Zoltan Kochanandgithub-actions[bot]
91774e72a0
* chore(release): 11.28.7, pacquet 12.15.0, pnpr 0.1.0-alpha.16 * docs(release): curate 11.28.7, pacquet 12.15.0, and pnpr 0.1.0-alpha.16 release notes Add lead paragraphs and group the patch entries by what the reader was doing, with security fixes first on each page. - v11: lead with the registry metadata name check, pinned pnpm trustPolicy check, maxTarballUnpackedSize, and the removal of registry revisions; merge overlapping entries for minimumReleaseAge metadata revalidation, frozen-lockfile directory dependency checks, syncInjectedDepsAfterScripts, verifyDepsBeforeRun, pnpm sbom, and unreadable config settings. - v12: order minor highlights from config includes and lockfile.integrityTarget down to interactive update styling; drop the pnpr-only distribution note from the CLI changelog; merge overlapping entries for workspace and pnpr install speedups, minimumReleaseAge and If-Modified-Since revalidation, frozen-lockfile and injected package checks, verifyDepsBeforeRun, pnpm prune, pnpm pack, pnpm licenses list, pnpm self-update, pinned pnpm flag forwarding, and WebContainer fixes. - pnpr: lead the minor section with the breaking ecosystem URL prefix, hosted storage layout, artifacts.orgs, and strict config schema changes; fold dist.pnpr tarball metadata into one entry and drop the redundant /metrics note; lead the patch section with reserved-username and auth security fixes. - Use one issue-link label style across the release pages. --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@pnpm/pnpr.client
Client library for the pnpr server. pnpm uses it when
the pnprServer setting is set. It covers two pnpr protocols:
- Install acceleration. Sends
POST /-/pnpr/v0/resolvewith the projects and the existing lockfile, and returns the resolved lockfile for pnpm's headless install, which fetches the tarballs itself. See Install acceleration. - Shared side-effects cache. Looks up, verifies, restores, and publishes
signed build artifacts through the
/-/pnpr/v0/artifactsendpoints. See Shared side-effects cache.
Usage
import { resolveViaPnprServer } from '@pnpm/pnpr.client'
const { lockfile, stats } = await resolveViaPnprServer({
registryUrl: 'http://localhost:7677',
dependencies: { react: '^19.0.0' },
})
console.log(`Resolved ${stats.totalPackages} packages`)
// lockfile is ready for headless install
Configuration
Add to pnpm-workspace.yaml to offload resolution during pnpm install:
pnprServer: http://localhost:7677
The shared side-effects cache is configured under sideEffectsCache.remote.
The workspace names the organization and the eligible packages; the trust
material comes from the global config file or the environment:
pnprServer: http://localhost:7677
sideEffectsCache:
remote:
org: acme
packages:
- native-addon
The server side of both protocols, including the artifacts.orgs access
rules, the signed-envelope format, and the platform compatibility tags, is
documented with pnpr.
License
MIT