Skip to content

Commit facb729

Browse files
davidbarrattdavidbarratt
authored
Merge branch 'pnpm:main' into fix/locked-peer-pin-sibling-leak
2 parents 107e935 + 5f63458 commit facb729

572 files changed

Lines changed: 26231 additions & 4634 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.changeset-released/main.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,17 @@
11
catalog-range-spec-update-crash
22
clean-package-manager-registries
33
clever-rocks-listen
4+
clever-warnings-guide
45
deps-status-no-manifest
56
destroy-windows-dispatchers
67
dollar-overrides-deprecation
8+
fast-repeat-install-restores-lockfile
79
fix-concurrent-import-partial-pkg
810
fix-config-globalconfig
911
fuzzy-color-flags
1012
gvs-rebuild-native-deps
1113
gvs-toggle-detection
14+
lockfile-verification-cached-message
1215
loose-meteors-travel
1316
pacquet-install-engine-identity
1417
pnpr-client-ndjson-resolve
@@ -18,11 +21,14 @@ pnpr-inline-only-access
1821
pnpr-lockfile-only
1922
pnpr-resolve-only
2023
prefer-locked-peer-contexts
24+
quick-registries-env-auth
2125
quiet-peers-settle
26+
raise-default-network-concurrency
2227
rename-agent-to-pnpr-server
2328
runtime-not-cataloged
2429
sharp-registry-env-placeholders
2530
short-lamps-relax
31+
spicy-pots-wonder
2632
stale-stage-tarballs
2733
store-discl
2834
strange-bin-segments

‎.changeset/batch-publish-single-request.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
"@pnpm/releasing.commands": minor
3+
"pnpm": minor
4+
---
5+
6+
Added a new opt-in `--batch` flag to `pnpm publish --recursive` that sends all selected packages to the registry in a single `PUT /-/pnpm/v1/publish` request instead of one request per package. The target registry has to implement the batch publish endpoint (pnpr does); registries that don't are reported with a clear `ERR_PNPM_BATCH_PUBLISH_UNSUPPORTED` error. The batch is processed all-or-nothing by pnpr: if any package in the batch fails validation, none of the packages are published.

‎.changeset/contain-hoisted-dependency-aliases.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
"@pnpm/fs.symlink-dependency": patch
3+
"@pnpm/installing.deps-resolver": patch
4+
"@pnpm/installing.deps-installer": patch
5+
"@pnpm/installing.deps-restorer": patch
6+
"pnpm": patch
7+
---
8+
9+
Reject path-traversal and reserved dependency aliases (such as `../../../escape`, `.bin`, `.pnpm`, or `node_modules`) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted `node_modules` directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.
10+
11+
The fix adds two layers:
12+
13+
- The `nodeLinker: hoisted` graph builder now validates each alias at the directory sink (`safeJoinModulesDir`), matching the validation pnpm already performs when resolving aliases from manifests.
14+
- The lockfile verification gate (`verifyLockfileResolutions`) now runs an always-on, policy-independent check that rejects any importer or snapshot dependency alias that is not a valid package name, failing the install early — before any fetch or filesystem work — for every node linker at once.

‎.changeset/deterministic-shared-children-resolution.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
"@pnpm/installing.deps-resolver": patch
3+
"pnpm": patch
4+
---
5+
6+
Made shared package child resolution deterministic when the same package is reached through multiple contexts. pnpm now chooses the shallowest occurrence, then importer order, then parent path, instead of letting request timing decide the child context and missing-peer report [pnpm/pnpm#12358](https://github.com/pnpm/pnpm/issues/12358).

‎.changeset/fast-repeat-install-restores-lockfile.md‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎.changeset/fix-interactive-prompt-summary.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
"@pnpm/installing.commands": patch
3+
"@pnpm/deps.compliance.commands": patch
4+
"pnpm": patch
5+
---
6+
7+
Fix garbled summary line after submitting `pnpm update -i` and `pnpm audit --fix -i`. The interactive checkbox prompt previously printed every selected choice's full table row (label, current/target versions, workspace, URL) joined by commas, producing a wall of text after pressing Enter. The summary now lists only the selected package names (or vulnerability keys) by setting an explicit `short` per choice; the in-progress selection UI is unchanged.

‎.changeset/fix-patch-remove-containment.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
"@pnpm/patching.commands": patch
3+
"pnpm": patch
4+
---
5+
6+
Prevent `pnpm patch-remove` from removing files outside the configured patches directory.

‎.changeset/fix-publish-strict-ssl.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
"@pnpm/releasing.commands": patch
3+
"pnpm": patch
4+
---
5+
6+
Fixed `pnpm publish` ignoring `strictSsl: false` when publishing to registries with self-signed certificates. The `strictSSL` option is now forwarded to `libnpmpublish` / `npm-registry-fetch` so that `strict-ssl=false` in `.npmrc` or `strictSsl: false` in `pnpm-workspace.yaml` is respected during publish, the same way it is for `pnpm install` [pnpm/pnpm#12012](https://github.com/pnpm/pnpm/issues/12012).

‎.changeset/fix-windows-recursive-undefined-manifest.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
"@pnpm/installing.commands": patch
3+
"pnpm": patch
4+
---
5+
6+
Fixed `Cannot destructure property 'manifest' of 'manifestsByPath[rootDir]' as it is undefined` regression introduced in 11.6.0 when running `pnpm add <pkg>` outside a workspace on Windows. `selectProjectByDir` was keying the resulting `ProjectsGraph` by `opts.dir` instead of `project.rootDir`, so downstream `manifestsByPath` lookups missed when the two paths normalized differently (typically drive-letter casing). [pnpm/pnpm#12379](https://github.com/pnpm/pnpm/issues/12379)

‎.changeset/frozen-store.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
"@pnpm/config.reader": minor
3+
"@pnpm/store.index": minor
4+
"@pnpm/store.controller": minor
5+
"@pnpm/store.connection-manager": minor
6+
"@pnpm/building.after-install": patch
7+
"@pnpm/building.during-install": patch
8+
"@pnpm/bins.linker": patch
9+
"@pnpm/resolving.npm-resolver": patch
10+
"@pnpm/worker": minor
11+
"@pnpm/installing.package-requester": minor
12+
"@pnpm/installing.context": patch
13+
"@pnpm/installing.deps-installer": minor
14+
"@pnpm/installing.commands": minor
15+
"pnpm": minor
16+
---
17+
18+
Added a new setting `frozenStore` (`--frozen-store`) that lets `pnpm install` run against a package store on a read-only filesystem (e.g. a Nix store, a read-only bind mount, an OCI layer). When enabled, pnpm opens the store's SQLite `index.db` through the `immutable=1` URI — bypassing the WAL/`-shm` sidecar creation that otherwise fails on a read-only directory — and suppresses every store-write path (the `index.db` writer and the project-registry write). Pair it with `--offline --frozen-lockfile` against a fully-populated store. Under the global virtual store, package directories live inside the store, so if the store is missing the build output of a package whose lifecycle scripts are approved (or that has a patch), pnpm fails up front with `ERR_PNPM_FROZEN_STORE_NEEDS_BUILD` rather than crashing mid-build on a read-only write — seed the store with those builds first. Incompatible with `--force` and with a configured pnpr server, since both write into the store; the side-effects cache is likewise not written under `frozenStore`. If the store is missing its content directory, the install fails fast with `ERR_PNPM_FROZEN_STORE_INCOMPLETE` rather than attempting to initialize it. The read-only `immutable=1` open requires Node.js >=22.15.0, >=23.11.0, or >=24.0.0; on older runtimes `--frozen-store` fails with a clear `ERR_PNPM_FROZEN_STORE_UNSUPPORTED_NODE` error. Bin-linking also tolerates a read-only store: under the global virtual store a package's bin source lives inside the store, so the `chmod` that makes it executable would be refused — with `EPERM`/`EACCES`, or with `EROFS` on a genuinely read-only filesystem. That `chmod` is redundant when the seed already ships its bins executable with a normalized shebang, so it is now skipped in that case, while a non-executable bin (or one still carrying a Windows CRLF shebang) on a read-only store still errors.

0 commit comments

Comments
 (0)