The pnpm 10 self-update handler passed the general resolved configuration to both the package resolver and the engine identity verifier. Workspace settings can preserve otherwise unknown runtime keys, so repository configuration could overwrite the internal package-manager registry and the verifier's test-only trusted-key override.
Construct resolver and installer options from the dedicated package-manager bootstrap configuration, which is captured from non-project sources before workspace settings are merged. Move the shared bootstrap helper into `@pnpm/config` so automatic version switching and self-update use the same boundary. Pass unsigned-fixture keys through a separate explicit test argument instead of the runtime command options.
Also skip automatic loading of the default project pnpmfile for self-update, while preserving its behavior for other commands. Add regressions for registry redirection, identity-verification bypass, trusted bootstrap config, and pnpmfile loading.
* fix: `shamefullyHoist` set via `updateConfig` in `.pnpmfile.cjs`
* refactor: consolidate derived config processing to cli-utils
Move shamefullyHoist → publicHoistPattern conversion from
config/config to cli-utils/getConfig.ts as suggested in review.
* test(config): update tests for derived config processing move
* refactor: move applyDerivedConfig to cli-utils
* refactor: move applyDerivedConfig to cli-utils
* test: use unit test for hoist: false in cli-utils
* revert: not needed changes
close#10271
* fix: fix packageManager field not working with prerelease version
* fix: remove hash from packageManager reference
* test: install should not fail for packageManager field with hash
* fix: packageManager field may contain URL instead of semver
corepack uses `URL.canParse()` to check if a given value is a URL or semver,
which was only added in recent Node versions and
is not supported by all node versions `"node" >= "18.12"` that pnpm supports.
So instead, we check if the value contains ':'
as it may not appear on semver, while it must appear on URL.
* test: install should not fail for packageManager field with url
* test: checking prerelease versions in package-is-installable
* fix: typo
---------
Co-authored-by: Zoltan Kochan <z@kochan.io>
* feat!: check the packageManager field
* test: fix
* refactor: update error message to match what corepack prints
* feat: add pm-strict option
* refactor: pm-strict=>package-manager-strict
* fix: remove packageManager field from package.json on publish
Zoltan Kochan