# pm2 v7.0.2

- Product: pm2 (https://whatsnew.fyi/product/pm2)
- Vendor: Unitech
- Date: 2026-06-29
- Version: v7.0.2
- Original notes: https://github.com/Unitech/pm2/releases/tag/v7.0.2
- Permalink: https://whatsnew.fyi/product/pm2/releases/v7.0.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Fix pm2 serve returning 403 Forbidden on Windows due to traversal guard using hardcoded / separator
- **fixed** — Fix pm2 ls table misalignment when username exceeds user column width caused by cli-tableau's truncate() miscounting ANSI bytes
- **fixed** — Fix long status lines wrapping on narrow terminals by making Common.printOut ANSI-aware and cropping output to terminal width
- **added** — Show pm2 ls host-metrics line by default
- **added** — Add adaptive layout to pm2 ls that picks the widest layout fitting the terminal (full, condensed, or ultra-compact mini)
- **changed** — Filter pm2 ls host-metrics line to only list network interfaces carrying traffic
- **changed** — Replace pm2 ls host-metrics mem free with ram usage percentage and add GPU memory/temperature when reported
- **changed** — Show per-interface network errors/drops in pm2 ls host-metrics line when non-zero
- **removed** — Remove old vizion module and 3 submodules
- **changed** — Replace bundled pm2-sysmonit module and systeminformation with lib/tools/SysMetrics.js for Linux/macOS
- **security** — Bump js-yaml 4.1.1 to 4.3.0 to fix quadratic-complexity DoS in merge-key handling
- **security** — Bump ws 8.20.0 to 8.21.0 to fix uninitialized-memory disclosure and tiny-fragment DoS
- **security** — Bump @pm2/js-api 0.8.0 to 0.8.1 to pull in patched ws@8.21.0

##### 7.0.2

###### Bug Fixes

- Fix `pm2 serve` returning 403 Forbidden on Windows — traversal guard used hardcoded `/` separator #6109
- Fix `pm2 ls` table misalignment when a username exceeds the `user` column width — cli-tableau's `truncate()` miscounts ANSI bytes, leaking bold into the `watching` column
- Fix long status lines (e.g. `Applying action … on app […]`) wrapping on narrow terminals — `Common.printOut` now ANSI-aware crops single-line TTY output to terminal width (piped output unaffected)

###### Features

- `pm2 ls` host-metrics line now shown by default`pm2 update`)
- `pm2 ls` adaptive layout: picks the widest layout that fits the terminal — full → condensed → new ultra-compact `mini` (`id · name · status · cpu · mem`) — and caps the `name` column so long names can't overflow the table
- `pm2 ls` host-metrics line only lists network interfaces carrying traffic (hides idle utun/awdl/bridge/anpi/unused en*)
- `pm2 ls` host-metrics line: replaced `mem free` with `ram usage` (%), added GPU memory/temperature when reported, per-interface network errors/drops shown when non-zero

###### Core Refactor

- Drop old vizion module, refactor to support only git and drop 3 submodules
- Replace the bundled `pm2-sysmonit` module and `systeminformation` with `lib/tools/SysMetrics.js` (Linux/macOS); `pm2 slist`/`getSystemData` and the Docker metrics path now read this collector. Covered by `test/programmatic/sysmetrics.mocha.js`

###### Security

- Bump `js-yaml` 4.1.1 → 4.3.0 — fixes quadratic-complexity DoS in merge-key handling (GHSA-h67p-54hq-rp68) #6122
- Bump `ws` 8.20.0 → 8.21.0 — fixes uninitialized-memory disclosure and tiny-fragment DoS (GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p) #6116
- Bump `@pm2/js-api` 0.8.0 → 0.8.1, pulling in patched `ws@8.21.0` (its transitive `ws` was pinned to the vulnerable 7.x). Production deps are now advisory-free (`npm audit --omit=dev` clean)