chore(release): pacquet 12.3.2 (#14520)

.changeset/anchored-links.md

@@ -1,5 +0,0 @@
----
-"pacquet": patch
----
-
-Sped up installs in large workspaces: the anchor for re-rendering workspace `link:` targets is now derived once per project instead of once per dependency edge, and project ordering hashes paths by their raw bytes [#14352](https://github.com/pnpm/pnpm/issues/14352).

.changeset/changelogs/@pnpm!napi@12.3.1.md

@@ -1 +0,0 @@
-## 12.3.1

.changeset/changelogs/@pnpm!napi@12.3.2.md

@@ -0,0 +1 @@
+## 12.3.2

.changeset/changelogs/pacquet@12.3.1.md

@@ -1,9 +0,0 @@
-## 12.3.1
-
-### Patch Changes
-
-- Sped up installs in large workspaces: the anchor for re-rendering workspace `link:` targets is now derived once per project instead of once per dependency edge, and project ordering hashes paths by their raw bytes [#14352](https://github.com/pnpm/pnpm/issues/14352).
-
-- After a self-update from pnpm 12.2 to 12.3, global commands such as `node`, `npm`, and `yarn` failed with `unexpected argument '--shim' found`. Global commands now launch normally, and their first launch migrates the global bin directory to native shims. When self-update downgrades to pnpm 12.2 or older, it keeps the newer native shims so those commands continue to work.
-
-- Sped up installs in large workspaces. The check that verifies each project against the lockfile now runs the projects in parallel [#14352](https://github.com/pnpm/pnpm/issues/14352).

.changeset/changelogs/pacquet@12.3.2.md

@@ -0,0 +1,41 @@
+## 12.3.2
+
+### Patch Changes
+
+- `pnpm audit --fix update` no longer aborts when a vulnerable package has no safe version inside its declared range [#14508](https://github.com/pnpm/pnpm/issues/14508). The run updates every package it can and lists the rest as remaining.
+
+- `pnpm install` no longer reruns root lifecycle scripts when the global virtual store contains an unfinished-build marker in a package slot that the current lockfile does not use [pnpm/pnpm#14485](https://github.com/pnpm/pnpm/issues/14485).
+
+- Sped up installs that have no lockfile. pnpm now links packages whose dependency subtree has no peer dependencies into the virtual store while resolution is still running.
+
+- `pnpm run` and `pnpm exec` now start without reinstalling on filesystems that keep sub-millisecond mtimes, such as NTFS. Previously, every run on those filesystems reinstalled first [pnpm/pnpm#14486](https://github.com/pnpm/pnpm/issues/14486).
+
+- `pnpm import` now keeps the versions recorded in `package-lock.json`, `npm-shrinkwrap.json`, or `yarn.lock` when it generates `pnpm-lock.yaml`. A range in `package.json`, a catalog, or an override still decides which versions are eligible, and the recorded version is preferred among them. The generated lockfile previously could pin newer versions than the source lockfile [#14476](https://github.com/pnpm/pnpm/issues/14476).
+
+  `pnpm import` in a workspace now imports every workspace project into the shared lockfile. It previously imported only the project in the current directory.
+
+  `pnpm import` now fails with `ERR_PNPM_LOCKFILE_NOT_FOUND` when none of the three source lockfiles is present. It also fails with `ERR_PNPM_YARN_LOCKFILE_PARSE_FAILED` when it cannot parse `yarn.lock`. It previously generated a lockfile from scratch in both cases.
+
+  `pnpm import` always resolves locally. It warns when `--pnpr-server` or the `pnpr-server` setting is given and does not use the server.
+
+- Sped up installs in large workspaces. Discovering the workspace projects no longer enumerates every matched directory to learn which manifest files it holds [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- Sped up installs in large workspaces. The resolver and the peer pass allocate less for every dependency edge [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- `pnpm self-update`, `pnpm with`, and automatic package-manager version switching no longer wait through registry retry delays when a configured registry has no signatures and `registry.npmjs.org` is unavailable [#14483](https://github.com/pnpm/pnpm/issues/14483).
+
+- Sped up installs in large workspaces. Saving the lockfile is faster, and the install finishes without waiting for memory cleanup [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- `pnpm install` now relinks workspace packages when `publishConfig.linkDirectory` changes. Frozen installs report an outdated lockfile until it is regenerated [pnpm/pnpm#14488](https://github.com/pnpm/pnpm/issues/14488).
+
+- The pnpm npm wrapper keeps its placeholder shebang-less so pnpm 11 can install pnpm 12 through the version store. Wrapper installs must allow lifecycle scripts to install the native binary [#14502](https://github.com/pnpm/pnpm/issues/14502).
+
+- Sped up dependency resolution when there is no lockfile, and for the dependencies a lockfile does not cover.
+
+- Sped up installs in large workspaces. Workspace `link:` targets and importer ids are now derived from the paths' suffixes under the workspace root [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- `pnpm install` now reports "Already up to date" when local tarball dependencies have not changed [#14495](https://github.com/pnpm/pnpm/issues/14495).
+
+- `pnpm update` now accepts `--ignore-scripts` and skips lifecycle scripts during the update [pnpm/pnpm#14512](https://github.com/pnpm/pnpm/issues/14512).
+
+- Sped up installs that restore a deleted `node_modules` from a warm global virtual store. pnpm no longer re-links packages that are already fully present in the global virtual store [#14510](https://github.com/pnpm/pnpm/issues/14510).

.changeset/ledger.yaml

@@ -3567,6 +3567,25 @@ pacquet@12.3.1:
     - anchored-links
     - legacy-shim-dispatch-compat
     - quiet-install-tail
+pacquet@12.3.2:
+  dir: pnpm/npm/pnpm
+  intents:
+    - audit-fix-update-keeps-going
+    - calm-slots-rest
+    - early-materialization
+    - fix-pacquet-validated-timestamp
+    - import-keeps-foreign-lockfile-versions
+    - lean-discovery
+    - leaner-edges
+    - quick-signature-fallback
+    - quiet-teardown
+    - relink-publish-directories
+    - repair-native-pnpm-shims
+    - resolver-recursive-warmup
+    - string-space-anchors
+    - unchanged-local-tarballs
+    - update-ignore-scripts
+    - warm-gvs-restore
 pnpm@11.13.0:
   dir: pnpm11/pnpm
   intents:

.changeset/legacy-shim-dispatch-compat.md

@@ -1,5 +0,0 @@
----
-"pacquet": patch
----
-
-After a self-update from pnpm 12.2 to 12.3, global commands such as `node`, `npm`, and `yarn` failed with `unexpected argument '--shim' found`. Global commands now launch normally, and their first launch migrates the global bin directory to native shims. When self-update downgrades to pnpm 12.2 or older, it keeps the newer native shims so those commands continue to work.

.changeset/quiet-install-tail.md

@@ -1,5 +0,0 @@
----
-"pacquet": patch
----
-
-Sped up installs in large workspaces. The check that verifies each project against the lockfile now runs the projects in parallel [#14352](https://github.com/pnpm/pnpm/issues/14352).

pnpm/crates/config/src/defaults.rs

@@ -327,7 +327,7 @@ pub fn default_fetch_retry_maxtimeout() -> u64 {
 /// can't drift apart. `pnpm bump` keeps this constant in sync with the
 /// version of the npm wrapper package (`pnpm/npm/pnpm/package.json`);
 /// the release workflow verifies the two match before building.
-pub const PNPM_VERSION: &str = "12.3.1";
+pub const PNPM_VERSION: &str = "12.3.2";
 
 /// The command that installs pnpm with the standalone script, as documented
 /// at <https://pnpm.io/installation>: the PowerShell form on Windows, the

pnpm/npm/napi/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pnpm/napi",
   "private": true,
-  "version": "12.3.1",
+  "version": "12.3.2",
   "description": "Node.js addon bindings for the pnpm v12 Rust engine (pacquet)",
   "keywords": [
     "pnpm",

pnpm/npm/pnpm/package.json

@@ -11,7 +11,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.3.1",
+  "version": "12.3.2",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",