Ben MaurerandZoltan Kochan
b260a317ec
Enable reqwest's `zstd` feature and set `.zstd(true)` next to `.gzip(true)` in the shared install client. pnpm now sends `Accept-Encoding: zstd,gzip,deflate` (previously `gzip,deflate`) and decodes zstd bodies transparently. Full packuments gain the most. A long field repeated across versions, such as vite's `licenseText` (up to 259 KB per version, 34 MB of the document), spans far more than gzip's 32 KB window, so gzip cannot reuse the earlier copies. vite's full packument on registry.npmjs.org is 38.9 MB: gzip -6 gives 4.65 MB, zstd -3 603 KB, zstd -19 455 KB. pnpm fetches full packuments for `trustPolicy: no-downgrade`, for `resolutionMode: time-based` on registries without a `time` field, and for `minimumReleaseAge` when the abbreviated document has no `time`. Abbreviated packuments gain less (vite: 403 KB gzip, 382 KB zstd -3). Brotli is left out on purpose. On these payloads it saves about as much as zstd and would add a second decoder to the binary. Tarballs are unaffected: registries serve them without `Content-Encoding`, so integrity verification still hashes the raw `.tgz`. Because `reqwest` is a workspace dependency, pnpr's upstream client gains zstd too. The WebContainer transport gets a no-op `zstd()` builder method to match its `gzip()`. pnpr also serves zstd: tower-http's `compression-zstd` lets its CompressionLayer pick zstd when the client prefers it. Resolving 1,235 packuments against pnpr with full metadata moved 103.6 MB instead of 115.4 MB (-10%), and took 34.5 s instead of 38.4 s on a 25 Mbit/s link. `zstd-sys` compiles the bundled libzstd with `cc`, which the build already needs on every release target. The release binary grows by 152 KiB (+0.3%). --------- Co-authored-by: Zoltan Kochan <z@kochan.io>
16 lines
635 B
Plaintext
16 lines
635 B
Plaintext
* text eol=lf
|
|
|
|
*.tgz binary
|
|
*.zst binary
|
|
|
|
# Test fixtures embed package.json/lockfiles that name real packages purely as
|
|
# test data, never as dependencies we install. Mark the fixture trees as
|
|
# generated so GitHub's dependency graph (and therefore Dependabot alerts and
|
|
# automatic security PRs) ignores them. This also collapses fixtures in diffs.
|
|
# The `@pnpm/test-fixtures` helper package (__utils__/test-fixtures) is real
|
|
# source, so it is intentionally not matched here.
|
|
**/fixtures/** linguist-generated
|
|
**/__fixtures__/** linguist-generated
|
|
**/findPackages-fixtures/** linguist-generated
|
|
pnpr/.fixtures/** linguist-generated
|