Bump pm2 from 5.3.0 to 7.0.0 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: pm2.

Updates pm2 from 5.3.0 to 7.0.0

Release notes

Sourced from pm2's releases.

v7.0.0

7.0.0

Breaking Changes

• Require Node.js >= 18.0.0 (dropped Node.js 16 support)

Core Refactor

• Internalize pm2-axon, pm2-axon-rpc, pm2-io-bpm, pm2-io-agent, fclone as local modules (reduced supply chain surface)
• Internalize pm2-multimeter and charm into lib/tools/multimeter (zero external deps)
• Add Bun runtime support (ProcessContainerBun.js, ProcessContainerForkBun.js)
• Replace needle with native fetch (CliAuth, TAR publish)
• Replace enquirer with lightweight built-in prompt (boilerplate selector)
• Replace promptly with built-in lib/tools/prompt
• Replace mkdirp with native fs.mkdirSync({ recursive: true })
• Replace source-map-support with native process.setSourceMapsEnabled()
• Replace sprintf-js with template literals (Dashboard)
• Replace url.parse() with native URL constructor (Serve, Utility, CliAuth)
• Remove fclone npm dep, use internalized module
• Drop auto source map file detection in Common.prepareAppConf

Security

• CVE-2025-5891 Fix ReDoS in Config.js string-to-array split regex #6075
• CVE-2026-27699 Update proxy-agent to 6.5.0, basic-ftp to 5.3.1 #6088
• Fix command injection in WebAuth.js open() — replace exec() with execFile() #6089
• Fix command injection in PM2IO.js open() — replace exec() with execFile(), validate SUDO_USER
• Fix command injection in lib/tools/open.js — replace exec() with execFile(), validate SUDO_USER
• Fix prototype pollution in Configuration.set/unset via proto key traversal #6089
• Fix HttpInterface env stripping never executing (WEB_STRIP_ENV_VARS) #6089

Bug Fixes

• Rewrite TreeKill: single ps snapshot + in-memory tree build, eliminates race conditions. SIGKILL escalation now targets surviving child processes directly instead of re-walking a dead tree #6084
• Fix [object Object] env vars leaked to fork mode subprocesses #6073
• Fix Windows home path: use os.homedir() instead of HOMEPATH/HOMEDRIVE env vars #6106
• Fix Windows TreeKill callback consistency
• Fix missing BPM monitoring injection in Bun cluster mode (ProcessContainerBun.js)
• Fix ReferenceError crash in Bun cluster console overrides when disable_logs is true
• Fix CliAuth wrong credentials error displaying "undefined" instead of error message

Features

• Add --ftp option to pm2 serve for directory listing (python http.server style)

Dependencies

• Add OpenTelemetry tracing as direct dependencies (@​opentelemetry/api, sdk-node, auto-instrumentations-node)
• Upgrade OpenTelemetry packages to latest

... (truncated)

Changelog

Sourced from pm2's changelog.

7.0.0

Breaking Changes

• Require Node.js >= 18.0.0 (dropped Node.js 16 support)

Core Refactor

• Internalize pm2-axon, pm2-axon-rpc, pm2-io-bpm, pm2-io-agent, fclone as local modules (reduced supply chain surface)
• Internalize pm2-multimeter and charm into lib/tools/multimeter (zero external deps)
• Add Bun runtime support (ProcessContainerBun.js, ProcessContainerForkBun.js)
• Replace needle with native fetch (CliAuth, TAR publish)
• Replace enquirer with lightweight built-in prompt (boilerplate selector)
• Replace promptly with built-in lib/tools/prompt
• Replace mkdirp with native fs.mkdirSync({ recursive: true })
• Replace source-map-support with native process.setSourceMapsEnabled()
• Replace sprintf-js with template literals (Dashboard)
• Replace url.parse() with native URL constructor (Serve, Utility, CliAuth)
• Remove fclone npm dep, use internalized module
• Drop auto source map file detection in Common.prepareAppConf

Security

• CVE-2025-5891 Fix ReDoS in Config.js string-to-array split regex #6075
• CVE-2026-27699 Update proxy-agent to 6.5.0, basic-ftp to 5.3.1 #6088
• Fix command injection in WebAuth.js open() — replace exec() with execFile() #6089
• Fix command injection in PM2IO.js open() — replace exec() with execFile(), validate SUDO_USER
• Fix command injection in lib/tools/open.js — replace exec() with execFile(), validate SUDO_USER
• Fix prototype pollution in Configuration.set/unset via proto key traversal #6089
• Fix HttpInterface env stripping never executing (WEB_STRIP_ENV_VARS) #6089

Bug Fixes

• Rewrite TreeKill: single ps snapshot + in-memory tree build, eliminates race conditions. SIGKILL escalation now targets surviving child processes directly instead of re-walking a dead tree #6084
• Fix [object Object] env vars leaked to fork mode subprocesses #6073
• Fix Windows home path: use os.homedir() instead of HOMEPATH/HOMEDRIVE env vars #6106
• Fix Windows TreeKill callback consistency
• Fix missing BPM monitoring injection in Bun cluster mode (ProcessContainerBun.js)
• Fix ReferenceError crash in Bun cluster console overrides when disable_logs is true
• Fix CliAuth wrong credentials error displaying "undefined" instead of error message

Features

• Add --ftp option to pm2 serve for directory listing (python http.server style)

Dependencies

• Add OpenTelemetry tracing as direct dependencies (@​opentelemetry/api, sdk-node, auto-instrumentations-node)
• Upgrade OpenTelemetry packages to latest
• Update pidusage from 3.0.2 to 4.0.1

... (truncated)

Commits

• 24adf55 pm2@7.0.0
• 36c3b51 ungit package-lock + bun lock
• b44395c fix deps
• 791d353 pm2@7.0.0
• 0887faf Node 18.x
• a6a2df6 windows pm2 install fix
• 7c1f969 no more shell: true + remove util._extends
• e007774 otel install fix
• 61a1142 psh
• 8620c30 otel
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}