOfChildren { | CODE |
| LOW⚡ | …11/installing/deps-resolver/src/resolveDependencies.ts | 1266 | function isCurrentChildrenResolution ( | CODE |
| LOW⚡ | …11/installing/deps-resolver/src/resolveDependencies.ts | 1274 | async function resolveMissingPeersFromCurrentChildrenResolution ( | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 1290 | function setDependencyTreeNodeWithCurrentChildren ( | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 1318 | function updateChildrenResolutionNodes ( | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 1597 | function referenceSatisfiesWantedSpec ( | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 1639 | function findHigherDirectDepVersion ( | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 2243 | function wantedLockfileContainsSatisfyingEntry (lockfile: LockfileObject, wantedDependency: WantedDependency): boolean { | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 2340 | function peerDependenciesWithoutOwn (pkg: PackageManifest): PeerDependencies { | CODE |
| LOW | …11/installing/deps-resolver/src/resolveDependencies.ts | 2366 | function getCatalogExistingVersionFromSnapshot ( | CODE |
| LOW | …g/deps-resolver/src/getExactSinglePreferredVersions.ts | 9 | export function getExactSinglePreferredVersions (wantedDependency: WantedDependency, version: string): PreferredVersions | CODE |
| LOW | …lling/deps-resolver/src/getNonDevWantedDependencies.ts | 22 | export function getNonDevWantedDependencies (pkg: GetNonDevWantedDependenciesManifest): WantedDependency[] { | CODE |
| LOW | …lling/deps-resolver/src/getNonDevWantedDependencies.ts | 44 | function getWantedDependenciesFromGivenSet ( | CODE |
| LOW | pnpm11/installing/deps-restorer/test/index.ts | 28 | function prepareFixtureWithIntegrity (name: string): string { | CODE |
| LOW | …talling/deps-restorer/src/lockfileToHoistedDepGraph.ts | 66 | export async function lockfileToHoistedDepGraph ( | CODE |
| LOW | …talling/deps-restorer/src/lockfileToHoistedDepGraph.ts | 305 | async function dirHasPackageJsonWithVersion (dir: string, expectedVersion?: string): Promise<boolean> { | CODE |
| LOW | pnpm11/installing/deps-restorer/src/index.ts | 799 | async function symlinkDirectDependencies ( | CODE |
| LOW | pnpm11/installing/context/src/index.ts | 240 | export async function getContextForSingleImporter ( | CODE |
| LOW | pnpm11/installing/context/src/index.ts | 388 | export function arrayOfWorkspacePackagesToMap ( | CODE |
| LOW | pnpm11/installing/deps-installer/test/catalogs.ts | 23 | function preparePackagesAndReturnObjects (manifests: Array<ProjectManifest & Required<Pick<ProjectManifest, 'name'>>>) { | CODE |
| LOW | …ng/deps-installer/test/install/optionalDependencies.ts | 194 | function createMetadataStrippingRegistryProxy (): http.Server { | CODE |
| LOW | …ng/deps-installer/test/install/optionalDependencies.ts | 286 | function createVersionHidingRegistryProxy (pkgNames: string[], hiddenVersion: string): http.Server { | CODE |
| LOW | pnpm11/installing/deps-installer/test/install/misc.ts | 1557 | function makeAssertNoPackageMapNodeOptionsScript (marker: string): string { | CODE |
| LOW | …staller/src/install/warnOnStaleConvergenceOverrides.ts | 36 | export async function warnOnStaleConvergenceOverrides (opts: WarnOnStaleConvergenceOverridesOptions): Promise<void> { | CODE |
| LOW | …stalling/deps-installer/src/install/validateModules.ts | 135 | async function purgeModulesDirsOfImporter ( | CODE |
| LOW | …stalling/deps-installer/src/install/validateModules.ts | 145 | async function purgeModulesDirsOfImporters ( | CODE |
| LOW | …staller/src/install/writeLockfilesAndRecordVerified.ts | 20 | export async function writeLockfilesAndRecordVerified ( | CODE |
| LOW | …ps-installer/src/install/reportPeerDependencyIssues.ts | 9 | export function reportPeerDependencyIssues ( | CODE |
| LOW | …ps-installer/src/install/reportPeerDependencyIssues.ts | 33 | export function filterPeerDependencyIssues ( | CODE |
| LOW | …eps-installer/src/install/verifyLockfileResolutions.ts | 62 | export function withOfflineCheckCacheIdentities (verifiers: readonly VerifierCacheIdentity[]): VerifierCacheIdentity[] { | CODE |
| 346 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …ling/deps-installer/test/install/globalVirtualStore.ts | 314 | // Step 2: Reinstall with allowBuilds changed (simulating what approve-builds does) | COMMENT |
| LOW⚡ | …ling/deps-installer/test/install/globalVirtualStore.ts | 322 | // Step 3: Verify the hash changed and build artifacts are in the new directory | COMMENT |
| LOW⚡ | …ling/deps-installer/test/install/globalVirtualStore.ts | 390 | // Step 2: Simulate a previous build failure by removing the GVS hash directory | COMMENT |
| LOW⚡ | …ling/deps-installer/test/install/globalVirtualStore.ts | 394 | // Step 3: Remove node_modules and reinstall with frozenLockfile | COMMENT |
| LOW⚡ | …ling/deps-installer/test/install/globalVirtualStore.ts | 437 | // Step 2: Simulate a crash between import and build — write a .pnpm-needs-build | COMMENT |
| LOW⚡ | …ling/deps-installer/test/install/globalVirtualStore.ts | 446 | // Step 3: Reinstall — the GVS fast path should detect the .pnpm-needs-build | COMMENT |
| LOW | …ling/deps-installer/test/install/globalVirtualStore.ts | 214 | // Step 1: Install with no packages allowed to build (engine-agnostic hashes) | COMMENT |
| LOW | …ling/deps-installer/test/install/globalVirtualStore.ts | 228 | // Step 2: Reinstall with dep allowed to build — hashes should change | COMMENT |
| LOW | …ling/deps-installer/test/install/globalVirtualStore.ts | 299 | // Step 1: Install with builds NOT approved (simulating first `pnpm install`) | COMMENT |
| LOW | …ling/deps-installer/test/install/globalVirtualStore.ts | 376 | // Step 1: Successful install with build | COMMENT |
| LOW | …ling/deps-installer/test/install/globalVirtualStore.ts | 420 | // Step 1: Install with build | COMMENT |
| LOW | …alling/deps-installer/test/install/autoInstallPeers.ts | 689 | // Step 1: install without override — auto-installs peer-c@1.0.1 | COMMENT |
| LOW | …alling/deps-installer/test/install/autoInstallPeers.ts | 702 | // Step 2: reinstall with override narrowing peer-c to 1.0.0 | COMMENT |
| LOW | pnpm11/workspace/injected-deps-syncer/src/index.ts | 82 | // Step 1: Link bins in .pnpm virtual store | COMMENT |
| LOW | pnpm11/workspace/injected-deps-syncer/src/index.ts | 98 | // Step 2: Relink bins for all workspace projects | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 30 | // Step 1: populate a lockfile under no policy. The resolver picks | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 37 | // Step 2: turn on minimumReleaseAge in strict mode. The lockfile is now | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 81 | // Step 1: populate the lockfile with no policy. is-positive@1.0.0 | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 88 | // Step 2: turn the policy on. The post-resolution gate now runs | COMMENT |
| LOW | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 113 | // Step 3: another install with the same lockfile + policy. The cache | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 368 | // Step 1: install with the full exclude list — verifier writes a | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 377 | // Step 2: drop `is-odd` from the exclude list. The cached record | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/globalVirtualStore.ts | 47 | // Step 1: Install with GVS, builds NOT approved | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/globalVirtualStore.ts | 57 | // Step 2: approve-builds — updates config then runs install in GVS mode | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/globalVirtualStore.ts | 60 | // Step 3: Verify GVS hash changed (new engine-specific directory) | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/misc.ts | 648 | // Step 1: install with trust policy off. The resolver picks up the | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/misc.ts | 656 | // Step 2: turn the policy on. The resolver wouldn't be invoked under | COMMENT |
| LOW⚡ | pnpm/crates/network/src/tls.rs | 208 | // Step 1: exact URL. | COMMENT |
| LOW⚡ | pnpm/crates/network/src/tls.rs | 212 | // Step 2: nerf-darted URL. | COMMENT |
| LOW⚡ | pnpm/crates/network/src/tls.rs | 219 | // Step 4: walk progressively shorter prefixes of the | COMMENT |
| LOW⚡ | pnpm/crates/git-fetcher/src/tarball_fetcher.rs | 94 | // Step 1: Materialize the CAS-resident files into a writable | COMMENT |
| LOW⚡ | pnpm/crates/git-fetcher/src/tarball_fetcher.rs | 99 | // Step 2: Run `preparePackage` on the materialized tree. This | COMMENT |
| LOW⚡ | pnpm/crates/git-fetcher/src/tarball_fetcher.rs | 138 | // Step 3: Compute the packlist over the prepared tree. The | COMMENT |
| LOW⚡ | pnpm/crates/git-fetcher/src/tarball_fetcher.rs | 148 | // Step 4: Fast path — when nothing got filtered out AND | COMMENT |
| LOW⚡ | pnpm/crates/git-fetcher/src/tarball_fetcher.rs | 190 | // Step 5: Slow path — re-import the filtered file set back | COMMENT |
| LOW⚡ | pnpm/crates/git-fetcher/src/tarball_fetcher.rs | 195 | // Step 6: Queue a `PackageFilesIndex` row so a future install's | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …ling/deps-installer/test/install/globalVirtualStore.ts | 314 | // Step 2: Reinstall with allowBuilds changed (simulating what approve-builds does) | COMMENT |
| LOW⚡ | …ling/deps-installer/test/install/globalVirtualStore.ts | 322 | // Step 3: Verify the hash changed and build artifacts are in the new directory | COMMENT |
| LOW⚡ | …ling/deps-installer/test/install/globalVirtualStore.ts | 390 | // Step 2: Simulate a previous build failure by removing the GVS hash directory | COMMENT |
| LOW⚡ | …ling/deps-installer/test/install/globalVirtualStore.ts | 394 | // Step 3: Remove node_modules and reinstall with frozenLockfile | COMMENT |
| LOW⚡ | …ling/deps-installer/test/install/globalVirtualStore.ts | 437 | // Step 2: Simulate a crash between import and build — write a .pnpm-needs-build | COMMENT |
| LOW⚡ | …ling/deps-installer/test/install/globalVirtualStore.ts | 446 | // Step 3: Reinstall — the GVS fast path should detect the .pnpm-needs-build | COMMENT |
| LOW | …ling/deps-installer/test/install/globalVirtualStore.ts | 214 | // Step 1: Install with no packages allowed to build (engine-agnostic hashes) | COMMENT |
| LOW | …ling/deps-installer/test/install/globalVirtualStore.ts | 228 | // Step 2: Reinstall with dep allowed to build — hashes should change | COMMENT |
| LOW | …ling/deps-installer/test/install/globalVirtualStore.ts | 299 | // Step 1: Install with builds NOT approved (simulating first `pnpm install`) | COMMENT |
| LOW | …ling/deps-installer/test/install/globalVirtualStore.ts | 376 | // Step 1: Successful install with build | COMMENT |
| LOW | …ling/deps-installer/test/install/globalVirtualStore.ts | 420 | // Step 1: Install with build | COMMENT |
| LOW | …alling/deps-installer/test/install/autoInstallPeers.ts | 689 | // Step 1: install without override — auto-installs peer-c@1.0.1 | COMMENT |
| LOW | …alling/deps-installer/test/install/autoInstallPeers.ts | 702 | // Step 2: reinstall with override narrowing peer-c to 1.0.0 | COMMENT |
| LOW | pnpm11/workspace/injected-deps-syncer/src/index.ts | 82 | // Step 1: Link bins in .pnpm virtual store | COMMENT |
| LOW | pnpm11/workspace/injected-deps-syncer/src/index.ts | 98 | // Step 2: Relink bins for all workspace projects | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 30 | // Step 1: populate a lockfile under no policy. The resolver picks | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 37 | // Step 2: turn on minimumReleaseAge in strict mode. The lockfile is now | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 81 | // Step 1: populate the lockfile with no policy. is-positive@1.0.0 | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 88 | // Step 2: turn the policy on. The post-resolution gate now runs | COMMENT |
| LOW | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 113 | // Step 3: another install with the same lockfile + policy. The cache | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 368 | // Step 1: install with the full exclude list — verifier writes a | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/minimumReleaseAge.ts | 377 | // Step 2: drop `is-odd` from the exclude list. The cached record | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/globalVirtualStore.ts | 47 | // Step 1: Install with GVS, builds NOT approved | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/globalVirtualStore.ts | 57 | // Step 2: approve-builds — updates config then runs install in GVS mode | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/globalVirtualStore.ts | 60 | // Step 3: Verify GVS hash changed (new engine-specific directory) | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/misc.ts | 648 | // Step 1: install with trust policy off. The resolver picks up the | COMMENT |
| LOW⚡ | pnpm11/pnpm/test/install/misc.ts | 656 | // Step 2: turn the policy on. The resolver wouldn't be invoked under | COMMENT |
| LOW⚡ | pnpm/crates/network/src/tls.rs | 208 | // Step 1: exact URL. | COMMENT |
| LOW⚡ | pnpm/crates/network/src/tls.rs | 212 | // Step 2: nerf-darted URL. | COMMENT |
| LOW⚡ | pnpm/crates/network/src/tls.rs | 219 | // Step 4: walk progressively shorter prefixes of the | COMMENT |
| LOW⚡ | pnpm/crates/git-fetcher/src/tarball_fetcher.rs | 94 | // Step 1: Materialize the CAS-resident files into a writable | COMMENT |
| LOW⚡ | pnpm/crates/git-fetcher/src/tarball_fetcher.rs | 99 | // Step 2: Run `preparePackage` on the materialized tree. This | COMMENT |
| LOW⚡ | pnpm/crates/git-fetcher/src/tarball_fetcher.rs | 138 | // Step 3: Compute the packlist over the prepared tree. The | COMMENT |
| LOW⚡ | pnpm/crates/git-fetcher/src/tarball_fetcher.rs | 148 | // Step 4: Fast path — when nothing got filtered out AND | COMMENT |
| LOW⚡ | pnpm/crates/git-fetcher/src/tarball_fetcher.rs | 190 | // Step 5: Slow path — re-import the filtered file set back | COMMENT |
| LOW⚡ | pnpm/crates/git-fetcher/src/tarball_fetcher.rs | 195 | // Step 6: Queue a `PackageFilesIndex` row so a future install's | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | pnpm11/installing/deps-installer/test/install/auth.ts | 80 | email: 'foo@bar.com', | CODE |
| LOW | pnpm11/installing/deps-installer/test/install/auth.ts | 138 | email: 'foo@bar.com', | CODE |
| LOW | pnpm11/installing/deps-installer/test/install/auth.ts | 230 | email: 'foo@bar.com', | CODE |
| LOW | pnpm11/installing/deps-installer/test/install/auth.ts | 256 | email: 'foo@bar.com', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 31 | HOME: '/home/fake-user', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 32 | PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 46 | HOME: '/home/fake-user', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 47 | PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 61 | HOME: '/home/fake-user', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 62 | PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 76 | HOME: '/home/fake-user', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 77 | PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin', | CODE |
| LOW⚡ | pnpm11/config/reader/test/env.test.ts | 91 | HOME: '/home/fake-user', | CODE |
| LOW⚡ | pnpm11/config/reader/test/env.test.ts | 92 | PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin', | CODE |
| LOW⚡ | pnpm11/config/reader/test/env.test.ts | 99 | bar: path.join('/home/fake-user', 'abc/def/ghi'), | CODE |
| LOW⚡ | pnpm11/config/reader/test/env.test.ts | 100 | baz: path.join('/home/fake-user', 'abc\\def\\ghi'), | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 117 | HOME: '/home/fake-user', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 118 | PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 132 | HOME: '/home/fake-user', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 133 | PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 152 | HOME: '/home/fake-user', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 153 | PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 172 | HOME: '/home/fake-user', | CODE |
| LOW | pnpm11/config/reader/test/env.test.ts | 173 | PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin', | CODE |
| LOW | pnpm11/__fixtures__/has-outdated-deps/pnpm-lock.yaml | 26 | deprecated: This package is deprecated. Lorem ipsum dolor sit amet, consectetur adipiscing elit. | CODE |
| LOW | pnpm11/__fixtures__/has-outdated-deps/pnpm-lock.yaml | 26 | deprecated: This package is deprecated. Lorem ipsum dolor sit amet, consectetur adipiscing elit. | CODE |
| LOW | …1/__fixtures__/has-only-deprecated-deps/pnpm-lock.yaml | 16 | deprecated: This package is deprecated. Lorem ipsum dolor sit amet, consectetur adipiscing elit. | CODE |
| LOW | …1/__fixtures__/has-only-deprecated-deps/pnpm-lock.yaml | 16 | deprecated: This package is deprecated. Lorem ipsum dolor sit amet, consectetur adipiscing elit. | CODE |
| LOW | pnpm11/resolving/npm-resolver/test/trustChecks.test.ts | 88 | email: 'user@example.com', | CODE |
| LOW | pnpm11/resolving/npm-resolver/test/trustChecks.test.ts | 104 | email: 'user@example.com', | CODE |
| LOW | pnpm11/resolving/npm-resolver/test/trustChecks.test.ts | 107 | email: 'user@example.com', | CODE |
| LOW | pnpm11/resolving/npm-resolver/test/trustChecks.test.ts | 124 | email: 'user@example.com', | CODE |
| LOW | pnpm11/resolving/npm-resolver/test/trustChecks.test.ts | 127 | email: 'user@example.com', | CODE |
| LOW | pnpm11/network/git-utils/test/index.test.ts | 44 | await execa('git', ['config', 'user.email', 'test@test.com'], { cwd: tempDir }) | CODE |
| LOW | pnpm11/pnpm/test/dlx.ts | 408 | email: 'foo@bar.com', | CODE |
| LOW | …1/deps/compliance/sbom/test/serializeCycloneDx.test.ts | 27 | author: 'Jane Doe', | CODE |
| LOW | …1/deps/compliance/sbom/test/serializeCycloneDx.test.ts | 153 | sbomAuthors: ['Jane Doe', 'John Smith'], | CODE |
| LOW | …1/deps/compliance/sbom/test/serializeCycloneDx.test.ts | 157 | expect(parsed.metadata.authors).toEqual([{ name: 'Jane Doe' }, { name: 'John Smith' }]) | CODE |
| LOW | …1/deps/compliance/sbom/test/serializeCycloneDx.test.ts | 299 | expect(parsed.components[0].authors).toEqual([{ name: 'Jane Doe' }]) | CODE |
| LOW | pnpm11/deps/inspection/commands/test/outdated/index.ts | 64 | │ @pnpm.e2e/deprecated │ 1.0.0 │ Deprecated │ This package is deprecated. Lorem ipsum │ | CODE |
| LOW | pnpm11/deps/inspection/commands/test/outdated/index.ts | 65 | │ │ │ │ dolor sit amet, consectetur adipiscing │ | CODE |
| LOW | pnpm11/deps/inspection/commands/test/outdated/index.ts | 184 | This package is deprecated. Lorem ipsum dolor sit amet, consectetur adipiscing elit. | CODE |
| LOW | pnpm11/deps/inspection/commands/test/outdated/index.ts | 184 | This package is deprecated. Lorem ipsum dolor sit amet, consectetur adipiscing elit. | CODE |
| LOW | pnpm11/deps/inspection/commands/test/outdated/index.ts | 529 | │ @pnpm.e2e/deprecated │ 1.0.0 │ Deprecated │ This package is deprecated. Lorem ipsum │ | CODE |
| LOW | pnpm11/deps/inspection/commands/test/outdated/index.ts | 530 | │ │ │ │ dolor sit amet, consectetur adipiscing │ | CODE |
| LOW | pnpm/crates/package-manager/src/install/tests.rs | 1994 | let slot = virtual_store_dir.join("placeholder@1.0.0").join("node_modules").join("placeholder"); | CODE |
| LOW | pnpm/crates/package-manager/src/install/tests.rs | 2017 | manifest.add_dependency("placeholder", "1.0.0", DependencyGroup::Prod).unwrap(); | CODE |
| LOW | pnpm/crates/package-manager/src/install/tests.rs | 2119 | manifest.add_dependency("placeholder", "1.0.0", DependencyGroup::Prod).unwrap(); | CODE |
| LOW | pnpm/crates/package-manager/src/install/tests.rs | 2238 | manifest.add_dependency("placeholder", "1.0.0", DependencyGroup::Prod).unwrap(); | CODE |
| LOW | pnpm/crates/package-manager/src/install/tests.rs | 2416 | manifest.add_dependency("placeholder", "1.0.0", DependencyGroup::Prod).unwrap(); | CODE |
| LOW | pnpm/crates/package-manager/src/install/tests.rs | 2688 | overrides.insert("placeholder".to_string(), "9.9.9".to_string()); | CODE |
| LOW | pnpm/crates/package-manager/src/install/tests.rs | 2768 | r#"{"name":"my-app","version":"1.0.0","dependencies":{"placeholder":"^9"}}"#, | CODE |
| LOW | pnpm/crates/package-manager/src/install/tests.rs | 2778 | overrides.insert("placeholder".to_string(), "1.0.0".to_string()); | CODE |
| LOW | pnpm/crates/package-manager/src/install/tests.rs | 2884 | r#"{"name":"my-app","version":"1.0.0","dependencies":{"placeholder":"^9"}}"#, | CODE |
| LOW | pnpm/crates/package-manager/src/install/tests.rs | 2898 | overrides.insert("placeholder".to_string(), "catalog:".to_string()); | CODE |
| LOW | pnpm/crates/package-manager/src/install/tests.rs | 6055 | manifest.add_dependency("placeholder", "1.0.0", DependencyGroup::Prod).unwrap(); | CODE |
| LOW | pnpm/crates/package-manager/src/install/tests.rs | 6135 | manifest.add_dependency("placeholder", "1.0.0", DependencyGroup::Prod).unwrap(); | CODE |
| LOW | pnpm/crates/cli/tests/search.rs | 82 | "author": { "name": "John Doe" }, | CODE |
| LOW⚡ | pnpm/crates/cli/src/cli_args/sbom/tests.rs | 76 | let manifest = serde_json::json!({ "author": "Jane Doe" }); | CODE |
| LOW⚡ | pnpm/crates/cli/src/cli_args/sbom/tests.rs | 77 | assert_eq!(extract_author(&manifest), Some("Jane Doe".to_string())); | CODE |
| 4 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | pnpm11/__fixtures__/pnpm-workspace.yaml | 26 | # policy for fixture installs — they're test scaffolding, not a real | COMMENT |
| MEDIUM | pnpm11/benchmarks/bench.sh | 9 | # as before; the orchestration logic is shared with the pacquet bench. | COMMENT |
| MEDIUM | pnpm/tasks/ecosystem-e2e/README.md | 53 | # Iterate without re-scaffolding | COMMENT |
| MEDIUM | pnpm/tasks/ecosystem-e2e/src/stacks.rs | 3 | /// `scaffold` generates the project on disk *without* installing | COMMENT |
| MEDIUM | pnpm/tasks/ecosystem-e2e/src/stacks.rs | 7 | /// scaffold command is run through `pnpm dlx`, so the first token is the | COMMENT |
| MEDIUM | pnpm/tasks/ecosystem-e2e/src/main.rs | 50 | // A failed scaffold dooms every cell of this stack; record | COMMENT |
| MEDIUM | pnpm/crates/cli/tests/run.rs | 539 | // directory would scaffold one before doing anything else. | COMMENT |
| MEDIUM | pnpm/crates/cli/tests/workspace_install.rs | 364 | /// root `package.json`, and installing must not scaffold one — pnpm never | COMMENT |
| MEDIUM | pnpm/crates/package-manifest/src/lib.rs | 116 | /// The scaffold manifest `pnpm init` (and [`Self::create_if_needed`]) | COMMENT |
| MEDIUM | pnpm/crates/package-manifest/src/lib.rs | 187 | // Read the scaffold back rather than assembling the manifest by | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | pnpm11/deps/compliance/audit/test/index.ts | 316 | // robust to constant-factor changes in future refactors. | COMMENT |
| MEDIUM | pnpm/crates/package-manager/src/install/tests.rs | 5737 | // literal here. Membership-by-name keeps the test robust to the | COMMENT |
| MEDIUM | pnpm/crates/lockfile/src/env_lockfile/tests.rs | 143 | // a `Lockfile` literal — keeps the test robust as the `Lockfile` | COMMENT |
| MEDIUM | pnpm/crates/fs/src/ensure_file/tests.rs | 68 | /// those keeps the test robust without weakening what it verifies | COMMENT |
| MEDIUM | .github/workflows/test.yml | 97 | # The test harness serves package fixtures through the in-repo `pnpr` | COMMENT |
| MEDIUM | .github/workflows/ecosystem-e2e.yml | 24 | # Compile pacquet, the harness, and the pnpm bundle once, then share them | COMMENT |
| MEDIUM | .github/workflows/ecosystem-e2e.yml | 96 | # The harness takes a single executable for --pnpm; the launcher is a | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | pnpm11/installing/deps-installer/test/catalogs.ts | 987 | // Double check the correct version of is-positive as requested from the | COMMENT |
| HIGH | pnpm11/installing/deps-installer/test/catalogs.ts | 1055 | // Double check the correct version of is-positive as requested from the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | pnpm11/pnpm/bundle-deps.ts | 39 | // │ ├── node_modules ──────────────┐ | COMMENT |
| MEDIUM | pnpm11/pnpm/bundle-deps.ts | 47 | // │ ├── node_modules <────────────┘ | COMMENT |
| MEDIUM | pnpm/crates/config/src/version_policy/tests.rs | 84 | // ─── create_package_version_policy ──────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | pnpm11/installing/deps-installer/test/install/misc.ts | 965 | // TODO: implement | COMMENT |
| LOW | pnpm11/store/controller/src/storeController/prune.ts | 83 | // TODO: implement prune of Node.js packages, they don't have a package.json file | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/pacquet-micro-benchmark.yml | 113 | # Check if the event is not triggered by a fork | COMMENT |
| LOW | .github/workflows/pacquet-micro-benchmark.yml | 123 | # Check if the event is not triggered by a fork | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | shell/resolve-pr-conflicts.sh | 4 | # Usage: | COMMENT |