@pnpm/deps.inspection.outdated 1100.0.16 → 1100.1.0

package/lib/outdated.d.ts

@@ -1,8 +1,8 @@
 import type { Catalogs } from '@pnpm/catalogs.types';
+import type { ResolveLatestDispatcher } from '@pnpm/installing.client';
 import { type LockfileObject } from '@pnpm/lockfile.fs';
-import { type DependenciesField, type IncludedDependencies, type PackageManifest, type ProjectManifest, type Registries } from '@pnpm/types';
+import { type DependenciesField, type IncludedDependencies, type PackageManifest, type PackageVersionPolicy, type ProjectManifest } from '@pnpm/types';
 export * from './createManifestGetter.js';
-export type GetLatestManifestFunction = (packageName: string, rangeOrTag: string) => Promise<PackageManifest | null>;
 export interface OutdatedPackage {
     alias: string;
     belongsTo: DependenciesField;
@@ -16,7 +16,7 @@ export declare function outdated(opts: {
     catalogs?: Catalogs;
     compatible?: boolean;
     currentLockfile: LockfileObject | null;
-    getLatestManifest: GetLatestManifestFunction;
+    resolveLatest: ResolveLatestDispatcher;
     ignoreDependencies?: string[];
     include?: IncludedDependencies;
     lockfileDir: string;
@@ -25,6 +25,7 @@ export declare function outdated(opts: {
     minimumReleaseAge?: number;
     minimumReleaseAgeExclude?: string[];
     prefix: string;
-    registries: Registries;
+    publishedBy?: Date;
+    publishedByExclude?: PackageVersionPolicy;
     wantedLockfile: LockfileObject | null;
 }): Promise<OutdatedPackage[]>;

package/lib/outdated.js

@@ -1,15 +1,12 @@
 import { matchCatalogResolveResult, resolveFromCatalog, } from '@pnpm/catalogs.resolver';
 import { createMatcher } from '@pnpm/config.matcher';
 import { parseOverrides } from '@pnpm/config.parse-overrides';
-import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
-import { LOCKFILE_VERSION, WANTED_LOCKFILE } from '@pnpm/constants';
+import { LOCKFILE_VERSION } from '@pnpm/constants';
 import * as dp from '@pnpm/deps.path';
 import { PnpmError } from '@pnpm/error';
 import { createReadPackageHook } from '@pnpm/hooks.read-package-hook';
 import { getLockfileImporterId, } from '@pnpm/lockfile.fs';
-import { nameVerFromPkgSnapshot } from '@pnpm/lockfile.utils';
 import { getAllDependenciesFromManifest } from '@pnpm/pkg-manifest.utils';
-import { parseBareSpecifier } from '@pnpm/resolving.npm-resolver';
 import { DEPENDENCIES_FIELDS, } from '@pnpm/types';
 import semver from 'semver';
 export * from './createManifestGetter.js';
@@ -37,6 +34,13 @@ export async function outdated(opts) {
     const currentLockfile = opts.currentLockfile ?? { lockfileVersion: LOCKFILE_VERSION, importers: { [importerId]: { specifiers: {} } } };
     const outdated = [];
     const ignoreDependenciesMatcher = opts.ignoreDependencies?.length ? createMatcher(opts.ignoreDependencies) : undefined;
+    const resolveOpts = {
+        lockfileDir: opts.lockfileDir,
+        preferredVersions: {},
+        projectDir: opts.prefix,
+        publishedBy: opts.publishedBy,
+        publishedByExclude: opts.publishedByExclude,
+    };
     await Promise.all(DEPENDENCIES_FIELDS.map(async (depType) => {
         if (opts.include?.[depType] === false ||
             (opts.wantedLockfile.importers[importerId][depType] == null))
@@ -49,31 +53,31 @@ export async function outdated(opts) {
         await Promise.all(pkgs.map(async (alias) => {
             if (!allDeps[alias])
                 return;
-            const ref = opts.wantedLockfile.importers[importerId][depType][alias];
-            if (ref.startsWith('file:') || // ignoring linked packages. (For backward compatibility)
-                ignoreDependenciesMatcher?.(alias)) {
+            const wantedRef = opts.wantedLockfile.importers[importerId][depType][alias];
+            if (ignoreDependenciesMatcher?.(alias))
                 return;
-            }
-            const relativeDepPath = dp.refToRelative(ref, alias);
-            // ignoring linked packages
-            if (relativeDepPath === null)
-                return;
-            const pkgSnapshot = opts.wantedLockfile.packages?.[relativeDepPath];
-            if (pkgSnapshot == null) {
-                throw new Error(`Invalid ${WANTED_LOCKFILE} file. ${relativeDepPath} not found in packages field`);
-            }
             const currentRef = currentLockfile.importers[importerId]?.[depType]?.[alias];
-            const currentRelative = currentRef && dp.refToRelative(currentRef, alias);
-            const current = (currentRelative && dp.parse(currentRelative).version) ?? currentRef;
-            const wanted = dp.parse(relativeDepPath).version ?? ref;
-            const { name: packageName } = nameVerFromPkgSnapshot(relativeDepPath, pkgSnapshot);
-            const name = dp.parse(relativeDepPath).name ?? packageName;
+            const wantedRelative = dp.refToRelative(wantedRef, alias);
+            const currentRelative = currentRef ? dp.refToRelative(currentRef, alias) : null;
+            const wantedSnapshot = wantedRelative != null ? opts.wantedLockfile.packages?.[wantedRelative] : undefined;
+            const currentSnapshot = currentRelative != null ? currentLockfile.packages?.[currentRelative] : undefined;
+            // Aliased npm deps lock under their real name (e.g. `positive: is-positive@3.1.0`);
+            // pull the name off the depPath so the report shows the real package.
+            const packageName = (wantedRelative != null ? dp.parse(wantedRelative).name : undefined) ?? alias;
             const bareSpecifier = _replaceCatalogProtocolIfNecessary({ alias, bareSpecifier: allDeps[alias] });
-            // If the npm resolve parser cannot parse the spec of the dependency,
-            // it means that the package is not from a npm-compatible registry.
-            // In that case, we can't check whether the package is up-to-date
-            if (parseBareSpecifier(bareSpecifier, alias, 'latest', pickRegistryForPackage(opts.registries, name)) == null) {
-                if (current !== wanted) {
+            const info = await opts.resolveLatest({ wantedDependency: { alias, bareSpecifier }, compatible: opts.compatible }, resolveOpts);
+            if (info == null)
+                return; // resolver doesn't claim this dep — skip silently
+            const wanted = displayVersion(wantedRef, wantedRelative, wantedSnapshot?.version);
+            const current = currentRef ? displayVersion(currentRef, currentRelative, currentSnapshot?.version) : undefined;
+            const { latestManifest } = info;
+            // Compare the parsed `wanted` / `current` rather than raw refs.
+            // For npm-style deps that means peer-graph-only changes (same
+            // semver, different `(peer-hash)`) don't surface as fake
+            // "outdated" entries; for URL/git refs the display values *are*
+            // the refs, so a commit/path change still fires correctly.
+            if (latestManifest == null) {
+                if (wanted !== current) {
                     outdated.push({
                         alias,
                         belongsTo: depType,
@@ -86,9 +90,6 @@ export async function outdated(opts) {
                 }
                 return;
             }
-            const latestManifest = await opts.getLatestManifest(name, opts.compatible ? (bareSpecifier ?? 'latest') : 'latest');
-            if (latestManifest == null)
-                return;
             if (!current) {
                 outdated.push({
                     alias,
@@ -100,7 +101,7 @@ export async function outdated(opts) {
                 });
                 return;
             }
-            if (current !== wanted || semver.lt(current, latestManifest.version) || latestManifest.deprecated) {
+            if (wanted !== current || isLowerVersion(wanted, latestManifest.version) || latestManifest.deprecated) {
                 outdated.push({
                     alias,
                     belongsTo: depType,
@@ -123,6 +124,34 @@ function packageHasNoDeps(manifest) {
 function isEmpty(obj) {
     return Object.keys(obj).length === 0;
 }
+// Pick a clean display string for a lockfile ref.
+//
+//   - If the dep-path parses to a semver, that's the value (handles
+//     `pkg@1.0.0(peer-hash)` and aliased `positive: is-positive@3.1.0`).
+//   - If the dep-path's non-semver version contains a `/`, it's a
+//     URL/git-shape (`https://`, `git+ssh://`, scheme-less `github.com/…/sha`,
+//     `link:../foo`, etc.) — return the raw ref so a commit/path change is
+//     visible to the user.
+//   - Otherwise prefer `snapshot.version` (clean semver for `runtime:`-style
+//     refs); fall back to the raw ref when the snapshot didn't record one.
+function displayVersion(ref, relativeDepPath, snapshotVersion) {
+    if (relativeDepPath != null) {
+        const parsed = dp.parse(relativeDepPath);
+        if (parsed.version != null)
+            return parsed.version;
+        if (parsed.nonSemverVersion?.includes('/'))
+            return ref;
+    }
+    return snapshotVersion ?? ref;
+}
+// semver.lt throws on non-semver strings (e.g. URL refs from git/tarball).
+// Treat those as "not lower" so a ref change still gets surfaced via the
+// `wantedRef !== currentRef` check above.
+function isLowerVersion(current, latest) {
+    if (!semver.valid(current) || !semver.valid(latest))
+        return false;
+    return semver.lt(current, latest);
+}
 function replaceCatalogProtocolIfNecessary(catalogs, wantedDependency) {
     return matchCatalogResolveResult(resolveFromCatalog(catalogs, wantedDependency), {
         unused: () => wantedDependency.bareSpecifier,

package/lib/outdatedDepsOfProjects.d.ts

@@ -1,15 +1,23 @@
 import type { Catalogs } from '@pnpm/catalogs.types';
-import type { IncludedDependencies, ProjectManifest, ProjectRootDir } from '@pnpm/types';
-import { type ManifestGetterOptions } from './createManifestGetter.js';
+import { type ClientOptions } from '@pnpm/installing.client';
+import type { IncludedDependencies, ProjectManifest, ProjectRootDir, RegistryConfig } from '@pnpm/types';
 import { type OutdatedPackage } from './outdated.js';
+export type OutdatedDepsOfProjectsOptions = Omit<ClientOptions, 'configByUri' | 'minimumReleaseAgeExclude' | 'storeIndex'> & {
+    dir: string;
+    lockfileDir?: string;
+    configByUri: Record<string, RegistryConfig>;
+    fullMetadata?: boolean;
+    minimumReleaseAge?: number;
+    minimumReleaseAgeExclude?: string[];
+    minimumReleaseAgeIgnoreMissingTime?: boolean;
+    minimumReleaseAgeStrict?: boolean;
+};
 export declare function outdatedDepsOfProjects(pkgs: Array<{
     rootDir: ProjectRootDir;
     manifest: ProjectManifest;
-}>, args: string[], opts: Omit<ManifestGetterOptions, 'fullMetadata' | 'lockfileDir'> & {
+}>, args: string[], opts: OutdatedDepsOfProjectsOptions & {
     catalogs?: Catalogs;
     compatible?: boolean;
     ignoreDependencies?: string[];
     include: IncludedDependencies;
-    minimumReleaseAge?: number;
-    minimumReleaseAgeExclude?: string[];
-} & Partial<Pick<ManifestGetterOptions, 'fullMetadata' | 'lockfileDir'>>): Promise<OutdatedPackage[][]>;
+}): Promise<OutdatedPackage[][]>;

package/lib/outdatedDepsOfProjects.js

@@ -1,8 +1,9 @@
 import path from 'node:path';
 import { createMatcher } from '@pnpm/config.matcher';
+import { getPublishedByPolicy } from '@pnpm/config.version-policy';
+import { createResolver } from '@pnpm/installing.client';
 import { readCurrentLockfile, readWantedLockfile, } from '@pnpm/lockfile.fs';
 import { unnest } from 'ramda';
-import { createManifestGetter } from './createManifestGetter.js';
 import { outdated } from './outdated.js';
 export async function outdatedDepsOfProjects(pkgs, args, opts) {
     if (!opts.lockfileDir) {
@@ -12,12 +13,13 @@ export async function outdatedDepsOfProjects(pkgs, args, opts) {
     const internalPnpmDir = path.join(path.join(lockfileDir, 'node_modules/.pnpm'));
     const currentLockfile = await readCurrentLockfile(internalPnpmDir, { ignoreIncompatible: false });
     const wantedLockfile = await readWantedLockfile(lockfileDir, { ignoreIncompatible: false }) ?? currentLockfile;
-    const getLatestManifest = createManifestGetter({
+    const { publishedBy, publishedByExclude } = getPublishedByPolicy(opts);
+    const { resolveLatest } = createResolver({
         ...opts,
+        configByUri: opts.configByUri,
+        filterMetadata: false,
         fullMetadata: opts.fullMetadata === true || Boolean(opts.minimumReleaseAge),
-        lockfileDir,
-        minimumReleaseAge: opts.minimumReleaseAge,
-        minimumReleaseAgeExclude: opts.minimumReleaseAgeExclude,
+        ignoreMissingTimeField: opts.minimumReleaseAgeIgnoreMissingTime,
     });
     return Promise.all(pkgs.map(async ({ rootDir, manifest }) => {
         const match = (args.length > 0) && createMatcher(args) || undefined;
@@ -25,7 +27,7 @@ export async function outdatedDepsOfProjects(pkgs, args, opts) {
             catalogs: opts.catalogs,
             compatible: opts.compatible,
             currentLockfile,
-            getLatestManifest,
+            resolveLatest,
             ignoreDependencies: opts.ignoreDependencies,
             include: opts.include,
             lockfileDir,
@@ -34,7 +36,8 @@ export async function outdatedDepsOfProjects(pkgs, args, opts) {
             minimumReleaseAge: opts.minimumReleaseAge,
             minimumReleaseAgeExclude: opts.minimumReleaseAgeExclude,
             prefix: rootDir,
-            registries: opts.registries,
+            publishedBy,
+            publishedByExclude,
             wantedLockfile,
         });
     }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.inspection.outdated",
-  "version": "1100.0.16",
+  "version": "1100.1.0",
   "description": "Check for outdated packages",
   "keywords": [
     "pnpm",
@@ -27,22 +27,21 @@
   "dependencies": {
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "semver": "^7.7.2",
-    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/catalogs.resolver": "1100.0.0",
     "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/config.parse-overrides": "1100.0.1",
-    "@pnpm/config.version-policy": "1100.1.0",
+    "@pnpm/deps.path": "1100.0.4",
+    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.3",
+    "@pnpm/config.parse-overrides": "1100.0.1",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/hooks.read-package-hook": "1100.0.3",
-    "@pnpm/installing.client": "1100.1.0",
-    "@pnpm/lockfile.fs": "1100.1.0",
-    "@pnpm/resolving.npm-resolver": "1101.2.0",
-    "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/types": "1101.1.0",
-    "@pnpm/pkg-manifest.utils": "1100.1.4",
-    "@pnpm/config.pick-registry-for-package": "1100.0.3",
-    "@pnpm/lockfile.utils": "1100.0.8"
+    "@pnpm/lockfile.utils": "1100.0.9",
+    "@pnpm/pkg-manifest.utils": "1100.2.0",
+    "@pnpm/hooks.read-package-hook": "1100.0.4",
+    "@pnpm/types": "1101.1.1",
+    "@pnpm/installing.client": "1100.2.0",
+    "@pnpm/resolving.npm-resolver": "1101.3.0",
+    "@pnpm/config.version-policy": "1100.1.1",
+    "@pnpm/lockfile.fs": "1100.1.1"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -51,9 +50,9 @@
     "@jest/globals": "30.3.0",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
-    "@pnpm/deps.inspection.outdated": "1100.0.16",
+    "@pnpm/deps.inspection.outdated": "1100.1.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/resolving.resolver-base": "1100.2.0"
+    "@pnpm/resolving.resolver-base": "1100.3.0"
   },
   "engines": {
     "node": ">=22.13"