fix: dlx command with minimumReleaseAge set (#10047)

close #9963

.changeset/tiny-friends-wave.md

@@ -0,0 +1,6 @@
+---
+"@pnpm/plugin-commands-script-runners": patch
+"pnpm": patch
+---
+
+`pnpm dlx` should request the full metadata of packages, when `minimumReleaseAge` is set [#9963](https://github.com/pnpm/pnpm/issues/9963).

exec/plugin-commands-script-runners/src/dlx.ts

@@ -85,9 +85,12 @@ export async function handler (
   [command, ...args]: string[]
 ): Promise<{ exitCode: number }> {
   const pkgs = opts.package ?? [command]
+  const fullMetadata = ((opts.resolutionMode === 'time-based' || Boolean(opts.minimumReleaseAge)) && !opts.registrySupportsTimeField)
   const { resolve } = createResolver({
     ...opts,
     authConfig: opts.rawConfig,
+    fullMetadata,
+    filterMetadata: fullMetadata,
   })
   const resolvedPkgAliases: string[] = []
   const publishedBy = opts.minimumReleaseAge ? new Date(Date.now() - opts.minimumReleaseAge * 60 * 1000) : undefined

exec/plugin-commands-script-runners/test/dlx.e2e.ts

@@ -369,3 +369,20 @@ test('dlx builds the packages passed via --allow-build', async () => {
   expect(fs.existsSync(path.join(builtPkg2Path, 'package.json'))).toBeTruthy()
   expect(fs.existsSync(path.join(builtPkg2Path, 'generated-by-install.js'))).toBeTruthy()
 })
+
+test('dlx should fail when the requested package does not meet the minimum age requirement', async () => {
+  prepareEmpty()
+
+  await expect(
+    dlx.handler({
+      ...DEFAULT_OPTS,
+      dir: path.resolve('project'),
+      minimumReleaseAge: 60 * 24 * 10000,
+      registries: {
+        // We must use the public registry instead of verdaccio here
+        // because verdaccio has the "times" field in the abbreviated metadata too.
+        default: 'https://registry.npmjs.org/',
+      },
+    }, ['shx@0.3.4'])
+  ).rejects.toThrow('No matching version found for shx@0.3.4 published by')
+})