@pnpm/config.version-policy 1100.1.12 → 1100.2.1

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @pnpm/config.version-policy
 
+## 1100.2.1
+
+### Patch Changes
+
+- Fixed `trustPolicyExclude` and `minimumReleaseAgeExclude` being ignored when set to a single string instead of a list. The value was read one character at a time, so the exclusion never matched the package it named — and a `*` anywhere in it matched every package, silently switching the policy off.
+
+- Fixed an inconsistency where `minimumReleaseAgeExclude` (and `trustPolicyExclude`) wildcard/bare-name rules behaved differently in the evaluator and normalizer. A bare rule now consistently evaluates as matching every version, preventing unexpected behavior and silent widening of version policy exemptions when pnpm rewrites the workspace manifest [pnpm/pnpm#13725](https://github.com/pnpm/pnpm/issues/13725).
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.3
+  - @pnpm/types@1102.0.0
+
+## 1100.2.0
+
+### Minor Changes
+
+- Added a new setting `minimumReleaseAgeExcludePrune`. When enabled, `pnpm add`, `pnpm update`, and `pnpm remove` prune the entries of `minimumReleaseAgeExclude` in `pnpm-workspace.yaml` that the freshly written lockfile no longer resolves: versions that are gone are dropped (an entry is removed once none of its versions remain), and entries for packages that are no longer in the lockfile are removed too. Name patterns (`@scope/*`) are always kept. The cleanup is skipped when the install's lockfile does not cover the whole workspace (`sharedWorkspaceLockfile: false`), since entries another project still needs would look stale.
+
+  Renamed `cleanupUnusedCatalogs` to `catalogPrune`, so that catalog pruning and release-age exclude pruning use one vocabulary. `cleanupUnusedCatalogs` continues to work; when both are set, `catalogPrune` wins.
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.2
+
 ## 1100.1.12
 
 ### Patch Changes

package/lib/index.d.ts

@@ -1,11 +1,15 @@
 import type { PackageVersionPolicy } from '@pnpm/types';
-export declare function createPackageVersionPolicy(patterns: string[]): PackageVersionPolicy;
+/**
+ * `patterns` arrives as a lone string when the setting is written as a YAML
+ * scalar or comes from a `PNPM_CONFIG_*` env var.
+ */
+export declare function createPackageVersionPolicy(patterns: string[] | string): PackageVersionPolicy;
 /**
  * Like {@link createPackageVersionPolicy}, but rewraps parser errors with an
  * `INVALID_<KEY>` PnpmError so the message points at the user-facing config key
  * (e.g. `minimumReleaseAgeExclude`) instead of the internal parser code.
  */
-export declare function createPackageVersionPolicyOrThrow(patterns: string[], key: string): PackageVersionPolicy;
+export declare function createPackageVersionPolicyOrThrow(patterns: string[] | string, key: string): PackageVersionPolicy;
 export interface PublishedByPolicyOptions {
     minimumReleaseAge?: number;
     minimumReleaseAgeExclude?: string[];
@@ -31,3 +35,8 @@ export declare function getPublishedByPolicy(opts: PublishedByPolicyOptions): Pu
  */
 export declare function mergePackageVersionSpecs(specs: string[]): string[];
 export declare function expandPackageVersionSpecs(specs: string[]): Set<string>;
+export interface ParsedVersionPolicyRule {
+    packageName: string;
+    exactVersions: string[];
+}
+export declare function parseVersionPolicyRule(pattern: string): ParsedVersionPolicyRule;

package/lib/index.js

@@ -1,9 +1,14 @@
 import { createMatcher } from '@pnpm/config.matcher';
 import { PnpmError } from '@pnpm/error';
 import semver from 'semver';
+/**
+ * `patterns` arrives as a lone string when the setting is written as a YAML
+ * scalar or comes from a `PNPM_CONFIG_*` env var.
+ */
 export function createPackageVersionPolicy(patterns) {
     const rules = [];
-    for (const pattern of patterns) {
+    const patternList = typeof patterns === 'string' ? [patterns] : patterns;
+    for (const pattern of patternList) {
         const parsed = parseVersionPolicyRule(pattern);
         rules.push({ nameMatcher: createMatcher(parsed.packageName), exactVersions: parsed.exactVersions });
     }
@@ -91,7 +96,7 @@ function evaluateVersionPolicy(rules, pkgName) {
             continue;
         }
         if (exactVersions.length === 0) {
-            return matchedVersions ?? true;
+            return true;
         }
         if (matchedVersions == null) {
             matchedVersions = [];
@@ -106,7 +111,7 @@ function evaluateVersionPolicy(rules, pkgName) {
     }
     return matchedVersions ?? false;
 }
-function parseVersionPolicyRule(pattern) {
+export function parseVersionPolicyRule(pattern) {
     const isScoped = pattern.startsWith('@');
     const atIndex = isScoped ? pattern.indexOf('@', 1) : pattern.indexOf('@');
     if (atIndex === -1) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/config.version-policy",
-  "version": "1100.1.12",
+  "version": "1100.2.1",
   "description": "Parses and evaluates package version policy specs and produces package-version matchers",
   "keywords": [
     "pnpm",
@@ -28,14 +28,14 @@
   ],
   "dependencies": {
     "@pnpm/config.matcher": "1100.0.2",
-    "@pnpm/error": "1100.1.1",
-    "@pnpm/types": "1101.9.0",
+    "@pnpm/error": "1100.1.3",
+    "@pnpm/types": "1102.0.0",
     "semver": "^7.8.5"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/config.version-policy": "1100.1.12",
-    "@types/semver": "7.7.1"
+    "@pnpm/config.version-policy": "1100.2.1",
+    "@types/semver": "7.8.0"
   },
   "engines": {
     "node": ">=22.13"