mirror of https://github.com/pnpm/pnpm.git synced 2026-07-25 23:17:08 -04:00

Files

Varun Chawla 8efd18dfda fix(lockfile): respect lockfile-include-tarball-url=false for non-standard URLs (#10621 )

When lockfile-include-tarball-url is explicitly set to false, tarball URLs
are now always excluded from the lockfile. Previously, packages hosted under
non-standard tarball URLs would still have their tarball field written to the
lockfile even when the setting was false, causing flaky and inconsistent
behavior across environments.

The fix makes the option tri-state internally:
- true: always include tarball URLs
- false: never include tarball URLs
- undefined (not set): use the existing heuristic that includes tarball URLs
  only for packages with non-standard registry URLs

close #6667

2026-03-07 15:24:13 +01:00

src

fix(lockfile): respect lockfile-include-tarball-url=false for non-standard URLs (#10621 )

2026-03-07 15:24:13 +01:00

test

fix(lockfile): respect lockfile-include-tarball-url=false for non-standard URLs (#10621 )

2026-03-07 15:24:13 +01:00

CHANGELOG.md

chore(release): 10.30.2

2026-02-24 00:36:58 +01:00

package.json

chore(release): 10.30.2

2026-02-24 00:36:58 +01:00

README.md

refactor: group projects in different subdirectories (#5659 )

2022-11-20 01:35:22 +02:00

tsconfig.json

fix: dependencies that were added to onlyBuiltDependencies should be built on install (#10256 )

2025-12-02 15:36:29 +01:00

tsconfig.lint.json

refactor: put all non-public projects to directories that start with __

2022-11-20 02:40:44 +02:00

README.md

@pnpm/core

Fast, disk space efficient installation engine. Used by pnpm

Install

Install it via npm.

pnpm add @pnpm/core

It also depends on @pnpm/logger version 1, so install it as well via:

pnpm add @pnpm/logger@1

API

`mutateModules(importers, options)`

TODO

`link(linkFromPkgs, linkToModules, [options])`

Create symbolic links from the linked packages to the target package's node_modules (and its node_modules/.bin).

Arguments:

linkFromPkgs - String[] - paths to the packages that should be linked.
linkToModules - String - path to the dependent package's node_modules directory.
options.reporter - Function - A function that listens for logs.

`linkToGlobal(linkFrom, options)`

Create a symbolic link from the specified package to the global node_modules.

Arguments:

linkFrom - String - path to the package that should be linked.
globalDir - String - path to the global directory.
options.reporter - Function - A function that listens for logs.

`linkFromGlobal(pkgNames, linkTo, options)`

Create symbolic links from the global pkgNames to the linkTo/node_modules folder.

Arguments:

pkgNames - String[] - packages to link.
linkTo - String - package to link to.
globalDir - String - path to the global directory.
options.reporter - Function - A function that listens for logs.

`storeStatus([options])`

Return the list of modified dependencies.

Arguments:

options.reporter - Function - A function that listens for logs.

Returns: Promise<string[]> - the paths to the modified packages of the current project. The paths contain the location of packages in the store, not in the projects node_modules folder.

`storePrune([options])`

Remove unreferenced packages from the store.

Hooks

Hooks are functions that can step into the installation process.

`readPackage(pkg: Manifest): Manifest | Promise<Manifest>`

This hook is called with every dependency's manifest information. The modified manifest returned by this hook is then used by @pnpm/core during installation. An async function is supported.

Example:

const { installPkgs } = require('@pnpm/core')

installPkgs({
  hooks: {readPackage}
})

function readPackage (pkg) {
  if (pkg.name === 'foo') {
    pkg.dependencies = {
      bar: '^2.0.0',
    }
  }
  return pkg
}

`afterAllResolved(lockfile: Lockfile): Lockfile | Promise<Lockfile>`

This hook is called after all dependencies are resolved. It receives and returns the resolved lockfile object. An async function is supported.

License

MIT