fix(arborist): block symlink escape in patch applier #10129

Open
rootvector2 opened 1:40am on October 15, 2026 wants to merge 25 Δ into npm/cli latest from
block-patch-applier-symlink-escape

Pull request #10129 quality checks

Code files and functions touched by this pull request are analyzed below.

Quality targets

How does this pull request compare to chosen code quality targets? Read more about code quality targets.

Target name Target value This PR
Maximum Diff Delta per PR 500 25
Maximum comment count per PR 10 2
Pull request maximum business days between activity 3 16
Pull request maximum business days open 5 16

Coupled files

Are there any files from this commit that are always committed alongside another file? This often suggests that there exists code coupling to potentially remove. Read more about code coupling

No file coupling detected. 🎉

Biggest files changes in pull request

Path View whole file Lines removed Lines added Final line count
workspaces/arborist/lib/patch.js 0 16 127
workspaces/arborist/test/patch.js 0 26 169

️ Biggest functions grown or shrunk by pull request

Which functions had their line count change as part of this pull request?

Qualified function name View whole function Lines removed Lines added Final line count
stripPrefix::containedTarget 0 16 23