Skip nodeHardenFlags for pnpm < 11

Author: jdalton

.dep-stats.json

@@ -10,7 +10,7 @@
     "@socketregistry/is-interactive": "1.0.5",
     "@socketregistry/packageurl-js": "1.0.5",
     "@socketsecurity/config": "2.1.3",
-    "@socketsecurity/registry": "1.0.141",
+    "@socketsecurity/registry": "1.0.142",
     "@socketsecurity/sdk": "1.4.28",
     "browserslist": "4.24.4",
     "chalk-table": "1.0.2",

package-lock.json

@@ -86,7 +86,7 @@
     "@socketregistry/is-interactive": "1.0.5",
     "@socketregistry/packageurl-js": "1.0.5",
     "@socketsecurity/config": "2.1.3",
-    "@socketsecurity/registry": "1.0.141",
+    "@socketsecurity/registry": "1.0.142",
     "@socketsecurity/sdk": "1.4.28",
     "browserslist": "4.24.4",
     "chalk-table": "1.0.2",

package.json

@@ -7,7 +7,7 @@ import { safeNpmInstall } from '../../utils/npm'
 
 import type { EnvDetails } from '../../utils/package-environment'
 
-const { NPM } = constants
+const { NPM, PNPM } = constants
 
 type SpawnOption = Exclude<Parameters<typeof spawn>[2], undefined>
 type SpawnResult = ReturnType<typeof spawn>
@@ -34,15 +34,19 @@ export function runAgentInstall(
     spinner,
     ...spawnOptions
   } = { __proto__: null, ...options } as AgentInstallOptions
+  const skipNodeHardenFlags =
+    pkgEnvDetails.agent === PNPM && pkgEnvDetails.agentVersion.major < 11
   return spawn(agentExecPath, ['install', ...args], {
     spinner,
     stdio: 'inherit',
     ...spawnOptions,
     env: {
       ...process.env,
       NODE_OPTIONS: cmdFlagsToString([
-        // Lazily access constants.nodeHardenFlags.
-        ...constants.nodeHardenFlags,
+        ...(skipNodeHardenFlags
+          ? []
+          : // Lazily access constants.nodeHardenFlags.
+            constants.nodeHardenFlags),
         // Lazily access constants.nodeNoWarningsFlags.
         ...constants.nodeNoWarningsFlags
       ]),

src/commands/optimize/run-agent.ts

@@ -359,7 +359,7 @@ const lazyNodeHardenFlags = () =>
       // Node's --frozen-intrinsics workable.
       // √ https://github.com/SBoudrias/Inquirer.js/pull/1683
       // √ https://github.com/pnpm/components/pull/23
-      ['--disable-proto', 'delete', '--frozen-intrinsics', '--no-deprecation']
+      ['--disable-proto', 'throw', '--frozen-intrinsics', '--no-deprecation']
 
 const lazyRootBinPath = () =>
   // Lazily access constants.rootPath.