@pnpm/deps.graph-builder 1100.0.25 → 1100.1.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # @pnpm/deps.graph-builder
 
+## 1100.1.0
+
+### Minor Changes
+
+- Fixed an installed optional dependency being left without one of its own required dependencies. When a package reached through `optionalDependencies` is installable on the current system but one of its regular `dependencies` is not, a lockfile-based install skipped that dependency and installed the parent anyway, so importing the parent failed with `MODULE_NOT_FOUND`. The dependency is now installed, and an install-check warning reports the incompatibility. A dependency is still only skipped when every path to it is optional, or when the package that pulls it in was itself skipped [#13286](https://github.com/pnpm/pnpm/issues/13286).
+
+### Patch Changes
+
+- Installing a local `file:` directory dependency with the global virtual store enabled no longer fails with `TypeError: Cannot read properties of undefined (reading 'split')` [#13335](https://github.com/pnpm/pnpm/issues/13335).
+
+  Local directory dependencies — `file:` directories and injected workspace packages — now get a global-virtual-store slot of their own per project. They used to share one slot across every project that depended on a directory of the same name, so a project could end up linked to another project's copy of the dependency.
+
+- Updated dependencies:
+  - @pnpm/config.package-is-installable@1100.1.0
+  - @pnpm/core-loggers@1100.3.0
+  - @pnpm/deps.graph-hasher@1100.2.13
+  - @pnpm/deps.path@1100.0.12
+  - @pnpm/fs.symlink-dependency@1100.0.15
+  - @pnpm/hooks.types@1100.2.4
+  - @pnpm/installing.modules-yaml@1100.0.13
+  - @pnpm/lockfile.fs@1100.1.15
+  - @pnpm/lockfile.utils@1100.1.6
+  - @pnpm/patching.config@1100.0.13
+  - @pnpm/store.controller-types@1100.1.11
+  - @pnpm/types@1101.7.0
+
+## 1100.0.26
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/config.package-is-installable@1100.0.16
+  - @pnpm/constants@1100.0.1
+  - @pnpm/core-loggers@1100.2.5
+  - @pnpm/deps.graph-hasher@1100.2.12
+  - @pnpm/deps.path@1100.0.11
+  - @pnpm/fs.symlink-dependency@1100.0.14
+  - @pnpm/hooks.types@1100.2.3
+  - @pnpm/installing.modules-yaml@1100.0.12
+  - @pnpm/lockfile.fs@1100.1.14
+  - @pnpm/lockfile.utils@1100.1.5
+  - @pnpm/patching.config@1100.0.12
+  - @pnpm/patching.types@1100.0.1
+  - @pnpm/store.controller-types@1100.1.10
+  - @pnpm/types@1101.6.0
+
 ## 1100.0.25
 
 ### Patch Changes

package/lib/index.d.ts

@@ -0,0 +1 @@
+export * from './lockfileToDepGraph.js';

package/lib/iteratePkgsForVirtualStore.d.ts

@@ -0,0 +1,17 @@
+import { type PkgMetaAndSnapshot } from '@pnpm/deps.graph-hasher';
+import type { LockfileObject } from '@pnpm/lockfile.fs';
+import type { AllowBuild, SupportedArchitectures } from '@pnpm/types';
+interface PkgSnapshotWithLocation {
+    pkgMeta: PkgMetaAndSnapshot;
+    dirInVirtualStore: string;
+}
+export declare function iteratePkgsForVirtualStore(lockfile: LockfileObject, opts: {
+    allowBuild?: AllowBuild;
+    enableGlobalVirtualStore?: boolean;
+    lockfileDir: string;
+    virtualStoreDirMaxLength: number;
+    virtualStoreDir: string;
+    globalVirtualStoreDir: string;
+    supportedArchitectures?: SupportedArchitectures;
+}): IterableIterator<PkgSnapshotWithLocation>;
+export {};

package/lib/iteratePkgsForVirtualStore.js

@@ -0,0 +1,67 @@
+import path from 'node:path';
+import { calcGraphNodeHash, findRuntimeNodeVersion, iterateHashedGraphNodes, iteratePkgMeta, lockfileToDepGraph, } from '@pnpm/deps.graph-hasher';
+import * as dp from '@pnpm/deps.path';
+import { nameVerFromPkgSnapshot, } from '@pnpm/lockfile.utils';
+export function* iteratePkgsForVirtualStore(lockfile, opts) {
+    // Resolve the project's pinned runtime Node version once per
+    // invocation — the result drives every snapshot's GVS hash (or
+    // the side-effects-cache key prefix in the non-GVS runtime
+    // branch). `undefined` when no `engines.runtime` / `devEngines.runtime`
+    // pin reached the lockfile, in which case the hasher falls through
+    // to the host-detected Node.
+    const nodeVersion = findRuntimeNodeVersion(Object.keys(lockfile.packages ?? {}));
+    if (opts.enableGlobalVirtualStore) {
+        for (const { hash, pkgMeta } of hashDependencyPaths(lockfile, {
+            allowBuild: opts.allowBuild,
+            supportedArchitectures: opts.supportedArchitectures,
+            nodeVersion,
+            lockfileDir: opts.lockfileDir,
+        })) {
+            yield {
+                dirInVirtualStore: path.join(opts.globalVirtualStoreDir, hash),
+                pkgMeta,
+            };
+        }
+    }
+    else if (lockfile.packages) {
+        let graphNodeHashOpts;
+        for (const depPath in lockfile.packages) {
+            if (!Object.hasOwn(lockfile.packages, depPath)) {
+                continue;
+            }
+            const pkgSnapshot = lockfile.packages[depPath];
+            const { name, version } = nameVerFromPkgSnapshot(depPath, pkgSnapshot);
+            const pkgMeta = {
+                depPath: depPath,
+                pkgIdWithPatchHash: dp.getPkgIdWithPatchHash(depPath),
+                name,
+                version,
+                pkgSnapshot,
+            };
+            let dirInVirtualStore;
+            if (dp.isRuntimeDepPath(depPath)) {
+                graphNodeHashOpts ??= {
+                    cache: {},
+                    graph: lockfileToDepGraph(lockfile, opts.supportedArchitectures),
+                    supportedArchitectures: opts.supportedArchitectures,
+                    nodeVersion,
+                    lockfileDir: opts.lockfileDir,
+                };
+                const hash = calcGraphNodeHash(graphNodeHashOpts, pkgMeta);
+                dirInVirtualStore = path.join(opts.globalVirtualStoreDir, hash);
+            }
+            else {
+                dirInVirtualStore = path.join(opts.virtualStoreDir, dp.depPathToFilename(depPath, opts.virtualStoreDirMaxLength));
+            }
+            yield {
+                dirInVirtualStore,
+                pkgMeta,
+            };
+        }
+    }
+}
+function hashDependencyPaths(lockfile, opts) {
+    const graph = lockfileToDepGraph(lockfile, opts.supportedArchitectures);
+    return iterateHashedGraphNodes(graph, iteratePkgMeta(lockfile, graph), opts);
+}
+//# sourceMappingURL=iteratePkgsForVirtualStore.js.map

package/lib/lockfileToDepGraph.d.ts

@@ -0,0 +1,93 @@
+import type { IncludedDependencies } from '@pnpm/installing.modules-yaml';
+import type { LockfileObject, LockfileResolution } from '@pnpm/lockfile.fs';
+import { type PatchGroupRecord } from '@pnpm/patching.config';
+import type { PatchInfo } from '@pnpm/patching.types';
+import type { PkgRequestFetchResult, StoreController } from '@pnpm/store.controller-types';
+import type { AllowBuild, DepPath, PkgIdWithPatchHash, ProjectId, Registries, SupportedArchitectures } from '@pnpm/types';
+export interface DependenciesGraphNode {
+    alias?: string;
+    hasBundledDependencies: boolean;
+    modules: string;
+    name: string;
+    version: string;
+    fetching?: () => Promise<PkgRequestFetchResult>;
+    forceImportPackage?: boolean;
+    dir: string;
+    children: Record<string, string>;
+    optionalDependencies: Set<string>;
+    optional: boolean;
+    depPath: DepPath;
+    pkgIdWithPatchHash: PkgIdWithPatchHash;
+    isBuilt?: boolean;
+    requiresBuild?: boolean;
+    hasBin: boolean;
+    filesIndexFile?: string;
+    patch?: PatchInfo;
+    resolution: LockfileResolution;
+}
+export interface DependenciesGraph {
+    [depPath: string]: DependenciesGraphNode;
+}
+export interface LockfileToDepGraphOptions {
+    allowBuild?: AllowBuild;
+    autoInstallPeers: boolean;
+    enableGlobalVirtualStore?: boolean;
+    engineStrict: boolean;
+    force: boolean;
+    importerIds: ProjectId[];
+    include: IncludedDependencies;
+    includeUnchangedDeps?: boolean;
+    ignoreScripts: boolean;
+    /**
+     * When true, skip fetching local dependencies (file: protocol pointing to directories).
+     * This is useful for `pnpm fetch` which only downloads packages from the registry
+     * and doesn't need local packages that won't be available (e.g., in Docker builds).
+     */
+    ignoreLocalPackages?: boolean;
+    lockfileDir: string;
+    nodeVersion: string;
+    pnpmVersion: string;
+    patchedDependencies?: PatchGroupRecord;
+    registries: Registries;
+    /**
+     * The dep paths a non-optional edge reaches, as classified by
+     * `filterLockfileByImportersAndEngine`. Installability is evaluated as
+     * optional for everything outside this set.
+     */
+    requiredDepPaths: Set<DepPath>;
+    sideEffectsCacheRead: boolean;
+    skipped: Set<DepPath>;
+    storeController: StoreController;
+    storeDir: string;
+    globalVirtualStoreDir: string;
+    virtualStoreDir: string;
+    supportedArchitectures?: SupportedArchitectures;
+    virtualStoreDirMaxLength: number;
+}
+export interface DirectDependenciesByImporterId {
+    [importerId: string]: {
+        [alias: string]: string;
+    };
+}
+export interface DepHierarchy {
+    [depPath: string]: Record<string, DepHierarchy>;
+}
+export interface LockfileToDepGraphResult {
+    directDependenciesByImporterId: DirectDependenciesByImporterId;
+    graph: DependenciesGraph;
+    hierarchy?: DepHierarchy;
+    hoistedLocations?: Record<string, string[]>;
+    symlinkedDirectDependenciesByImporterId?: DirectDependenciesByImporterId;
+    prevGraph?: DependenciesGraph;
+    injectionTargetsByDepPath: Map<string, string[]>;
+}
+/**
+ * Generate a dependency graph from lockfiles.
+ *
+ * If a current lockfile is provided, this function only includes new or changed
+ * packages in the graph. In other words, the graph returned will be a set
+ * subtraction of the packages in the wanted lockfile minus the current
+ * lockfile. This behavior can be configured with the `includeUnchangedDeps`
+ * option.
+ */
+export declare function lockfileToDepGraph(lockfile: LockfileObject, currentLockfile: LockfileObject | null, opts: LockfileToDepGraphOptions): Promise<LockfileToDepGraphResult>;

package/lib/lockfileToDepGraph.js

@@ -0,0 +1,232 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { packageIsInstallable } from '@pnpm/config.package-is-installable';
+import { WANTED_LOCKFILE } from '@pnpm/constants';
+import { progressLogger, } from '@pnpm/core-loggers';
+import * as dp from '@pnpm/deps.path';
+import { safeJoinModulesDir } from '@pnpm/fs.symlink-dependency';
+import { packageIdFromSnapshot, pkgSnapshotToResolution, } from '@pnpm/lockfile.utils';
+import { logger } from '@pnpm/logger';
+import { getPatchInfo } from '@pnpm/patching.config';
+import { pathExists } from 'path-exists';
+import { equals, isEmpty } from 'ramda';
+import { iteratePkgsForVirtualStore } from './iteratePkgsForVirtualStore.js';
+const brokenModulesLogger = logger('_broken_node_modules');
+/**
+ * Generate a dependency graph from lockfiles.
+ *
+ * If a current lockfile is provided, this function only includes new or changed
+ * packages in the graph. In other words, the graph returned will be a set
+ * subtraction of the packages in the wanted lockfile minus the current
+ * lockfile. This behavior can be configured with the `includeUnchangedDeps`
+ * option.
+ */
+export async function lockfileToDepGraph(lockfile, currentLockfile, opts) {
+    const { graph, locationByDepPath, injectionTargetsByDepPath, } = await buildGraphFromPackages(lockfile, currentLockfile, opts);
+    const _getChildrenPaths = getChildrenPaths.bind(null, {
+        force: opts.force,
+        graph,
+        lockfileDir: opts.lockfileDir,
+        registries: opts.registries,
+        sideEffectsCacheRead: opts.sideEffectsCacheRead,
+        skipped: opts.skipped,
+        storeController: opts.storeController,
+        storeDir: opts.storeDir,
+        virtualStoreDir: opts.virtualStoreDir,
+        virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
+        locationByDepPath,
+    });
+    for (const node of Object.values(graph)) {
+        const pkgSnapshot = lockfile.packages[node.depPath];
+        const allDeps = {
+            ...pkgSnapshot.dependencies,
+            ...(opts.include.optionalDependencies ? pkgSnapshot.optionalDependencies : {}),
+        };
+        const peerDeps = pkgSnapshot.peerDependencies ? new Set(Object.keys(pkgSnapshot.peerDependencies)) : null;
+        node.children = _getChildrenPaths(allDeps, peerDeps, '.');
+    }
+    const directDependenciesByImporterId = {};
+    for (const importerId of opts.importerIds) {
+        const projectSnapshot = lockfile.importers[importerId];
+        const rootDeps = {
+            ...(opts.include.devDependencies ? projectSnapshot.devDependencies : {}),
+            ...(opts.include.dependencies ? projectSnapshot.dependencies : {}),
+            ...(opts.include.optionalDependencies ? projectSnapshot.optionalDependencies : {}),
+        };
+        directDependenciesByImporterId[importerId] = _getChildrenPaths(rootDeps, null, importerId);
+    }
+    return { graph, directDependenciesByImporterId, injectionTargetsByDepPath };
+}
+async function buildGraphFromPackages(lockfile, currentLockfile, opts) {
+    const currentPackages = currentLockfile?.packages ?? {};
+    const graph = {};
+    const locationByDepPath = {};
+    // Only populated for directory deps (injected workspace packages)
+    const injectionTargetsByDepPath = new Map();
+    const _getPatchInfo = getPatchInfo.bind(null, opts.patchedDependencies);
+    const promises = [];
+    const pkgSnapshotsWithLocations = iteratePkgsForVirtualStore(lockfile, opts);
+    for (const { dirInVirtualStore, pkgMeta } of pkgSnapshotsWithLocations) {
+        promises.push((async () => {
+            const { pkgIdWithPatchHash, name: pkgName, version: pkgVersion, depPath, pkgSnapshot } = pkgMeta;
+            if (opts.skipped.has(depPath))
+                return;
+            const pkg = {
+                name: pkgName,
+                version: pkgVersion,
+                engines: pkgSnapshot.engines,
+                cpu: pkgSnapshot.cpu,
+                os: pkgSnapshot.os,
+                libc: pkgSnapshot.libc,
+            };
+            const packageId = packageIdFromSnapshot(depPath, pkgSnapshot);
+            if (!opts.force && packageIsInstallable(packageId, pkg, {
+                // An incompatibility inside an `optionalDependencies` subtree is
+                // reported, not fatal — see `filterLockfileByImportersAndEngine`,
+                // which classifies these dep paths.
+                engineStrict: opts.engineStrict && pkgSnapshot.optional !== true,
+                lockfileDir: opts.lockfileDir,
+                nodeVersion: opts.nodeVersion,
+                optional: !opts.requiredDepPaths.has(depPath),
+                supportedArchitectures: opts.supportedArchitectures,
+            }) === false) {
+                opts.skipped.add(depPath);
+                return;
+            }
+            const isDirectoryDep = 'directory' in pkgSnapshot.resolution && pkgSnapshot.resolution.directory != null;
+            if (isDirectoryDep && opts.ignoreLocalPackages) {
+                logger.info({
+                    message: `Skipping local dependency ${pkgName}@${pkgVersion} (file: protocol)`,
+                    prefix: opts.lockfileDir,
+                });
+                return;
+            }
+            const depIsPresent = !isDirectoryDep &&
+                currentPackages[depPath] &&
+                equals(currentPackages[depPath].dependencies, pkgSnapshot.dependencies);
+            const depIntegrityIsUnchanged = isIntegrityEqual(pkgSnapshot.resolution, currentPackages[depPath]?.resolution);
+            const modules = path.join(dirInVirtualStore, 'node_modules');
+            // `pkgName` is reconstructed from the (attacker-controllable) lockfile
+            // depPath key via `dp.parse`, which does no validation. Contain it here so
+            // a traversal name (e.g. `../../../tmp/x`) can't make the package import
+            // escape the virtual store. Mirrors the guard on the hoisted linker.
+            const dir = safeJoinModulesDir(modules, pkgName);
+            locationByDepPath[depPath] = dir;
+            // Track directory deps for injected workspace packages
+            if (isDirectoryDep) {
+                injectionTargetsByDepPath.set(depPath, [dir]);
+            }
+            // In GVS mode, packages that are allowed to build may have a .pnpm-needs-build
+            // marker indicating a previous build failed or was interrupted. When the
+            // marker is present, skip the fast path to force a re-fetch/re-import/re-build.
+            const mightNeedBuild = opts.enableGlobalVirtualStore &&
+                opts.allowBuild?.(depPath) === true;
+            let dirExists;
+            if (depIsPresent &&
+                depIntegrityIsUnchanged &&
+                isEmpty(currentPackages[depPath].optionalDependencies ?? {}) &&
+                isEmpty(pkgSnapshot.optionalDependencies ?? {}) &&
+                !opts.includeUnchangedDeps) {
+                dirExists = await pathExists(dir);
+                if (dirExists) {
+                    if (!(mightNeedBuild && fs.existsSync(path.join(dir, '.pnpm-needs-build'))))
+                        return;
+                }
+                else {
+                    brokenModulesLogger.debug({ missing: dir });
+                }
+            }
+            let fetchResponse;
+            if (depIsPresent && depIntegrityIsUnchanged && equals(currentPackages[depPath].optionalDependencies, pkgSnapshot.optionalDependencies)) {
+                if (dirExists ?? await pathExists(dir)) {
+                    if (!(mightNeedBuild && fs.existsSync(path.join(dir, '.pnpm-needs-build')))) {
+                        fetchResponse = {};
+                    }
+                }
+                else {
+                    brokenModulesLogger.debug({ missing: dir });
+                }
+            }
+            if (!fetchResponse && opts.enableGlobalVirtualStore && !isDirectoryDep
+                && !opts.force) {
+                if (dirExists ?? await pathExists(dir)) {
+                    if (!(mightNeedBuild && fs.existsSync(path.join(dir, '.pnpm-needs-build')))) {
+                        fetchResponse = {};
+                    }
+                }
+            }
+            if (!fetchResponse) {
+                const resolution = pkgSnapshotToResolution(depPath, pkgSnapshot, opts.registries);
+                progressLogger.debug({ packageId, requester: opts.lockfileDir, status: 'resolved' });
+                try {
+                    fetchResponse = await opts.storeController.fetchPackage({
+                        allowBuild: opts.allowBuild,
+                        force: false,
+                        lockfileDir: opts.lockfileDir,
+                        ignoreScripts: opts.ignoreScripts,
+                        pkg: { name: pkgName, version: pkgVersion, id: packageId, resolution },
+                        supportedArchitectures: opts.supportedArchitectures,
+                    });
+                }
+                catch (err) {
+                    if (pkgSnapshot.optional)
+                        return;
+                    throw err;
+                }
+            }
+            graph[dir] = {
+                children: {},
+                pkgIdWithPatchHash,
+                resolution: pkgSnapshot.resolution,
+                depPath,
+                dir,
+                fetching: fetchResponse.fetching,
+                filesIndexFile: fetchResponse.filesIndexFile,
+                forceImportPackage: !depIntegrityIsUnchanged,
+                hasBin: pkgSnapshot.hasBin === true,
+                hasBundledDependencies: pkgSnapshot.bundledDependencies != null,
+                modules,
+                name: pkgName,
+                version: pkgVersion,
+                optional: !!pkgSnapshot.optional,
+                optionalDependencies: new Set(Object.keys(pkgSnapshot.optionalDependencies ?? {})),
+                patch: _getPatchInfo(pkgName, pkgVersion),
+            };
+        })());
+    }
+    await Promise.all(promises);
+    return { graph, locationByDepPath, injectionTargetsByDepPath };
+}
+function getChildrenPaths(ctx, allDeps, peerDeps, importerId) {
+    const children = {};
+    for (const [alias, ref] of Object.entries(allDeps)) {
+        const childDepPath = dp.refToRelative(ref, alias);
+        if (childDepPath === null) {
+            children[alias] = path.resolve(ctx.lockfileDir, importerId, ref.slice(5));
+            continue;
+        }
+        const childRelDepPath = dp.refToRelative(ref, alias);
+        if (ctx.locationByDepPath[childRelDepPath]) {
+            children[alias] = ctx.locationByDepPath[childRelDepPath];
+        }
+        else if (ctx.graph[childRelDepPath]) {
+            children[alias] = ctx.graph[childRelDepPath].dir;
+        }
+        else if (ref.startsWith('file:')) {
+            children[alias] = path.resolve(ctx.lockfileDir, ref.slice(5));
+        }
+        else if (!ctx.skipped.has(childRelDepPath) && ((peerDeps == null) || !peerDeps.has(alias))) {
+            throw new Error(`${childRelDepPath} not found in ${WANTED_LOCKFILE}`);
+        }
+    }
+    return children;
+}
+function isIntegrityEqual(resolutionA, resolutionB) {
+    // The LockfileResolution type is a union, but it doesn't have a "tag"
+    // field to perform a discriminant match on. Using a type assertion is
+    // required to get the integrity field.
+    const integrityA = resolutionA?.integrity;
+    const integrityB = resolutionB?.integrity;
+    return integrityA === integrityB;
+}
+//# sourceMappingURL=lockfileToDepGraph.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.graph-builder",
-  "version": "1100.0.25",
+  "version": "1100.1.0",
   "description": "A package for building a dependency graph from a lockfile",
   "keywords": [
     "pnpm",
@@ -27,20 +27,20 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/config.package-is-installable": "1100.0.15",
-    "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.2.4",
-    "@pnpm/deps.graph-hasher": "1100.2.11",
-    "@pnpm/deps.path": "1100.0.10",
-    "@pnpm/fs.symlink-dependency": "1100.0.13",
-    "@pnpm/hooks.types": "1100.2.2",
-    "@pnpm/installing.modules-yaml": "1100.0.11",
-    "@pnpm/lockfile.fs": "1100.1.13",
-    "@pnpm/lockfile.utils": "1100.1.4",
-    "@pnpm/patching.config": "1100.0.11",
-    "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/store.controller-types": "1100.1.9",
-    "@pnpm/types": "1101.5.0",
+    "@pnpm/config.package-is-installable": "1100.1.0",
+    "@pnpm/constants": "1100.0.1",
+    "@pnpm/core-loggers": "1100.3.0",
+    "@pnpm/deps.graph-hasher": "1100.2.13",
+    "@pnpm/deps.path": "1100.0.12",
+    "@pnpm/fs.symlink-dependency": "1100.0.15",
+    "@pnpm/hooks.types": "1100.2.4",
+    "@pnpm/installing.modules-yaml": "1100.0.13",
+    "@pnpm/lockfile.fs": "1100.1.15",
+    "@pnpm/lockfile.utils": "1100.1.6",
+    "@pnpm/patching.config": "1100.0.13",
+    "@pnpm/patching.types": "1100.0.1",
+    "@pnpm/store.controller-types": "1100.1.11",
+    "@pnpm/types": "1101.7.0",
     "path-exists": "^5.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1"
   },
@@ -49,9 +49,9 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.graph-builder": "1100.0.25",
+    "@pnpm/deps.graph-builder": "1100.1.0",
     "@pnpm/logger": "1100.0.0",
-    "@types/ramda": "0.31.1"
+    "@types/ramda": "0.32.0"
   },
   "engines": {
     "node": ">=22.13"