From b286ddbfbf770227f3cbd37d30f91ecbdac0aec7 Mon Sep 17 00:00:00 2001 From: Zoltan Kochan Date: Wed, 5 Aug 2026 21:42:03 +0200 Subject: [PATCH] chore(release): pacquet 12.0.0-rc.0 (#13667) Co-authored-by: github-actions[bot] --- .../@pnpm!assert-project@1100.0.25.md | 10 -- .../@pnpm!assert-store@1100.0.25.md | 7 -- .../@pnpm!auth.commands@1100.3.1.md | 11 -- .../changelogs/@pnpm!bins.linker@1100.0.25.md | 11 -- .../@pnpm!bins.remover@1100.0.19.md | 9 -- .../@pnpm!bins.resolver@1100.0.14.md | 6 - .../@pnpm!building.after-install@1102.0.15.md | 30 ----- .../@pnpm!building.commands@1100.1.20.md | 17 --- ...@pnpm!building.during-install@1102.0.14.md | 16 --- ...m!building.pkg-requires-build@1100.0.14.md | 6 - .../@pnpm!building.policy@1100.0.18.md | 8 -- .../changelogs/@pnpm!cache.api@1100.0.36.md | 10 -- .../@pnpm!cache.commands@1100.0.37.md | 11 -- .../@pnpm!catalogs.config@1100.0.4.md | 6 - .../@pnpm!cli.commands@1100.0.35.md | 6 - .../@pnpm!cli.default-reporter@1100.3.15.md | 10 -- .../changelogs/@pnpm!cli.meta@1100.0.14.md | 6 - .../@pnpm!cli.parse-cli-args@1100.1.8.md | 7 -- .../changelogs/@pnpm!cli.utils@1101.0.22.md | 11 -- .../@pnpm!config.commands@1100.0.36.md | 11 -- ...pm!config.normalize-registries@1100.1.0.md | 11 -- ...!config.package-is-installable@1100.1.2.md | 10 -- .../@pnpm!config.parse-overrides@1100.1.2.md | 6 - ...nfig.pick-registry-for-package@1100.1.0.md | 10 -- .../@pnpm!config.reader@1101.16.0.md | 73 ------------- ...@pnpm!config.registry-auth-key@1100.0.0.md | 5 - .../@pnpm!config.version-policy@1100.1.12.md | 7 -- .../@pnpm!config.writer@1100.0.21.md | 7 -- .../changelogs/@pnpm!constants@1101.0.0.md | 59 ---------- .../changelogs/@pnpm!core-loggers@1100.3.2.md | 6 - .../@pnpm!crypto.integrity@1100.0.3.md | 6 - .../@pnpm!crypto.shasums-file@1100.1.5.md | 6 - .../@pnpm!deps.compliance.audit@1101.0.29.md | 14 --- ...@pnpm!deps.compliance.commands@1101.6.0.md | 80 -------------- ...eps.compliance.license-scanner@1100.1.0.md | 71 ------------ .../@pnpm!deps.compliance.sbom@1100.4.0.md | 73 ------------- .../@pnpm!deps.github-actions@1100.1.3.md | 7 -- .../@pnpm!deps.graph-builder@1100.2.0.md | 72 ------------ .../@pnpm!deps.graph-hasher@1100.2.15.md | 11 -- ...@pnpm!deps.inspection.commands@1100.7.3.md | 26 ----- .../@pnpm!deps.inspection.list@1100.1.0.md | 64 ----------- ...pnpm!deps.inspection.outdated@1100.1.23.md | 17 --- ...deps.inspection.peers-checker@1100.0.26.md | 11 -- ...pection.peers-issues-renderer@1100.0.12.md | 6 - ...m!deps.inspection.tree-builder@1100.1.0.md | 69 ------------ .../changelogs/@pnpm!deps.path@1100.1.0.md | 60 ---------- ...pnpm!deps.security.signatures@1101.2.10.md | 7 -- .../changelogs/@pnpm!deps.status@1100.1.15.md | 18 --- .../@pnpm!engine.pm.commands@1101.3.2.md | 31 ------ ...m!engine.runtime.bun-resolver@1102.0.14.md | 12 -- ...@pnpm!engine.runtime.commands@1100.1.19.md | 11 -- ...!engine.runtime.deno-resolver@1102.0.14.md | 12 -- ...!engine.runtime.node-resolver@1101.1.21.md | 10 -- ...!engine.runtime.system-version@1100.0.9.md | 7 -- .changeset/changelogs/@pnpm!error@1100.1.1.md | 6 - .../@pnpm!exec.commands@1100.4.7.md | 23 ---- .../@pnpm!exec.lifecycle@1100.1.11.md | 12 -- .../@pnpm!exec.prepare-package@1100.0.30.md | 9 -- .../@pnpm!fetching.binary-fetcher@1102.0.9.md | 8 -- ...pm!fetching.directory-fetcher@1100.0.28.md | 10 -- .../@pnpm!fetching.fetcher-base@1100.2.7.md | 7 -- .../@pnpm!fetching.git-fetcher@1102.0.12.md | 10 -- .../@pnpm!fetching.pick-fetcher@1100.1.6.md | 9 -- ...pnpm!fetching.tarball-fetcher@1102.0.12.md | 11 -- ...@pnpm!fs.indexed-pkg-importer@1100.0.24.md | 7 -- .../@pnpm!fs.symlink-dependency@1100.0.17.md | 7 -- .../@pnpm!global.commands@1100.0.43.md | 19 ---- .../@pnpm!global.packages@1100.0.16.md | 8 -- .../@pnpm!hooks.pnpmfile@1100.0.25.md | 11 -- .../@pnpm!hooks.read-package-hook@1100.2.2.md | 8 -- .../changelogs/@pnpm!hooks.types@1100.2.6.md | 9 -- .../@pnpm!installing.client@1100.3.2.md | 19 ---- .../@pnpm!installing.commands@1100.13.0.md | 102 ----------------- .../@pnpm!installing.context@1100.1.0.md | 68 ------------ .../@pnpm!installing.dedupe.check@1100.1.8.md | 8 -- ...pnpm!installing.deps-installer@1103.1.0.md | 103 ------------------ ...@pnpm!installing.deps-resolver@1101.1.0.md | 82 -------------- ...@pnpm!installing.deps-restorer@1102.3.0.md | 86 --------------- ...pnpm!installing.env-installer@1102.0.15.md | 28 ----- ...ing.linking.direct-dep-linker@1100.0.17.md | 7 -- ...pnpm!installing.linking.hoist@1100.0.25.md | 9 -- ...lling.linking.modules-cleaner@1100.1.18.md | 13 --- ...installing.linking.real-hoist@1100.1.12.md | 8 -- ...@pnpm!installing.modules-yaml@1100.0.15.md | 6 - ...m!installing.package-requester@1102.1.9.md | 17 --- ...talling.read-projects-context@1100.0.27.md | 9 -- ...npm!lockfile.detect-dep-types@1100.0.19.md | 8 -- .../@pnpm!lockfile.filtering@1100.2.2.md | 13 --- .../changelogs/@pnpm!lockfile.fs@1100.2.0.md | 66 ----------- ...kfile.make-dedicated-lockfile@1100.0.33.md | 12 -- .../@pnpm!lockfile.merger@1100.0.19.md | 7 -- ...m!lockfile.preferred-versions@1100.0.28.md | 9 -- .../@pnpm!lockfile.pruner@1100.0.19.md | 9 -- ...npm!lockfile.settings-checker@1100.1.10.md | 8 -- .../@pnpm!lockfile.to-pnp@1100.1.12.md | 10 -- .../@pnpm!lockfile.types@1100.0.19.md | 7 -- .../@pnpm!lockfile.utils@1101.0.0.md | 69 ------------ .../@pnpm!lockfile.verification@1100.0.31.md | 12 -- .../@pnpm!lockfile.walker@1100.0.19.md | 8 -- .../@pnpm!modules-mounter.daemon@1100.0.36.md | 13 --- .../changelogs/@pnpm!napi@12.0.0-beta.4.md | 1 - .../changelogs/@pnpm!napi@12.0.0-rc.0.md | 9 ++ .../@pnpm!network.auth-header@1101.1.9.md | 7 -- .../@pnpm!network.fetch@1100.1.11.md | 8 -- .../@pnpm!network.web-auth@1101.4.1.md | 6 - .../@pnpm!object.property-path@1100.1.3.md | 6 - .../@pnpm!patching.apply-patch@1100.0.5.md | 6 - .../@pnpm!patching.commands@1100.1.20.md | 21 ---- .../@pnpm!patching.config@1100.0.15.md | 7 -- .../@pnpm!pkg-manifest.commands@1100.1.20.md | 10 -- .../@pnpm!pkg-manifest.reader@1100.0.15.md | 7 -- .../@pnpm!pkg-manifest.utils@1100.3.1.md | 8 -- .../changelogs/@pnpm!pnpr.client@1.3.10.md | 8 -- .../changelogs/@pnpm!prepare@1100.0.25.md | 7 -- .../@pnpm!registry-access.client@1100.1.13.md | 8 -- ...@pnpm!registry-access.commands@1100.5.8.md | 15 --- .../@pnpm!releasing.commands@1100.8.2.md | 33 ------ ...!releasing.exportable-manifest@1100.2.2.md | 10 -- .../@pnpm!releasing.versioning@1100.2.4.md | 8 -- ...pm!resolving.default-resolver@1100.3.23.md | 17 --- .../@pnpm!resolving.git-resolver@1100.1.15.md | 8 -- ...resolving.jsr-specifier-parser@1100.0.4.md | 6 - ...pnpm!resolving.local-resolver@1101.1.17.md | 9 -- .../@pnpm!resolving.npm-resolver@1103.1.0.md | 78 ------------- ....registry.pkg-metadata-filter@1100.0.15.md | 8 -- ...@pnpm!resolving.registry.types@1100.1.9.md | 6 - .../@pnpm!resolving.resolver-base@1101.1.0.md | 60 ---------- ...pm!resolving.tarball-resolver@1100.1.12.md | 6 - .../changelogs/@pnpm!store.cafs@1100.1.18.md | 9 -- .../@pnpm!store.commands@1100.0.41.md | 22 ---- ...pnpm!store.connection-manager@1100.3.15.md | 12 -- .../@pnpm!store.controller-types@1101.1.0.md | 62 ----------- .../@pnpm!store.controller@1102.0.11.md | 15 --- ...@pnpm!store.create-cafs-store@1100.0.24.md | 10 -- .../changelogs/@pnpm!store.index@1100.2.3.md | 6 - .../changelogs/@pnpm!store.path@1100.0.4.md | 7 -- .../@pnpm!store.pkg-finder@1100.0.28.md | 9 -- .../@pnpm!testing.temp-store@1100.1.24.md | 10 -- .../@pnpm!text.ordinal-comparator@1100.0.0.md | 5 - .changeset/changelogs/@pnpm!types@1101.9.0.md | 5 - .../changelogs/@pnpm!worker@1100.2.10.md | 12 -- .../@pnpm!workspace.commands@1100.1.34.md | 11 -- ...orkspace.injected-deps-syncer@1100.0.31.md | 12 -- ...space.project-manifest-reader@1100.0.23.md | 9 -- ...space.project-manifest-writer@1100.0.14.md | 6 - ...npm!workspace.projects-filter@1100.0.35.md | 9 -- ...pnpm!workspace.projects-graph@1100.0.31.md | 7 -- ...npm!workspace.projects-reader@1101.0.22.md | 9 -- ...npm!workspace.projects-sorter@1100.0.14.md | 6 - .../@pnpm!workspace.root-finder@1100.0.5.md | 6 - .../@pnpm!workspace.state@1100.0.36.md | 7 -- ...pace.workspace-manifest-reader@1100.1.5.md | 8 -- ...ace.workspace-manifest-writer@1100.0.21.md | 11 -- .../changelogs/pacquet@12.0.0-beta.4.md | 91 ---------------- .changeset/changelogs/pacquet@12.0.0-rc.0.md | 29 +++++ .changeset/changelogs/pnpm@11.20.0.md | 71 ------------ .../inline-string-and-npmrc-key-utils.md | 7 -- .changeset/ledger.yaml | 20 ++++ .changeset/rebuild-depath-name-traversal.md | 6 - pnpm/crates/config/src/defaults.rs | 2 +- pnpm/npm/napi/package.json | 2 +- pnpm/npm/pnpm/package.json | 2 +- 162 files changed, 61 insertions(+), 2931 deletions(-) delete mode 100644 .changeset/changelogs/@pnpm!assert-project@1100.0.25.md delete mode 100644 .changeset/changelogs/@pnpm!assert-store@1100.0.25.md delete mode 100644 .changeset/changelogs/@pnpm!auth.commands@1100.3.1.md delete mode 100644 .changeset/changelogs/@pnpm!bins.linker@1100.0.25.md delete mode 100644 .changeset/changelogs/@pnpm!bins.remover@1100.0.19.md delete mode 100644 .changeset/changelogs/@pnpm!bins.resolver@1100.0.14.md delete mode 100644 .changeset/changelogs/@pnpm!building.after-install@1102.0.15.md delete mode 100644 .changeset/changelogs/@pnpm!building.commands@1100.1.20.md delete mode 100644 .changeset/changelogs/@pnpm!building.during-install@1102.0.14.md delete mode 100644 .changeset/changelogs/@pnpm!building.pkg-requires-build@1100.0.14.md delete mode 100644 .changeset/changelogs/@pnpm!building.policy@1100.0.18.md delete mode 100644 .changeset/changelogs/@pnpm!cache.api@1100.0.36.md delete mode 100644 .changeset/changelogs/@pnpm!cache.commands@1100.0.37.md delete mode 100644 .changeset/changelogs/@pnpm!catalogs.config@1100.0.4.md delete mode 100644 .changeset/changelogs/@pnpm!cli.commands@1100.0.35.md delete mode 100644 .changeset/changelogs/@pnpm!cli.default-reporter@1100.3.15.md delete mode 100644 .changeset/changelogs/@pnpm!cli.meta@1100.0.14.md delete mode 100644 .changeset/changelogs/@pnpm!cli.parse-cli-args@1100.1.8.md delete mode 100644 .changeset/changelogs/@pnpm!cli.utils@1101.0.22.md delete mode 100644 .changeset/changelogs/@pnpm!config.commands@1100.0.36.md delete mode 100644 .changeset/changelogs/@pnpm!config.normalize-registries@1100.1.0.md delete mode 100644 .changeset/changelogs/@pnpm!config.package-is-installable@1100.1.2.md delete mode 100644 .changeset/changelogs/@pnpm!config.parse-overrides@1100.1.2.md delete mode 100644 .changeset/changelogs/@pnpm!config.pick-registry-for-package@1100.1.0.md delete mode 100644 .changeset/changelogs/@pnpm!config.reader@1101.16.0.md delete mode 100644 .changeset/changelogs/@pnpm!config.registry-auth-key@1100.0.0.md delete mode 100644 .changeset/changelogs/@pnpm!config.version-policy@1100.1.12.md delete mode 100644 .changeset/changelogs/@pnpm!config.writer@1100.0.21.md delete mode 100644 .changeset/changelogs/@pnpm!constants@1101.0.0.md delete mode 100644 .changeset/changelogs/@pnpm!core-loggers@1100.3.2.md delete mode 100644 .changeset/changelogs/@pnpm!crypto.integrity@1100.0.3.md delete mode 100644 .changeset/changelogs/@pnpm!crypto.shasums-file@1100.1.5.md delete mode 100644 .changeset/changelogs/@pnpm!deps.compliance.audit@1101.0.29.md delete mode 100644 .changeset/changelogs/@pnpm!deps.compliance.commands@1101.6.0.md delete mode 100644 .changeset/changelogs/@pnpm!deps.compliance.license-scanner@1100.1.0.md delete mode 100644 .changeset/changelogs/@pnpm!deps.compliance.sbom@1100.4.0.md delete mode 100644 .changeset/changelogs/@pnpm!deps.github-actions@1100.1.3.md delete mode 100644 .changeset/changelogs/@pnpm!deps.graph-builder@1100.2.0.md delete mode 100644 .changeset/changelogs/@pnpm!deps.graph-hasher@1100.2.15.md delete mode 100644 .changeset/changelogs/@pnpm!deps.inspection.commands@1100.7.3.md delete mode 100644 .changeset/changelogs/@pnpm!deps.inspection.list@1100.1.0.md delete mode 100644 .changeset/changelogs/@pnpm!deps.inspection.outdated@1100.1.23.md delete mode 100644 .changeset/changelogs/@pnpm!deps.inspection.peers-checker@1100.0.26.md delete mode 100644 .changeset/changelogs/@pnpm!deps.inspection.peers-issues-renderer@1100.0.12.md delete mode 100644 .changeset/changelogs/@pnpm!deps.inspection.tree-builder@1100.1.0.md delete mode 100644 .changeset/changelogs/@pnpm!deps.path@1100.1.0.md delete mode 100644 .changeset/changelogs/@pnpm!deps.security.signatures@1101.2.10.md delete mode 100644 .changeset/changelogs/@pnpm!deps.status@1100.1.15.md delete mode 100644 .changeset/changelogs/@pnpm!engine.pm.commands@1101.3.2.md delete mode 100644 .changeset/changelogs/@pnpm!engine.runtime.bun-resolver@1102.0.14.md delete mode 100644 .changeset/changelogs/@pnpm!engine.runtime.commands@1100.1.19.md delete mode 100644 .changeset/changelogs/@pnpm!engine.runtime.deno-resolver@1102.0.14.md delete mode 100644 .changeset/changelogs/@pnpm!engine.runtime.node-resolver@1101.1.21.md delete mode 100644 .changeset/changelogs/@pnpm!engine.runtime.system-version@1100.0.9.md delete mode 100644 .changeset/changelogs/@pnpm!error@1100.1.1.md delete mode 100644 .changeset/changelogs/@pnpm!exec.commands@1100.4.7.md delete mode 100644 .changeset/changelogs/@pnpm!exec.lifecycle@1100.1.11.md delete mode 100644 .changeset/changelogs/@pnpm!exec.prepare-package@1100.0.30.md delete mode 100644 .changeset/changelogs/@pnpm!fetching.binary-fetcher@1102.0.9.md delete mode 100644 .changeset/changelogs/@pnpm!fetching.directory-fetcher@1100.0.28.md delete mode 100644 .changeset/changelogs/@pnpm!fetching.fetcher-base@1100.2.7.md delete mode 100644 .changeset/changelogs/@pnpm!fetching.git-fetcher@1102.0.12.md delete mode 100644 .changeset/changelogs/@pnpm!fetching.pick-fetcher@1100.1.6.md delete mode 100644 .changeset/changelogs/@pnpm!fetching.tarball-fetcher@1102.0.12.md delete mode 100644 .changeset/changelogs/@pnpm!fs.indexed-pkg-importer@1100.0.24.md delete mode 100644 .changeset/changelogs/@pnpm!fs.symlink-dependency@1100.0.17.md delete mode 100644 .changeset/changelogs/@pnpm!global.commands@1100.0.43.md delete mode 100644 .changeset/changelogs/@pnpm!global.packages@1100.0.16.md delete mode 100644 .changeset/changelogs/@pnpm!hooks.pnpmfile@1100.0.25.md delete mode 100644 .changeset/changelogs/@pnpm!hooks.read-package-hook@1100.2.2.md delete mode 100644 .changeset/changelogs/@pnpm!hooks.types@1100.2.6.md delete mode 100644 .changeset/changelogs/@pnpm!installing.client@1100.3.2.md delete mode 100644 .changeset/changelogs/@pnpm!installing.commands@1100.13.0.md delete mode 100644 .changeset/changelogs/@pnpm!installing.context@1100.1.0.md delete mode 100644 .changeset/changelogs/@pnpm!installing.dedupe.check@1100.1.8.md delete mode 100644 .changeset/changelogs/@pnpm!installing.deps-installer@1103.1.0.md delete mode 100644 .changeset/changelogs/@pnpm!installing.deps-resolver@1101.1.0.md delete mode 100644 .changeset/changelogs/@pnpm!installing.deps-restorer@1102.3.0.md delete mode 100644 .changeset/changelogs/@pnpm!installing.env-installer@1102.0.15.md delete mode 100644 .changeset/changelogs/@pnpm!installing.linking.direct-dep-linker@1100.0.17.md delete mode 100644 .changeset/changelogs/@pnpm!installing.linking.hoist@1100.0.25.md delete mode 100644 .changeset/changelogs/@pnpm!installing.linking.modules-cleaner@1100.1.18.md delete mode 100644 .changeset/changelogs/@pnpm!installing.linking.real-hoist@1100.1.12.md delete mode 100644 .changeset/changelogs/@pnpm!installing.modules-yaml@1100.0.15.md delete mode 100644 .changeset/changelogs/@pnpm!installing.package-requester@1102.1.9.md delete mode 100644 .changeset/changelogs/@pnpm!installing.read-projects-context@1100.0.27.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.detect-dep-types@1100.0.19.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.filtering@1100.2.2.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.fs@1100.2.0.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.make-dedicated-lockfile@1100.0.33.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.merger@1100.0.19.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.preferred-versions@1100.0.28.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.pruner@1100.0.19.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.settings-checker@1100.1.10.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.to-pnp@1100.1.12.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.types@1100.0.19.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.utils@1101.0.0.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.verification@1100.0.31.md delete mode 100644 .changeset/changelogs/@pnpm!lockfile.walker@1100.0.19.md delete mode 100644 .changeset/changelogs/@pnpm!modules-mounter.daemon@1100.0.36.md delete mode 100644 .changeset/changelogs/@pnpm!napi@12.0.0-beta.4.md create mode 100644 .changeset/changelogs/@pnpm!napi@12.0.0-rc.0.md delete mode 100644 .changeset/changelogs/@pnpm!network.auth-header@1101.1.9.md delete mode 100644 .changeset/changelogs/@pnpm!network.fetch@1100.1.11.md delete mode 100644 .changeset/changelogs/@pnpm!network.web-auth@1101.4.1.md delete mode 100644 .changeset/changelogs/@pnpm!object.property-path@1100.1.3.md delete mode 100644 .changeset/changelogs/@pnpm!patching.apply-patch@1100.0.5.md delete mode 100644 .changeset/changelogs/@pnpm!patching.commands@1100.1.20.md delete mode 100644 .changeset/changelogs/@pnpm!patching.config@1100.0.15.md delete mode 100644 .changeset/changelogs/@pnpm!pkg-manifest.commands@1100.1.20.md delete mode 100644 .changeset/changelogs/@pnpm!pkg-manifest.reader@1100.0.15.md delete mode 100644 .changeset/changelogs/@pnpm!pkg-manifest.utils@1100.3.1.md delete mode 100644 .changeset/changelogs/@pnpm!pnpr.client@1.3.10.md delete mode 100644 .changeset/changelogs/@pnpm!prepare@1100.0.25.md delete mode 100644 .changeset/changelogs/@pnpm!registry-access.client@1100.1.13.md delete mode 100644 .changeset/changelogs/@pnpm!registry-access.commands@1100.5.8.md delete mode 100644 .changeset/changelogs/@pnpm!releasing.commands@1100.8.2.md delete mode 100644 .changeset/changelogs/@pnpm!releasing.exportable-manifest@1100.2.2.md delete mode 100644 .changeset/changelogs/@pnpm!releasing.versioning@1100.2.4.md delete mode 100644 .changeset/changelogs/@pnpm!resolving.default-resolver@1100.3.23.md delete mode 100644 .changeset/changelogs/@pnpm!resolving.git-resolver@1100.1.15.md delete mode 100644 .changeset/changelogs/@pnpm!resolving.jsr-specifier-parser@1100.0.4.md delete mode 100644 .changeset/changelogs/@pnpm!resolving.local-resolver@1101.1.17.md delete mode 100644 .changeset/changelogs/@pnpm!resolving.npm-resolver@1103.1.0.md delete mode 100644 .changeset/changelogs/@pnpm!resolving.registry.pkg-metadata-filter@1100.0.15.md delete mode 100644 .changeset/changelogs/@pnpm!resolving.registry.types@1100.1.9.md delete mode 100644 .changeset/changelogs/@pnpm!resolving.resolver-base@1101.1.0.md delete mode 100644 .changeset/changelogs/@pnpm!resolving.tarball-resolver@1100.1.12.md delete mode 100644 .changeset/changelogs/@pnpm!store.cafs@1100.1.18.md delete mode 100644 .changeset/changelogs/@pnpm!store.commands@1100.0.41.md delete mode 100644 .changeset/changelogs/@pnpm!store.connection-manager@1100.3.15.md delete mode 100644 .changeset/changelogs/@pnpm!store.controller-types@1101.1.0.md delete mode 100644 .changeset/changelogs/@pnpm!store.controller@1102.0.11.md delete mode 100644 .changeset/changelogs/@pnpm!store.create-cafs-store@1100.0.24.md delete mode 100644 .changeset/changelogs/@pnpm!store.index@1100.2.3.md delete mode 100644 .changeset/changelogs/@pnpm!store.path@1100.0.4.md delete mode 100644 .changeset/changelogs/@pnpm!store.pkg-finder@1100.0.28.md delete mode 100644 .changeset/changelogs/@pnpm!testing.temp-store@1100.1.24.md delete mode 100644 .changeset/changelogs/@pnpm!text.ordinal-comparator@1100.0.0.md delete mode 100644 .changeset/changelogs/@pnpm!types@1101.9.0.md delete mode 100644 .changeset/changelogs/@pnpm!worker@1100.2.10.md delete mode 100644 .changeset/changelogs/@pnpm!workspace.commands@1100.1.34.md delete mode 100644 .changeset/changelogs/@pnpm!workspace.injected-deps-syncer@1100.0.31.md delete mode 100644 .changeset/changelogs/@pnpm!workspace.project-manifest-reader@1100.0.23.md delete mode 100644 .changeset/changelogs/@pnpm!workspace.project-manifest-writer@1100.0.14.md delete mode 100644 .changeset/changelogs/@pnpm!workspace.projects-filter@1100.0.35.md delete mode 100644 .changeset/changelogs/@pnpm!workspace.projects-graph@1100.0.31.md delete mode 100644 .changeset/changelogs/@pnpm!workspace.projects-reader@1101.0.22.md delete mode 100644 .changeset/changelogs/@pnpm!workspace.projects-sorter@1100.0.14.md delete mode 100644 .changeset/changelogs/@pnpm!workspace.root-finder@1100.0.5.md delete mode 100644 .changeset/changelogs/@pnpm!workspace.state@1100.0.36.md delete mode 100644 .changeset/changelogs/@pnpm!workspace.workspace-manifest-reader@1100.1.5.md delete mode 100644 .changeset/changelogs/@pnpm!workspace.workspace-manifest-writer@1100.0.21.md delete mode 100644 .changeset/changelogs/pacquet@12.0.0-beta.4.md create mode 100644 .changeset/changelogs/pacquet@12.0.0-rc.0.md delete mode 100644 .changeset/changelogs/pnpm@11.20.0.md delete mode 100644 .changeset/inline-string-and-npmrc-key-utils.md delete mode 100644 .changeset/rebuild-depath-name-traversal.md diff --git a/.changeset/changelogs/@pnpm!assert-project@1100.0.25.md b/.changeset/changelogs/@pnpm!assert-project@1100.0.25.md deleted file mode 100644 index 3a7740edb4..0000000000 --- a/.changeset/changelogs/@pnpm!assert-project@1100.0.25.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1100.0.25 - -### Patch Changes - -- Updated dependencies: - - @pnpm/assert-store@1100.0.25 - - @pnpm/constants@1101.0.0 - - @pnpm/installing.modules-yaml@1100.0.15 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!assert-store@1100.0.25.md b/.changeset/changelogs/@pnpm!assert-store@1100.0.25.md deleted file mode 100644 index ea7d8b5173..0000000000 --- a/.changeset/changelogs/@pnpm!assert-store@1100.0.25.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.25 - -### Patch Changes - -- Updated dependencies: - - @pnpm/store.cafs@1100.1.18 - - @pnpm/store.index@1100.2.3 diff --git a/.changeset/changelogs/@pnpm!auth.commands@1100.3.1.md b/.changeset/changelogs/@pnpm!auth.commands@1100.3.1.md deleted file mode 100644 index 42a2cfa4b2..0000000000 --- a/.changeset/changelogs/@pnpm!auth.commands@1100.3.1.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1100.3.1 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.reader@1101.16.0 - - @pnpm/error@1100.1.1 - - @pnpm/network.fetch@1100.1.11 - - @pnpm/network.web-auth@1101.4.1 - - @pnpm/registry-access.client@1100.1.13 diff --git a/.changeset/changelogs/@pnpm!bins.linker@1100.0.25.md b/.changeset/changelogs/@pnpm!bins.linker@1100.0.25.md deleted file mode 100644 index e907c6fd7b..0000000000 --- a/.changeset/changelogs/@pnpm!bins.linker@1100.0.25.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1100.0.25 - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.resolver@1100.0.14 - - @pnpm/error@1100.1.1 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/pkg-manifest.utils@1100.3.1 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!bins.remover@1100.0.19.md b/.changeset/changelogs/@pnpm!bins.remover@1100.0.19.md deleted file mode 100644 index 40a0037c00..0000000000 --- a/.changeset/changelogs/@pnpm!bins.remover@1100.0.19.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1100.0.19 - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.resolver@1100.0.14 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!bins.resolver@1100.0.14.md b/.changeset/changelogs/@pnpm!bins.resolver@1100.0.14.md deleted file mode 100644 index a2bdeeccff..0000000000 --- a/.changeset/changelogs/@pnpm!bins.resolver@1100.0.14.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.14 - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!building.after-install@1102.0.15.md b/.changeset/changelogs/@pnpm!building.after-install@1102.0.15.md deleted file mode 100644 index 94c206bfba..0000000000 --- a/.changeset/changelogs/@pnpm!building.after-install@1102.0.15.md +++ /dev/null @@ -1,30 +0,0 @@ -## 1102.0.15 - -### Patch Changes - -- Security: `pnpm rebuild` now refuses a lockfile whose `packages` key carries a path traversal in the package name (e.g. `../../../escaped@1.0.0`), instead of running that package's lifecycle scripts and linking its bins in a directory outside the virtual store. Such a name is rejected with `ERR_PNPM_INVALID_DEPENDENCY_NAME`. - -- Updated dependencies: - - @pnpm/bins.linker@1100.0.25 - - @pnpm/building.pkg-requires-build@1100.0.14 - - @pnpm/building.policy@1100.0.18 - - @pnpm/config.normalize-registries@1100.1.0 - - @pnpm/config.reader@1101.16.0 - - @pnpm/constants@1101.0.0 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.graph-hasher@1100.2.15 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/exec.lifecycle@1100.1.11 - - @pnpm/fs.symlink-dependency@1100.0.17 - - @pnpm/installing.context@1100.1.0 - - @pnpm/installing.modules-yaml@1100.0.15 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/lockfile.walker@1100.0.19 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/store.cafs@1100.1.18 - - @pnpm/store.connection-manager@1100.3.15 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/store.index@1100.2.3 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!building.commands@1100.1.20.md b/.changeset/changelogs/@pnpm!building.commands@1100.1.20.md deleted file mode 100644 index c3982dc19b..0000000000 --- a/.changeset/changelogs/@pnpm!building.commands@1100.1.20.md +++ /dev/null @@ -1,17 +0,0 @@ -## 1100.1.20 - -### Patch Changes - -- Updated dependencies: - - @pnpm/building.after-install@1102.0.15 - - @pnpm/building.policy@1100.0.18 - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.reader@1101.16.0 - - @pnpm/config.writer@1100.0.21 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/installing.commands@1100.13.0 - - @pnpm/installing.modules-yaml@1100.0.15 - - @pnpm/store.connection-manager@1100.3.15 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.projects-sorter@1100.0.14 diff --git a/.changeset/changelogs/@pnpm!building.during-install@1102.0.14.md b/.changeset/changelogs/@pnpm!building.during-install@1102.0.14.md deleted file mode 100644 index 96c15cf1db..0000000000 --- a/.changeset/changelogs/@pnpm!building.during-install@1102.0.14.md +++ /dev/null @@ -1,16 +0,0 @@ -## 1102.0.14 - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.linker@1100.0.25 - - @pnpm/config.reader@1101.16.0 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.graph-hasher@1100.2.15 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/exec.lifecycle@1100.1.11 - - @pnpm/patching.apply-patch@1100.0.5 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!building.pkg-requires-build@1100.0.14.md b/.changeset/changelogs/@pnpm!building.pkg-requires-build@1100.0.14.md deleted file mode 100644 index a2bdeeccff..0000000000 --- a/.changeset/changelogs/@pnpm!building.pkg-requires-build@1100.0.14.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.14 - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!building.policy@1100.0.18.md b/.changeset/changelogs/@pnpm!building.policy@1100.0.18.md deleted file mode 100644 index 246d22cabf..0000000000 --- a/.changeset/changelogs/@pnpm!building.policy@1100.0.18.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.0.18 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.version-policy@1100.1.12 - - @pnpm/deps.path@1100.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!cache.api@1100.0.36.md b/.changeset/changelogs/@pnpm!cache.api@1100.0.36.md deleted file mode 100644 index d020e77326..0000000000 --- a/.changeset/changelogs/@pnpm!cache.api@1100.0.36.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1100.0.36 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.reader@1101.16.0 - - @pnpm/constants@1101.0.0 - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/store.cafs@1100.1.18 - - @pnpm/store.index@1100.2.3 diff --git a/.changeset/changelogs/@pnpm!cache.commands@1100.0.37.md b/.changeset/changelogs/@pnpm!cache.commands@1100.0.37.md deleted file mode 100644 index 2a943ed022..0000000000 --- a/.changeset/changelogs/@pnpm!cache.commands@1100.0.37.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1100.0.37 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cache.api@1100.0.36 - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.reader@1101.16.0 - - @pnpm/constants@1101.0.0 - - @pnpm/error@1100.1.1 - - @pnpm/store.path@1100.0.4 diff --git a/.changeset/changelogs/@pnpm!catalogs.config@1100.0.4.md b/.changeset/changelogs/@pnpm!catalogs.config@1100.0.4.md deleted file mode 100644 index 5f50fdac01..0000000000 --- a/.changeset/changelogs/@pnpm!catalogs.config@1100.0.4.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.4 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 diff --git a/.changeset/changelogs/@pnpm!cli.commands@1100.0.35.md b/.changeset/changelogs/@pnpm!cli.commands@1100.0.35.md deleted file mode 100644 index 136261c575..0000000000 --- a/.changeset/changelogs/@pnpm!cli.commands@1100.0.35.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.35 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.reader@1101.16.0 diff --git a/.changeset/changelogs/@pnpm!cli.default-reporter@1100.3.15.md b/.changeset/changelogs/@pnpm!cli.default-reporter@1100.3.15.md deleted file mode 100644 index 42b7294d0f..0000000000 --- a/.changeset/changelogs/@pnpm!cli.default-reporter@1100.3.15.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1100.3.15 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.meta@1100.0.14 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.inspection.peers-issues-renderer@1100.0.12 - - @pnpm/error@1100.1.1 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!cli.meta@1100.0.14.md b/.changeset/changelogs/@pnpm!cli.meta@1100.0.14.md deleted file mode 100644 index a2bdeeccff..0000000000 --- a/.changeset/changelogs/@pnpm!cli.meta@1100.0.14.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.14 - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!cli.parse-cli-args@1100.1.8.md b/.changeset/changelogs/@pnpm!cli.parse-cli-args@1100.1.8.md deleted file mode 100644 index f23d96f333..0000000000 --- a/.changeset/changelogs/@pnpm!cli.parse-cli-args@1100.1.8.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.1.8 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/workspace.root-finder@1100.0.5 diff --git a/.changeset/changelogs/@pnpm!cli.utils@1101.0.22.md b/.changeset/changelogs/@pnpm!cli.utils@1101.0.22.md deleted file mode 100644 index 320936c757..0000000000 --- a/.changeset/changelogs/@pnpm!cli.utils@1101.0.22.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1101.0.22 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.meta@1100.0.14 - - @pnpm/config.package-is-installable@1100.1.2 - - @pnpm/error@1100.1.1 - - @pnpm/pkg-manifest.utils@1100.3.1 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!config.commands@1100.0.36.md b/.changeset/changelogs/@pnpm!config.commands@1100.0.36.md deleted file mode 100644 index b99d582eb7..0000000000 --- a/.changeset/changelogs/@pnpm!config.commands@1100.0.36.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1100.0.36 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.reader@1101.16.0 - - @pnpm/constants@1101.0.0 - - @pnpm/error@1100.1.1 - - @pnpm/object.property-path@1100.1.3 - - @pnpm/workspace.workspace-manifest-writer@1100.0.21 diff --git a/.changeset/changelogs/@pnpm!config.normalize-registries@1100.1.0.md b/.changeset/changelogs/@pnpm!config.normalize-registries@1100.1.0.md deleted file mode 100644 index dc51859425..0000000000 --- a/.changeset/changelogs/@pnpm!config.normalize-registries@1100.1.0.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1100.1.0 - -### Minor Changes - -- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs. - -### Patch Changes - -- Updated dependencies: - - @pnpm/constants@1101.0.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!config.package-is-installable@1100.1.2.md b/.changeset/changelogs/@pnpm!config.package-is-installable@1100.1.2.md deleted file mode 100644 index 99a8b2c57b..0000000000 --- a/.changeset/changelogs/@pnpm!config.package-is-installable@1100.1.2.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1100.1.2 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.meta@1100.0.14 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/engine.runtime.system-version@1100.0.9 - - @pnpm/error@1100.1.1 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!config.parse-overrides@1100.1.2.md b/.changeset/changelogs/@pnpm!config.parse-overrides@1100.1.2.md deleted file mode 100644 index 6eb1872d68..0000000000 --- a/.changeset/changelogs/@pnpm!config.parse-overrides@1100.1.2.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.1.2 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 diff --git a/.changeset/changelogs/@pnpm!config.pick-registry-for-package@1100.1.0.md b/.changeset/changelogs/@pnpm!config.pick-registry-for-package@1100.1.0.md deleted file mode 100644 index 571d3b37f5..0000000000 --- a/.changeset/changelogs/@pnpm!config.pick-registry-for-package@1100.1.0.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1100.1.0 - -### Minor Changes - -- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs. - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!config.reader@1101.16.0.md b/.changeset/changelogs/@pnpm!config.reader@1101.16.0.md deleted file mode 100644 index e975de3719..0000000000 --- a/.changeset/changelogs/@pnpm!config.reader@1101.16.0.md +++ /dev/null @@ -1,73 +0,0 @@ -## 1101.16.0 - -### Minor Changes - -- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs. - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- An empty `http-proxy`, `https-proxy`, `proxy`, or `no-proxy` value — from the `.npmrc`, `pnpm-workspace.yaml`, the CLI, or the `HTTP_PROXY` / `HTTPS_PROXY` / `PROXY` / `NO_PROXY` environment variables — no longer fails the install with `ERR_PNPM_INVALID_PROXY`. Empty settings read as unset, so a shell exporting `HTTP_PROXY=` disables the proxy, and an empty `proxy=` in the `.npmrc` no longer suppresses `HTTPS_PROXY` [#13533](https://github.com/pnpm/pnpm/issues/13533). - - `proxy=false` in the `.npmrc` or `proxy: false` in `pnpm-workspace.yaml` now turns proxying off instead of being read as a proxy host named `false`. `false` and `null` on `https-proxy` / `http-proxy` / `no-proxy` read as unset, and on the command line they are ordinary host names, since a flag carries its value verbatim. - -- Updated dependencies: - - @pnpm/catalogs.config@1100.0.4 - - @pnpm/constants@1101.0.0 - - @pnpm/error@1100.1.1 - - @pnpm/hooks.pnpmfile@1100.0.25 - - @pnpm/pkg-manifest.utils@1100.3.1 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 - - @pnpm/workspace.workspace-manifest-reader@1100.1.5 diff --git a/.changeset/changelogs/@pnpm!config.registry-auth-key@1100.0.0.md b/.changeset/changelogs/@pnpm!config.registry-auth-key@1100.0.0.md deleted file mode 100644 index 780f6947ef..0000000000 --- a/.changeset/changelogs/@pnpm!config.registry-auth-key@1100.0.0.md +++ /dev/null @@ -1,5 +0,0 @@ -## 1100.0.0 - -### Patch Changes - -- `lexCompare` and `nerfDart` are now published as `@pnpm/text.ordinal-comparator` and `@pnpm/config.registry-auth-key`. Use these instead of `@pnpm/util.lex-comparator` and `@pnpm/config.nerf-dart`. diff --git a/.changeset/changelogs/@pnpm!config.version-policy@1100.1.12.md b/.changeset/changelogs/@pnpm!config.version-policy@1100.1.12.md deleted file mode 100644 index 2149dbef66..0000000000 --- a/.changeset/changelogs/@pnpm!config.version-policy@1100.1.12.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.1.12 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!config.writer@1100.0.21.md b/.changeset/changelogs/@pnpm!config.writer@1100.0.21.md deleted file mode 100644 index 4a06a5b643..0000000000 --- a/.changeset/changelogs/@pnpm!config.writer@1100.0.21.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.21 - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 - - @pnpm/workspace.workspace-manifest-writer@1100.0.21 diff --git a/.changeset/changelogs/@pnpm!constants@1101.0.0.md b/.changeset/changelogs/@pnpm!constants@1101.0.0.md deleted file mode 100644 index 5b5cc99bf0..0000000000 --- a/.changeset/changelogs/@pnpm!constants@1101.0.0.md +++ /dev/null @@ -1,59 +0,0 @@ -## 1101.0.0 - -### Major Changes - -- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs. - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. diff --git a/.changeset/changelogs/@pnpm!core-loggers@1100.3.2.md b/.changeset/changelogs/@pnpm!core-loggers@1100.3.2.md deleted file mode 100644 index 988a63cc80..0000000000 --- a/.changeset/changelogs/@pnpm!core-loggers@1100.3.2.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.3.2 - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!crypto.integrity@1100.0.3.md b/.changeset/changelogs/@pnpm!crypto.integrity@1100.0.3.md deleted file mode 100644 index 536611d361..0000000000 --- a/.changeset/changelogs/@pnpm!crypto.integrity@1100.0.3.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.3 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 diff --git a/.changeset/changelogs/@pnpm!crypto.shasums-file@1100.1.5.md b/.changeset/changelogs/@pnpm!crypto.shasums-file@1100.1.5.md deleted file mode 100644 index 65449dab07..0000000000 --- a/.changeset/changelogs/@pnpm!crypto.shasums-file@1100.1.5.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.1.5 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 diff --git a/.changeset/changelogs/@pnpm!deps.compliance.audit@1101.0.29.md b/.changeset/changelogs/@pnpm!deps.compliance.audit@1101.0.29.md deleted file mode 100644 index 32445a6b09..0000000000 --- a/.changeset/changelogs/@pnpm!deps.compliance.audit@1101.0.29.md +++ /dev/null @@ -1,14 +0,0 @@ -## 1101.0.29 - -### Patch Changes - -- Updated dependencies: - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/lockfile.detect-dep-types@1100.0.19 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/lockfile.walker@1100.0.19 - - @pnpm/network.fetch@1100.1.11 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!deps.compliance.commands@1101.6.0.md b/.changeset/changelogs/@pnpm!deps.compliance.commands@1101.6.0.md deleted file mode 100644 index ee4b015538..0000000000 --- a/.changeset/changelogs/@pnpm!deps.compliance.commands@1101.6.0.md +++ /dev/null @@ -1,80 +0,0 @@ -## 1101.6.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.meta@1100.0.14 - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.pick-registry-for-package@1100.1.0 - - @pnpm/config.reader@1101.16.0 - - @pnpm/config.version-policy@1100.1.12 - - @pnpm/config.writer@1100.0.21 - - @pnpm/constants@1101.0.0 - - @pnpm/deps.compliance.audit@1101.0.29 - - @pnpm/deps.compliance.license-scanner@1100.1.0 - - @pnpm/deps.compliance.sbom@1100.4.0 - - @pnpm/deps.security.signatures@1101.2.10 - - @pnpm/error@1100.1.1 - - @pnpm/installing.commands@1100.13.0 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/lockfile.walker@1100.0.19 - - @pnpm/network.auth-header@1101.1.9 - - @pnpm/store.path@1100.0.4 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!deps.compliance.license-scanner@1100.1.0.md b/.changeset/changelogs/@pnpm!deps.compliance.license-scanner@1100.1.0.md deleted file mode 100644 index f9d7fc6c5e..0000000000 --- a/.changeset/changelogs/@pnpm!deps.compliance.license-scanner@1100.1.0.md +++ /dev/null @@ -1,71 +0,0 @@ -## 1100.1.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.package-is-installable@1100.1.2 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/lockfile.detect-dep-types@1100.0.19 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/lockfile.walker@1100.0.19 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/store.index@1100.2.3 - - @pnpm/store.pkg-finder@1100.0.28 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!deps.compliance.sbom@1100.4.0.md b/.changeset/changelogs/@pnpm!deps.compliance.sbom@1100.4.0.md deleted file mode 100644 index 29d4136660..0000000000 --- a/.changeset/changelogs/@pnpm!deps.compliance.sbom@1100.4.0.md +++ /dev/null @@ -1,73 +0,0 @@ -## 1100.4.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs. - -- Updated dependencies: - - @pnpm/config.normalize-registries@1100.1.0 - - @pnpm/constants@1101.0.0 - - @pnpm/error@1100.1.1 - - @pnpm/lockfile.detect-dep-types@1100.0.19 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/lockfile.walker@1100.0.19 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/store.index@1100.2.3 - - @pnpm/store.pkg-finder@1100.0.28 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!deps.github-actions@1100.1.3.md b/.changeset/changelogs/@pnpm!deps.github-actions@1100.1.3.md deleted file mode 100644 index 29b68aec08..0000000000 --- a/.changeset/changelogs/@pnpm!deps.github-actions@1100.1.3.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.1.3 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/resolving.git-resolver@1100.1.15 diff --git a/.changeset/changelogs/@pnpm!deps.graph-builder@1100.2.0.md b/.changeset/changelogs/@pnpm!deps.graph-builder@1100.2.0.md deleted file mode 100644 index bae7a94ab2..0000000000 --- a/.changeset/changelogs/@pnpm!deps.graph-builder@1100.2.0.md +++ /dev/null @@ -1,72 +0,0 @@ -## 1100.2.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.package-is-installable@1100.1.2 - - @pnpm/constants@1101.0.0 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.graph-hasher@1100.2.15 - - @pnpm/deps.path@1100.1.0 - - @pnpm/fs.symlink-dependency@1100.0.17 - - @pnpm/hooks.types@1100.2.6 - - @pnpm/installing.modules-yaml@1100.0.15 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/patching.config@1100.0.15 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!deps.graph-hasher@1100.2.15.md b/.changeset/changelogs/@pnpm!deps.graph-hasher@1100.2.15.md deleted file mode 100644 index b25498e789..0000000000 --- a/.changeset/changelogs/@pnpm!deps.graph-hasher@1100.2.15.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1100.2.15 - -### Patch Changes - -- Updated dependencies: - - @pnpm/deps.path@1100.1.0 - - @pnpm/engine.runtime.system-version@1100.0.9 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!deps.inspection.commands@1100.7.3.md b/.changeset/changelogs/@pnpm!deps.inspection.commands@1100.7.3.md deleted file mode 100644 index 03a286606b..0000000000 --- a/.changeset/changelogs/@pnpm!deps.inspection.commands@1100.7.3.md +++ /dev/null @@ -1,26 +0,0 @@ -## 1100.7.3 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.pick-registry-for-package@1100.1.0 - - @pnpm/config.reader@1101.16.0 - - @pnpm/deps.github-actions@1100.1.3 - - @pnpm/deps.inspection.list@1100.1.0 - - @pnpm/deps.inspection.outdated@1100.1.23 - - @pnpm/deps.inspection.peers-checker@1100.0.26 - - @pnpm/deps.inspection.peers-issues-renderer@1100.0.12 - - @pnpm/error@1100.1.1 - - @pnpm/global.commands@1100.0.43 - - @pnpm/global.packages@1100.0.16 - - @pnpm/installing.modules-yaml@1100.0.15 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/network.auth-header@1101.1.9 - - @pnpm/network.fetch@1100.1.11 - - @pnpm/resolving.default-resolver@1100.3.23 - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/resolving.registry.types@1100.1.9 - - @pnpm/store.path@1100.0.4 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!deps.inspection.list@1100.1.0.md b/.changeset/changelogs/@pnpm!deps.inspection.list@1100.1.0.md deleted file mode 100644 index 0c041f18c9..0000000000 --- a/.changeset/changelogs/@pnpm!deps.inspection.list@1100.1.0.md +++ /dev/null @@ -1,64 +0,0 @@ -## 1100.1.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/deps.inspection.tree-builder@1100.1.0 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!deps.inspection.outdated@1100.1.23.md b/.changeset/changelogs/@pnpm!deps.inspection.outdated@1100.1.23.md deleted file mode 100644 index 3a096068e4..0000000000 --- a/.changeset/changelogs/@pnpm!deps.inspection.outdated@1100.1.23.md +++ /dev/null @@ -1,17 +0,0 @@ -## 1100.1.23 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.parse-overrides@1100.1.2 - - @pnpm/config.version-policy@1100.1.12 - - @pnpm/constants@1101.0.0 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/hooks.read-package-hook@1100.2.2 - - @pnpm/installing.client@1100.3.2 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/pkg-manifest.utils@1100.3.1 - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!deps.inspection.peers-checker@1100.0.26.md b/.changeset/changelogs/@pnpm!deps.inspection.peers-checker@1100.0.26.md deleted file mode 100644 index 9bcd8a94ae..0000000000 --- a/.changeset/changelogs/@pnpm!deps.inspection.peers-checker@1100.0.26.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1100.0.26 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.parse-overrides@1100.1.2 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.walker@1100.0.19 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!deps.inspection.peers-issues-renderer@1100.0.12.md b/.changeset/changelogs/@pnpm!deps.inspection.peers-issues-renderer@1100.0.12.md deleted file mode 100644 index b85d66f259..0000000000 --- a/.changeset/changelogs/@pnpm!deps.inspection.peers-issues-renderer@1100.0.12.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.12 - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!deps.inspection.tree-builder@1100.1.0.md b/.changeset/changelogs/@pnpm!deps.inspection.tree-builder@1100.1.0.md deleted file mode 100644 index ebe605193a..0000000000 --- a/.changeset/changelogs/@pnpm!deps.inspection.tree-builder@1100.1.0.md +++ /dev/null @@ -1,69 +0,0 @@ -## 1100.1.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.normalize-registries@1100.1.0 - - @pnpm/deps.path@1100.1.0 - - @pnpm/installing.modules-yaml@1100.0.15 - - @pnpm/lockfile.detect-dep-types@1100.0.19 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/store.cafs@1100.1.18 - - @pnpm/store.index@1100.2.3 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!deps.path@1100.1.0.md b/.changeset/changelogs/@pnpm!deps.path@1100.1.0.md deleted file mode 100644 index d331eee129..0000000000 --- a/.changeset/changelogs/@pnpm!deps.path@1100.1.0.md +++ /dev/null @@ -1,60 +0,0 @@ -## 1100.1.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!deps.security.signatures@1101.2.10.md b/.changeset/changelogs/@pnpm!deps.security.signatures@1101.2.10.md deleted file mode 100644 index ff641d156c..0000000000 --- a/.changeset/changelogs/@pnpm!deps.security.signatures@1101.2.10.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1101.2.10 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/network.fetch@1100.1.11 diff --git a/.changeset/changelogs/@pnpm!deps.status@1100.1.15.md b/.changeset/changelogs/@pnpm!deps.status@1100.1.15.md deleted file mode 100644 index ada33bafea..0000000000 --- a/.changeset/changelogs/@pnpm!deps.status@1100.1.15.md +++ /dev/null @@ -1,18 +0,0 @@ -## 1100.1.15 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.parse-overrides@1100.1.2 - - @pnpm/config.reader@1101.16.0 - - @pnpm/constants@1101.0.0 - - @pnpm/error@1100.1.1 - - @pnpm/installing.context@1100.1.0 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.settings-checker@1100.1.10 - - @pnpm/lockfile.verification@1100.0.31 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.projects-reader@1101.0.22 - - @pnpm/workspace.state@1100.0.36 - - @pnpm/workspace.workspace-manifest-reader@1100.1.5 diff --git a/.changeset/changelogs/@pnpm!engine.pm.commands@1101.3.2.md b/.changeset/changelogs/@pnpm!engine.pm.commands@1101.3.2.md deleted file mode 100644 index 66f539a61f..0000000000 --- a/.changeset/changelogs/@pnpm!engine.pm.commands@1101.3.2.md +++ /dev/null @@ -1,31 +0,0 @@ -## 1101.3.2 - -### Patch Changes - -- The env lockfile no longer pins `@pnpm/exe` alongside `pnpm` when the wanted pnpm version is 12 or newer. From v12 the unscoped `pnpm` package is itself the native executable, so `@pnpm/exe` is not published for it and resolving it would fail. The engine identity check now verifies the native binary through whichever package ships it. - -- Updated dependencies: - - @pnpm/bins.linker@1100.0.25 - - @pnpm/building.policy@1100.0.18 - - @pnpm/cli.meta@1100.0.14 - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.pick-registry-for-package@1100.1.0 - - @pnpm/config.reader@1101.16.0 - - @pnpm/config.version-policy@1100.1.12 - - @pnpm/deps.graph-hasher@1100.2.15 - - @pnpm/deps.security.signatures@1101.2.10 - - @pnpm/error@1100.1.1 - - @pnpm/global.commands@1100.0.43 - - @pnpm/global.packages@1100.0.16 - - @pnpm/installing.client@1100.3.2 - - @pnpm/installing.deps-restorer@1102.3.0 - - @pnpm/installing.env-installer@1102.0.15 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/network.auth-header@1101.1.9 - - @pnpm/pkg-manifest.utils@1100.3.1 - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/store.connection-manager@1100.3.15 - - @pnpm/store.controller@1102.0.11 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!engine.runtime.bun-resolver@1102.0.14.md b/.changeset/changelogs/@pnpm!engine.runtime.bun-resolver@1102.0.14.md deleted file mode 100644 index 65e7b406cb..0000000000 --- a/.changeset/changelogs/@pnpm!engine.runtime.bun-resolver@1102.0.14.md +++ /dev/null @@ -1,12 +0,0 @@ -## 1102.0.14 - -### Patch Changes - -- Updated dependencies: - - @pnpm/crypto.shasums-file@1100.1.5 - - @pnpm/error@1100.1.1 - - @pnpm/fetching.binary-fetcher@1102.0.9 - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!engine.runtime.commands@1100.1.19.md b/.changeset/changelogs/@pnpm!engine.runtime.commands@1100.1.19.md deleted file mode 100644 index f1180aa995..0000000000 --- a/.changeset/changelogs/@pnpm!engine.runtime.commands@1100.1.19.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1100.1.19 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.reader@1101.16.0 - - @pnpm/engine.runtime.node-resolver@1101.1.21 - - @pnpm/error@1100.1.1 - - @pnpm/network.fetch@1100.1.11 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!engine.runtime.deno-resolver@1102.0.14.md b/.changeset/changelogs/@pnpm!engine.runtime.deno-resolver@1102.0.14.md deleted file mode 100644 index 65e7b406cb..0000000000 --- a/.changeset/changelogs/@pnpm!engine.runtime.deno-resolver@1102.0.14.md +++ /dev/null @@ -1,12 +0,0 @@ -## 1102.0.14 - -### Patch Changes - -- Updated dependencies: - - @pnpm/crypto.shasums-file@1100.1.5 - - @pnpm/error@1100.1.1 - - @pnpm/fetching.binary-fetcher@1102.0.9 - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!engine.runtime.node-resolver@1101.1.21.md b/.changeset/changelogs/@pnpm!engine.runtime.node-resolver@1101.1.21.md deleted file mode 100644 index cd8330095e..0000000000 --- a/.changeset/changelogs/@pnpm!engine.runtime.node-resolver@1101.1.21.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1101.1.21 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.reader@1101.16.0 - - @pnpm/crypto.shasums-file@1100.1.5 - - @pnpm/error@1100.1.1 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!engine.runtime.system-version@1100.0.9.md b/.changeset/changelogs/@pnpm!engine.runtime.system-version@1100.0.9.md deleted file mode 100644 index e7d9852f86..0000000000 --- a/.changeset/changelogs/@pnpm!engine.runtime.system-version@1100.0.9.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.9 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.meta@1100.0.14 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!error@1100.1.1.md b/.changeset/changelogs/@pnpm!error@1100.1.1.md deleted file mode 100644 index f677e1741e..0000000000 --- a/.changeset/changelogs/@pnpm!error@1100.1.1.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.1.1 - -### Patch Changes - -- Updated dependencies: - - @pnpm/constants@1101.0.0 diff --git a/.changeset/changelogs/@pnpm!exec.commands@1100.4.7.md b/.changeset/changelogs/@pnpm!exec.commands@1100.4.7.md deleted file mode 100644 index 2be9970a45..0000000000 --- a/.changeset/changelogs/@pnpm!exec.commands@1100.4.7.md +++ /dev/null @@ -1,23 +0,0 @@ -## 1100.4.7 - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.resolver@1100.0.14 - - @pnpm/building.commands@1100.1.20 - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.reader@1101.16.0 - - @pnpm/config.version-policy@1100.1.12 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.status@1100.1.15 - - @pnpm/engine.runtime.commands@1100.1.19 - - @pnpm/error@1100.1.1 - - @pnpm/exec.lifecycle@1100.1.11 - - @pnpm/installing.client@1100.3.2 - - @pnpm/installing.commands@1100.13.0 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/store.path@1100.0.4 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.injected-deps-syncer@1100.0.31 - - @pnpm/workspace.project-manifest-reader@1100.0.23 - - @pnpm/workspace.projects-sorter@1100.0.14 diff --git a/.changeset/changelogs/@pnpm!exec.lifecycle@1100.1.11.md b/.changeset/changelogs/@pnpm!exec.lifecycle@1100.1.11.md deleted file mode 100644 index 0c43bc3ef2..0000000000 --- a/.changeset/changelogs/@pnpm!exec.lifecycle@1100.1.11.md +++ /dev/null @@ -1,12 +0,0 @@ -## 1100.1.11 - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.linker@1100.0.25 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/error@1100.1.1 - - @pnpm/fetching.directory-fetcher@1100.0.28 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!exec.prepare-package@1100.0.30.md b/.changeset/changelogs/@pnpm!exec.prepare-package@1100.0.30.md deleted file mode 100644 index 485473b3bb..0000000000 --- a/.changeset/changelogs/@pnpm!exec.prepare-package@1100.0.30.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1100.0.30 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/exec.lifecycle@1100.1.11 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!fetching.binary-fetcher@1102.0.9.md b/.changeset/changelogs/@pnpm!fetching.binary-fetcher@1102.0.9.md deleted file mode 100644 index 916ae23376..0000000000 --- a/.changeset/changelogs/@pnpm!fetching.binary-fetcher@1102.0.9.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1102.0.9 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/store.index@1100.2.3 diff --git a/.changeset/changelogs/@pnpm!fetching.directory-fetcher@1100.0.28.md b/.changeset/changelogs/@pnpm!fetching.directory-fetcher@1100.0.28.md deleted file mode 100644 index 969d11e950..0000000000 --- a/.changeset/changelogs/@pnpm!fetching.directory-fetcher@1100.0.28.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1100.0.28 - -### Patch Changes - -- Updated dependencies: - - @pnpm/building.pkg-requires-build@1100.0.14 - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!fetching.fetcher-base@1100.2.7.md b/.changeset/changelogs/@pnpm!fetching.fetcher-base@1100.2.7.md deleted file mode 100644 index baffb813ef..0000000000 --- a/.changeset/changelogs/@pnpm!fetching.fetcher-base@1100.2.7.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.2.7 - -### Patch Changes - -- Updated dependencies: - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!fetching.git-fetcher@1102.0.12.md b/.changeset/changelogs/@pnpm!fetching.git-fetcher@1102.0.12.md deleted file mode 100644 index 22e95d8a0f..0000000000 --- a/.changeset/changelogs/@pnpm!fetching.git-fetcher@1102.0.12.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1102.0.12 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/exec.prepare-package@1100.0.30 - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/resolving.git-resolver@1100.1.15 - - @pnpm/store.index@1100.2.3 diff --git a/.changeset/changelogs/@pnpm!fetching.pick-fetcher@1100.1.6.md b/.changeset/changelogs/@pnpm!fetching.pick-fetcher@1100.1.6.md deleted file mode 100644 index 4047d3b52e..0000000000 --- a/.changeset/changelogs/@pnpm!fetching.pick-fetcher@1100.1.6.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1100.1.6 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/hooks.types@1100.2.6 - - @pnpm/resolving.resolver-base@1101.1.0 diff --git a/.changeset/changelogs/@pnpm!fetching.tarball-fetcher@1102.0.12.md b/.changeset/changelogs/@pnpm!fetching.tarball-fetcher@1102.0.12.md deleted file mode 100644 index ae35856c66..0000000000 --- a/.changeset/changelogs/@pnpm!fetching.tarball-fetcher@1102.0.12.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1102.0.12 - -### Patch Changes - -- Updated dependencies: - - @pnpm/core-loggers@1100.3.2 - - @pnpm/error@1100.1.1 - - @pnpm/exec.prepare-package@1100.0.30 - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/store.index@1100.2.3 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!fs.indexed-pkg-importer@1100.0.24.md b/.changeset/changelogs/@pnpm!fs.indexed-pkg-importer@1100.0.24.md deleted file mode 100644 index fba1a148dd..0000000000 --- a/.changeset/changelogs/@pnpm!fs.indexed-pkg-importer@1100.0.24.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.24 - -### Patch Changes - -- Updated dependencies: - - @pnpm/core-loggers@1100.3.2 - - @pnpm/store.controller-types@1101.1.0 diff --git a/.changeset/changelogs/@pnpm!fs.symlink-dependency@1100.0.17.md b/.changeset/changelogs/@pnpm!fs.symlink-dependency@1100.0.17.md deleted file mode 100644 index 5cd7b5d298..0000000000 --- a/.changeset/changelogs/@pnpm!fs.symlink-dependency@1100.0.17.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.17 - -### Patch Changes - -- Updated dependencies: - - @pnpm/core-loggers@1100.3.2 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!global.commands@1100.0.43.md b/.changeset/changelogs/@pnpm!global.commands@1100.0.43.md deleted file mode 100644 index 2351d0d5b2..0000000000 --- a/.changeset/changelogs/@pnpm!global.commands@1100.0.43.md +++ /dev/null @@ -1,19 +0,0 @@ -## 1100.0.43 - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.linker@1100.0.25 - - @pnpm/bins.remover@1100.0.19 - - @pnpm/bins.resolver@1100.0.14 - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.reader@1101.16.0 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.inspection.list@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/global.packages@1100.0.16 - - @pnpm/installing.deps-installer@1103.1.0 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/pkg-manifest.utils@1100.3.1 - - @pnpm/store.connection-manager@1100.3.15 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!global.packages@1100.0.16.md b/.changeset/changelogs/@pnpm!global.packages@1100.0.16.md deleted file mode 100644 index 53d3017b00..0000000000 --- a/.changeset/changelogs/@pnpm!global.packages@1100.0.16.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.0.16 - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.resolver@1100.0.14 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!hooks.pnpmfile@1100.0.25.md b/.changeset/changelogs/@pnpm!hooks.pnpmfile@1100.0.25.md deleted file mode 100644 index 34061bd0d2..0000000000 --- a/.changeset/changelogs/@pnpm!hooks.pnpmfile@1100.0.25.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1100.0.25 - -### Patch Changes - -- Updated dependencies: - - @pnpm/core-loggers@1100.3.2 - - @pnpm/error@1100.1.1 - - @pnpm/hooks.types@1100.2.6 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!hooks.read-package-hook@1100.2.2.md b/.changeset/changelogs/@pnpm!hooks.read-package-hook@1100.2.2.md deleted file mode 100644 index f9e8db6f0b..0000000000 --- a/.changeset/changelogs/@pnpm!hooks.read-package-hook@1100.2.2.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.2.2 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.parse-overrides@1100.1.2 - - @pnpm/error@1100.1.1 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!hooks.types@1100.2.6.md b/.changeset/changelogs/@pnpm!hooks.types@1100.2.6.md deleted file mode 100644 index 88814265da..0000000000 --- a/.changeset/changelogs/@pnpm!hooks.types@1100.2.6.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1100.2.6 - -### Patch Changes - -- Updated dependencies: - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!installing.client@1100.3.2.md b/.changeset/changelogs/@pnpm!installing.client@1100.3.2.md deleted file mode 100644 index 5135d03ba1..0000000000 --- a/.changeset/changelogs/@pnpm!installing.client@1100.3.2.md +++ /dev/null @@ -1,19 +0,0 @@ -## 1100.3.2 - -### Patch Changes - -- Updated dependencies: - - @pnpm/engine.runtime.node-resolver@1101.1.21 - - @pnpm/error@1100.1.1 - - @pnpm/fetching.binary-fetcher@1102.0.9 - - @pnpm/fetching.directory-fetcher@1100.0.28 - - @pnpm/fetching.git-fetcher@1102.0.12 - - @pnpm/fetching.tarball-fetcher@1102.0.12 - - @pnpm/hooks.types@1100.2.6 - - @pnpm/network.auth-header@1101.1.9 - - @pnpm/network.fetch@1100.1.11 - - @pnpm/resolving.default-resolver@1100.3.23 - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/store.index@1100.2.3 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!installing.commands@1100.13.0.md b/.changeset/changelogs/@pnpm!installing.commands@1100.13.0.md deleted file mode 100644 index ddec3d7dc9..0000000000 --- a/.changeset/changelogs/@pnpm!installing.commands@1100.13.0.md +++ /dev/null @@ -1,102 +0,0 @@ -## 1100.13.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/building.after-install@1102.0.15 - - @pnpm/building.policy@1100.0.18 - - @pnpm/catalogs.config@1100.0.4 - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.pick-registry-for-package@1100.1.0 - - @pnpm/config.reader@1101.16.0 - - @pnpm/config.version-policy@1100.1.12 - - @pnpm/config.writer@1100.0.21 - - @pnpm/constants@1101.0.0 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.github-actions@1100.1.3 - - @pnpm/deps.inspection.outdated@1100.1.23 - - @pnpm/deps.path@1100.1.0 - - @pnpm/deps.security.signatures@1101.2.10 - - @pnpm/deps.status@1100.1.15 - - @pnpm/error@1100.1.1 - - @pnpm/global.commands@1100.0.43 - - @pnpm/hooks.pnpmfile@1100.0.25 - - @pnpm/installing.context@1100.1.0 - - @pnpm/installing.dedupe.check@1100.1.8 - - @pnpm/installing.deps-installer@1103.1.0 - - @pnpm/installing.env-installer@1102.0.15 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/network.auth-header@1101.1.9 - - @pnpm/network.fetch@1100.1.11 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/pkg-manifest.utils@1100.3.1 - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/store.connection-manager@1100.3.15 - - @pnpm/store.controller@1102.0.11 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 - - @pnpm/workspace.project-manifest-writer@1100.0.14 - - @pnpm/workspace.projects-filter@1100.0.35 - - @pnpm/workspace.projects-graph@1100.0.31 - - @pnpm/workspace.projects-reader@1101.0.22 - - @pnpm/workspace.projects-sorter@1100.0.14 - - @pnpm/workspace.root-finder@1100.0.5 - - @pnpm/workspace.state@1100.0.36 - - @pnpm/workspace.workspace-manifest-reader@1100.1.5 - - @pnpm/workspace.workspace-manifest-writer@1100.0.21 diff --git a/.changeset/changelogs/@pnpm!installing.context@1100.1.0.md b/.changeset/changelogs/@pnpm!installing.context@1100.1.0.md deleted file mode 100644 index a1e24c953a..0000000000 --- a/.changeset/changelogs/@pnpm!installing.context@1100.1.0.md +++ /dev/null @@ -1,68 +0,0 @@ -## 1100.1.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/constants@1101.0.0 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/error@1100.1.1 - - @pnpm/installing.modules-yaml@1100.0.15 - - @pnpm/installing.read-projects-context@1100.0.27 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/store.controller@1102.0.11 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!installing.dedupe.check@1100.1.8.md b/.changeset/changelogs/@pnpm!installing.dedupe.check@1100.1.8.md deleted file mode 100644 index d7f9f4b3d8..0000000000 --- a/.changeset/changelogs/@pnpm!installing.dedupe.check@1100.1.8.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.1.8 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!installing.deps-installer@1103.1.0.md b/.changeset/changelogs/@pnpm!installing.deps-installer@1103.1.0.md deleted file mode 100644 index 4a6cf73a67..0000000000 --- a/.changeset/changelogs/@pnpm!installing.deps-installer@1103.1.0.md +++ /dev/null @@ -1,103 +0,0 @@ -## 1103.1.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.linker@1100.0.25 - - @pnpm/bins.remover@1100.0.19 - - @pnpm/building.after-install@1102.0.15 - - @pnpm/building.during-install@1102.0.14 - - @pnpm/building.policy@1100.0.18 - - @pnpm/catalogs.config@1100.0.4 - - @pnpm/config.normalize-registries@1100.1.0 - - @pnpm/config.parse-overrides@1100.1.2 - - @pnpm/config.version-policy@1100.1.12 - - @pnpm/constants@1101.0.0 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.graph-hasher@1100.2.15 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/exec.lifecycle@1100.1.11 - - @pnpm/fs.symlink-dependency@1100.0.17 - - @pnpm/hooks.read-package-hook@1100.2.2 - - @pnpm/hooks.types@1100.2.6 - - @pnpm/installing.context@1100.1.0 - - @pnpm/installing.deps-resolver@1101.1.0 - - @pnpm/installing.deps-restorer@1102.3.0 - - @pnpm/installing.linking.direct-dep-linker@1100.0.17 - - @pnpm/installing.linking.hoist@1100.0.25 - - @pnpm/installing.linking.modules-cleaner@1100.1.18 - - @pnpm/installing.modules-yaml@1100.0.15 - - @pnpm/installing.package-requester@1102.1.9 - - @pnpm/lockfile.filtering@1100.2.2 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.preferred-versions@1100.0.28 - - @pnpm/lockfile.pruner@1100.0.19 - - @pnpm/lockfile.settings-checker@1100.1.10 - - @pnpm/lockfile.to-pnp@1100.1.12 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/lockfile.verification@1100.0.31 - - @pnpm/lockfile.walker@1100.0.19 - - @pnpm/network.auth-header@1101.1.9 - - @pnpm/patching.config@1100.0.15 - - @pnpm/pkg-manifest.utils@1100.3.1 - - @pnpm/pnpr.client@1.3.10 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/store.index@1100.2.3 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!installing.deps-resolver@1101.1.0.md b/.changeset/changelogs/@pnpm!installing.deps-resolver@1101.1.0.md deleted file mode 100644 index e6e2e86d37..0000000000 --- a/.changeset/changelogs/@pnpm!installing.deps-resolver@1101.1.0.md +++ /dev/null @@ -1,82 +0,0 @@ -## 1101.1.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs. - -- Updated dependencies: - - @pnpm/config.normalize-registries@1100.1.0 - - @pnpm/config.version-policy@1100.1.12 - - @pnpm/constants@1101.0.0 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.graph-hasher@1100.2.15 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/fetching.pick-fetcher@1100.1.6 - - @pnpm/fs.symlink-dependency@1100.0.17 - - @pnpm/hooks.types@1100.2.6 - - @pnpm/lockfile.preferred-versions@1100.0.28 - - @pnpm/lockfile.pruner@1100.0.19 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/patching.config@1100.0.15 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/pkg-manifest.utils@1100.3.1 - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!installing.deps-restorer@1102.3.0.md b/.changeset/changelogs/@pnpm!installing.deps-restorer@1102.3.0.md deleted file mode 100644 index 2de0f854b9..0000000000 --- a/.changeset/changelogs/@pnpm!installing.deps-restorer@1102.3.0.md +++ /dev/null @@ -1,86 +0,0 @@ -## 1102.3.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.linker@1100.0.25 - - @pnpm/building.during-install@1102.0.14 - - @pnpm/building.policy@1100.0.18 - - @pnpm/config.package-is-installable@1100.1.2 - - @pnpm/constants@1101.0.0 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.graph-builder@1100.2.0 - - @pnpm/deps.graph-hasher@1100.2.15 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/exec.lifecycle@1100.1.11 - - @pnpm/fs.symlink-dependency@1100.0.17 - - @pnpm/installing.linking.direct-dep-linker@1100.0.17 - - @pnpm/installing.linking.hoist@1100.0.25 - - @pnpm/installing.linking.modules-cleaner@1100.1.18 - - @pnpm/installing.linking.real-hoist@1100.1.12 - - @pnpm/installing.modules-yaml@1100.0.15 - - @pnpm/installing.package-requester@1102.1.9 - - @pnpm/lockfile.filtering@1100.2.2 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.to-pnp@1100.1.12 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/patching.config@1100.0.15 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!installing.env-installer@1102.0.15.md b/.changeset/changelogs/@pnpm!installing.env-installer@1102.0.15.md deleted file mode 100644 index 6cb7abb2ef..0000000000 --- a/.changeset/changelogs/@pnpm!installing.env-installer@1102.0.15.md +++ /dev/null @@ -1,28 +0,0 @@ -## 1102.0.15 - -### Patch Changes - -- The env lockfile no longer pins `@pnpm/exe` alongside `pnpm` when the wanted pnpm version is 12 or newer. From v12 the unscoped `pnpm` package is itself the native executable, so `@pnpm/exe` is not published for it and resolving it would fail. The engine identity check now verifies the native binary through whichever package ships it. - -- Updated dependencies: - - @pnpm/config.package-is-installable@1100.1.2 - - @pnpm/config.pick-registry-for-package@1100.1.0 - - @pnpm/config.writer@1100.0.21 - - @pnpm/constants@1101.0.0 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.graph-hasher@1100.2.15 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/fs.symlink-dependency@1100.0.17 - - @pnpm/installing.deps-resolver@1101.1.0 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.pruner@1100.0.19 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/network.auth-header@1101.1.9 - - @pnpm/network.fetch@1100.1.11 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/store.controller@1102.0.11 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!installing.linking.direct-dep-linker@1100.0.17.md b/.changeset/changelogs/@pnpm!installing.linking.direct-dep-linker@1100.0.17.md deleted file mode 100644 index 9c078a512a..0000000000 --- a/.changeset/changelogs/@pnpm!installing.linking.direct-dep-linker@1100.0.17.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.17 - -### Patch Changes - -- Updated dependencies: - - @pnpm/core-loggers@1100.3.2 - - @pnpm/fs.symlink-dependency@1100.0.17 diff --git a/.changeset/changelogs/@pnpm!installing.linking.hoist@1100.0.25.md b/.changeset/changelogs/@pnpm!installing.linking.hoist@1100.0.25.md deleted file mode 100644 index dca4cb8f46..0000000000 --- a/.changeset/changelogs/@pnpm!installing.linking.hoist@1100.0.25.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1100.0.25 - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.linker@1100.0.25 - - @pnpm/constants@1101.0.0 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!installing.linking.modules-cleaner@1100.1.18.md b/.changeset/changelogs/@pnpm!installing.linking.modules-cleaner@1100.1.18.md deleted file mode 100644 index 0e7e6a6d41..0000000000 --- a/.changeset/changelogs/@pnpm!installing.linking.modules-cleaner@1100.1.18.md +++ /dev/null @@ -1,13 +0,0 @@ -## 1100.1.18 - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.remover@1100.0.19 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.path@1100.1.0 - - @pnpm/lockfile.filtering@1100.2.2 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!installing.linking.real-hoist@1100.1.12.md b/.changeset/changelogs/@pnpm!installing.linking.real-hoist@1100.1.12.md deleted file mode 100644 index 3c9da3b473..0000000000 --- a/.changeset/changelogs/@pnpm!installing.linking.real-hoist@1100.1.12.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.1.12 - -### Patch Changes - -- Updated dependencies: - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/lockfile.utils@1101.0.0 diff --git a/.changeset/changelogs/@pnpm!installing.modules-yaml@1100.0.15.md b/.changeset/changelogs/@pnpm!installing.modules-yaml@1100.0.15.md deleted file mode 100644 index ae5d46d399..0000000000 --- a/.changeset/changelogs/@pnpm!installing.modules-yaml@1100.0.15.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.15 - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!installing.package-requester@1102.1.9.md b/.changeset/changelogs/@pnpm!installing.package-requester@1102.1.9.md deleted file mode 100644 index 518215ce3c..0000000000 --- a/.changeset/changelogs/@pnpm!installing.package-requester@1102.1.9.md +++ /dev/null @@ -1,17 +0,0 @@ -## 1102.1.9 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.package-is-installable@1100.1.2 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/fetching.pick-fetcher@1100.1.6 - - @pnpm/hooks.types@1100.2.6 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/store.cafs@1100.1.18 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/store.index@1100.2.3 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!installing.read-projects-context@1100.0.27.md b/.changeset/changelogs/@pnpm!installing.read-projects-context@1100.0.27.md deleted file mode 100644 index d0036e5ccc..0000000000 --- a/.changeset/changelogs/@pnpm!installing.read-projects-context@1100.0.27.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1100.0.27 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.normalize-registries@1100.1.0 - - @pnpm/installing.modules-yaml@1100.0.15 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!lockfile.detect-dep-types@1100.0.19.md b/.changeset/changelogs/@pnpm!lockfile.detect-dep-types@1100.0.19.md deleted file mode 100644 index 8dd7157076..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.detect-dep-types@1100.0.19.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.0.19 - -### Patch Changes - -- Updated dependencies: - - @pnpm/deps.path@1100.1.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!lockfile.filtering@1100.2.2.md b/.changeset/changelogs/@pnpm!lockfile.filtering@1100.2.2.md deleted file mode 100644 index f31bf2d385..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.filtering@1100.2.2.md +++ /dev/null @@ -1,13 +0,0 @@ -## 1100.2.2 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.package-is-installable@1100.1.2 - - @pnpm/constants@1101.0.0 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/lockfile.walker@1100.0.19 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!lockfile.fs@1100.2.0.md b/.changeset/changelogs/@pnpm!lockfile.fs@1100.2.0.md deleted file mode 100644 index 8fb9919665..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.fs@1100.2.0.md +++ /dev/null @@ -1,66 +0,0 @@ -## 1100.2.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/constants@1101.0.0 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/lockfile.merger@1100.0.19 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!lockfile.make-dedicated-lockfile@1100.0.33.md b/.changeset/changelogs/@pnpm!lockfile.make-dedicated-lockfile@1100.0.33.md deleted file mode 100644 index 7ab152be50..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.make-dedicated-lockfile@1100.0.33.md +++ /dev/null @@ -1,12 +0,0 @@ -## 1100.0.33 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.pruner@1100.0.19 - - @pnpm/releasing.exportable-manifest@1100.2.2 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 - - @pnpm/workspace.root-finder@1100.0.5 diff --git a/.changeset/changelogs/@pnpm!lockfile.merger@1100.0.19.md b/.changeset/changelogs/@pnpm!lockfile.merger@1100.0.19.md deleted file mode 100644 index 794f0a8571..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.merger@1100.0.19.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.19 - -### Patch Changes - -- Updated dependencies: - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!lockfile.preferred-versions@1100.0.28.md b/.changeset/changelogs/@pnpm!lockfile.preferred-versions@1100.0.28.md deleted file mode 100644 index c1bed09f27..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.preferred-versions@1100.0.28.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1100.0.28 - -### Patch Changes - -- Updated dependencies: - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/pkg-manifest.utils@1100.3.1 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!lockfile.pruner@1100.0.19.md b/.changeset/changelogs/@pnpm!lockfile.pruner@1100.0.19.md deleted file mode 100644 index c7177cb2c9..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.pruner@1100.0.19.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1100.0.19 - -### Patch Changes - -- Updated dependencies: - - @pnpm/constants@1101.0.0 - - @pnpm/deps.path@1100.1.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!lockfile.settings-checker@1100.1.10.md b/.changeset/changelogs/@pnpm!lockfile.settings-checker@1100.1.10.md deleted file mode 100644 index 8f557de16c..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.settings-checker@1100.1.10.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.1.10 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.parse-overrides@1100.1.2 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.verification@1100.0.31 diff --git a/.changeset/changelogs/@pnpm!lockfile.to-pnp@1100.1.12.md b/.changeset/changelogs/@pnpm!lockfile.to-pnp@1100.1.12.md deleted file mode 100644 index 8a90e50d8a..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.to-pnp@1100.1.12.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1100.1.12 - -### Patch Changes - -- Updated dependencies: - - @pnpm/deps.path@1100.1.0 - - @pnpm/fs.symlink-dependency@1100.0.17 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!lockfile.types@1100.0.19.md b/.changeset/changelogs/@pnpm!lockfile.types@1100.0.19.md deleted file mode 100644 index 9067095917..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.types@1100.0.19.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.19 - -### Patch Changes - -- Updated dependencies: - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!lockfile.utils@1101.0.0.md b/.changeset/changelogs/@pnpm!lockfile.utils@1101.0.0.md deleted file mode 100644 index 52a4296d4d..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.utils@1101.0.0.md +++ /dev/null @@ -1,69 +0,0 @@ -## 1101.0.0 - -### Major Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs. - -- Updated dependencies: - - @pnpm/config.normalize-registries@1100.1.0 - - @pnpm/constants@1101.0.0 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/hooks.types@1100.2.6 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!lockfile.verification@1100.0.31.md b/.changeset/changelogs/@pnpm!lockfile.verification@1100.0.31.md deleted file mode 100644 index f43655918f..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.verification@1100.0.31.md +++ /dev/null @@ -1,12 +0,0 @@ -## 1100.0.31 - -### Patch Changes - -- Updated dependencies: - - @pnpm/deps.path@1100.1.0 - - @pnpm/installing.context@1100.1.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!lockfile.walker@1100.0.19.md b/.changeset/changelogs/@pnpm!lockfile.walker@1100.0.19.md deleted file mode 100644 index 8dd7157076..0000000000 --- a/.changeset/changelogs/@pnpm!lockfile.walker@1100.0.19.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.0.19 - -### Patch Changes - -- Updated dependencies: - - @pnpm/deps.path@1100.1.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!modules-mounter.daemon@1100.0.36.md b/.changeset/changelogs/@pnpm!modules-mounter.daemon@1100.0.36.md deleted file mode 100644 index c8f2e1d822..0000000000 --- a/.changeset/changelogs/@pnpm!modules-mounter.daemon@1100.0.36.md +++ /dev/null @@ -1,13 +0,0 @@ -## 1100.0.36 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.reader@1101.16.0 - - @pnpm/deps.path@1100.1.0 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/store.cafs@1100.1.18 - - @pnpm/store.index@1100.2.3 - - @pnpm/store.path@1100.0.4 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!napi@12.0.0-beta.4.md b/.changeset/changelogs/@pnpm!napi@12.0.0-beta.4.md deleted file mode 100644 index 83344fe08e..0000000000 --- a/.changeset/changelogs/@pnpm!napi@12.0.0-beta.4.md +++ /dev/null @@ -1 +0,0 @@ -## 12.0.0-beta.4 diff --git a/.changeset/changelogs/@pnpm!napi@12.0.0-rc.0.md b/.changeset/changelogs/@pnpm!napi@12.0.0-rc.0.md new file mode 100644 index 0000000000..f95fd0f785 --- /dev/null +++ b/.changeset/changelogs/@pnpm!napi@12.0.0-rc.0.md @@ -0,0 +1,9 @@ +## 12.0.0-rc.0 + +### Minor Changes + +- `install` accepts `enableGlobalVirtualStore`, `globalVirtualStoreDir`, `packageExtensions` and `patchedDependencies`, and `readConfig` reports `enableGlobalVirtualStore`, `globalVirtualStoreDir`, `virtualStoreDir` and `effectiveVirtualStoreDir`. Hosts embedding the engine can now use the global virtual store, declare dependencies a package failed to declare, patch a package, and locate the virtual store instead of assuming `node_modules/.pnpm`. + +### Patch Changes + +- Fixed `resolveDependency({ fullMetadata: true })` returning a manifest stripped down to the abbreviated npm field set. Registry-custom fields on the version object (such as Bit's `componentId`) are now preserved. diff --git a/.changeset/changelogs/@pnpm!network.auth-header@1101.1.9.md b/.changeset/changelogs/@pnpm!network.auth-header@1101.1.9.md deleted file mode 100644 index feba868342..0000000000 --- a/.changeset/changelogs/@pnpm!network.auth-header@1101.1.9.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1101.1.9 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!network.fetch@1100.1.11.md b/.changeset/changelogs/@pnpm!network.fetch@1100.1.11.md deleted file mode 100644 index d0e4683464..0000000000 --- a/.changeset/changelogs/@pnpm!network.fetch@1100.1.11.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.1.11 - -### Patch Changes - -- Updated dependencies: - - @pnpm/core-loggers@1100.3.2 - - @pnpm/error@1100.1.1 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!network.web-auth@1101.4.1.md b/.changeset/changelogs/@pnpm!network.web-auth@1101.4.1.md deleted file mode 100644 index 1576af9d6e..0000000000 --- a/.changeset/changelogs/@pnpm!network.web-auth@1101.4.1.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1101.4.1 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 diff --git a/.changeset/changelogs/@pnpm!object.property-path@1100.1.3.md b/.changeset/changelogs/@pnpm!object.property-path@1100.1.3.md deleted file mode 100644 index faa1c8b255..0000000000 --- a/.changeset/changelogs/@pnpm!object.property-path@1100.1.3.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.1.3 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 diff --git a/.changeset/changelogs/@pnpm!patching.apply-patch@1100.0.5.md b/.changeset/changelogs/@pnpm!patching.apply-patch@1100.0.5.md deleted file mode 100644 index 05a970ddbc..0000000000 --- a/.changeset/changelogs/@pnpm!patching.apply-patch@1100.0.5.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.5 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 diff --git a/.changeset/changelogs/@pnpm!patching.commands@1100.1.20.md b/.changeset/changelogs/@pnpm!patching.commands@1100.1.20.md deleted file mode 100644 index 3e0b0e2e65..0000000000 --- a/.changeset/changelogs/@pnpm!patching.commands@1100.1.20.md +++ /dev/null @@ -1,21 +0,0 @@ -## 1100.1.20 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.reader@1101.16.0 - - @pnpm/config.writer@1100.0.21 - - @pnpm/constants@1101.0.0 - - @pnpm/error@1100.1.1 - - @pnpm/installing.commands@1100.13.0 - - @pnpm/installing.modules-yaml@1100.0.15 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/patching.apply-patch@1100.0.5 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/store.connection-manager@1100.3.15 - - @pnpm/store.path@1100.0.4 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 - - @pnpm/workspace.workspace-manifest-reader@1100.1.5 diff --git a/.changeset/changelogs/@pnpm!patching.config@1100.0.15.md b/.changeset/changelogs/@pnpm!patching.config@1100.0.15.md deleted file mode 100644 index 2682c716a9..0000000000 --- a/.changeset/changelogs/@pnpm!patching.config@1100.0.15.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.15 - -### Patch Changes - -- Updated dependencies: - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 diff --git a/.changeset/changelogs/@pnpm!pkg-manifest.commands@1100.1.20.md b/.changeset/changelogs/@pnpm!pkg-manifest.commands@1100.1.20.md deleted file mode 100644 index 73dd364301..0000000000 --- a/.changeset/changelogs/@pnpm!pkg-manifest.commands@1100.1.20.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1100.1.20 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.reader@1101.16.0 - - @pnpm/error@1100.1.1 - - @pnpm/object.property-path@1100.1.3 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!pkg-manifest.reader@1100.0.15.md b/.changeset/changelogs/@pnpm!pkg-manifest.reader@1100.0.15.md deleted file mode 100644 index 5ad4ca8027..0000000000 --- a/.changeset/changelogs/@pnpm!pkg-manifest.reader@1100.0.15.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.15 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!pkg-manifest.utils@1100.3.1.md b/.changeset/changelogs/@pnpm!pkg-manifest.utils@1100.3.1.md deleted file mode 100644 index d5d0f5804f..0000000000 --- a/.changeset/changelogs/@pnpm!pkg-manifest.utils@1100.3.1.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.3.1 - -### Patch Changes - -- Updated dependencies: - - @pnpm/core-loggers@1100.3.2 - - @pnpm/error@1100.1.1 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!pnpr.client@1.3.10.md b/.changeset/changelogs/@pnpm!pnpr.client@1.3.10.md deleted file mode 100644 index 324c4937a2..0000000000 --- a/.changeset/changelogs/@pnpm!pnpr.client@1.3.10.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1.3.10 - -### Patch Changes - -- Updated dependencies: - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!prepare@1100.0.25.md b/.changeset/changelogs/@pnpm!prepare@1100.0.25.md deleted file mode 100644 index 003a6bf3ac..0000000000 --- a/.changeset/changelogs/@pnpm!prepare@1100.0.25.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.25 - -### Patch Changes - -- Updated dependencies: - - @pnpm/assert-project@1100.0.25 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!registry-access.client@1100.1.13.md b/.changeset/changelogs/@pnpm!registry-access.client@1100.1.13.md deleted file mode 100644 index 0d465dd54f..0000000000 --- a/.changeset/changelogs/@pnpm!registry-access.client@1100.1.13.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.1.13 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/network.fetch@1100.1.11 - - @pnpm/network.web-auth@1101.4.1 diff --git a/.changeset/changelogs/@pnpm!registry-access.commands@1100.5.8.md b/.changeset/changelogs/@pnpm!registry-access.commands@1100.5.8.md deleted file mode 100644 index 5c055c525d..0000000000 --- a/.changeset/changelogs/@pnpm!registry-access.commands@1100.5.8.md +++ /dev/null @@ -1,15 +0,0 @@ -## 1100.5.8 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.pick-registry-for-package@1100.1.0 - - @pnpm/config.reader@1101.16.0 - - @pnpm/error@1100.1.1 - - @pnpm/network.auth-header@1101.1.9 - - @pnpm/network.fetch@1100.1.11 - - @pnpm/network.web-auth@1101.4.1 - - @pnpm/registry-access.client@1100.1.13 - - @pnpm/resolving.registry.types@1100.1.9 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!releasing.commands@1100.8.2.md b/.changeset/changelogs/@pnpm!releasing.commands@1100.8.2.md deleted file mode 100644 index 547beae601..0000000000 --- a/.changeset/changelogs/@pnpm!releasing.commands@1100.8.2.md +++ /dev/null @@ -1,33 +0,0 @@ -## 1100.8.2 - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.resolver@1100.0.14 - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.pick-registry-for-package@1100.1.0 - - @pnpm/config.reader@1101.16.0 - - @pnpm/constants@1101.0.0 - - @pnpm/deps.path@1100.1.0 - - @pnpm/engine.runtime.commands@1100.1.19 - - @pnpm/engine.runtime.node-resolver@1101.1.21 - - @pnpm/error@1100.1.1 - - @pnpm/exec.lifecycle@1100.1.11 - - @pnpm/fetching.directory-fetcher@1100.0.28 - - @pnpm/fs.indexed-pkg-importer@1100.0.24 - - @pnpm/installing.client@1100.3.2 - - @pnpm/installing.commands@1100.13.0 - - @pnpm/lockfile.fs@1100.2.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/network.auth-header@1101.1.9 - - @pnpm/network.fetch@1100.1.11 - - @pnpm/network.web-auth@1101.4.1 - - @pnpm/releasing.exportable-manifest@1100.2.2 - - @pnpm/releasing.versioning@1100.2.4 - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/resolving.registry.types@1100.1.9 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.projects-filter@1100.0.35 - - @pnpm/workspace.projects-sorter@1100.0.14 - - @pnpm/workspace.workspace-manifest-writer@1100.0.21 diff --git a/.changeset/changelogs/@pnpm!releasing.exportable-manifest@1100.2.2.md b/.changeset/changelogs/@pnpm!releasing.exportable-manifest@1100.2.2.md deleted file mode 100644 index 62a75f7470..0000000000 --- a/.changeset/changelogs/@pnpm!releasing.exportable-manifest@1100.2.2.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1100.2.2 - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.resolver@1100.0.14 - - @pnpm/error@1100.1.1 - - @pnpm/resolving.jsr-specifier-parser@1100.0.4 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!releasing.versioning@1100.2.4.md b/.changeset/changelogs/@pnpm!releasing.versioning@1100.2.4.md deleted file mode 100644 index a55c854a2f..0000000000 --- a/.changeset/changelogs/@pnpm!releasing.versioning@1100.2.4.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.2.4 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!resolving.default-resolver@1100.3.23.md b/.changeset/changelogs/@pnpm!resolving.default-resolver@1100.3.23.md deleted file mode 100644 index d53deead60..0000000000 --- a/.changeset/changelogs/@pnpm!resolving.default-resolver@1100.3.23.md +++ /dev/null @@ -1,17 +0,0 @@ -## 1100.3.23 - -### Patch Changes - -- Updated dependencies: - - @pnpm/engine.runtime.bun-resolver@1102.0.14 - - @pnpm/engine.runtime.deno-resolver@1102.0.14 - - @pnpm/engine.runtime.node-resolver@1101.1.21 - - @pnpm/error@1100.1.1 - - @pnpm/hooks.types@1100.2.6 - - @pnpm/network.auth-header@1101.1.9 - - @pnpm/resolving.git-resolver@1100.1.15 - - @pnpm/resolving.local-resolver@1101.1.17 - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/resolving.tarball-resolver@1100.1.12 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!resolving.git-resolver@1100.1.15.md b/.changeset/changelogs/@pnpm!resolving.git-resolver@1100.1.15.md deleted file mode 100644 index 7ca7ac1a0c..0000000000 --- a/.changeset/changelogs/@pnpm!resolving.git-resolver@1100.1.15.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.1.15 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/network.fetch@1100.1.11 - - @pnpm/resolving.resolver-base@1101.1.0 diff --git a/.changeset/changelogs/@pnpm!resolving.jsr-specifier-parser@1100.0.4.md b/.changeset/changelogs/@pnpm!resolving.jsr-specifier-parser@1100.0.4.md deleted file mode 100644 index 5f50fdac01..0000000000 --- a/.changeset/changelogs/@pnpm!resolving.jsr-specifier-parser@1100.0.4.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.4 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 diff --git a/.changeset/changelogs/@pnpm!resolving.local-resolver@1101.1.17.md b/.changeset/changelogs/@pnpm!resolving.local-resolver@1101.1.17.md deleted file mode 100644 index dd99a7d131..0000000000 --- a/.changeset/changelogs/@pnpm!resolving.local-resolver@1101.1.17.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1101.1.17 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!resolving.npm-resolver@1103.1.0.md b/.changeset/changelogs/@pnpm!resolving.npm-resolver@1103.1.0.md deleted file mode 100644 index dcae4d4c5b..0000000000 --- a/.changeset/changelogs/@pnpm!resolving.npm-resolver@1103.1.0.md +++ /dev/null @@ -1,78 +0,0 @@ -## 1103.1.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs. - -- Dependency resolution is faster: package metadata is now filtered once per packument instead of once per dependency edge when `minimumReleaseAge` is active, and parsed semver versions and ranges are reused instead of re-parsed on every comparison. - -- Updated dependencies: - - @pnpm/config.normalize-registries@1100.1.0 - - @pnpm/config.pick-registry-for-package@1100.1.0 - - @pnpm/config.version-policy@1100.1.12 - - @pnpm/constants@1101.0.0 - - @pnpm/core-loggers@1100.3.2 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/pkg-manifest.utils@1100.3.1 - - @pnpm/resolving.jsr-specifier-parser@1100.0.4 - - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.15 - - @pnpm/resolving.registry.types@1100.1.9 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/store.cafs@1100.1.18 - - @pnpm/store.index@1100.2.3 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!resolving.registry.pkg-metadata-filter@1100.0.15.md b/.changeset/changelogs/@pnpm!resolving.registry.pkg-metadata-filter@1100.0.15.md deleted file mode 100644 index 79e1170b66..0000000000 --- a/.changeset/changelogs/@pnpm!resolving.registry.pkg-metadata-filter@1100.0.15.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.0.15 - -### Patch Changes - -- Dependency resolution is faster: package metadata is now filtered once per packument instead of once per dependency edge when `minimumReleaseAge` is active, and parsed semver versions and ranges are reused instead of re-parsed on every comparison. - -- Updated dependencies: - - @pnpm/resolving.registry.types@1100.1.9 diff --git a/.changeset/changelogs/@pnpm!resolving.registry.types@1100.1.9.md b/.changeset/changelogs/@pnpm!resolving.registry.types@1100.1.9.md deleted file mode 100644 index 2d86a67333..0000000000 --- a/.changeset/changelogs/@pnpm!resolving.registry.types@1100.1.9.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.1.9 - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!resolving.resolver-base@1101.1.0.md b/.changeset/changelogs/@pnpm!resolving.resolver-base@1101.1.0.md deleted file mode 100644 index 186d72ca63..0000000000 --- a/.changeset/changelogs/@pnpm!resolving.resolver-base@1101.1.0.md +++ /dev/null @@ -1,60 +0,0 @@ -## 1101.1.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!resolving.tarball-resolver@1100.1.12.md b/.changeset/changelogs/@pnpm!resolving.tarball-resolver@1100.1.12.md deleted file mode 100644 index cb521b52f2..0000000000 --- a/.changeset/changelogs/@pnpm!resolving.tarball-resolver@1100.1.12.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.1.12 - -### Patch Changes - -- Updated dependencies: - - @pnpm/resolving.resolver-base@1101.1.0 diff --git a/.changeset/changelogs/@pnpm!store.cafs@1100.1.18.md b/.changeset/changelogs/@pnpm!store.cafs@1100.1.18.md deleted file mode 100644 index 382b8145de..0000000000 --- a/.changeset/changelogs/@pnpm!store.cafs@1100.1.18.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1100.1.18 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!store.commands@1100.0.41.md b/.changeset/changelogs/@pnpm!store.commands@1100.0.41.md deleted file mode 100644 index 63d2777fac..0000000000 --- a/.changeset/changelogs/@pnpm!store.commands@1100.0.41.md +++ /dev/null @@ -1,22 +0,0 @@ -## 1100.0.41 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.normalize-registries@1100.1.0 - - @pnpm/config.reader@1101.16.0 - - @pnpm/crypto.integrity@1100.0.3 - - @pnpm/deps.path@1100.1.0 - - @pnpm/error@1100.1.1 - - @pnpm/global.packages@1100.0.16 - - @pnpm/installing.client@1100.3.2 - - @pnpm/installing.context@1100.1.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/lockfile.utils@1101.0.0 - - @pnpm/store.cafs@1100.1.18 - - @pnpm/store.connection-manager@1100.3.15 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/store.index@1100.2.3 - - @pnpm/store.path@1100.0.4 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!store.connection-manager@1100.3.15.md b/.changeset/changelogs/@pnpm!store.connection-manager@1100.3.15.md deleted file mode 100644 index 8d10bdcb9a..0000000000 --- a/.changeset/changelogs/@pnpm!store.connection-manager@1100.3.15.md +++ /dev/null @@ -1,12 +0,0 @@ -## 1100.3.15 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.meta@1100.0.14 - - @pnpm/config.reader@1101.16.0 - - @pnpm/installing.client@1100.3.2 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/store.controller@1102.0.11 - - @pnpm/store.index@1100.2.3 - - @pnpm/store.path@1100.0.4 diff --git a/.changeset/changelogs/@pnpm!store.controller-types@1101.1.0.md b/.changeset/changelogs/@pnpm!store.controller-types@1101.1.0.md deleted file mode 100644 index f01d53b225..0000000000 --- a/.changeset/changelogs/@pnpm!store.controller-types@1101.1.0.md +++ /dev/null @@ -1,62 +0,0 @@ -## 1101.1.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Updated dependencies: - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!store.controller@1102.0.11.md b/.changeset/changelogs/@pnpm!store.controller@1102.0.11.md deleted file mode 100644 index 456aacb479..0000000000 --- a/.changeset/changelogs/@pnpm!store.controller@1102.0.11.md +++ /dev/null @@ -1,15 +0,0 @@ -## 1102.0.11 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/hooks.types@1100.2.6 - - @pnpm/installing.package-requester@1102.1.9 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/store.cafs@1100.1.18 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/store.create-cafs-store@1100.0.24 - - @pnpm/store.index@1100.2.3 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!store.create-cafs-store@1100.0.24.md b/.changeset/changelogs/@pnpm!store.create-cafs-store@1100.0.24.md deleted file mode 100644 index 2a13bc3064..0000000000 --- a/.changeset/changelogs/@pnpm!store.create-cafs-store@1100.0.24.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1100.0.24 - -### Patch Changes - -- Updated dependencies: - - @pnpm/building.pkg-requires-build@1100.0.14 - - @pnpm/fetching.fetcher-base@1100.2.7 - - @pnpm/fs.indexed-pkg-importer@1100.0.24 - - @pnpm/store.cafs@1100.1.18 - - @pnpm/store.controller-types@1101.1.0 diff --git a/.changeset/changelogs/@pnpm!store.index@1100.2.3.md b/.changeset/changelogs/@pnpm!store.index@1100.2.3.md deleted file mode 100644 index 28da646089..0000000000 --- a/.changeset/changelogs/@pnpm!store.index@1100.2.3.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.2.3 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 diff --git a/.changeset/changelogs/@pnpm!store.path@1100.0.4.md b/.changeset/changelogs/@pnpm!store.path@1100.0.4.md deleted file mode 100644 index 17e4956f10..0000000000 --- a/.changeset/changelogs/@pnpm!store.path@1100.0.4.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.4 - -### Patch Changes - -- Updated dependencies: - - @pnpm/constants@1101.0.0 - - @pnpm/error@1100.1.1 diff --git a/.changeset/changelogs/@pnpm!store.pkg-finder@1100.0.28.md b/.changeset/changelogs/@pnpm!store.pkg-finder@1100.0.28.md deleted file mode 100644 index 810431ec65..0000000000 --- a/.changeset/changelogs/@pnpm!store.pkg-finder@1100.0.28.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1100.0.28 - -### Patch Changes - -- Updated dependencies: - - @pnpm/fetching.directory-fetcher@1100.0.28 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/store.cafs@1100.1.18 - - @pnpm/store.index@1100.2.3 diff --git a/.changeset/changelogs/@pnpm!testing.temp-store@1100.1.24.md b/.changeset/changelogs/@pnpm!testing.temp-store@1100.1.24.md deleted file mode 100644 index 4970ffc257..0000000000 --- a/.changeset/changelogs/@pnpm!testing.temp-store@1100.1.24.md +++ /dev/null @@ -1,10 +0,0 @@ -## 1100.1.24 - -### Patch Changes - -- Updated dependencies: - - @pnpm/installing.client@1100.3.2 - - @pnpm/resolving.resolver-base@1101.1.0 - - @pnpm/store.controller@1102.0.11 - - @pnpm/store.controller-types@1101.1.0 - - @pnpm/store.index@1100.2.3 diff --git a/.changeset/changelogs/@pnpm!text.ordinal-comparator@1100.0.0.md b/.changeset/changelogs/@pnpm!text.ordinal-comparator@1100.0.0.md deleted file mode 100644 index 780f6947ef..0000000000 --- a/.changeset/changelogs/@pnpm!text.ordinal-comparator@1100.0.0.md +++ /dev/null @@ -1,5 +0,0 @@ -## 1100.0.0 - -### Patch Changes - -- `lexCompare` and `nerfDart` are now published as `@pnpm/text.ordinal-comparator` and `@pnpm/config.registry-auth-key`. Use these instead of `@pnpm/util.lex-comparator` and `@pnpm/config.nerf-dart`. diff --git a/.changeset/changelogs/@pnpm!types@1101.9.0.md b/.changeset/changelogs/@pnpm!types@1101.9.0.md deleted file mode 100644 index e2536b66dd..0000000000 --- a/.changeset/changelogs/@pnpm!types@1101.9.0.md +++ /dev/null @@ -1,5 +0,0 @@ -## 1101.9.0 - -### Minor Changes - -- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs. diff --git a/.changeset/changelogs/@pnpm!worker@1100.2.10.md b/.changeset/changelogs/@pnpm!worker@1100.2.10.md deleted file mode 100644 index d52c2447eb..0000000000 --- a/.changeset/changelogs/@pnpm!worker@1100.2.10.md +++ /dev/null @@ -1,12 +0,0 @@ -## 1100.2.10 - -### Patch Changes - -- Updated dependencies: - - @pnpm/building.pkg-requires-build@1100.0.14 - - @pnpm/crypto.integrity@1100.0.3 - - @pnpm/error@1100.1.1 - - @pnpm/fs.symlink-dependency@1100.0.17 - - @pnpm/store.cafs@1100.1.18 - - @pnpm/store.create-cafs-store@1100.0.24 - - @pnpm/store.index@1100.2.3 diff --git a/.changeset/changelogs/@pnpm!workspace.commands@1100.1.34.md b/.changeset/changelogs/@pnpm!workspace.commands@1100.1.34.md deleted file mode 100644 index 2e6e0ebf97..0000000000 --- a/.changeset/changelogs/@pnpm!workspace.commands@1100.1.34.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1100.1.34 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.meta@1100.0.14 - - @pnpm/cli.utils@1101.0.22 - - @pnpm/config.reader@1101.16.0 - - @pnpm/error@1100.1.1 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-writer@1100.0.14 diff --git a/.changeset/changelogs/@pnpm!workspace.injected-deps-syncer@1100.0.31.md b/.changeset/changelogs/@pnpm!workspace.injected-deps-syncer@1100.0.31.md deleted file mode 100644 index bdf0f01226..0000000000 --- a/.changeset/changelogs/@pnpm!workspace.injected-deps-syncer@1100.0.31.md +++ /dev/null @@ -1,12 +0,0 @@ -## 1100.0.31 - -### Patch Changes - -- Updated dependencies: - - @pnpm/bins.linker@1100.0.25 - - @pnpm/error@1100.1.1 - - @pnpm/fetching.directory-fetcher@1100.0.28 - - @pnpm/installing.modules-yaml@1100.0.15 - - @pnpm/pkg-manifest.reader@1100.0.15 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.projects-reader@1101.0.22 diff --git a/.changeset/changelogs/@pnpm!workspace.project-manifest-reader@1100.0.23.md b/.changeset/changelogs/@pnpm!workspace.project-manifest-reader@1100.0.23.md deleted file mode 100644 index 70830c5485..0000000000 --- a/.changeset/changelogs/@pnpm!workspace.project-manifest-reader@1100.0.23.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1100.0.23 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/pkg-manifest.utils@1100.3.1 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-writer@1100.0.14 diff --git a/.changeset/changelogs/@pnpm!workspace.project-manifest-writer@1100.0.14.md b/.changeset/changelogs/@pnpm!workspace.project-manifest-writer@1100.0.14.md deleted file mode 100644 index a2bdeeccff..0000000000 --- a/.changeset/changelogs/@pnpm!workspace.project-manifest-writer@1100.0.14.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.14 - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!workspace.projects-filter@1100.0.35.md b/.changeset/changelogs/@pnpm!workspace.projects-filter@1100.0.35.md deleted file mode 100644 index b7c0bcad63..0000000000 --- a/.changeset/changelogs/@pnpm!workspace.projects-filter@1100.0.35.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1100.0.35 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 - - @pnpm/workspace.projects-graph@1100.0.31 - - @pnpm/workspace.projects-reader@1101.0.22 - - @pnpm/workspace.workspace-manifest-reader@1100.1.5 diff --git a/.changeset/changelogs/@pnpm!workspace.projects-graph@1100.0.31.md b/.changeset/changelogs/@pnpm!workspace.projects-graph@1100.0.31.md deleted file mode 100644 index 7b967901a5..0000000000 --- a/.changeset/changelogs/@pnpm!workspace.projects-graph@1100.0.31.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.31 - -### Patch Changes - -- Updated dependencies: - - @pnpm/resolving.npm-resolver@1103.1.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!workspace.projects-reader@1101.0.22.md b/.changeset/changelogs/@pnpm!workspace.projects-reader@1101.0.22.md deleted file mode 100644 index 8a1f0f9855..0000000000 --- a/.changeset/changelogs/@pnpm!workspace.projects-reader@1101.0.22.md +++ /dev/null @@ -1,9 +0,0 @@ -## 1101.0.22 - -### Patch Changes - -- Updated dependencies: - - @pnpm/cli.utils@1101.0.22 - - @pnpm/constants@1101.0.0 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.project-manifest-reader@1100.0.23 diff --git a/.changeset/changelogs/@pnpm!workspace.projects-sorter@1100.0.14.md b/.changeset/changelogs/@pnpm!workspace.projects-sorter@1100.0.14.md deleted file mode 100644 index a2bdeeccff..0000000000 --- a/.changeset/changelogs/@pnpm!workspace.projects-sorter@1100.0.14.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.14 - -### Patch Changes - -- Updated dependencies: - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!workspace.root-finder@1100.0.5.md b/.changeset/changelogs/@pnpm!workspace.root-finder@1100.0.5.md deleted file mode 100644 index 05a970ddbc..0000000000 --- a/.changeset/changelogs/@pnpm!workspace.root-finder@1100.0.5.md +++ /dev/null @@ -1,6 +0,0 @@ -## 1100.0.5 - -### Patch Changes - -- Updated dependencies: - - @pnpm/error@1100.1.1 diff --git a/.changeset/changelogs/@pnpm!workspace.state@1100.0.36.md b/.changeset/changelogs/@pnpm!workspace.state@1100.0.36.md deleted file mode 100644 index 701276d3ff..0000000000 --- a/.changeset/changelogs/@pnpm!workspace.state@1100.0.36.md +++ /dev/null @@ -1,7 +0,0 @@ -## 1100.0.36 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.reader@1101.16.0 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!workspace.workspace-manifest-reader@1100.1.5.md b/.changeset/changelogs/@pnpm!workspace.workspace-manifest-reader@1100.1.5.md deleted file mode 100644 index 6fd0e394e0..0000000000 --- a/.changeset/changelogs/@pnpm!workspace.workspace-manifest-reader@1100.1.5.md +++ /dev/null @@ -1,8 +0,0 @@ -## 1100.1.5 - -### Patch Changes - -- Updated dependencies: - - @pnpm/constants@1101.0.0 - - @pnpm/error@1100.1.1 - - @pnpm/types@1101.9.0 diff --git a/.changeset/changelogs/@pnpm!workspace.workspace-manifest-writer@1100.0.21.md b/.changeset/changelogs/@pnpm!workspace.workspace-manifest-writer@1100.0.21.md deleted file mode 100644 index 877dc2439a..0000000000 --- a/.changeset/changelogs/@pnpm!workspace.workspace-manifest-writer@1100.0.21.md +++ /dev/null @@ -1,11 +0,0 @@ -## 1100.0.21 - -### Patch Changes - -- Updated dependencies: - - @pnpm/config.parse-overrides@1100.1.2 - - @pnpm/config.version-policy@1100.1.12 - - @pnpm/constants@1101.0.0 - - @pnpm/lockfile.types@1100.0.19 - - @pnpm/types@1101.9.0 - - @pnpm/workspace.workspace-manifest-reader@1100.1.5 diff --git a/.changeset/changelogs/pacquet@12.0.0-beta.4.md b/.changeset/changelogs/pacquet@12.0.0-beta.4.md deleted file mode 100644 index 7953f6da93..0000000000 --- a/.changeset/changelogs/pacquet@12.0.0-beta.4.md +++ /dev/null @@ -1,91 +0,0 @@ -## 12.0.0-beta.4 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- Installing a workspace whose projects auto-install peer dependencies is substantially faster. Each round of the peer-hoist loop no longer scans the whole workspace once per project, so the cost of resolution grows with the workspace instead of with its square. - -- Installing a dependency chain whose packages carry peer dependencies no longer expands exponentially with the depth of the chain. A single project with a single such dependency could exhaust memory before finishing; it now resolves in tens of megabytes. - -- Fixed non-deterministic resolution on multi-project workspaces: two consecutive installs of the same inputs could bind peer-suffixed packages to different (still valid) providers, rewriting `pnpm-lock.yaml` on every install [#13567](https://github.com/pnpm/pnpm/issues/13567). - -- Installing a workspace now produces the same `pnpm-lock.yaml` every time. Two installs of the same workspace could previously bind a peer dependency to a different — still valid — version, which changed the lockfile without anything in the project changing. - -- An empty `http-proxy`, `https-proxy`, `proxy`, or `no-proxy` value — from the `.npmrc`, `pnpm-workspace.yaml`, the CLI, or the `HTTP_PROXY` / `HTTPS_PROXY` / `PROXY` / `NO_PROXY` environment variables — no longer fails the install with `ERR_PNPM_INVALID_PROXY`. Empty settings read as unset, so a shell exporting `HTTP_PROXY=` disables the proxy, and an empty `proxy=` in the `.npmrc` no longer suppresses `HTTPS_PROXY` [#13533](https://github.com/pnpm/pnpm/issues/13533). - - `proxy=false` in the `.npmrc` or `proxy: false` in `pnpm-workspace.yaml` now turns proxying off instead of being read as a proxy host named `false`. `false` and `null` on `https-proxy` / `http-proxy` / `no-proxy` read as unset, and on the command line they are ordinary host names, since a flag carries its value verbatim. - -- The env lockfile no longer pins `@pnpm/exe` alongside `pnpm` when the wanted pnpm version is 12 or newer. From v12 the unscoped `pnpm` package is itself the native executable, so `@pnpm/exe` is not published for it and resolving it would fail. The engine identity check now verifies the native binary through whichever package ships it. - -- Resolution on large peer-heavy workspaces got faster: a Bit workspace with 114 projects and ~21,000 lockfile entries resolves in ~13.4s instead of ~16.0s. The resolved dependency graph is unchanged. - -- Fixed nondeterministic peer bindings in large multi-project workspaces. - -- Resolving a workspace whose dependency chains are deep is faster: deciding which missing peer dependencies another project's resolution already covers now answers once per shared chain segment instead of once per report. - -- Peer resolution on large workspaces got faster: each hoist round now refreshes its view of the dependency graph from what the round changed instead of re-reading every resolved package. The resolved dependency graph is unchanged. - -- `pnpm install` no longer crashes on a machine whose system certificate store is empty or absent — for example a minimal container or build sandbox that ships no CA certificates [#13588](https://github.com/pnpm/pnpm/issues/13588). Such a system now falls back to the Mozilla root certificates bundled into the binary, the same set Node.js ships, so both offline and online installs work again. Certificates from the system store, `NODE_EXTRA_CA_CERTS`, and the `.npmrc` `ca` / `cafile` settings keep taking precedence whenever any of them is available. - -- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs. - -- `pnpm login` / `pnpm adduser` now read the `scope` setting from `pnpm-workspace.yaml`, the global `config.yaml`, and the `PNPM_CONFIG_SCOPE` environment variable, not only from the `--scope` command-line flag. When `scope` is configured, the granted token is keyed to that scope and the scope-to-registry mapping is recorded. `--scope` still takes precedence when both are set. Note that `scope` in an `.npmrc` is not read — pnpm keeps only auth and registry keys from that file. - -- Resolution spends less time in its final peer pass: the package-name cycle graph it consults is now derived once per package instead of once per occurrence of that package. - -- npm's `--prefix` is accepted as a spelling of `--dir`, and `--store` as a spelling of `--store-dir`, so `pnpm --prefix ../ run test` no longer fails with "unexpected argument '--prefix' found" [#13583](https://github.com/pnpm/pnpm/issues/13583). - -- pnpm now ships `node-gyp` again, so packages whose install scripts shell out to it build out of the box. Previously they failed with `spawn node-gyp ENOENT` unless a `node-gyp` was already on `PATH` — affecting `node-gyp-build` with no matching prebuild, `node-pre-gyp`, a plain `"install": "node-gyp rebuild"`, and any package shipping a `binding.gyp` without an install script. As in pnpm 11, the whole `node-gyp` dependency tree is resolved from pnpm's own lockfile when pnpm is released, so it is frozen per release rather than resolved on your machine, and `npm_config_node_gyp`, a workspace `node-gyp`, and a package's own `node-gyp` dependency all still take precedence. diff --git a/.changeset/changelogs/pacquet@12.0.0-rc.0.md b/.changeset/changelogs/pacquet@12.0.0-rc.0.md new file mode 100644 index 0000000000..f5ec0e5b07 --- /dev/null +++ b/.changeset/changelogs/pacquet@12.0.0-rc.0.md @@ -0,0 +1,29 @@ +## 12.0.0-rc.0 + +### Minor Changes + +- Running `pnpm setup`, `pnpm self-update`, or a command that modifies the global installation (such as `pnpm add --global`) through `sudo` now fails with `ERR_PNPM_SUDO_NOT_SUPPORTED` instead of silently operating on the root user's home directory. pnpm keeps global packages and configuration in the invoking user's home directory, so these commands never need root permissions. Read-only global commands (such as `pnpm bin --global`) still work under sudo. + +### Patch Changes + +- Archive entries whose paths use `\` as a separator are now read the same way pnpm reads them. A nested path spelled `bin\tool.js` by Windows publishing tooling resolves to `bin/tool.js`, and a path traversal spelled with backslashes is rejected instead of being stored verbatim. + +- Fixed `file:` dependencies not being re-copied when their source directory changed. A `file:` dependency is copied into the store at install time rather than symlinked, so editing the local package's files and running `pnpm install` again left the previous copy in place — the lockfile is unchanged by such an edit, so the install treated the tree as up to date. + +- Write blocked-build approval scaffolding to the discovered workspace manifest when using per-project lockfiles. + +- Concurrent installs sharing a global virtual store no longer fail with `failed to remove existing directory ... prior to swap: Directory not empty`, and no longer briefly remove a package directory another process is reading. + +- Fixed `link:` dependencies under `enableGlobalVirtualStore` so linked children are materialized and slots remain isolated by their resolved link targets. + +- A headless install (`--frozen-lockfile`) now creates the command shims for a publicly hoisted workspace package's `bin`, matching what a normal install already did and what pnpm's own headless install does. Previously those shims were missing until the next non-frozen install. + +- `pnpm fetch`, and any install run with `virtualStoreOnly`, no longer writes a `.pnp.cjs` loader under `nodeLinker: pnp`. These installs populate the virtual store without linking the project, so the loader would have claimed the project resolves out of a store it was never linked into. The importer links and `node_modules/.package-map.json` were already skipped; the PnP loader now follows the same rule. + +- Prevent pnpm from removing project files when `modulesDir` resolves to the project root. + +- Fixed `pnpm install` ignoring a `pnpm-lock.yaml` that carries a leading env lockfile document when the file has CRLF line endings or a UTF-8 byte order mark, as a `core.autocrlf` checkout on Windows produces. The lockfile was reported as broken with `multiple YAML documents detected` and every dependency was re-resolved from the registry [#13606](https://github.com/pnpm/pnpm/issues/13606). + +- When no directory above the project accepts a hard link — inside an AI agent sandbox that only grants write access to the project, or a container with just the project mounted writable — the default store is now created at `/node_modules/.pnpm-store` instead of in the pnpm home directory. In those environments the home store is either read-only or on another volume, which forces every package to be copied instead of hard linked [#13525](https://github.com/pnpm/pnpm/issues/13525). + +- A stray non-directory entry in `node_modules` no longer fails an install. Files placed next to the installed dependencies are skipped rather than reported as an unreadable manifest. diff --git a/.changeset/changelogs/pnpm@11.20.0.md b/.changeset/changelogs/pnpm@11.20.0.md deleted file mode 100644 index 090f057866..0000000000 --- a/.changeset/changelogs/pnpm@11.20.0.md +++ /dev/null @@ -1,71 +0,0 @@ -## 11.20.0 - -### Minor Changes - -- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. - - The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. - - That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. - - Packages resolved from a named registry are now recorded under registry-qualified keys (`@:`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. - - The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. - - ### If you use named registries - - Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. - - Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. - - There is no setting to keep the old behavior: the old shape is the vulnerability. - - Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. - - To use named registries, map your aliases in `pnpm-workspace.yaml`: - - ```yaml - namedRegistries: - work: https://npm.enterprise.example.com/ - ``` - - ### New built-in `npmjs:` alias - - `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: - - ```json - { "dependencies": { "left-pad": "npmjs:^1.3.0" } } - ``` - - `npm:` cannot do this — it is the alias protocol (`npm:@`) and resolves through whatever `registry` points at. - - **If you mirror or proxy npmjs, point the alias at your mirror:** - - ```yaml - namedRegistries: - npmjs: https://npm.internal.example.com/ - ``` - - Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. - - Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. - - Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. - - `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. - -### Patch Changes - -- An empty `http-proxy`, `https-proxy`, `proxy`, or `no-proxy` value — from the `.npmrc`, `pnpm-workspace.yaml`, the CLI, or the `HTTP_PROXY` / `HTTPS_PROXY` / `PROXY` / `NO_PROXY` environment variables — no longer fails the install with `ERR_PNPM_INVALID_PROXY`. Empty settings read as unset, so a shell exporting `HTTP_PROXY=` disables the proxy, and an empty `proxy=` in the `.npmrc` no longer suppresses `HTTPS_PROXY` [#13533](https://github.com/pnpm/pnpm/issues/13533). - - `proxy=false` in the `.npmrc` or `proxy: false` in `pnpm-workspace.yaml` now turns proxying off instead of being read as a proxy host named `false`. `false` and `null` on `https-proxy` / `http-proxy` / `no-proxy` read as unset, and on the command line they are ordinary host names, since a flag carries its value verbatim. - -- The env lockfile no longer pins `@pnpm/exe` alongside `pnpm` when the wanted pnpm version is 12 or newer. From v12 the unscoped `pnpm` package is itself the native executable, so `@pnpm/exe` is not published for it and resolving it would fail. The engine identity check now verifies the native binary through whichever package ships it. - -- `lexCompare` and `nerfDart` are now published as `@pnpm/text.ordinal-comparator` and `@pnpm/config.registry-auth-key`. Use these instead of `@pnpm/util.lex-comparator` and `@pnpm/config.nerf-dart`. - -- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs. - -- Dependency resolution is faster: package metadata is now filtered once per packument instead of once per dependency edge when `minimumReleaseAge` is active, and parsed semver versions and ranges are reused instead of re-parsed on every comparison. - -- Security: `pnpm rebuild` now refuses a lockfile whose `packages` key carries a path traversal in the package name (e.g. `../../../escaped@1.0.0`), instead of running that package's lifecycle scripts and linking its bins in a directory outside the virtual store. Such a name is rejected with `ERR_PNPM_INVALID_DEPENDENCY_NAME`. diff --git a/.changeset/inline-string-and-npmrc-key-utils.md b/.changeset/inline-string-and-npmrc-key-utils.md deleted file mode 100644 index b692c04dd5..0000000000 --- a/.changeset/inline-string-and-npmrc-key-utils.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@pnpm/text.ordinal-comparator": patch -"@pnpm/config.registry-auth-key": patch -"pnpm": patch ---- - -`lexCompare` and `nerfDart` are now published as `@pnpm/text.ordinal-comparator` and `@pnpm/config.registry-auth-key`. Use these instead of `@pnpm/util.lex-comparator` and `@pnpm/config.nerf-dart`. diff --git a/.changeset/ledger.yaml b/.changeset/ledger.yaml index c230c7c861..6292212c95 100644 --- a/.changeset/ledger.yaml +++ b/.changeset/ledger.yaml @@ -890,6 +890,11 @@ intents: - napi-explicit-settings - tidy-moons-repeat +"@pnpm/napi@12.0.0-rc.0": + dir: pnpm/npm/napi + intents: + - napi-global-virtual-store + - napi-resolve-full-metadata "@pnpm/network.auth-header@1101.1.4": dir: pnpm11/network/auth-header intents: @@ -1686,6 +1691,21 @@ pacquet@12.0.0-beta.4: - peer-cycle-graph-name-once - prefix-alias-of-dir - ship-node-gyp-with-the-rust-cli +pacquet@12.0.0-rc.0: + dir: pnpm/npm/pnpm + intents: + - backslash-entry-paths + - directory-dep-recopy + - fix-pacquet-allow-builds-workspace + - gvs-concurrent-slot-import + - gvs-link-deps-in-slots + - headless-hoisted-workspace-bins + - pnp-loader-virtual-store-only + - protect-workspace-root-modules-purge + - read-crlf-multi-document-lockfile + - refuse-sudo-global + - sandbox-store-path + - stray-node-modules-entry-no-longer-fails-install pnpm@11.13.0: dir: pnpm11/pnpm intents: diff --git a/.changeset/rebuild-depath-name-traversal.md b/.changeset/rebuild-depath-name-traversal.md deleted file mode 100644 index 75a0a47d3d..0000000000 --- a/.changeset/rebuild-depath-name-traversal.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@pnpm/building.after-install": patch -"pnpm": patch ---- - -Security: `pnpm rebuild` now refuses a lockfile whose `packages` key carries a path traversal in the package name (e.g. `../../../escaped@1.0.0`), instead of running that package's lifecycle scripts and linking its bins in a directory outside the virtual store. Such a name is rejected with `ERR_PNPM_INVALID_DEPENDENCY_NAME`. diff --git a/pnpm/crates/config/src/defaults.rs b/pnpm/crates/config/src/defaults.rs index 287893b5c7..3e779ddc28 100644 --- a/pnpm/crates/config/src/defaults.rs +++ b/pnpm/crates/config/src/defaults.rs @@ -252,7 +252,7 @@ pub fn default_fetch_retry_maxtimeout() -> u64 { /// can't drift apart. `pnpm bump` keeps this constant in sync with the /// version of the npm wrapper package (`pnpm/npm/pnpm/package.json`); /// the release workflow verifies the two match before building. -pub const PNPM_VERSION: &str = "12.0.0-beta.4"; +pub const PNPM_VERSION: &str = "12.0.0-rc.0"; pub fn default_fetch_timeout() -> u64 { pacquet_network::DEFAULT_FETCH_TIMEOUT_MS diff --git a/pnpm/npm/napi/package.json b/pnpm/npm/napi/package.json index 35ac558f53..f12e882d4b 100644 --- a/pnpm/npm/napi/package.json +++ b/pnpm/npm/napi/package.json @@ -1,7 +1,7 @@ { "name": "@pnpm/napi", "private": true, - "version": "12.0.0-beta.4", + "version": "12.0.0-rc.0", "description": "Node.js addon bindings for the pnpm v12 Rust engine (pacquet)", "keywords": [ "pnpm", diff --git a/pnpm/npm/pnpm/package.json b/pnpm/npm/pnpm/package.json index b5261b78e8..75e61c61e2 100644 --- a/pnpm/npm/pnpm/package.json +++ b/pnpm/npm/pnpm/package.json @@ -11,7 +11,7 @@ "./dist/node_modules/node-gyp/gyp/gyp" ] }, - "version": "12.0.0-beta.4", + "version": "12.0.0-rc.0", "description": "Fast, disk space efficient package manager", "keywords": [ "pnpm",