* fix: store every Node.js artifact's integrity separately in the lockfile
* fix: store every Node.js artifact's integrity separately in the lockfile
* style: fix
* Potential fix for code scanning alert no. 76: Incomplete string escaping or encoding
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* fix: windows
* refactor: node install
* fix: test
* fix: test on Windows
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* feat: changes local-resolver to support absolute paths
Previously absolute paths were being turned to relative paths, but if the file:
specifier is 'file:/path/to/file', and the users are using a shared network
storage, this relative path requires that the users all use the same
local folder structure. Instead, using an absolute path as the specifier
allows them to have the source code anywhere, and the absolute path will
be resolved consistently.
Enabled via the `preserveAbsolutePaths` option.
* chore: changeset
* feat: add preserve absolute paths option
* docs: add changesets
* fix: also update the 'dependencyPath', add test for that case
---------
Co-authored-by: Zoltan Kochan <z@kochan.io>
* chore: `package.json` add type field
* chore: add type field to every package.json
* chore: add type field to every package.json
---------
Co-authored-by: Zoltan Kochan <z@kochan.io>
* fix(git-resolver): handle private git repo resolution
In the case where:
1. No git auth token was specified by the user
2. The package requested to be fetched via https
3. The user does not have SSH access to the repo but has HTTPS access
4. The package was hosted in a private GitHub repo
pnpm would fallback to using SSH since it was a "likely private repo"
and would fail to resolve the package. Now, rather than only checking if
there is an auth token specified, it also checks both:
1. Is the repo private
2. Does the user have access to ls-remote it.
And if these conditions are true, it tries to use https anyway.
This matches the behavior of npm and Yarn berry. Yarn classic also has
this bug, and there's a code comment that alludes to it.
