* chore(release): 11.28.5, pacquet 12.10.0
* docs(release): curate the 11.28.5 and 12.10.0 release notes
Add a lead paragraph to each page and group the patch entries under
subject headings, with the security fixes first.
- Merge the unpublish path-boundary fix into the unpublish entry, the
legacy metadata cache prune into the metadata cache entry, the two
binary size entries, and the two 64 MiB archive limits on the v11 page.
- Drop the manifest-utils saveType entry from the CLI page: the CLI
only passes saveType values derived from its own flags, so no CLI user
can reach the fixed path.
- Rewrite mechanism-only entries (PAX header validation, bundled
dependency symlinks, custom resolutions under name@version keys, proxy
setting validation) in terms of what the user sees.
- Use one link style for pnpm/pnpm issues.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(store): coordinate concurrent read-only index access
* test(cli): avoid race in concurrency assertion
wait_for_holders already proves that both tasks hold their slots before
release. The later overlap marker assertion races with release_holders
removing the markers before the scripts inspect them.
Clarify that ordinary concurrent installs and frozen-lockfile allow shared
store writes; only frozenStore requires an immutable store.
* fix(store): preserve immutable reader compatibility
Keep the published ReadOnlyStoreIndex contract for finalized read-only stores.
Expose ConcurrentReadOnlyStoreIndex for readers alongside active writers.
This fixes the shared-store use case without requiring immutable callers
to migrate in a patch release.
* fix(store): configure readers through prepared statements
* test(proxy): use local certificate fixtures
* fix(store)!: coordinate read-only index access
Use the normal WAL-aware connection for ReadOnlyStoreIndex and reserve
ImmutableStoreIndex for frozen stores. Update every frozen-store caller.
The maintainer requested a major release of `@pnpm/store.index` so existing
shared-store consumers receive the safe default when upgrading.
The pnpm CLI and internal consumers retain patch releases.
BREAKING CHANGE: Callers using ReadOnlyStoreIndex for a finalized store on
a read-only filesystem must switch to ImmutableStoreIndex.
* test(store): follow updated variable naming rules
`getAgent` and `getProxyAgent` keyed their agent caches on
`Boolean(strictSsl)`, which maps an omitted strictSsl and an explicit
false to the same key. Node.js verifies certificates when
rejectUnauthorized is omitted, so an insecure agent cached first was
handed to later callers that expected verification. The keys also left
out maxSockets and timeout, so a caller got an agent with another
caller's connection settings.
Both factories now resolve strictSsl, maxSockets, and timeout to their
effective values once, and use those values in the key and the agent.
`pickSettingByUrl` checked candidate keys by truthiness and skipped
settings whose value is false, 0, or an empty string. It now checks
whether the key exists. Its port-stripping fallback appended the slash
after the query string, which turned `/path?a=1` into a URL whose path
was lost when mapped to a registry key. The slash now goes on the path.
None of these packages is used by the pnpm CLI.
The remaining packages of the pnpm/components Bit workspace now live
under pnpm11/ and are published from here, keeping their npm names:
@pnpm/config.env-replace -> pnpm11/config/env-replace
@pnpm/log.group -> pnpm11/log/group
@pnpm/network.agent -> pnpm11/network/agent
@pnpm/network.ca-file -> pnpm11/network/ca-file
@pnpm/network.config -> pnpm11/network/config
@pnpm/network.proxy-agent -> pnpm11/network/proxy-agent
@pnpm/os.env.path-extender -> pnpm11/os/env/path-extender
@pnpm/os.env.path-extender-posix -> pnpm11/os/env/path-extender-posix
@pnpm/os.env.path-extender-windows -> pnpm11/os/env/path-extender-windows
lex-comparator and nerf-dart were already moved under new names, and the
Bit env component is build tooling with no counterpart here.
The sources are carried over from pnpm/components at 42ec0f7, which
includes the Windows fix that rewrites a PNPM_HOME value stored with the
wrong registry type. pnpm v12 got the same fix in pnpm/pnpm#15746, so
its changeset now also covers pnpm v11, which bundles the workspace copy.
Porting to the monorepo's ES module setup:
- relative imports carry .js and type re-exports are marked `type`;
- tests use jest.unstable_mockModule and import through the package;
- string.prototype.matchall and graceful-fs give way to built-ins;
- safe-execa and lru-cache move to the catalog versions (0.3, 11);
- network.config depends on @pnpm/config.registry-auth-key;
- the strict-ssl proxy test uses node:https and proxy v4 instead of
node-fetch and proxy v1.
The packages start at 1100.0.0 to sit in the pnpm11 version band.
