Commit Graph

431 Commits

Author SHA1 Message Date
Zoltan Kochan
6ca07ffbe6 fix: normalize Windows backslash path traversal attempts in tarball entry filenames
to prevent security vulnerabilities.
2026-01-16 01:53:31 +01:00
Zoltan Kochan
91a241e692 chore(release): 10.28.0 2026-01-09 23:47:40 +01:00
Brandon Cheng
ff4747f6c2 feat: improve filtered install performance
with an optimistic lookup of package metadata from store (#10408)
2026-01-09 19:56:51 +01:00
Zoltan Kochan
7e0879443b fix: prevent circular symlinks in projects registry (#10432)
close #10411
2026-01-09 19:29:17 +01:00
Zoltan Kochan
6bdba72ad3 chore(release): 10.27.0 2025-12-30 21:49:41 +01:00
Zoltan Kochan
fa2a02b29e test: fix 2025-12-30 18:40:05 +01:00
Junius Chen
1c1053308f fix(store): return only directory names when clean expired cache (#10384)
* fix(store): return only directory names when clean expired cache

* docs: add changeset

* test: clean dlx cache

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-12-30 18:03:48 +01:00
btea
3f2c5f4d39 feat: add trustPolicyIgnoreAfter (#10359)
* feat: add `trustPolicyIgnoreAfter`

* Update .changeset/big-lies-pump.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* refactor: npm-resolver

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-12-28 02:03:56 +01:00
Zoltan Kochan
b1ea7e09bd test: skip 2025-12-27 16:09:21 +01:00
Zoltan Kochan
c78216e0bb test: fix on Windows 2025-12-27 12:27:52 +01:00
Zoltan Kochan
0958027f88 feat: enhance store prune to clean global virtual store (#10360)
* feat: enhance `store prune` to clean global virtual store

`pnpm store prune` will now clean the global virtual store
via a new project registry and mark-and-sweep garbage collection.

* test: add store prune test for transitive dependency preservation

* refactor: extract global virtual store pruning logic to a new file

* fix: improve symlink handling in global virtual store pruning

* fix: optimize removal of unreachable packages in global virtual store

* fix: refine project registry error handling

Throw `PnpmError` for inaccessible projects
and specifically clean up stale symlinks for `ENOENT` errors.

* test: create virtual store with install command

* refactor: standardize global virtual store directory structure

by placing unscoped packages under an `@` scope.

* test: update store prune tests to use `toContain` and `not.toContain` assertions`

* fix: linting issues

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: implemented CR suggestions

* fix: revert not needed change

* fix: use `is-subdir` to accurately determine if symlink targets

are within the global virtual store.

* revert: changes in package.json files

* test: add `--config.ci=false` to store prune tests
2025-12-26 02:07:48 +01:00
Zoltan Kochan
8ec7939657 chore(release): 10.26.2 2025-12-23 14:34:19 +01:00
Zoltan Kochan
914f2e5e3e fix: linking commands of engines (#10354)
close #10244
2025-12-23 12:31:42 +01:00
Zoltan Kochan
4986c46b48 chore(release): 10.26.1 2025-12-19 01:48:40 +01:00
Zoltan Kochan
244e33b4e9 chore(release): 10.26.0 2025-12-15 12:10:26 +01:00
Oren
40775391d5 fix(git-fetcher): block git dependencies from running prepare scripts unless allowed (#10288)
* fix(git-fetcher): block git dependencies from running prepare scripts unless allowed

* Update exec/prepare-package/src/index.ts

Co-authored-by: Zoltan Kochan <z@kochan.io>

* Also implement in gitHostedTarballFetcher

* refactor: move allowBuild function creation to the store manager

* refactor: pass allowBuild function to fetch function directly

* refactor: revert not needed changes and update changesets

* test: fix

* fix: implemented CR suggestions

* test: fix

* test: fix

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-12-10 00:51:43 +01:00
Oren
b7d3ec65b1 fix(tarball-resolver): add integrity hash to HTTP tarball dependencies (#10287)
* fix(tarball-resolver): add integrity hash to HTTP tarball dependencies

* Refactor to download tarball just once

* Fix tests

* fix: only calc hash when it is not passed in to the fetcher

* docs: update changesets
2025-12-10 00:49:50 +01:00
Zoltan Kochan
b0cd2dea48 chore(release): 10.25.0 2025-12-08 15:33:42 +01:00
Zoltan Kochan
7c15c93c26 chore(release): libs 2025-12-02 16:02:38 +01:00
Zoltan Kochan
16d08d0cb0 chore(release): 10.24.0 2025-11-27 14:53:58 +01:00
Zoltan Kochan
603aedae0a chore(release): 10.23.0 2025-11-20 14:46:54 +01:00
Zoltan Kochan
32dae0276b fix: store prune should not fail if the store contains Node.js (#10193)
close #10131
2025-11-18 11:52:46 +01:00
Zoltan Kochan
1de6d19f59 chore(release): 10.22.0 2025-11-12 14:13:12 +01:00
Ryo Matsukawa
93d49548ca feat: add support for trustPolicyExclude (#10168)
close #10164
2025-11-11 13:01:56 +01:00
Zoltan Kochan
2e2dc27d07 chore(release): 10.21.0 2025-11-09 23:45:04 +01:00
Ryo Matsukawa
68ad0868b4 feat: add support for npm package trust evidence check via a new trustPolicy setting (#10103)
close #8889

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-11-09 23:32:56 +01:00
Zoltan Kochan
49f03d14ee chore(release): 10.20.0 2025-10-28 17:35:21 +01:00
Zoltan Kochan
0cde1287c8 chore: update repository fields 2025-10-23 11:57:12 +02:00
Zoltan Kochan
43d7b18c2f chore(release): 10.19.0 2025-10-21 15:30:20 +02:00
Ryo Matsukawa
7c1382f7b7 feat: add support for exact versions in minimumReleaseAgeExclude (#10059)
close #9985

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-10-18 11:10:08 +02:00
Zoltan Kochan
1bfc105da0 chore(release): 10.18.3 2025-10-14 11:27:45 +02:00
Zoltan Kochan
1b15e45ae9 chore(release): 10.18.2 2025-10-09 16:56:04 +02:00
Zoltan Kochan
6618431aee chore(release): libs 2025-09-29 11:56:00 +02:00
Luis Hebendanz
9b9faa5c24 fix: retry filesystem operations on EAGAIN (#9959)
* fix: retry filesystem operations on EAGAIN

filesystem operations can raise EAGAIN to tell the application to try
again later. This is especially often the case under ZFS.

fix: move wrapped functions to graceful-fs directly

* fix: retry filesystem operations on EAGAIN

* fix: retry filesystem operations on EAGAIN

* fix: indexed-pkg-importer

* test: fix

* docs: add changeset

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-09-29 09:32:43 +02:00
Zoltan Kochan
fb4da0c0ab feat: print a warning if network requests are slow (#10025)
* feat: print a warning if network requests are slow

* feat: print a warning if network requests are slow

add a new setting for fetch tarball speed

* feat: print a warning if network requests are slow

* fix: src/fetch.ts

* docs: add changeset
2025-09-28 11:19:10 +02:00
Zoltan Kochan
f6242c333b chore(release): 10.17.1 2025-09-22 15:09:34 +02:00
Zoltan Kochan
1a1a272fa4 chore(release): 10.17.0 2025-09-17 16:48:25 +02:00
Zoltan Kochan
ea44ff979f chore(release): 10.16.1 2025-09-13 19:20:27 +02:00
Zoltan Kochan
a3c1498403 chore(release): 10.16.0 2025-09-12 14:24:30 +02:00
Zoltan Kochan
38e2599ecd feat: set minimumReleaseAge to delay new versions of dependencies from being installed (#9957)
close #9921
2025-09-11 17:25:11 +02:00
Zoltan Kochan
3d1711a439 chore(release): 10.15.1 2025-09-01 11:41:05 +02:00
btea
a42e9ff1fc perf: replace indexOf with startsWith (#9902) 2025-08-26 23:48:20 +02:00
Zoltan Kochan
979ce80c87 chore(release): 10.15.0 2025-08-19 17:50:28 +02:00
Zoltan Kochan
facd7656e8 refactor: always use extensions in relative imports (#9878) 2025-08-19 15:25:11 +02:00
Zoltan Kochan
c89c93d59b test: use @jest/globals (#9877) 2025-08-19 00:16:25 +02:00
Zoltan Kochan
dcfb186f21 chore(release): libs 2025-08-07 14:09:55 +02:00
Zoltan Kochan
a4d654807c chore(release): 10.14.0 2025-07-31 15:00:26 +02:00
Zoltan Kochan
86b33e91ea feat: support installing Bun runtime (#9815)
* feat: support installing Bun runtime

* feat: support installing Bun runtime

* fix: cache libc resolution

* refactor: shasum file fetching

* docs: add changesets

* feat: installing the right artifact

* test: supported architectures

* test: fix on Windows
2025-07-31 13:46:13 +02:00
Colin T.A. Gray
5dedadac76 fix: changes local-resolver to support absolute paths (#9761)
* feat: changes local-resolver to support absolute paths

Previously absolute paths were being turned to relative paths, but if the file:
specifier is 'file:/path/to/file', and the users are using a shared network
storage, this relative path requires that the users all use the same
local folder structure. Instead, using an absolute path as the specifier
allows them to have the source code anywhere, and the absolute path will
be resolved consistently.

Enabled via the `preserveAbsolutePaths` option.

* chore: changeset

* feat: add preserve absolute paths option

* docs: add changesets

* fix: also update the 'dependencyPath', add test for that case

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-07-23 23:54:49 +02:00
Zoltan Kochan
fb9de7ac3a chore(release): 10.14.0-0 2025-07-23 14:54:13 +02:00