Brandon Cheng
5bf7768ca4
feat: skip confirm modules purge prompt if --yes is passed ( #10383 )
...
* feat: add --yes command line option
* feat: skip confirm modules purge prompt if --yes is passed
* refactor: factor out `ExecPnpmSyncOpts`
* test: add end-to-end test for --yes flag
2026-02-11 02:39:23 +01:00
Brandon Cheng
1a5b5beea2
build: replace ts-jest with simple transformer ( #10579 )
...
* test: use `import type` in more places
Several tests are failing because a module isn't being mocked. This is
due to the mocked module being imported before the mock being set up.
Switching to `import type` should elide the import fully.
* build: replace ts-jest with simple transformer
* chore: remove `ts-jest`
* chore: remove babel dependencies from root project
* ci: use Node.js 22.13.0 (instead of 22.12.0)
Node.js 22.13.0 introduces the `stripTypeScriptTypes` function
* fix: copilot feedback
2026-02-09 11:35:22 +01:00
Zoltan Kochan
1b4df57a01
feat!: drop Node.js 20 and 21 support ( #10569 )
2026-02-08 19:16:24 +01:00
Alessio Attilio
312226cbf0
fix: skip local file: protocol dependencies during pnpm fetch ( #10514 )
...
This fixes an issue where pnpm fetch would fail in Docker builds when
local directory dependencies (file: protocol) were not available.
The fix adds an ignoreLocalPackages option that is passed from the fetch
command to skip local dependencies during graph building, since pnpm
fetch only downloads packages from the registry and doesn't need local
packages that won't be available in Docker builds.
close #10460
2026-02-06 17:28:39 +01:00
Zoltan Kochan
3cfffaad10
perf: save node_modules/.modules.yaml in JSON format ( #10406 )
2026-02-06 15:59:22 +01:00
Johan Quan Vo
7b1c189f2e
feat!: remove deprecated patch options ( #10505 )
...
* refactor: remove allowNonAppliedPatches
* refactor: remove ignorePatchFailures
* refactor: remove `strict` field in groupPatchedDependencies
* test: update test failure in package patching
* test: fix
* docs: update changesets
---------
Co-authored-by: Zoltan Kochan <z@kochan.io >
2026-01-27 17:08:45 +01:00
Alessio Attilio
94571fb2fe
fix: prevent catalog: from leaking into pnpm-workspace.yaml ( #10476 )
...
close #10176
2026-01-27 15:52:31 +01:00
Zoltan Kochan
3c40892b90
feat!: remove old way of declaring node.js in dependencies ( #10507 )
2026-01-25 16:07:30 +01:00
Zoltan Kochan
e2e0a321b3
perf: optimize how the integrities of files in the CAFS are stored ( #10504 )
2026-01-24 21:41:11 +01:00
Zoltan Kochan
c55c6146d9
feat!: bump store version to v11 ( #10506 )
2026-01-24 21:36:39 +01:00
Zoltan Kochan
40b107efa7
perf: migrate internal cache and index files to MessagePack serialization ( #10500 )
2026-01-23 01:31:09 +01:00
Zoltan Kochan
e3b35b6f37
style: update eslint to v9 ( #10474 )
2026-01-17 12:01:23 +01:00
Trevor Burnham
e0aa058cf3
feat: pass pkgSnapshot to shouldForceResolve ( #10449 )
...
* feat: pass pkgSnapshot to shouldForceResolve
The shouldForceResolve hook now receives:
- depPath: The dependency path (e.g., 'lodash@4.17.21 ')
- pkgSnapshot: The lockfile entry with resolution, dependencies, etc.
This replaces the previous wantedDependency argument, which was inconsistent
with how wantedDependency is constructed for the resolve() method (where it
contains the user's alias and full specifier from package.json).
2026-01-14 21:57:39 +01:00
btea
825b98a39d
fix: make catalog protocol matching error messages clearer ( #10052 )
...
* fix: verify in advance whether the specifier that the catalog pkg is valid
* fix: update error message
* test: update
* Update resolving/default-resolver/src/index.ts
Co-authored-by: Brandon Cheng <gluxon@users.noreply.github.com >
---------
Co-authored-by: Brandon Cheng <gluxon@users.noreply.github.com >
2026-01-14 13:25:27 +01:00
Zoltan Kochan
a00f9e515c
chore: use typescript-go ( #10452 )
2026-01-14 01:18:13 +01:00
Zoltan Kochan
da112f7cb2
revert: "perf: use v8 serialize/deserialize instead of JSON ( #9971 )" ( #10420 )
...
close #10409
2026-01-13 15:16:33 +01:00
Trevor Burnham
41664e83f5
feat: pass currentPkg to custom resolvers ( #10440 )
...
- Add currentPkg (with name/version) to custom resolver ResolveOptions
- Pass currentPkg through to custom resolvers in default-resolver
- Simplify checkCustomResolverForceResolve to use parseDepPath
2026-01-12 21:04:38 +01:00
Zoltan Kochan
8a8a51c394
perf: don't calculate package file paths in the store twice ( #10428 )
2026-01-12 15:58:25 +01:00
Zoltan Kochan
8b4bdf9a83
refactor: replace onlyBuiltDependencies and ignoredBuiltDependencies with allowBuilds ( #10401 )
2026-01-02 23:21:17 +01:00
Zoltan Kochan
cb367b9515
feat!: deprecate old settings that were replaced by allowBuilds ( #10382 )
2026-01-02 12:22:42 +01:00
Brandon Cheng
4f3ad2388c
fix: pnpm add incorrectly modifies a catalog entry in pnpm-workspace.yaml to its exact version ( #10370 )
...
* refactor: factor out a `getRealNameAndSpec` function
* test: `pnpm add` does not modify existing catalog entries
* fix: resolve preferred version without mutating bare specifier
close #9759
2025-12-29 02:05:54 +01:00
btea
facdd717bf
feat: add trustPolicyIgnoreAfter ( #10359 )
...
* feat: add `trustPolicyIgnoreAfter`
* Update .changeset/big-lies-pump.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
* refactor: npm-resolver
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: Zoltan Kochan <z@kochan.io >
2025-12-28 02:01:09 +01:00
Zoltan Kochan
71de2b3f2b
feat!: remove use-node-version CLI option and pnpm.executionEnv.nodeVersion manifest field ( #10373 )
2025-12-27 22:41:53 +01:00
Brandon Cheng
db72923b5c
fix: forward $NODE_OPTIONS when running jest for debug terminals ( #10364 )
...
* fix: forward existing `$NODE_OPTIONS` when running jest
* chore: update `package.json` files for meta-updater changes
---------
Co-authored-by: Zoltan Kochan <z@kochan.io >
2025-12-27 22:10:52 +01:00
Zoltan Kochan
394d88cf5e
feat: enable injected local packages to work with global virtual store ( #10366 )
...
* feat: enable injected local packages to work with global virtual store
by leveraging `pkgLocationsByDepPath` for `file:` dependencies.
* fix: populate `pkgLocationsByDepPath` directly for directory dependencies in the graph builder
* refactor: store directory dependencies as a Map instead of an object
* refactor: improve file: dependency target directory resolution
by prioritizing `directoryDepsByDepPath` and providing a lockfile fallback.
* refactor: remove `pkgLocationsByDepPath` from hoisted dependency graph generation parameters
* test: fix
* test: fix
* refactor: simplify directory lookup for injected workspace packages
by directly using the dependency graph
* refactor: move extendProjectsWithTargetDirs to headless module and update imports
* refactor: make `directoryDepsByDepPath` required
in `LockfileToDepGraphOptions` and remove its nullish coalescing in headless
* refactor: directory dependency tracking
by renaming `directoryDepsByDepPath` to `injectionTargetsByDepPath`
and extracting related logic, and remove an unused export.
* docs: add changesets
* fix: implemented CR suggestions
2025-12-27 12:21:19 +01:00
Zoltan Kochan
c4045fc689
fix: update unscoped package storage location in virtual global store ( #10363 )
2025-12-25 21:13:41 +01:00
Zoltan Kochan
3bf5e218a6
fix: linking commands of engines ( #10354 )
...
close #10244
2025-12-23 12:26:59 +01:00
Zoltan Kochan
01760da877
fix(git-resolver): installing git-hosted dependency using annotated tags ( #10349 )
...
close #10335
2025-12-22 23:05:40 +01:00
Trevor Burnham
8b5dcaac4d
feat: provide wantedLockfile to shouldForceResolve ( #10330 )
2025-12-19 01:41:10 +01:00
Zoltan Kochan
0048667db4
refactor: use Maps instead of Records ( #10312 )
2025-12-15 11:48:19 +01:00
Oren
ae8b816121
feat: support blockExoticSubdeps option to disallow non-trusted dep sources in subdeps ( #10265 )
...
* feat(core): add onlyRegistryDependencies option to disallow non-registry subdependencies
* fix: onlyRegistryDependencies=>registrySubdepsOnly
* fix: allow resolution from custom resolver
* fix: add registry-subdeps-only to types
* docs: update changesets
* refactor: registry-only
* refactor: registrySubdepsOnly=>blockExoticSubdeps
* fix: trust runtime deps
* refactor: remove comment
---------
Co-authored-by: Zoltan Kochan <z@kochan.io >
2025-12-10 12:14:16 +01:00
Oren
ba065f6a8b
fix(git-fetcher): block git dependencies from running prepare scripts unless allowed ( #10288 )
...
* fix(git-fetcher): block git dependencies from running prepare scripts unless allowed
* Update exec/prepare-package/src/index.ts
Co-authored-by: Zoltan Kochan <z@kochan.io >
* Also implement in gitHostedTarballFetcher
* refactor: move allowBuild function creation to the store manager
* refactor: pass allowBuild function to fetch function directly
* refactor: revert not needed changes and update changesets
* test: fix
* fix: implemented CR suggestions
* test: fix
* test: fix
---------
Co-authored-by: Zoltan Kochan <z@kochan.io >
2025-12-09 18:25:07 +01:00
Oren
98a0410aa1
fix(tarball-resolver): add integrity hash to HTTP tarball dependencies ( #10287 )
...
* fix(tarball-resolver): add integrity hash to HTTP tarball dependencies
* Refactor to download tarball just once
* Fix tests
* fix: only calc hash when it is not passed in to the fetcher
* docs: update changesets
2025-12-08 23:38:27 +01:00
Zoltan Kochan
05fb1aee5f
fix: reporting ignored dependency builds ( #10276 )
2025-12-06 16:32:19 +01:00
Zoltan Kochan
4362c06005
fix: dependencies that were added to onlyBuiltDependencies should be built on install ( #10256 )
2025-12-02 15:31:52 +01:00
Zoltan Kochan
5f73b0f2b6
perf: always link runtimes from the global virtual store directory ( #10233 )
2025-12-01 14:27:18 +01:00
Trevor Burnham
38b8e357b5
feat: add custom resolvers and fetchers ( #10246 )
2025-11-30 14:19:04 +01:00
Brandon Cheng
69ebe38764
fix: throw a frozen lockfile error when catalogs change ( #10231 )
...
* fix: throw a frozen lockfile error when catalogs change
* fix: work around lockfile mismatch when installing `__fixtures__`
```
> @ step1 /home/runner/work/pnpm/pnpm/__fixtures__
> node ../pnpm/dist/pnpm.mjs install -rf --frozen-lockfile --no-shared-workspace-lockfile --no-link-workspace-packages
. | WARN using --force I sure hope you know what you are doing
Scope: all 26 workspace projects
circular | Progress: resolved 1, reused 0, downloaded 0, added 0
circular | +4 +
fixture | Progress: resolved 1, reused 0, downloaded 0, added 0
fixture | +12 +
fixture-with-no-pkg-name-and-no-version | Progress: resolved 1, reused 0, downloaded 0, added 0
fixture-with-no-pkg-name-and-no-version | +12 +
fixture-with-no-pkg-version | Progress: resolved 1, reused 0, downloaded 0, added 0
fixture-with-no-pkg-version | +12 +
circular | Progress: resolved 4, reused 0, downloaded 4, added 4, done
fixture | Progress: resolved 12, reused 6, downloaded 6, added 12, done
fixture-with-no-pkg-name-and-no-version | Progress: resolved 12, reused 0, downloaded 0, added 12, done
fixture-with-no-pkg-version | Progress: resolved 12, reused 0, downloaded 0, added 12, done
general | Progress: resolved 1, reused 0, downloaded 0, added 0
general | +13 +
has-2-outdated-deps | Progress: resolved 1, reused 0, downloaded 0, added 0
has-2-outdated-deps | +2 +
undefined
/home/runner/work/pnpm/pnpm/__fixtures__/has-outdated-deps-using-catalog-protocol:
ERR_PNPM_LOCKFILE_CONFIG_MISMATCH Cannot proceed with the frozen installation. The current "catalogs" configuration doesn't match the value found in the lockfile
Update your lockfile using "pnpm install --no-frozen-lockfile"
```
close #9369
2025-11-26 01:09:37 +01:00
Zoltan Kochan
7e2910e70f
chore(release): 11.0.0-alpha.0
2025-11-13 15:44:27 +01:00
Ryo Matsukawa
9d3f00b09a
feat: add support for trustPolicyExclude ( #10168 )
...
close #10164
2025-11-11 13:00:20 +01:00
Ryo Matsukawa
10bc39152e
feat: add support for npm package trust evidence check via a new trustPolicy setting ( #10103 )
...
close #8889
---------
Co-authored-by: Zoltan Kochan <z@kochan.io >
2025-11-09 23:23:58 +01:00
Zoltan Kochan
9b344c8982
perf: use v8 serialize/deserialize instead of JSON ( #9971 )
...
close #9965
2025-11-06 01:01:06 +01:00
Zoltan Kochan
efb48dcab5
feat: install js runtime as prod dependency ( #10141 )
2025-10-31 17:12:50 +01:00
Zoltan Kochan
3ce5f82bd7
Merge remote-tracking branch 'origin/main' into v11
2025-10-28 18:40:05 +01:00
Zoltan Kochan
49f03d14ee
chore(release): 10.20.0
2025-10-28 17:35:21 +01:00
Zoltan Kochan
dab9abef5c
Merge remote-tracking branch 'origin/main' into v11
2025-10-24 14:19:07 +02:00
Zoltan Kochan
0cde1287c8
chore: update repository fields
2025-10-23 11:57:12 +02:00
Zoltan Kochan
43d7b18c2f
chore(release): 10.19.0
2025-10-21 15:30:20 +02:00
Zoltan Kochan
dee39ecb8a
feat: support allowing the build of specific versions of dependencies ( #10104 )
...
close #10076
2025-10-21 12:38:16 +02:00
Ryo Matsukawa
7c1382f7b7
feat: add support for exact versions in minimumReleaseAgeExclude ( #10059 )
...
close #9985
---------
Co-authored-by: Zoltan Kochan <z@kochan.io >
2025-10-18 11:10:08 +02:00
