mirror/pnpm

0 Fork 0

mirror of https://github.com/pnpm/pnpm.git synced 2026-10-13 09:26:55 -04:00

Files

T

Zoltan Kochan d3ebbedc4a fix: enforce git prepare approvals on store reuse (#14160 )

Git preparation was gated only while fetching a package. Once an approved project placed prepared files in the shared store, a different project could link those files without consulting its own allowBuilds policy.

Persist whether preparation was required in each git package's store-index row and check the active project policy before warm-store reuse. Legacy rows without the marker are reused only with explicit approval; otherwise they go through the existing cold fetch and preparation gate. Revalidate in-process git fetch results as well so a long-lived store controller cannot carry approval across policy changes.

Pass the canonical lockfile resolution ID into both git fetch paths so the allowBuilds identity and suggested key stay byte-for-byte exact. Mirror the marker and warm-reuse gate in pacquet using the shared msgpackr-compatible store format.

Closes pnpm/pnpm#13965.

2026-08-25 18:15:59 +02:00

src

…

test

…

package.json

…

README.md

…

tsconfig.json

…

tsconfig.lint.json