diff --git a/.changeset/tiny-friends-wave.md b/.changeset/tiny-friends-wave.md new file mode 100644 index 0000000000..d9541cd633 --- /dev/null +++ b/.changeset/tiny-friends-wave.md @@ -0,0 +1,6 @@ +--- +"@pnpm/plugin-commands-script-runners": patch +"pnpm": patch +--- + +`pnpm dlx` should request the full metadata of packages, when `minimumReleaseAge` is set [#9963](https://github.com/pnpm/pnpm/issues/9963). diff --git a/exec/plugin-commands-script-runners/src/dlx.ts b/exec/plugin-commands-script-runners/src/dlx.ts index bc112f86c0..d15e4d5cc8 100644 --- a/exec/plugin-commands-script-runners/src/dlx.ts +++ b/exec/plugin-commands-script-runners/src/dlx.ts @@ -85,9 +85,12 @@ export async function handler ( [command, ...args]: string[] ): Promise<{ exitCode: number }> { const pkgs = opts.package ?? [command] + const fullMetadata = ((opts.resolutionMode === 'time-based' || Boolean(opts.minimumReleaseAge)) && !opts.registrySupportsTimeField) const { resolve } = createResolver({ ...opts, authConfig: opts.rawConfig, + fullMetadata, + filterMetadata: fullMetadata, }) const resolvedPkgAliases: string[] = [] const publishedBy = opts.minimumReleaseAge ? new Date(Date.now() - opts.minimumReleaseAge * 60 * 1000) : undefined diff --git a/exec/plugin-commands-script-runners/test/dlx.e2e.ts b/exec/plugin-commands-script-runners/test/dlx.e2e.ts index 5316dac6fc..a92f10f20a 100644 --- a/exec/plugin-commands-script-runners/test/dlx.e2e.ts +++ b/exec/plugin-commands-script-runners/test/dlx.e2e.ts @@ -369,3 +369,20 @@ test('dlx builds the packages passed via --allow-build', async () => { expect(fs.existsSync(path.join(builtPkg2Path, 'package.json'))).toBeTruthy() expect(fs.existsSync(path.join(builtPkg2Path, 'generated-by-install.js'))).toBeTruthy() }) + +test('dlx should fail when the requested package does not meet the minimum age requirement', async () => { + prepareEmpty() + + await expect( + dlx.handler({ + ...DEFAULT_OPTS, + dir: path.resolve('project'), + minimumReleaseAge: 60 * 24 * 10000, + registries: { + // We must use the public registry instead of verdaccio here + // because verdaccio has the "times" field in the abbreviated metadata too. + default: 'https://registry.npmjs.org/', + }, + }, ['shx@0.3.4']) + ).rejects.toThrow('No matching version found for shx@0.3.4 published by') +})