mirror of
https://github.com/pnpm/pnpm.git
synced 2026-07-22 05:32:44 -04:00
bae694f639
Some registries generate tarballs on demand and cannot list an integrity in their packument. pnpm then wrote integrity-less lockfile entries on the first install and failed the next one with ERR_PNPM_MISSING_TARBALL_INTEGRITY, unable to install from its own lockfile. Compute the missing integrity from the downloaded bytes and write it into the resolution before the lockfile is built: - Add an optional `resolutionNeedsFetch` contract to the fetcher API (backward compatible, since custom fetchers come from hooks). The remote-tarball fetcher reports it when a resolution lacks integrity; the picked fetcher's signal flows through PackageResponse -> ResolvedPackage so nothing re-derives it. - The package requester downloads such tarballs (including under --lockfile-only / skipFetch / not-installable) and fills the computed integrity onto the resolution via the already-running `fetching` promise, so dependency resolution isn't blocked. The deps-resolver awaits only the flagged entries before updateLockfile, because the integrity feeds the global virtual-store paths. - Move read-side enforcement into the npm resolver's lockfile verifier (MISSING_TARBALL_INTEGRITY): reject a registry/http(s) tarball entry whose integrity is missing/empty/non-string, fail-closed, before the URL-keyed and semver short-circuits. Drop the earlier read-side auto-heal (a missing-field bypass). Harden against tampered lockfiles (non-string tarball/integrity). - Reuse the fetcher picked during resolution on the fetch path instead of running pickFetcher (and a custom fetcher's async canFetch) twice per package. Mirrored in pacquet: PrefetchingResolver computes the integrity for integrity-less tarball resolutions during resolution (FetchTarballForResolution::run), deduped per URL with a singleflight cache. Closes pnpm/pnpm#12145. --------- Co-authored-by: Zoltan Kochan <z@kochan.io>
95 lines
3.0 KiB
JSON
95 lines
3.0 KiB
JSON
{
|
|
"name": "@pnpm/patching.commands",
|
|
"version": "1100.1.6",
|
|
"description": "Commands for creating patches",
|
|
"keywords": [
|
|
"pnpm",
|
|
"pnpm11",
|
|
"scripts"
|
|
],
|
|
"license": "MIT",
|
|
"funding": "https://opencollective.com/pnpm",
|
|
"repository": "https://github.com/pnpm/pnpm/tree/main/pnpm11/patching/commands",
|
|
"homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/patching/commands#readme",
|
|
"bugs": {
|
|
"url": "https://github.com/pnpm/pnpm/issues"
|
|
},
|
|
"type": "module",
|
|
"main": "lib/index.js",
|
|
"types": "lib/index.d.ts",
|
|
"exports": {
|
|
".": "./lib/index.js"
|
|
},
|
|
"files": [
|
|
"lib",
|
|
"!*.map"
|
|
],
|
|
"scripts": {
|
|
"start": "tsgo --watch",
|
|
"lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
|
|
"test": "pn compile && pn .test",
|
|
"prepublishOnly": "tsgo --build",
|
|
"compile": "tsgo --build && pn lint --fix",
|
|
".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
|
|
},
|
|
"dependencies": {
|
|
"@inquirer/prompts": "catalog:",
|
|
"@pnpm/cli.utils": "workspace:*",
|
|
"@pnpm/config.reader": "workspace:*",
|
|
"@pnpm/config.writer": "workspace:*",
|
|
"@pnpm/constants": "workspace:*",
|
|
"@pnpm/crypto.hash": "workspace:*",
|
|
"@pnpm/error": "workspace:*",
|
|
"@pnpm/fs.packlist": "workspace:*",
|
|
"@pnpm/installing.commands": "workspace:*",
|
|
"@pnpm/installing.modules-yaml": "workspace:*",
|
|
"@pnpm/lockfile.fs": "workspace:*",
|
|
"@pnpm/lockfile.utils": "workspace:*",
|
|
"@pnpm/patching.apply-patch": "workspace:*",
|
|
"@pnpm/pkg-manifest.reader": "workspace:*",
|
|
"@pnpm/resolving.parse-wanted-dependency": "workspace:*",
|
|
"@pnpm/store.connection-manager": "workspace:*",
|
|
"@pnpm/store.path": "workspace:*",
|
|
"@pnpm/types": "workspace:*",
|
|
"@pnpm/workspace.project-manifest-reader": "workspace:*",
|
|
"@pnpm/workspace.workspace-manifest-reader": "workspace:*",
|
|
"chalk": "catalog:",
|
|
"escape-string-regexp": "catalog:",
|
|
"is-windows": "catalog:",
|
|
"make-empty-dir": "catalog:",
|
|
"normalize-path": "catalog:",
|
|
"ramda": "catalog:",
|
|
"realpath-missing": "catalog:",
|
|
"render-help": "catalog:",
|
|
"safe-execa": "catalog:",
|
|
"semver": "catalog:",
|
|
"terminal-link": "catalog:",
|
|
"tinyglobby": "catalog:"
|
|
},
|
|
"peerDependencies": {
|
|
"@pnpm/logger": "catalog:"
|
|
},
|
|
"devDependencies": {
|
|
"@jest/globals": "catalog:",
|
|
"@pnpm/logger": "workspace:*",
|
|
"@pnpm/patching.commands": "workspace:*",
|
|
"@pnpm/prepare": "workspace:*",
|
|
"@pnpm/test-fixtures": "workspace:*",
|
|
"@pnpm/testing.command-defaults": "workspace:*",
|
|
"@pnpm/testing.registry-mock": "workspace:*",
|
|
"@pnpm/workspace.projects-filter": "workspace:*",
|
|
"@types/is-windows": "catalog:",
|
|
"@types/normalize-path": "catalog:",
|
|
"@types/ramda": "catalog:",
|
|
"@types/semver": "catalog:",
|
|
"tempy": "catalog:",
|
|
"write-yaml-file": "catalog:"
|
|
},
|
|
"engines": {
|
|
"node": ">=22.13"
|
|
},
|
|
"jest": {
|
|
"preset": "@pnpm/jest-config/with-registry"
|
|
}
|
|
}
|