CVE-2026-55700

## Summary The staged-tarball filename traversal reported as GHSA-v23m-ccfg-pq9h / CAND-PNPM-038 is fixed on `main` by [pnpm/pnpm#12303](https://github.com/pnpm/pnpm/pull/12303), merged as `65443f4bdf1f0db9c8c7dc58fee25252607e9234`. Before the fix, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. ## Security boundary - Package names and semantic versions are validated before they can influence a local filename. - POSIX and Windows path separators are rejected by basename checks. - Stage download and tarball summary paths use the same filename helper. - The resolved output path must remain an immediate child of the selected download directory. - The stage identifier is already constrained to a UUID. ## Exploit replay Before `65443f4bdf`, a traversal-bearing manifest version could make the command write outside the selected directory. After the fix, malicious package names fail with `ERR_PNPM_INVALID_PACKAGE_NAME`, malicious versions fail with `ERR_PNPM_INVALID_PACKAGE_VERSION`, no outside file is created, and the download directory remains empty. ## Files changed - `releasing/commands/src/tarball/safeTarballFilename.ts` validates manifest identity and rejects cross-platform path separators. - `releasing/commands/src/stage/download.ts` verifies the resolved destination before writing. - `releasing/commands/src/tarball/summarizeTarball.ts` uses the same filename contract. - `releasing/commands/test/stage.test.ts` covers traversal through both package name and version. - `.changeset/stale-stage-tarballs.md` includes patch bumps for `@pnpm/releasing.commands` and `pnpm`. ## Patch - Merged PR: https://github.com/pnpm/pnpm/pull/12303 - Fix commit: `65443f4bdf1f0db9c8c7dc58fee25252607e9234` - Th