Commit Graph

973 Commits

Author SHA1 Message Date
Brandon Cheng
5bf7768ca4 feat: skip confirm modules purge prompt if --yes is passed (#10383)
* feat: add --yes command line option

* feat: skip confirm modules purge prompt if --yes is passed

* refactor: factor out `ExecPnpmSyncOpts`

* test: add end-to-end test for --yes flag
2026-02-11 02:39:23 +01:00
Brandon Cheng
4c6c26a7e8 fix: disable global virtual store during pnpm deploy (#10577) 2026-02-11 02:19:43 +01:00
Brandon Cheng
1a5b5beea2 build: replace ts-jest with simple transformer (#10579)
* test: use `import type` in more places

Several tests are failing because a module isn't being mocked. This is
due to the mocked module being imported before the mock being set up.

Switching to `import type` should elide the import fully.

* build: replace ts-jest with simple transformer

* chore: remove `ts-jest`

* chore: remove babel dependencies from root project

* ci: use Node.js 22.13.0 (instead of 22.12.0)

Node.js 22.13.0 introduces the `stripTypeScriptTypes` function

* fix: copilot feedback
2026-02-09 11:35:22 +01:00
Zoltan Kochan
1b4df57a01 feat!: drop Node.js 20 and 21 support (#10569) 2026-02-08 19:16:24 +01:00
Alessio Attilio
312226cbf0 fix: skip local file: protocol dependencies during pnpm fetch (#10514)
This fixes an issue where pnpm fetch would fail in Docker builds when
local directory dependencies (file: protocol) were not available.

The fix adds an ignoreLocalPackages option that is passed from the fetch
command to skip local dependencies during graph building, since pnpm
fetch only downloads packages from the registry and doesn't need local
packages that won't be available in Docker builds.

close #10460
2026-02-06 17:28:39 +01:00
Zoltan Kochan
3cfffaad10 perf: save node_modules/.modules.yaml in JSON format (#10406) 2026-02-06 15:59:22 +01:00
Zoltan Kochan
57e99b6996 chore: update pnpm-lock.yaml (#10558)
---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-02-06 03:28:39 +01:00
Trevor Burnham
680c543263 fix: allow env vars and updateConfig hook to override frozen-lockfile in CI (#10224)
When CI=true, pnpm automatically enables frozen-lockfile mode. Previously,
this could only be overridden via .npmrc files or CLI flags because the
code checked rawLocalConfig (which excludes env vars and hook changes).

Now checks the fully resolved config values (frozenLockfile and
preferFrozenLockfile) instead of rawLocalConfig, allowing:
- Environment variables (pnpm_config_frozen_lockfile=false)
- updateConfig hook in .pnpmfile.cjs
- .npmrc files (already worked)
- CLI flags (already worked)

Fixes #9861
2026-02-05 23:06:12 +01:00
Johan Quan Vo
7b1c189f2e feat!: remove deprecated patch options (#10505)
* refactor: remove allowNonAppliedPatches

* refactor: remove ignorePatchFailures

* refactor: remove `strict` field in groupPatchedDependencies

* test: update test failure in package patching

* test: fix

* docs: update changesets

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2026-01-27 17:08:45 +01:00
Alessio Attilio
94571fb2fe fix: prevent catalog: from leaking into pnpm-workspace.yaml (#10476)
close #10176
2026-01-27 15:52:31 +01:00
Brandon Cheng
9a17bd74b0 fix: check updateSpec correctly when updating catalog snapshots (#10513) 2026-01-26 15:07:34 +01:00
3w36zj6
bb8baa7cff fix(npm-resolver): request full metadata for optional dependencies (#10455)
close #9950

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2026-01-26 01:13:06 +01:00
Zoltan Kochan
3c40892b90 feat!: remove old way of declaring node.js in dependencies (#10507) 2026-01-25 16:07:30 +01:00
Zoltan Kochan
e2e0a321b3 perf: optimize how the integrities of files in the CAFS are stored (#10504) 2026-01-24 21:41:11 +01:00
Zoltan Kochan
c55c6146d9 feat!: bump store version to v11 (#10506) 2026-01-24 21:36:39 +01:00
Zoltan Kochan
40b107efa7 perf: migrate internal cache and index files to MessagePack serialization (#10500) 2026-01-23 01:31:09 +01:00
Zoltan Kochan
13855aca86 fix: prevent path traversal in directories.bin (#10495)
by validating the bin directory is a subdirectory of the package root and adding relevant tests.
2026-01-21 15:46:41 +01:00
Trevor Burnham
88263a8be7 refactor: force re-fetch when resolution integrity changes (#10454)
* fix: force re-fetch when resolution integrity changes

When a resolver returns a resolution with a different integrity than
the current package's resolution, automatically force re-fetching the
package. This allows custom resolvers to trigger re-fetches by simply
returning the updated integrity, without needing to explicitly set
a forceFetch flag.

Closes #10451

* refactor: remove forceFetch

* test: fix

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2026-01-20 01:57:16 +01:00
Lindsay Glenn
cee1f58d3a fix(manifest-utils): normalize peer specs for protocol deps (#10442)
close #10417
2026-01-17 14:44:51 +01:00
Zoltan Kochan
e3b35b6f37 style: update eslint to v9 (#10474) 2026-01-17 12:01:23 +01:00
Vedant Madane
29a3151b60 feat: show available workspace versions on mismatch (#10466) 2026-01-16 17:47:30 +01:00
Zoltan Kochan
d7b8be49b1 fix: prevent path traversal by validating bin names 2026-01-15 17:07:09 +01:00
Zoltan Kochan
9f2b622d10 refactor: rename customFetcherHooks to customFetchers 2026-01-15 12:02:06 +01:00
Zoltan Kochan
5beece9615 feat!: remove old API for custom fetchers (#10464) 2026-01-15 11:57:48 +01:00
Zoltan Kochan
a8fe2d5298 feat!: remove the server command (#10463) 2026-01-15 11:32:07 +01:00
Trevor Burnham
e0aa058cf3 feat: pass pkgSnapshot to shouldForceResolve (#10449)
* feat: pass pkgSnapshot to shouldForceResolve

The shouldForceResolve hook now receives:
- depPath: The dependency path (e.g., 'lodash@4.17.21')
- pkgSnapshot: The lockfile entry with resolution, dependencies, etc.

This replaces the previous wantedDependency argument, which was inconsistent
with how wantedDependency is constructed for the resolve() method (where it
contains the user's alias and full specifier from package.json).
2026-01-14 21:57:39 +01:00
btea
825b98a39d fix: make catalog protocol matching error messages clearer (#10052)
* fix: verify in advance whether the specifier that the catalog pkg is valid

* fix: update error message

* test: update

* Update resolving/default-resolver/src/index.ts

Co-authored-by: Brandon Cheng <gluxon@users.noreply.github.com>

---------

Co-authored-by: Brandon Cheng <gluxon@users.noreply.github.com>
2026-01-14 13:25:27 +01:00
Zoltan Kochan
a00f9e515c chore: use typescript-go (#10452) 2026-01-14 01:18:13 +01:00
Zoltan Kochan
da112f7cb2 revert: "perf: use v8 serialize/deserialize instead of JSON (#9971)" (#10420)
close #10409
2026-01-13 15:16:33 +01:00
Trevor Burnham
41664e83f5 feat: pass currentPkg to custom resolvers (#10440)
- Add currentPkg (with name/version) to custom resolver ResolveOptions
- Pass currentPkg through to custom resolvers in default-resolver
- Simplify checkCustomResolverForceResolve to use parseDepPath
2026-01-12 21:04:38 +01:00
Zoltan Kochan
8a8a51c394 perf: don't calculate package file paths in the store twice (#10428) 2026-01-12 15:58:25 +01:00
Zoltan Kochan
0bcbaf9994 refactor: move out skip resolution logic from package requester (#10439) 2026-01-12 13:08:50 +01:00
baozj
9c0637f531 docs: fix typos on changelogs (#10441)
Co-authored-by: baozj <www.1670370148@qq.com>
2026-01-12 12:15:36 +01:00
Zoltan Kochan
c5d4d81f56 refactor: rename FilesIndex to FilesMap (#10427) 2026-01-08 18:17:57 +01:00
Zoltan Kochan
9aba854cbc test(package-requester): fix 2026-01-08 15:29:17 +01:00
Zoltan Kochan
d71174a4fa perf: calculate the package file maps in the workers (#10422) 2026-01-08 14:53:47 +01:00
Brandon Cheng
2b81a4f09d feat: improve filtered install performance with an optimistic lookup of package metadata from store (#10408) 2026-01-08 00:36:00 +01:00
Brandon Cheng
2b14c742eb feat: preserve comments when updating pnpm-workspace.yaml (#10402)
* chore: create empty new `@pnpm/yaml.document-sync` package

* feat: implement @pnpm/yaml.document-sync

* feat: preserve comments when updating `pnpm-workspace.yaml`

* fix: add missing rootProjectManifestDir field to fix test

This was causing a test to fail due to the rootProjectManifestDir being
an empty string.

The main branch doesn't have this problem because `write-yaml-file`
internally does a `path.dirname(...)` call that ends up resolving the
empty string to `.`.

● logger warns about peer dependencies when linking

    ENOENT: no such file or directory, mkdir ''

    25 |     singleQuote: true, // Prefer single quotes over double quotes
    26 |   })
    > 27 |   await fs.promises.mkdir(dir, { recursive: true })
        |   ^
    28 |   await writeFileAtomic(path.join(dir, fileName), manifestStr)
    29 | }
    30 |

    at writeManifestFile (../../workspace/manifest-writer/src/index.ts:27:3)
    at updateWorkspaceManifest (../../workspace/manifest-writer/src/index.ts:83:3)
    at writeSettings (../../config/config-writer/src/index.ts:38:3)
    at addLinkToManifest (src/link.ts:182:3)
    at src/link.ts:161:7
        at async Promise.all (index 0)
    at Module.handler (src/link.ts:159:3)
    at Object.<anonymous> (test/link.ts:300:3)%

* Update workspace/manifest-writer/src/index.ts
2026-01-06 01:11:17 +01:00
Zoltan Kochan
8b4bdf9a83 refactor: replace onlyBuiltDependencies and ignoredBuiltDependencies with allowBuilds (#10401) 2026-01-02 23:21:17 +01:00
Zoltan Kochan
cb367b9515 feat!: deprecate old settings that were replaced by allowBuilds (#10382) 2026-01-02 12:22:42 +01:00
Brandon Cheng
4f3ad2388c fix: pnpm add incorrectly modifies a catalog entry in pnpm-workspace.yaml to its exact version (#10370)
* refactor: factor out a `getRealNameAndSpec` function

* test: `pnpm add` does not modify existing catalog entries

* fix: resolve preferred version without mutating bare specifier

close #9759
2025-12-29 02:05:54 +01:00
Brandon Cheng
d404c55ac8 fix: handle npm aliases without a bare specifier in unwrapPackageName (#10374)
* refactor: factor out a `getRealNameAndSpec` function

* fix: handle npm aliases without a bare specifier in `unwrapPackageName`

* Fix formatting in unwrapPackageName.ts
2025-12-29 02:00:21 +01:00
Brandon Cheng
aa077a19ef refactor: factor out a getRealNameAndSpec function (#10369) 2025-12-29 01:54:14 +01:00
btea
facdd717bf feat: add trustPolicyIgnoreAfter (#10359)
* feat: add `trustPolicyIgnoreAfter`

* Update .changeset/big-lies-pump.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* refactor: npm-resolver

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-12-28 02:01:09 +01:00
Zoltan Kochan
71de2b3f2b feat!: remove use-node-version CLI option and pnpm.executionEnv.nodeVersion manifest field (#10373) 2025-12-27 22:41:53 +01:00
Brandon Cheng
db72923b5c fix: forward $NODE_OPTIONS when running jest for debug terminals (#10364)
* fix: forward existing `$NODE_OPTIONS` when running jest

* chore: update `package.json` files for meta-updater changes

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2025-12-27 22:10:52 +01:00
Zoltan Kochan
394d88cf5e feat: enable injected local packages to work with global virtual store (#10366)
* feat: enable injected local packages to work with global virtual store

by leveraging `pkgLocationsByDepPath` for `file:` dependencies.

* fix: populate `pkgLocationsByDepPath` directly for directory dependencies in the graph builder

* refactor: store directory dependencies as a Map instead of an object

* refactor: improve file: dependency target directory resolution

by prioritizing `directoryDepsByDepPath` and providing a lockfile fallback.

* refactor: remove `pkgLocationsByDepPath` from hoisted dependency graph generation parameters

* test: fix

* test: fix

* refactor: simplify directory lookup for injected workspace packages

by directly using the dependency graph

* refactor: move extendProjectsWithTargetDirs to headless module and update imports

* refactor: make `directoryDepsByDepPath` required

in `LockfileToDepGraphOptions` and remove its nullish coalescing in headless

* refactor: directory dependency tracking

by renaming `directoryDepsByDepPath` to `injectionTargetsByDepPath`
and extracting related logic, and remove an unused export.

* docs: add changesets

* fix: implemented CR suggestions
2025-12-27 12:21:19 +01:00
Brandon Cheng
6f806be0ae chore: enable TypeScript's erasableSyntaxOnly config (#10365)
* chore: configure `erasableSyntaxOnly`

* refactor: remove class property access modifiers in constructor

```
../dedupe/check/src/DedupeCheckIssuesError.ts:5:16 - error TS1294: This syntax is not allowed when 'erasableSyntaxOnly' is enabled.

5   constructor (public dedupeCheckIssues: DedupeCheckIssues) {
                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

../reviewing/dependencies-hierarchy/src/getTree.ts:243:24 - error TS1294: This syntax is not allowed when 'erasableSyntaxOnly' is enabled.

243   private constructor (private readonly keypath: readonly string[]) {}
                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```

* chore: migrate from enum types

```
../pkg-manager/plugin-commands-installation/src/import/index.ts:66:6 - error TS1294: This syntax is not allowed when 'erasableSyntaxOnly' is enabled.

66 enum YarnLockType {
        ~~~~~~~~~~~~

../lockfile/detect-dep-types/src/index.ts:5:13 - error TS1294: This syntax is not allowed when 'erasableSyntaxOnly' is enabled.

5 export enum DepType {
              ~~~~~~~
```

* chore: add changelog

* chore: remove `ts-node` dev dependency (#10371)

* chore: remove `ts-node` dev dependency

* chore: remove `ts-node` usages from `package.json` scripts
2025-12-27 11:23:49 +01:00
Zoltan Kochan
9eddabb32b feat: enhance store prune to clean global virtual store (#10360)
* feat: enhance `store prune` to clean global virtual store

`pnpm store prune` will now clean the global virtual store
via a new project registry and mark-and-sweep garbage collection.

* test: add store prune test for transitive dependency preservation

* refactor: extract global virtual store pruning logic to a new file

* fix: improve symlink handling in global virtual store pruning

* fix: optimize removal of unreachable packages in global virtual store

* fix: refine project registry error handling

Throw `PnpmError` for inaccessible projects
and specifically clean up stale symlinks for `ENOENT` errors.

* test: create virtual store with install command

* refactor: standardize global virtual store directory structure

by placing unscoped packages under an `@` scope.

* test: update store prune tests to use `toContain` and `not.toContain` assertions`

* fix: linting issues

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: implemented CR suggestions

* fix: revert not needed change

* fix: use `is-subdir` to accurately determine if symlink targets

are within the global virtual store.

* revert: changes in package.json files

* test: add `--config.ci=false` to store prune tests
2025-12-26 01:35:35 +01:00
Zoltan Kochan
c4045fc689 fix: update unscoped package storage location in virtual global store (#10363) 2025-12-25 21:13:41 +01:00