[Backport release-26.05] pnpm: don't require knownVulnerabilities to be set (#537069)

pkgs/development/tools/pnpm/default.nix

@@ -42,12 +42,13 @@ let
 
   callPnpm =
     variant:
-    callPackage ./generic.nix {
-      inherit (variant) version hash;
-      knownVulnerabilities = variant.knownVulnerabilities or [ ];
-      #FIXME: remove this hack in a future version.
-      nodejs = null; # Passing null to detect out-of-tree overrides
-    };
+    callPackage ./generic.nix (
+      variant
+      // {
+        #FIXME: remove this hack in a future version.
+        nodejs = null; # Passing null to detect out-of-tree overrides
+      }
+    );
 
   mkPnpm = versionSuffix: variant: nameValuePair "pnpm_${versionSuffix}" (callPnpm variant);
 in

pkgs/development/tools/pnpm/generic.nix

@@ -17,7 +17,7 @@
   withNode ? true,
   version,
   hash,
-  knownVulnerabilities,
+  knownVulnerabilities ? [ ],
 }:
 let
   majorVersion = lib.versions.major version;