Commit Graph

913 Commits

Author SHA1 Message Date
Zoltan Kochan
8afbb15984 fix: prevent path traversal by validating bin names 2026-01-16 01:53:24 +01:00
btea
6e4b09415f fix: make catalog protocol matching error messages clearer (#10052)
* fix: verify in advance whether the specifier that the catalog pkg is valid

* fix: update error message

* test: update

* Update resolving/default-resolver/src/index.ts

Co-authored-by: Brandon Cheng <gluxon@users.noreply.github.com>

---------

Co-authored-by: Brandon Cheng <gluxon@users.noreply.github.com>
2026-01-16 01:53:08 +01:00
Zoltan Kochan
91a241e692 chore(release): 10.28.0 2026-01-09 23:47:40 +01:00
Brandon Cheng
ff4747f6c2 feat: improve filtered install performance
with an optimistic lookup of package metadata from store (#10408)
2026-01-09 19:56:51 +01:00
Zoltan Kochan
6bdba72ad3 chore(release): 10.27.0 2025-12-30 21:49:41 +01:00
Brandon Cheng
6eb43b356c fix: pnpm add incorrectly modifies a catalog entry in pnpm-workspace.yaml to its exact version (#10370)
* refactor: factor out a `getRealNameAndSpec` function

* test: `pnpm add` does not modify existing catalog entries

* fix: resolve preferred version without mutating bare specifier

close #9759
2025-12-29 02:07:59 +01:00
Brandon Cheng
5d983ba175 fix: handle npm aliases without a bare specifier in unwrapPackageName (#10374)
* refactor: factor out a `getRealNameAndSpec` function

* fix: handle npm aliases without a bare specifier in `unwrapPackageName`

* Fix formatting in unwrapPackageName.ts
2025-12-29 02:07:53 +01:00
Brandon Cheng
25d7e790f8 refactor: factor out a getRealNameAndSpec function (#10369) 2025-12-29 02:07:46 +01:00
btea
3f2c5f4d39 feat: add trustPolicyIgnoreAfter (#10359)
* feat: add `trustPolicyIgnoreAfter`

* Update .changeset/big-lies-pump.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* refactor: npm-resolver

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-12-28 02:03:56 +01:00
Zoltan Kochan
9a2393f67e feat: enable injected local packages to work with global virtual store (#10366)
* feat: enable injected local packages to work with global virtual store

by leveraging `pkgLocationsByDepPath` for `file:` dependencies.

* fix: populate `pkgLocationsByDepPath` directly for directory dependencies in the graph builder

* refactor: store directory dependencies as a Map instead of an object

* refactor: improve file: dependency target directory resolution

by prioritizing `directoryDepsByDepPath` and providing a lockfile fallback.

* refactor: remove `pkgLocationsByDepPath` from hoisted dependency graph generation parameters

* test: fix

* test: fix

* refactor: simplify directory lookup for injected workspace packages

by directly using the dependency graph

* refactor: move extendProjectsWithTargetDirs to headless module and update imports

* refactor: make `directoryDepsByDepPath` required

in `LockfileToDepGraphOptions` and remove its nullish coalescing in headless

* refactor: directory dependency tracking

by renaming `directoryDepsByDepPath` to `injectionTargetsByDepPath`
and extracting related logic, and remove an unused export.

* docs: add changesets

* fix: implemented CR suggestions
2025-12-27 12:28:09 +01:00
Zoltan Kochan
0958027f88 feat: enhance store prune to clean global virtual store (#10360)
* feat: enhance `store prune` to clean global virtual store

`pnpm store prune` will now clean the global virtual store
via a new project registry and mark-and-sweep garbage collection.

* test: add store prune test for transitive dependency preservation

* refactor: extract global virtual store pruning logic to a new file

* fix: improve symlink handling in global virtual store pruning

* fix: optimize removal of unreachable packages in global virtual store

* fix: refine project registry error handling

Throw `PnpmError` for inaccessible projects
and specifically clean up stale symlinks for `ENOENT` errors.

* test: create virtual store with install command

* refactor: standardize global virtual store directory structure

by placing unscoped packages under an `@` scope.

* test: update store prune tests to use `toContain` and `not.toContain` assertions`

* fix: linting issues

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: implemented CR suggestions

* fix: revert not needed change

* fix: use `is-subdir` to accurately determine if symlink targets

are within the global virtual store.

* revert: changes in package.json files

* test: add `--config.ci=false` to store prune tests
2025-12-26 02:07:48 +01:00
Zoltan Kochan
8ec7939657 chore(release): 10.26.2 2025-12-23 14:34:19 +01:00
Zoltan Kochan
f9d53286e5 fix: compile 2025-12-23 12:45:14 +01:00
Zoltan Kochan
914f2e5e3e fix: linking commands of engines (#10354)
close #10244
2025-12-23 12:31:42 +01:00
Zoltan Kochan
cdd1fcd1fc fix(git-resolver): installing git-hosted dependency using annotated tags (#10349)
close #10335
2025-12-23 12:31:19 +01:00
月正海角
71624c9384 feat: improve error message for versions not meeting minimumReleaseAge (#10350)
close #10307
2025-12-23 12:31:08 +01:00
btea
cb9f72c658 fix: install absolute path pkg failed (#9888) 2025-12-23 12:30:07 +01:00
Zoltan Kochan
4986c46b48 chore(release): 10.26.1 2025-12-19 01:48:40 +01:00
Zoltan Kochan
d068fcf281 fix: the add command should not fail, when blockExoticSubdeps is true (#10327)
close #10324
2025-12-17 12:16:39 +01:00
klassiker
aba18acafd fix(git-fetcher): ensure the specified commit is used after checkout (#10310)
* fix(git-fetcher): ensure the specified commit is used after checkout

* fix(git-resolver): always resolve to a full commit

* chore: add changeset heavy-dragons-start

* test: fix related test case

* test: fix some other test that gets stuck

* Update heavy-dragons-start.md with PR reference

Add reference to pull request #10310 for clarity.
2025-12-17 12:16:31 +01:00
Zoltan Kochan
244e33b4e9 chore(release): 10.26.0 2025-12-15 12:10:26 +01:00
Oren
73cc63504d feat: support blockExoticSubdeps option to disallow non-trusted dep sources in subdeps (#10265)
* feat(core): add onlyRegistryDependencies option to disallow non-registry subdependencies

* fix: onlyRegistryDependencies=>registrySubdepsOnly

* fix: allow resolution from custom resolver

* fix: add registry-subdeps-only to types

* docs: update changesets

* refactor: registry-only

* refactor: registrySubdepsOnly=>blockExoticSubdeps

* fix: trust runtime deps

* refactor: remove comment

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-12-10 12:22:37 +01:00
Zoltan Kochan
7d0e7e855e test: fix 2025-12-10 12:15:55 +01:00
Oren
40775391d5 fix(git-fetcher): block git dependencies from running prepare scripts unless allowed (#10288)
* fix(git-fetcher): block git dependencies from running prepare scripts unless allowed

* Update exec/prepare-package/src/index.ts

Co-authored-by: Zoltan Kochan <z@kochan.io>

* Also implement in gitHostedTarballFetcher

* refactor: move allowBuild function creation to the store manager

* refactor: pass allowBuild function to fetch function directly

* refactor: revert not needed changes and update changesets

* test: fix

* fix: implemented CR suggestions

* test: fix

* test: fix

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-12-10 00:51:43 +01:00
Oren
b7d3ec65b1 fix(tarball-resolver): add integrity hash to HTTP tarball dependencies (#10287)
* fix(tarball-resolver): add integrity hash to HTTP tarball dependencies

* Refactor to download tarball just once

* Fix tests

* fix: only calc hash when it is not passed in to the fetcher

* docs: update changesets
2025-12-10 00:49:50 +01:00
Zoltan Kochan
b0cd2dea48 chore(release): 10.25.0 2025-12-08 15:33:42 +01:00
Zoltan Kochan
17d34fab8c fix: don't silently skip an optional dependency if it cannot be resolved from a mature version (#10289)
close #10270
2025-12-08 15:26:51 +01:00
Zoltan Kochan
9b05bdd7e1 fix: reporting ignored dependency builds (#10276) 2025-12-06 16:43:42 +01:00
Zoltan Kochan
7c15c93c26 chore(release): libs 2025-12-02 16:02:38 +01:00
Zoltan Kochan
033a2561eb fix: dependencies that were added to onlyBuiltDependencies should be built on install (#10256) 2025-12-02 15:36:29 +01:00
Zoltan Kochan
16d08d0cb0 chore(release): 10.24.0 2025-11-27 14:53:58 +01:00
Brandon Cheng
3631b01697 fix: throw a frozen lockfile error when catalogs change (#10231)
close #9369
2025-11-26 01:13:54 +01:00
Zoltan Kochan
463f30ccfb perf: increase the default network concurrency on machines with many CPU cores (#10215)
close #10068
2025-11-22 02:39:14 +01:00
Zoltan Kochan
603aedae0a chore(release): 10.23.0 2025-11-20 14:46:54 +01:00
Zoltan Kochan
43c56d9e7e fix: don't silently skip an optional dependency if if fails trust policy check (#10211)
close #10208
2025-11-20 14:21:13 +01:00
btea
234c5b4634 refactor: add createPackageVersionPolicyByExclude (#10194) 2025-11-18 11:53:21 +01:00
Zoltan Kochan
1de6d19f59 chore(release): 10.22.0 2025-11-12 14:13:12 +01:00
Ryo Matsukawa
93d49548ca feat: add support for trustPolicyExclude (#10168)
close #10164
2025-11-11 13:01:56 +01:00
Zoltan Kochan
2e2dc27d07 chore(release): 10.21.0 2025-11-09 23:45:04 +01:00
Ryo Matsukawa
68ad0868b4 feat: add support for npm package trust evidence check via a new trustPolicy setting (#10103)
close #8889

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-11-09 23:32:56 +01:00
Trevor Burnham
17344ca27f fix(update): prevent package.json updates when updating indirect dependencies (#5118) (#10155)
close #5118
2025-11-06 15:14:36 +01:00
Zoltan Kochan
f1ee865bc5 fix: compile 2025-10-31 17:26:59 +01:00
Zoltan Kochan
5847af412b feat: install js runtime as prod dependency (#10141) 2025-10-31 17:15:38 +01:00
Zoltan Kochan
49f03d14ee chore(release): 10.20.0 2025-10-28 17:35:21 +01:00
Zoltan Kochan
d9bcd616ea chore(release): 10.19.1-oidc-test.3 2025-10-24 01:36:02 +02:00
Zoltan Kochan
0cde1287c8 chore: update repository fields 2025-10-23 11:57:12 +02:00
Zoltan Kochan
e5ac91fa67 chore(release): 10.19.1-oidc-test.0 2025-10-23 10:30:03 +02:00
Zoltan Kochan
43d7b18c2f chore(release): 10.19.0 2025-10-21 15:30:20 +02:00
Zoltan Kochan
dee39ecb8a feat: support allowing the build of specific versions of dependencies (#10104)
close #10076
2025-10-21 12:38:16 +02:00
Ryo Matsukawa
7c1382f7b7 feat: add support for exact versions in minimumReleaseAgeExclude (#10059)
close #9985

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-10-18 11:10:08 +02:00