@pnpm/deps.graph-hasher 1100.3.0 → 1100.3.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @pnpm/calc-dep-state
 
+## 1100.3.1
+
+### Patch Changes
+
+- Fixed global virtual store hashes for dependency cycles. Every package that transitively depends on an allowed build now includes the engine in its store path, independent of traversal order [pnpm/pnpm#14341](https://github.com/pnpm/pnpm/issues/14341).
+
+- Updated dependencies:
+  - @pnpm/lockfile.types@1100.1.1
+  - @pnpm/lockfile.utils@1102.1.1
+
 ## 1100.3.0
 
 ### Minor Changes

package/lib/index.d.ts

@@ -126,11 +126,11 @@ export interface GraphNodeHashOptions {
     lockfileDir?: string;
 }
 export declare function iterateHashedGraphNodes<T extends PkgMeta>(graph: DepsGraph<DepPath>, pkgMetaIterator: PkgMetaIterator<T>, opts?: GraphNodeHashOptions): IterableIterator<HashedDepPath<T>>;
-export declare function calcGraphNodeHash<T extends PkgMeta>({ graph, cache, builtDepPaths, buildRequiredCache, supportedArchitectures, nodeVersion, lockfileDir }: {
+export declare function calcGraphNodeHash<T extends PkgMeta>({ graph, cache, buildRequiredDepPaths, supportedArchitectures, nodeVersion, lockfileDir }: {
     graph: DepsGraph<DepPath>;
     cache: DepsStateCache;
-    builtDepPaths?: Set<DepPath>;
-    buildRequiredCache?: Record<string, boolean>;
+    /** See {@link computeBuildRequiredDepPaths}. */
+    buildRequiredDepPaths?: Set<DepPath>;
     supportedArchitectures?: SupportedArchitectures;
     /** See {@link GraphNodeHashOptions.nodeVersion}. */
     nodeVersion?: string;
@@ -152,3 +152,18 @@ export interface PkgMetaAndSnapshot extends PkgMeta {
 }
 export declare function iteratePkgMeta(lockfile: LockfileObject, graph: DepsGraph<DepPath>): PkgMetaIterator<PkgMetaAndSnapshot>;
 export declare function lockfileToDepGraph(lockfile: LockfileObject, supportedArchitectures?: SupportedArchitectures, lockfileDir?: string): DepsGraph<DepPath>;
+/**
+ * Expand `builtDepPaths` to every node that is, or transitively depends
+ * on, one of them.
+ *
+ * The result gates the engine string in {@link calcGraphNodeHash}: only a
+ * package that may run a build script — or that depends on one — keeps the
+ * engine in its GVS hash. It is computed as one graph-wide reverse closure,
+ * so a package inside a dependency cycle gets the same answer no matter
+ * which node the hasher reaches it from.
+ *
+ * A path with no node in `graph` is kept and still marks whatever depends on
+ * it: the built set comes from the allowBuild policy rather than the graph,
+ * so the two can disagree.
+ */
+export declare function computeBuildRequiredDepPaths(graph: DepsGraph<DepPath>, builtDepPaths: Set<DepPath>): Set<DepPath>;

package/lib/index.js

@@ -167,11 +167,11 @@ function createDepGraphHashContext(supportedArchitectures) {
     };
 }
 export function* iterateHashedGraphNodes(graph, pkgMetaIterator, opts = {}) {
-    let builtDepPaths;
+    let buildRequiredDepPaths;
     let entries;
     if (opts.allowBuild != null) {
         const pkgMetaList = Array.from(pkgMetaIterator);
-        builtDepPaths = computeBuiltDepPaths(pkgMetaList, opts.allowBuild);
+        buildRequiredDepPaths = computeBuildRequiredDepPaths(graph, computeBuiltDepPaths(pkgMetaList, opts.allowBuild));
         entries = pkgMetaList;
     }
     else {
@@ -180,8 +180,7 @@ export function* iterateHashedGraphNodes(graph, pkgMetaIterator, opts = {}) {
     const ctx = {
         graph,
         cache: {},
-        builtDepPaths,
-        buildRequiredCache: builtDepPaths !== undefined ? {} : undefined,
+        buildRequiredDepPaths,
         supportedArchitectures: opts.supportedArchitectures,
         nodeVersion: opts.nodeVersion,
         lockfileDir: opts.lockfileDir,
@@ -193,15 +192,14 @@ export function* iterateHashedGraphNodes(graph, pkgMetaIterator, opts = {}) {
         };
     }
 }
-export function calcGraphNodeHash({ graph, cache, builtDepPaths, buildRequiredCache, supportedArchitectures, nodeVersion, lockfileDir }, pkgMeta) {
+export function calcGraphNodeHash({ graph, cache, buildRequiredDepPaths, supportedArchitectures, nodeVersion, lockfileDir }, pkgMeta) {
     const { name, version, depPath } = pkgMeta;
-    // When builtDepPaths is provided (derived from the allowBuilds config),
-    // we only include the engine name for packages that are allowed to build
-    // or transitively depend on a package that is allowed to build.
+    // When buildRequiredDepPaths is provided (derived from the allowBuilds
+    // config), we only include the engine name for packages that are allowed
+    // to build or transitively depend on a package that is allowed to build.
     // This makes GVS hashes engine-agnostic for pure-JS packages,
     // so they survive Node.js upgrades and architecture changes.
-    const includeEngine = builtDepPaths === undefined ||
-        transitivelyRequiresBuild(graph, builtDepPaths, buildRequiredCache ??= {}, depPath, new Set());
+    const includeEngine = buildRequiredDepPaths === undefined || buildRequiredDepPaths.has(depPath);
     // A snapshot that declares `engines.runtime` carries the desugared
     // `node@runtime:<version>` pin as a child; that's the Node the bin
     // linker spawns for its lifecycle scripts, so it has to drive the
@@ -347,30 +345,47 @@ function computeBuiltDepPaths(entries, allowBuild) {
     }
     return builtDepPaths;
 }
-function transitivelyRequiresBuild(graph, builtDepPaths, cache, depPath, parents) {
-    if (depPath in cache)
-        return cache[depPath];
-    if (builtDepPaths.has(depPath)) {
-        cache[depPath] = true;
-        return true;
-    }
-    const node = graph[depPath];
-    if (!node) {
-        cache[depPath] = false;
-        return false;
-    }
-    if (parents.has(depPath)) {
-        return false;
+/**
+ * Expand `builtDepPaths` to every node that is, or transitively depends
+ * on, one of them.
+ *
+ * The result gates the engine string in {@link calcGraphNodeHash}: only a
+ * package that may run a build script — or that depends on one — keeps the
+ * engine in its GVS hash. It is computed as one graph-wide reverse closure,
+ * so a package inside a dependency cycle gets the same answer no matter
+ * which node the hasher reaches it from.
+ *
+ * A path with no node in `graph` is kept and still marks whatever depends on
+ * it: the built set comes from the allowBuild policy rather than the graph,
+ * so the two can disagree.
+ */
+export function computeBuildRequiredDepPaths(graph, builtDepPaths) {
+    const buildRequiredDepPaths = new Set(builtDepPaths);
+    if (builtDepPaths.size === 0)
+        return buildRequiredDepPaths;
+    const parentsByChild = new Map();
+    for (const parent of Object.keys(graph)) {
+        for (const child of Object.values(graph[parent].children)) {
+            const parents = parentsByChild.get(child);
+            if (parents == null) {
+                parentsByChild.set(child, [parent]);
+            }
+            else {
+                parents.push(parent);
+            }
+        }
     }
-    const nextParents = new Set([...parents, depPath]);
-    for (const childDepPath of Object.values(node.children)) {
-        if (transitivelyRequiresBuild(graph, builtDepPaths, cache, childDepPath, nextParents)) {
-            cache[depPath] = true;
-            return true;
+    const pending = Array.from(builtDepPaths);
+    while (pending.length > 0) {
+        const child = pending.pop();
+        for (const parent of parentsByChild.get(child) ?? []) {
+            if (!buildRequiredDepPaths.has(parent)) {
+                buildRequiredDepPaths.add(parent);
+                pending.push(parent);
+            }
         }
     }
-    cache[depPath] = false;
-    return false;
+    return buildRequiredDepPaths;
 }
 function lockfileDepsToGraphChildren(deps, lockfileDir, linkTargetNodes) {
     const children = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.graph-hasher",
-  "version": "1100.3.0",
+  "version": "1100.3.1",
   "description": "Calculates the state of a dependency",
   "keywords": [
     "pnpm",
@@ -30,15 +30,15 @@
     "@pnpm/crypto.object-hasher": "1100.0.1",
     "@pnpm/deps.path": "1101.0.1",
     "@pnpm/engine.runtime.system-version": "1100.0.11",
-    "@pnpm/lockfile.types": "1100.1.0",
-    "@pnpm/lockfile.utils": "1102.1.0",
+    "@pnpm/lockfile.types": "1100.1.1",
+    "@pnpm/lockfile.utils": "1102.1.1",
     "@pnpm/resolving.resolver-base": "1101.2.0",
     "@pnpm/types": "1102.1.0",
     "detect-libc": "^2.1.2"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.graph-hasher": "1100.3.0"
+    "@pnpm/deps.graph-hasher": "1100.3.1"
   },
   "engines": {
     "node": ">=22.13"