Commit Graph

10701 Commits

Author SHA1 Message Date
Zoltan Kochan
ffb7cd198f fix: update dependencies 2026-01-18 21:15:45 +01:00
Zoltan Kochan
66d93e81d9 fix: update tar-stream to v3 2026-01-18 20:18:55 +01:00
Zoltan Kochan
1b1d984eec test: improve publish test isolation 2026-01-18 19:33:34 +01:00
Zoltan Kochan
daac2b6006 chore: remove .eslintcache 2026-01-17 16:39:19 +01:00
Lindsay Glenn
cee1f58d3a fix(manifest-utils): normalize peer specs for protocol deps (#10442)
close #10417
2026-01-17 14:44:51 +01:00
Zoltan Kochan
e3b94c06da fix: reference @pnpm/fs.packlist from the workspace (#10477) 2026-01-17 14:35:41 +01:00
btea
623634537d fix: audit (#10475)
* fix: audit

* fix: update

* fix: update
2026-01-17 12:14:02 +01:00
Zoltan Kochan
e3b35b6f37 style: update eslint to v9 (#10474) 2026-01-17 12:01:23 +01:00
dependabot[bot]
7ddc81b3f9 chore(deps): bump cbrgm/mastodon-github-action (#10410)
Bumps the github-actions group with 1 update: [cbrgm/mastodon-github-action](https://github.com/cbrgm/mastodon-github-action).


Updates `cbrgm/mastodon-github-action` from 2.1.22 to 2.1.23
- [Release notes](https://github.com/cbrgm/mastodon-github-action/releases)
- [Commits](771a360594...3ebdc72dcd)

---
updated-dependencies:
- dependency-name: cbrgm/mastodon-github-action
  dependency-version: 2.1.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-17 02:01:00 +01:00
Zoltan Kochan
260899d4a8 fix: prevent path traversal vulnerabilities during ZIP extraction 2026-01-16 20:36:40 +01:00
Zoltan Kochan
43e9b5f22d docs: update AGENTS.md 2026-01-16 20:06:12 +01:00
Zoltan Kochan
ec7c5d7d1a feat: improve git URL detection to recognize plain HTTP/HTTPS URLs
Improve git URL detection to recognize plain HTTP/HTTPS URLs
ending in `.git` and prioritize git resolver over tarball resolver.

close #10468
2026-01-16 19:38:02 +01:00
Vedant Madane
29a3151b60 feat: show available workspace versions on mismatch (#10466) 2026-01-16 17:47:30 +01:00
Johan Quan Vo
cc1b8e310a fix: use tarball URL returned in package metadata (#10431)
close #10254
2026-01-16 17:31:04 +01:00
Zoltan Kochan
a6dbcc72af fix: remove redundant ports from registry URL during normalization (#10470) 2026-01-16 17:28:18 +01:00
Zoltan Kochan
02c8ec50cb docs: add AI agent guides (#10469) 2026-01-16 16:31:31 +01:00
Tensorworker
29cb667d2b fix: prevent implicit root exclusion when user filters are provided (#10465)
* fix: prevent implicit root exclusion when user filters are provided

* docs: add changeset

* test: remove redundant init

---------

Co-authored-by: tensorworker <tensorworker@proton.me>
Co-authored-by: Zoltan Kochan <z@kochan.io>
2026-01-16 16:12:33 +01:00
Oleg Pustovit
46de860489 fix(run): fail when no packages have script in filtered recursive run (#10437)
* fix(run): fail when no packages have script in filtered recursive run

Previously, `pnpm run -r <script>` and `pnpm run --filter <filter> <script>`
would silently succeed with exit code 0 when no packages had the specified
script, as long as a filter was used. This was inconsistent with the
documentation which states "If none of the packages have the command, the
command fails."

This change makes the command fail with ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT in
all cases where no packages have the script, regardless of whether a filter
is used. The `--if-present` flag can be used to suppress this error.

close #6844
2026-01-16 01:49:24 +01:00
Zoltan Kochan
caabba44ff fix: normalize Windows backslash path traversal attempts in tarball entry filenames
to prevent security vulnerabilities.
2026-01-15 17:10:17 +01:00
Zoltan Kochan
d7b8be49b1 fix: prevent path traversal by validating bin names 2026-01-15 17:07:09 +01:00
Zoltan Kochan
9f2b622d10 refactor: rename customFetcherHooks to customFetchers 2026-01-15 12:02:06 +01:00
Zoltan Kochan
5beece9615 feat!: remove old API for custom fetchers (#10464) 2026-01-15 11:57:48 +01:00
Zoltan Kochan
a8fe2d5298 feat!: remove the server command (#10463) 2026-01-15 11:32:07 +01:00
Zoltan Kochan
08903c5afd chore: fix vulnerability 2026-01-15 01:34:27 +01:00
Trevor Burnham
e0aa058cf3 feat: pass pkgSnapshot to shouldForceResolve (#10449)
* feat: pass pkgSnapshot to shouldForceResolve

The shouldForceResolve hook now receives:
- depPath: The dependency path (e.g., 'lodash@4.17.21')
- pkgSnapshot: The lockfile entry with resolution, dependencies, etc.

This replaces the previous wantedDependency argument, which was inconsistent
with how wantedDependency is constructed for the resolve() method (where it
contains the user's alias and full specifier from package.json).
2026-01-14 21:57:39 +01:00
btea
825b98a39d fix: make catalog protocol matching error messages clearer (#10052)
* fix: verify in advance whether the specifier that the catalog pkg is valid

* fix: update error message

* test: update

* Update resolving/default-resolver/src/index.ts

Co-authored-by: Brandon Cheng <gluxon@users.noreply.github.com>

---------

Co-authored-by: Brandon Cheng <gluxon@users.noreply.github.com>
2026-01-14 13:25:27 +01:00
Khải
459a336c76 refactor: getNetworkConfigs (#10458)
Some tests are added as a bonus
2026-01-14 12:31:04 +01:00
Zoltan Kochan
e4d3fac479 chore: run tsgo without verbose logs
Removed verbose flag from tsgo command in typecheck-only script.
2026-01-14 01:53:01 +01:00
Zoltan Kochan
a00f9e515c chore: use typescript-go (#10452) 2026-01-14 01:18:13 +01:00
Zoltan Kochan
aef6c318a9 ci: compile pnpm only once then download it for testing (#10453) 2026-01-13 23:34:37 +01:00
Zoltan Kochan
268742acce chore: fix compile 2026-01-13 18:28:13 +01:00
Zoltan Kochan
27e7aeb3e8 fix: update @pnpm/registry-mock 2026-01-13 18:19:50 +01:00
Zoltan Kochan
5c4d1793f8 chore: update pnpm to v11 alpha 3 2026-01-13 16:24:38 +01:00
Zoltan Kochan
ee78096e4a chore(release): 11.0.0-alpha.3 v11.0.0-alpha.3 2026-01-13 15:48:50 +01:00
Zoltan Kochan
7486d3806f feat: remove engines.runtime from pnpm CLI 2026-01-13 15:25:02 +01:00
Zoltan Kochan
da112f7cb2 revert: "perf: use v8 serialize/deserialize instead of JSON (#9971)" (#10420)
close #10409
2026-01-13 15:16:33 +01:00
Trevor Burnham
41664e83f5 feat: pass currentPkg to custom resolvers (#10440)
- Add currentPkg (with name/version) to custom resolver ResolveOptions
- Pass currentPkg through to custom resolvers in default-resolver
- Simplify checkCustomResolverForceResolve to use parseDepPath
2026-01-12 21:04:38 +01:00
Zoltan Kochan
8a8a51c394 perf: don't calculate package file paths in the store twice (#10428) 2026-01-12 15:58:25 +01:00
Zoltan Kochan
e4d08f920e fix(exec): preserve user execution cwd (#10445)
close #5759
close #10403
2026-01-12 15:41:17 +01:00
Sam Chung
938ea1f18c Revert "fix: try not to make network requests with prefer offline" (#10423)
* Revert "fix: try not to make network requests with prefer offline (#10334)"

This reverts commit 1bc6b5ac2c.

* Add changeset

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
2026-01-12 13:39:59 +01:00
Zoltan Kochan
0bcbaf9994 refactor: move out skip resolution logic from package requester (#10439) 2026-01-12 13:08:50 +01:00
baozj
9c0637f531 docs: fix typos on changelogs (#10441)
Co-authored-by: baozj <www.1670370148@qq.com>
2026-01-12 12:15:36 +01:00
Zoltan Kochan
5a0ed1d450 fix: prevent circular symlinks in projects registry (#10432)
close #10411
2026-01-09 18:04:57 +01:00
Zoltan Kochan
c5d4d81f56 refactor: rename FilesIndex to FilesMap (#10427) 2026-01-08 18:17:57 +01:00
Zoltan Kochan
9aba854cbc test(package-requester): fix 2026-01-08 15:29:17 +01:00
Zoltan Kochan
d71174a4fa perf: calculate the package file maps in the workers (#10422) 2026-01-08 14:53:47 +01:00
Brandon Cheng
2b81a4f09d feat: improve filtered install performance with an optimistic lookup of package metadata from store (#10408) 2026-01-08 00:36:00 +01:00
Brandon Cheng
2b14c742eb feat: preserve comments when updating pnpm-workspace.yaml (#10402)
* chore: create empty new `@pnpm/yaml.document-sync` package

* feat: implement @pnpm/yaml.document-sync

* feat: preserve comments when updating `pnpm-workspace.yaml`

* fix: add missing rootProjectManifestDir field to fix test

This was causing a test to fail due to the rootProjectManifestDir being
an empty string.

The main branch doesn't have this problem because `write-yaml-file`
internally does a `path.dirname(...)` call that ends up resolving the
empty string to `.`.

● logger warns about peer dependencies when linking

    ENOENT: no such file or directory, mkdir ''

    25 |     singleQuote: true, // Prefer single quotes over double quotes
    26 |   })
    > 27 |   await fs.promises.mkdir(dir, { recursive: true })
        |   ^
    28 |   await writeFileAtomic(path.join(dir, fileName), manifestStr)
    29 | }
    30 |

    at writeManifestFile (../../workspace/manifest-writer/src/index.ts:27:3)
    at updateWorkspaceManifest (../../workspace/manifest-writer/src/index.ts:83:3)
    at writeSettings (../../config/config-writer/src/index.ts:38:3)
    at addLinkToManifest (src/link.ts:182:3)
    at src/link.ts:161:7
        at async Promise.all (index 0)
    at Module.handler (src/link.ts:159:3)
    at Object.<anonymous> (test/link.ts:300:3)%

* Update workspace/manifest-writer/src/index.ts
2026-01-06 01:11:17 +01:00
Brandon Cheng
8ed2c7d7c3 feat: create new @pnpm/yaml.document-sync package (#10405) 2026-01-05 12:14:56 +01:00
Zoltan Kochan
095f659720 fix: setting requiredScripts in pnpm-workspace.yaml (#10404)
close #10261
2026-01-04 16:43:08 +01:00