mirror/pnpm
1
0 Fork 0
mirror of https://github.com/pnpm/pnpm.git synced 2026-10-13 09:26:55 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
2f2bdaf37fca2d294a4ec100b89fb8ca975fe273
pnpm/pnpm-workspace.yaml
T
Zoltan Kochan a22206394e fix(run): clean up lifecycle process trees on failure (#14244) 
On Windows, pnpm's error handler cannot rely on descendant enumeration because modern systems may lack wmic and the PowerShell fallback can exceed its time budget. Recursive exec children already register their PIDs for the taskkill fallback, but lifecycle children spawned by recursive run did not.

Use the spawn observer added in `@pnpm/npm-lifecycle` 1100.1.0 to register lifecycle children with the existing tracker. Reuse the process-tree fixture to verify recursive run cleanup with the process-enumeration paths removed from PATH.

Also disable Git checks in the publish error test so a dirty contributor worktree cannot mask the missing-version error that test exercises.

Related to pnpm/pnpm#14211.
2026-08-27 21:27:50 +02:00

563 lines
16 KiB
YAML
Raw Blame History

packages:
- .meta-updater
- pnpm11/__typecheck__
- pnpm11/__typings__
- pnpm11/__utils__/*
- '!pnpm11/__utils__/build-artifacts'
- pnpm11/auth/*
- pnpm11/building/*
- pnpm11/cache/*
- pnpm11/catalogs/*
- pnpm11/cli/*
- pnpm11/config/*
- pnpm11/crypto/*
- pnpm11/installing/dedupe/*
- pnpm11/deps/*
- pnpm11/deps/compliance/*
- pnpm11/deps/inspection/*
- pnpm11/deps/security/*
- pnpm11/engine/*
- pnpm11/engine/pm/*
- pnpm11/engine/runtime/*
- pnpm11/exec/*
- pnpm11/fetching/*
- pnpm11/fs/*
- pnpm11/global/*
- pnpm11/hooks/*
- pnpm11/lockfile/*
- pnpm11/network/*
- pnpm11/modules-mounter/*
- pnpm11/object/*
- pnpm11/core/*
- pnpm11/bins/*
- pnpm11/installing/*
- pnpm11/installing/linking/*
- pnpm11/pkg-manifest/*
- pnpm11/patching/*
- pnpm11/pnpm
- pnpm11/pnpm/dev
- pnpm11/testing/*
- pnpm11/worker
- pnpm11/pnpm/artifacts/*
- pnpr/client
- pnpm11/registry-access/*
- pnpm11/releasing/*
- pnpm11/resolving/*
- pnpm11/resolving/registry/*
- pnpm11/shell/*
- pnpm11/store/*
- pnpm11/text/*
- pnpm11/workspace/*
- pnpm11/yaml/*
- pnpm/npm/napi
- pnpm/npm/pnpm
- pnpm/tasks/registry-mock
- pnpr/npm/pnpr
- '!**/example/**'
- '!**/test/**'
- '!pnpm11/resolving/local-resolver/example-package/**'
# Native workspace release management (consumed by `pnpm change` / `pnpm version -r`).
# The Rust CLI wrapper is the workspace package `pacquet` (published to npm as
# `pnpm`); generate-packages.mjs rewrites the name at pack time.
versioning:
# @pnpm/logger is a workspace package, but every consumer depends on the
# published one through the `^1100.0.0` catalog entry (a `catalog:` peer, kept
# deliberately so Jest loads the published CJS-bole logger — see the `bole`
# note in the catalog). The release engine would otherwise reject those
# catalog: peers as internal ranges that must use the workspace: protocol, so
# freeze @pnpm/logger from the automated release: it is bumped out of band.
ignore:
- '@pnpm/logger'
# The Rust CLI wrapper and its NAPI addon always release in lockstep at one
# shared version.
fixed:
- [ 'pacquet', '@pnpm/napi' ]
lanes:
'@pnpm/pnpr': alpha
allowBuilds:
core-js: false
esbuild: true
fuse-native: true
ghooks: true
msgpackr-extract: true
unrs-resolver: true
auditConfig:
ignoreGhsas:
- GHSA-2g4f-4pwh-qvx6
- GHSA-76c9-3jph-rj3q
- GHSA-ffrw-9mx8-89p8
- GHSA-mh29-5h37-fv8m
- GHSA-w5hq-g745-h8pq
# GHSA-h67p-54hq-rp68: js-yaml quadratic-complexity DoS in merge key handling.
# Patched only in >=4.1.2 with no v3 fix; @yarnpkg/parsers requires the js-yaml 3
# API (yaml.safeLoad), so its transitive js-yaml cannot be upgraded.
- GHSA-h67p-54hq-rp68
catalog:
# @babel/core 8.x (and its plugins) require Node.js ^22.18.0 || >=24.11.0,
# above pnpm's supported floor of Node.js >=22.13.
'@babel/core': ^7.29.7
'@babel/plugin-transform-explicit-resource-management': ^7.29.7
'@commitlint/cli': ^21.2.2
'@commitlint/config-conventional': ^21.2.2
'@commitlint/prompt-cli': ^21.2.2
'@cyclonedx/cyclonedx-library': 10.2.0
'@eslint/js': ^10.0.1
'@inquirer/prompts': ^8.6.0
'@jest/globals': 30.4.1
'@npm/types': ^2.1.0
'@pnpm/byline': ^1.0.0
'@pnpm/colorize-semver-diff': ^2.0.0
'@pnpm/config.env-replace': ^4.1.0
'@pnpm/exec': ^4.0.0
'@pnpm/log.group': 4.0.1
'@pnpm/logger': '^1100.0.0'
'@pnpm/meta-updater': 2.0.6
'@pnpm/nopt': ^0.3.1
'@pnpm/npm-lifecycle': ^1100.1.0
'@pnpm/npm-package-arg': ^2.0.0
'@pnpm/os.env.path-extender': ^3.0.1
'@pnpm/patch-package': 0.0.1
'@pnpm/semver-diff': ^2.0.0
'@pnpm/tabtab': ^0.5.4
'@pnpm/tgz-fixtures': 0.0.0
'@reflink/reflink': 0.1.19
'@rushstack/worker-pool': 0.7.25
'@stylistic/eslint-plugin': ^5.10.0
'@types/adm-zip': ^0.5.8
'@types/archy': 0.0.36
'@types/cross-spawn': ^6.0.6
'@types/fs-extra': ^11.0.4
'@types/graceful-fs': ^4.1.9
'@types/hosted-git-info': ^3.0.5
'@types/ini': 4.1.1
'@types/is-gzip': 2.0.2
'@types/is-windows': ^1.0.2
'@types/isexe': 2.0.4
'@types/jest': ^30.0.0
'@types/js-yaml': ^4.0.9
'@types/libnpmpublish': ^11.2.0
'@types/lodash.kebabcase': 4.1.9
'@types/lodash.throttle': 4.1.9
'@types/micromatch': ^4.0.10
# Kept on 22.x to match pnpm's minimum supported Node.js version (>=22.13);
# newer majors would type APIs that don't exist on the supported floor.
'@types/node': ^22.19.19
'@types/normalize-package-data': ^2.4.4
'@types/normalize-path': ^3.0.2
'@types/npm-registry-fetch': ^8.0.9
'@types/object-hash': 3.0.6
'@types/parse-json': ^7.0.0
'@types/picomatch': ^4.0.3
'@types/pnpm__byline': npm:@types/byline@^4.2.36
'@types/proxyquire': ^1.3.31
'@types/qrcode-terminal': ^0.12.2
'@types/ramda': 0.32.0
'@types/retry': ^0.12.5
'@types/semver': 7.8.0
'@types/ssri': ^7.1.5
'@types/tar-stream': ^3.1.4
'@types/touch': ^3.1.5
'@types/validate-npm-package-name': ^4.0.2
'@types/which': ^3.0.4
'@types/write-file-atomic': ^4.0.3
'@types/yarnpkg__lockfile': ^1.1.9
'@types/zkochan__table': npm:@types/table@6.3.2
'@typescript-eslint/utils': ^8.68.0
'@typescript/native-preview': 7.0.0-dev.20260707.2
'@yarnpkg/core': 4.9.1
'@yarnpkg/extensions': 2.0.7
'@yarnpkg/lockfile': ^1.1.0
'@yarnpkg/nm': 4.1.1
'@yarnpkg/pnp': ^4.1.7
'@zkochan/cmd-shim': ^9.0.7
'@zkochan/retry': ^0.2.0
'@zkochan/rimraf': ^4.0.0
'@zkochan/table': ^2.0.1
adm-zip: ^0.6.0
amaro: ^1.1.11
ansi-diff: ^1.2.0
archy: ^1.0.0
better-path-resolve: 2.0.0
# bin-links 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's
# supported floor of Node.js >=22.13.
bin-links: ^6.0.2
# bole 6 is ESM-only. Under Jest, the workspace logger's ESM bole and the
# published @pnpm/logger's CJS bole 5 land in different realms, so the
# globalThis.$$bole output registry is no longer shared and log events
# emitted through one logger copy never reach the other's streamParser.
# Keep bole 5 until the published @pnpm/logger ships with bole 6.
bole: ^5.0.29
boxen: npm:@zkochan/boxen@5.1.2
c8: ^12.0.0
camelcase: ^9.0.0
camelcase-keys: ^10.0.2
can-link: ^3.0.0
can-write-to-dir: ^2.0.0
chalk: ^6.0.0
ci-info: ^4.4.0
cli-truncate: ^6.1.1
cmd-extension: ^2.0.0
comver-to-semver: ^2.0.0
cross-env: ^10.1.0
cross-spawn: ^7.0.6
# cspell 10.x requires Node.js >=22.18.0, above pnpm's supported floor of
# Node.js >=22.13.
cspell: 9.8.0
deep-require-cwd: 1.0.0
delay: ^7.0.0
detect-indent: 7.0.2
detect-libc: ^2.1.2
didyoumean2: ^7.0.4
dint: ^5.1.0
dir-is-case-sensitive: ^3.0.0
empathic: ^2.0.1
encode-registry: ^3.0.1
esbuild: ^0.28.2
escape-string-regexp: ^5.0.0
eslint: ^10.9.1
eslint-plugin-import-x: ^4.17.1
eslint-plugin-jest: ^29.16.2
eslint-plugin-n: ^18.3.0
eslint-plugin-promise: ^7.3.0
eslint-plugin-regexp: ^3.1.1
eslint-plugin-simple-import-sort: ^14.0.0
execa: npm:safe-execa@0.3.0
exists-link: 2.0.0
fast-deep-equal: ^3.1.3
fast-glob: ^3.3.3
fs-extra: ^11.4.0
fuse-native: ^2.2.6
# Bundled into the pnpm 12 wrapper's dist/ payload, where the Corepack entry
# point loads it from; see pnpm/npm/pnpm/bin/pnpm.mjs.
get-pnpm: ^0.0.3
get-port: ^7.2.0
ghooks: 2.0.4
graceful-fs: ^4.2.11
graph-cycles: 3.0.0
hosted-git-info: npm:@pnpm/hosted-git-info@1.0.0
https-proxy-server-express: 0.1.2
husky: ^9.1.7
hyperdrive-schemas: ^2.0.0
# ini 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's
# supported floor of Node.js >=22.13.
ini: 6.0.0
is-gzip: 2.0.0
is-inner-link: ^5.0.0
is-subdir: ^2.0.0
is-windows: ^1.0.2
isexe: 4.0.0
jest: ^30.4.2
jest-diff: ^30.4.1
human-id: ^4.2.1
js-yaml: npm:@zkochan/js-yaml@0.0.11
json5: ^2.2.3
keyv: 5.6.0
lcov-result-merger: ^6.0.0
# libnpmpublish 12.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above
# pnpm's supported floor of Node.js >=22.13.
libnpmpublish: ^11.2.0
load-json-file: ^7.0.1
lodash.kebabcase: ^4.1.1
lodash.throttle: 4.1.1
loud-rejection: ^2.2.0
lru-cache: ^11.5.2
make-empty-dir: ^4.0.0
mdast-util-to-string: ^4.0.0
memoize: ^11.0.0
micromatch: ^4.0.8
msgpackr: 2.0.6
nm-prune: ^5.0.0
# node-gyp 13 (with its nopt 10 and which 7 dependencies) requires Node.js
# ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's supported floor of >=22.13.
node-gyp: ^12.3.0
normalize-newline: 5.0.0
# normalize-package-data 9.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0,
# above pnpm's supported floor of Node.js >=22.13.
normalize-package-data: ^8.0.0
normalize-path: ^3.0.0
normalize-registry-url: 2.0.1
# npm-packlist 11.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above
# pnpm's supported floor of Node.js >=22.13.
npm-packlist: 10.0.4
# npm-registry-fetch 20.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0,
# above pnpm's supported floor of Node.js >=22.13.
npm-registry-fetch: ^19.0.0
object-hash: 3.0.0
open: ^11.0.1
openpgp: ^6.3.1
'@openpgp/web-stream-tools': 0.3.1
p-defer: ^4.0.1
p-every: ^2.0.0
p-filter: ^4.1.0
p-limit: ^7.3.1
p-queue: ^9.3.3
parse-json: ^8.3.0
parse-npm-tarball-url: ^5.0.0
path-absolute: ^2.0.0
path-exists: ^5.0.0
path-name: ^1.0.0
path-temp: ^3.0.0
pidtree: ^1.0.0
preferred-pm: ^5.0.0
pretty-bytes: ^7.1.1
pretty-ms: ^9.3.0
promise-share: ^2.0.1
proxyquire: ^2.1.3
ps-list: ^9.0.0
qrcode-terminal: ^0.12.0
ramda: npm:@pnpm/ramda@0.28.1
read-ini-file: 5.0.0
read-yaml-file: ^3.0.0
realpath-missing: ^2.0.0
remark-parse: ^11.0.0
remark-stringify: ^11.0.0
rename-overwrite: ^7.0.1
render-help: ^2.0.0
resolve-link-target: ^3.0.0
rimraf: ^6.1.3
root-link-target: ^4.0.0
rxjs: ^7.8.2
safe-buffer: 5.2.1
safe-execa: ^0.3.0
safe-promise-defer: ^2.0.0
sanitize-filename: ^1.6.4
semver: ^7.8.5
semver-range-intersect: ^0.3.1
semver-utils: ^1.1.4
shlex: ^3.0.0
shx: ^0.4.0
socks: ^2.8.9
sort-keys: ^6.0.1
split-cmd: ^1.1.0
split2: ^4.2.0
# ssri 14.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's
# supported floor of Node.js >=22.13.
ssri: 13.0.1
stacktracey: ^2.2.0
string-length: ^7.0.1
string-width: ^8.2.2
strip-bom: ^5.0.0
strip-comments-strings: 1.2.0
symlink-dir: ^10.0.1
tar: ^7.5.22
tar-stream: ^3.2.1
# tempy >=3.1.0 uses temp-dir 3.x which has an async fs.realpath() in its
# module init. When esbuild bundles this into its __esm lazy-init pattern,
# the async operation deadlocks and the pnpm binary hangs on startup.
tempy: 3.0.0
terminal-link: ^5.0.0
tinyglobby: ^0.2.17
touch: 3.1.1
tree-kill: ^1.2.2
ts-jest-resolver: 2.0.1
# Kept on 6.x because typescript-eslint does not support the TypeScript 7.0 API
# yet (https://github.com/typescript-eslint/typescript-eslint/issues/10940); the
# 7.x compiler ships separately as @typescript/native-preview (tsgo).
typescript: 6.0.3
typescript-eslint: ^8.68.0
# undici 8.x requires Node.js >=22.19.0, above pnpm's supported floor of
# Node.js >=22.13.
undici: ^7.29.0
unified: ^11.0.5
# validate-npm-package-name 8.x requires Node.js ^22.22.2 || ^24.15.0 ||
# >=26.0.0, above pnpm's supported floor of Node.js >=22.13.
validate-npm-package-name: 7.0.2
version-selector-type: ^3.0.0
vfile: ^6.0.3
which: npm:@pnpm/which@^3.0.1
# write-file-atomic 8.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0,
# above pnpm's supported floor of Node.js >=22.13.
write-file-atomic: ^7.0.1
write-ini-file: 5.0.0
write-json-file: ^7.0.0
write-json5-file: ^4.0.0
write-package: 7.2.0
write-yaml-file: ^6.0.0
yaml: ^2.9.0
yaml-tag: 1.1.0
catalogMode: strict
catalogPrune: true
enablePrePostScripts: false
engineStrict: false
gitChecks: false
hoistPattern:
- jest-runner
minimumReleaseAge: 1440 # At least a day
minimumReleaseAgeExclude:
- '@pnpm/*'
- '@zkochan/*'
- better-path-resolve
- can-link
- can-write-to-dir
- cmd-extension
- comver-to-semver
- dir-is-case-sensitive
- '@esbuild/*'
- glob@11.1.0
- is-inner-link
- is-subdir
- make-empty-dir
- normalize-registry-url
- parse-npm-tarball-url@5.0.0
- path-absolute
- path-temp
- pnpm
- preferred-pm
- promise-share
- read-ini-file
- read-yaml-file
- realpath-missing
- rename-overwrite
- render-help
- resolve-link-target
- root-link-target
- safe-execa
- safe-promise-defer
- symlink-dir
- which-pm
- write-ini-file
- write-json5-file
- write-yaml-file
- http-proxy-middleware@3.0.7
- get-pnpm@0.0.3
minimumReleaseAgeExcludePrune: true
nodeVersion: 22.13.0
overrides:
'@cypress/request@3.0.9>qs': ^6.14.1
'@yarnpkg/fslib@2': '3'
adm-zip@<0.6.0: ^0.6.0
ajv@>=7.0.0-alpha.0 <8.18.0: '>=8.18.0'
body-parser@<2.2.1: '^2.2.1'
brace-expansion@<5.0.5: '>=5.0.5'
clipanion: 3.2.0-rc.6
cookie@<0.7.0: '>=0.7.0'
cross-spawn@<7.0.5: '>=7.0.5'
debug@<3.1.0: '>=3.1.0'
diff@<8.0.3: '^8.0.3'
express@<4.22.1: ^4.22.1
follow-redirects@<=1.15.5: '>=1.15.6'
glob-parent@<5.1.2: '>=5.1.2'
glob@>=10.3.7 <=11.0.3: '^11.1.0'
handlebars@>=4.0.0 <4.7.9: '>=4.7.9'
hosted-git-info@1: 'catalog:'
istanbul-reports: npm:@zkochan/istanbul-reports
js-yaml@<3.14.2: '^3.14.2'
js-yaml@^4.0.0: 'catalog:'
json5@<2.2.2: 'catalog:'
jsonwebtoken@<=8.5.1: '>=9.0.0'
jws@<3.2.3: '^3.2.3'
lodash@<=4.17.23: '>=4.18.0'
lodash@>=4.0.0 <=4.17.22: '^4.17.23'
lodash@>=4.0.0 <=4.17.23: '>=4.18.0'
minimatch@>=7.0.0 <7.4.7: '^7.4.7'
minimatch@>=9.0.0 <10.0.0: '>=10.2.4'
nopt@5: npm:@pnpm/nopt@^0.2.1
on-headers@<1.1.0: '>=1.1.0'
path-to-regexp@<0.1.13: ^0.1.13
path-to-regexp@>=4.0.0 <6.3.0: '>=6.3.0'
path-to-regexp@>=7.0.0 <8.0.0: '>=8.0.0'
postman-request>qs: ^6.14.1
qs@>=6.11.1 <=6.15.1: ^6.15.2
request: npm:postman-request@2.88.1-postman.40
semver@<7.5.2: 'catalog:'
send@<0.19.0: ^0.19.0
shell-quote@<1.8.4: '>=1.8.4'
serve-static@<1.16.0: ^1.16.0
# GHSA-w7jw-789q-3m8p / CVE-2026-9277: 1.8.4 patches critical shell-quote vulnerabilities in <=1.8.3.
shell-quote: 1.8.4
socks@2: ^2.8.1
tar@<=7.5.9: '>=7.5.10'
tmp@<=0.2.3: '>=0.2.4'
tough-cookie@<4.1.3: '>=4.1.3'
validator@<13.15.22: '>=13.15.22'
yaml@<2.2.2: '>=2.2.2'
http-proxy-middleware@>=0.16.0 <3.0.6: ^3.0.6
deepmerge-ts@<8.0.0: ^8.0.0
packageExtensions:
'@babel/parser':
peerDependencies:
'@babel/types': '*'
jest-circus:
dependencies:
slash: '3'
remark-parse:
dependencies:
vfile: ^6.0.0
peerDependencies:
unified: '*'
remark-stringify:
dependencies:
vfile: ^6.0.0
peerDependencies:
unified: '*'
patchedDependencies:
graceful-fs@4.2.11: __patches__/graceful-fs@4.2.11.patch
normalize-registry-url@2.0.1: __patches__/normalize-registry-url@2.0.1.patch
patchesDir: __patches__
publishBranch: main
resolutionMode: lowest-direct
savePrefix: ''
trustPolicy: no-downgrade
trustPolicyExclude:
- '@pnpm/*'
- '@yarnpkg/libzip@3.2.2'
- pnpm
- rxjs@7.8.2
- tinyexec@1.2.2
- undici-types@6.21.0
trustPolicyIgnoreAfter: 10080 # 1 week
# Dependencies deliberately held back, which `pnpm update --latest` (run by the
# update-lockfile workflow) would otherwise bump. Most of them are packages
# whose newer versions require a Node.js version above pnpm's supported floor
# (>=22.13); the comment at each catalog entry above records the reason.
# typescript is held on 6.x because typescript-eslint does not support the
# TypeScript 7.0 API yet.
update:
ignoreDeps:
- '@babel/core'
- '@babel/plugin-transform-explicit-resource-management'
- '@types/node'
- bin-links
- bole
- cspell
- eslint-plugin-regexp
- ini
- libnpmpublish
- node-gyp
- normalize-package-data
- npm-packlist
- npm-registry-fetch
- ssri
- tempy
- typescript
- undici
- validate-npm-package-name
- write-file-atomic
virtualStoreType: global
Reference in new issue View Git Blame Copy Permalink