Files
pnpm/.changeset/runtime-shasums-cache.md
T
Zoltan Kochan 509ff4461d perf(resolver): cache Node.js release metadata and skip the index for exact runtime pins (#13901)
The first node shim run in a project pinning a runtime through
devEngines.runtime took ~650ms even when the exact version was already
in the store. ~530ms of that was network, re-downloading immutable and
already-verified release metadata: a cold index.json fetch during
pre-save specifier normalization, a second index.json fetch in the
resolver, the SHASUMS256.txt + signature fetch, and a cold connection to
unofficial-builds.nodejs.org for the musl SHASUMS.

Two changes, mirrored in both stacks:

- Exact stable-release specifiers (runtime:22.23.2) skip the release
  index: the specifier is its own resolution and existence is proven by
  the asset-list fetch. When that fetch fails, the index is consulted
  after the fact so a nonexistent version still raises
  ERR_PNPM_NODEJS_VERSION_NOT_FOUND. The pacquet-only pre-save
  normalization takes the same shortcut.

- Per-version SHASUMS256.txt bodies are cached under
  <cacheDir>/v11/runtime-shasums/<host>/<url path>. The URLs are
  version-pinned and immutable; signed bodies are cached only after
  their OpenPGP signature verified, and a cached body is trusted like
  the registry metadata mirror (no re-verification on read). Both
  stacks share the layout.

With a warm store, the first shim run drops from ~650ms to ~100ms — the
remainder is materializing the runtime tree into the global virtual
store — and no longer needs the network at all.

Closes pnpm/pnpm#13899.
2026-08-14 11:58:24 +02:00

725 B

@pnpm/crypto.shasums-file, @pnpm/engine.runtime.node-resolver, @pnpm/resolving.default-resolver, pnpm, pacquet
@pnpm/crypto.shasums-file @pnpm/engine.runtime.node-resolver @pnpm/resolving.default-resolver pnpm pacquet
minor minor patch minor minor

Resolving a Node.js runtime version (devEngines.runtime / runtime: specifiers) is now much faster: the per-version release metadata is cached in the pnpm cache directory after its signature is verified, and an exact stable version such as runtime:22.23.2 no longer downloads the Node.js release index. A pinned runtime whose metadata was fetched once resolves without any network access, which removes the noticeable delay on the first node invocation in a project pinning an already-downloaded runtime #13899.