@pnpm/config.version-policy 1100.2.0 → 1100.2.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @pnpm/config.version-policy
 
+## 1100.2.1
+
+### Patch Changes
+
+- Fixed `trustPolicyExclude` and `minimumReleaseAgeExclude` being ignored when set to a single string instead of a list. The value was read one character at a time, so the exclusion never matched the package it named — and a `*` anywhere in it matched every package, silently switching the policy off.
+
+- Fixed an inconsistency where `minimumReleaseAgeExclude` (and `trustPolicyExclude`) wildcard/bare-name rules behaved differently in the evaluator and normalizer. A bare rule now consistently evaluates as matching every version, preventing unexpected behavior and silent widening of version policy exemptions when pnpm rewrites the workspace manifest [pnpm/pnpm#13725](https://github.com/pnpm/pnpm/issues/13725).
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.3
+  - @pnpm/types@1102.0.0
+
 ## 1100.2.0
 
 ### Minor Changes

package/lib/index.d.ts

@@ -1,11 +1,15 @@
 import type { PackageVersionPolicy } from '@pnpm/types';
-export declare function createPackageVersionPolicy(patterns: string[]): PackageVersionPolicy;
+/**
+ * `patterns` arrives as a lone string when the setting is written as a YAML
+ * scalar or comes from a `PNPM_CONFIG_*` env var.
+ */
+export declare function createPackageVersionPolicy(patterns: string[] | string): PackageVersionPolicy;
 /**
  * Like {@link createPackageVersionPolicy}, but rewraps parser errors with an
  * `INVALID_<KEY>` PnpmError so the message points at the user-facing config key
  * (e.g. `minimumReleaseAgeExclude`) instead of the internal parser code.
  */
-export declare function createPackageVersionPolicyOrThrow(patterns: string[], key: string): PackageVersionPolicy;
+export declare function createPackageVersionPolicyOrThrow(patterns: string[] | string, key: string): PackageVersionPolicy;
 export interface PublishedByPolicyOptions {
     minimumReleaseAge?: number;
     minimumReleaseAgeExclude?: string[];

package/lib/index.js

@@ -1,9 +1,14 @@
 import { createMatcher } from '@pnpm/config.matcher';
 import { PnpmError } from '@pnpm/error';
 import semver from 'semver';
+/**
+ * `patterns` arrives as a lone string when the setting is written as a YAML
+ * scalar or comes from a `PNPM_CONFIG_*` env var.
+ */
 export function createPackageVersionPolicy(patterns) {
     const rules = [];
-    for (const pattern of patterns) {
+    const patternList = typeof patterns === 'string' ? [patterns] : patterns;
+    for (const pattern of patternList) {
         const parsed = parseVersionPolicyRule(pattern);
         rules.push({ nameMatcher: createMatcher(parsed.packageName), exactVersions: parsed.exactVersions });
     }
@@ -91,7 +96,7 @@ function evaluateVersionPolicy(rules, pkgName) {
             continue;
         }
         if (exactVersions.length === 0) {
-            return matchedVersions ?? true;
+            return true;
         }
         if (matchedVersions == null) {
             matchedVersions = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/config.version-policy",
-  "version": "1100.2.0",
+  "version": "1100.2.1",
   "description": "Parses and evaluates package version policy specs and produces package-version matchers",
   "keywords": [
     "pnpm",
@@ -28,13 +28,13 @@
   ],
   "dependencies": {
     "@pnpm/config.matcher": "1100.0.2",
-    "@pnpm/error": "1100.1.2",
-    "@pnpm/types": "1101.9.0",
+    "@pnpm/error": "1100.1.3",
+    "@pnpm/types": "1102.0.0",
     "semver": "^7.8.5"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/config.version-policy": "1100.2.0",
+    "@pnpm/config.version-policy": "1100.2.1",
     "@types/semver": "7.8.0"
   },
   "engines": {