Bump pm2 from 5.4.3 to 7.0.1 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: pm2.

Updates pm2 from 5.4.3 to 7.0.1

Release notes

Sourced from pm2's releases.

v7.0.1

7.0.1

Bug Fixes

• Fix Python (and other non-Node) interpreter regression on Ubuntu: bun runtime detection used a naive includes('bun') substring check that matched any path containing the letters "bun" — most notably /home/ubuntu/.... Affected paths were routed through ProcessContainerForkBun.js and crashed with SyntaxError: unterminated string literal when Python tried to parse the JS container. Anchored the match to the end of the interpreter path (=== 'bun' or /bun$/) in both lib/God/ForkMode.js and lib/Common.js #5990
• Display max_memory_restart in pm2 describe output when set #5925
• Add missing port option to StartOptions TypeScript declaration #6045
• Fix incorrect file permissions on openrc.tpl template (0755 → 0644) #5957
• Fix Windows cmd.exe regression: revert bin/pm2* launchers to #!/usr/bin/env node shebang (was polyglot #!/bin/sh). Polyglot worked on Linux/macOS but broke npm's pm2.cmd shim on Windows — cmd.exe can't interpret /bin/sh shebang and failed with '"/bin/sh"' is not recognized as an internal or external command. PowerShell's auto-generated pm2.ps1 shim happened to call node directly so it kept working, masking the regression. Bun-only Linux/macOS users (no Node installed) need to symlink node to bun (sudo ln -s $(which bun) /usr/local/bin/node) — same workaround used in the project's bun test Dockerfile. Documented in README #6108

v7.0.0

7.0.0

Breaking Changes

• Require Node.js >= 18.0.0 (dropped Node.js 16 support)

Core Refactor

• Internalize pm2-axon, pm2-axon-rpc, pm2-io-bpm, pm2-io-agent, fclone as local modules (reduced supply chain surface)
• Internalize pm2-multimeter and charm into lib/tools/multimeter (zero external deps)
• Add Bun runtime support (ProcessContainerBun.js, ProcessContainerForkBun.js)
• Replace needle with native fetch (CliAuth, TAR publish)
• Replace enquirer with lightweight built-in prompt (boilerplate selector)
• Replace promptly with built-in lib/tools/prompt
• Replace mkdirp with native fs.mkdirSync({ recursive: true })
• Replace source-map-support with native process.setSourceMapsEnabled()
• Replace sprintf-js with template literals (Dashboard)
• Replace url.parse() with native URL constructor (Serve, Utility, CliAuth)
• Remove fclone npm dep, use internalized module
• Drop auto source map file detection in Common.prepareAppConf

Security

• CVE-2025-5891 Fix ReDoS in Config.js string-to-array split regex #6075
• CVE-2026-27699 Update proxy-agent to 6.5.0, basic-ftp to 5.3.1 #6088
• Fix command injection in WebAuth.js open() — replace exec() with execFile() #6089
• Fix command injection in PM2IO.js open() — replace exec() with execFile(), validate SUDO_USER
• Fix command injection in lib/tools/open.js — replace exec() with execFile(), validate SUDO_USER
• Fix prototype pollution in Configuration.set/unset via proto key traversal #6089
• Fix HttpInterface env stripping never executing (WEB_STRIP_ENV_VARS) #6089

Bug Fixes

• Rewrite TreeKill: single ps snapshot + in-memory tree build, eliminates race conditions. SIGKILL escalation now targets surviving child processes directly instead of re-walking a dead tree #6084
• Fix [object Object] env vars leaked to fork mode subprocesses #6073
• Fix Windows home path: use os.homedir() instead of HOMEPATH/HOMEDRIVE env vars #6106
• Fix Windows TreeKill callback consistency
• Fix missing BPM monitoring injection in Bun cluster mode (ProcessContainerBun.js)

... (truncated)

Changelog

Sourced from pm2's changelog.

7.0.1

Bug Fixes

• Fix Python (and other non-Node) interpreter regression on Ubuntu: bun runtime detection used a naive includes('bun') substring check that matched any path containing the letters "bun" — most notably /home/ubuntu/.... Affected paths were routed through ProcessContainerForkBun.js and crashed with SyntaxError: unterminated string literal when Python tried to parse the JS container. Anchored the match to the end of the interpreter path (=== 'bun' or /bun$/) in both lib/God/ForkMode.js and lib/Common.js #5990
• Display max_memory_restart in pm2 describe output when set #5925
• Add missing port option to StartOptions TypeScript declaration #6045
• Fix incorrect file permissions on openrc.tpl template (0755 → 0644) #5957
• Fix Windows cmd.exe regression: revert bin/pm2* launchers to #!/usr/bin/env node shebang (was polyglot #!/bin/sh). Polyglot worked on Linux/macOS but broke npm's pm2.cmd shim on Windows — cmd.exe can't interpret /bin/sh shebang and failed with '"/bin/sh"' is not recognized as an internal or external command. PowerShell's auto-generated pm2.ps1 shim happened to call node directly so it kept working, masking the regression. Bun-only Linux/macOS users (no Node installed) need to symlink node to bun (sudo ln -s $(which bun) /usr/local/bin/node) — same workaround used in the project's bun test Dockerfile. Documented in README #6108

7.0.0

Breaking Changes

• Require Node.js >= 18.0.0 (dropped Node.js 16 support)

Core Refactor

• Internalize pm2-axon, pm2-axon-rpc, pm2-io-bpm, pm2-io-agent, fclone as local modules (reduced supply chain surface)
• Internalize pm2-multimeter and charm into lib/tools/multimeter (zero external deps)
• Add Bun runtime support (ProcessContainerBun.js, ProcessContainerForkBun.js)
• Replace needle with native fetch (CliAuth, TAR publish)
• Replace enquirer with lightweight built-in prompt (boilerplate selector)
• Replace promptly with built-in lib/tools/prompt
• Replace mkdirp with native fs.mkdirSync({ recursive: true })
• Replace source-map-support with native process.setSourceMapsEnabled()
• Replace sprintf-js with template literals (Dashboard)
• Replace url.parse() with native URL constructor (Serve, Utility, CliAuth)
• Remove fclone npm dep, use internalized module
• Drop auto source map file detection in Common.prepareAppConf

Security

• CVE-2025-5891 Fix ReDoS in Config.js string-to-array split regex #6075
• CVE-2026-27699 Update proxy-agent to 6.5.0, basic-ftp to 5.3.1 #6088
• Fix command injection in WebAuth.js open() — replace exec() with execFile() #6089
• Fix command injection in PM2IO.js open() — replace exec() with execFile(), validate SUDO_USER
• Fix command injection in lib/tools/open.js — replace exec() with execFile(), validate SUDO_USER
• Fix prototype pollution in Configuration.set/unset via proto key traversal #6089
• Fix HttpInterface env stripping never executing (WEB_STRIP_ENV_VARS) #6089

Bug Fixes

• Rewrite TreeKill: single ps snapshot + in-memory tree build, eliminates race conditions. SIGKILL escalation now targets surviving child processes directly instead of re-walking a dead tree #6084
• Fix [object Object] env vars leaked to fork mode subprocesses #6073
• Fix Windows home path: use os.homedir() instead of HOMEPATH/HOMEDRIVE env vars #6106
• Fix Windows TreeKill callback consistency
• Fix missing BPM monitoring injection in Bun cluster mode (ProcessContainerBun.js)
• Fix ReferenceError crash in Bun cluster console overrides when disable_logs is true

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.