@pnpm/engine.pm.commands 1101.1.11 → 1101.1.13

package/lib/self-updater/selfUpdate.d.ts

@@ -5,5 +5,5 @@ export declare function cliOptionsTypes(): Record<string, unknown>;
 export declare const commandNames: string[];
 export declare const skipPackageManagerCheck = true;
 export declare function help(): string;
-export type SelfUpdateCommandOptions = CreateStoreControllerOptions & Pick<Config, 'globalPkgDir' | 'lockfileDir' | 'modulesDir' | 'pnpmHomeDir'> & Pick<ConfigContext, 'rootProjectManifestDir' | 'wantedPackageManager'>;
+export type SelfUpdateCommandOptions = CreateStoreControllerOptions & Pick<Config, 'globalPkgDir' | 'lockfileDir' | 'minimumReleaseAge' | 'minimumReleaseAgeExclude' | 'minimumReleaseAgeIgnoreMissingTime' | 'minimumReleaseAgeStrict' | 'modulesDir' | 'pnpmHomeDir'> & Pick<ConfigContext, 'rootProjectManifestDir' | 'wantedPackageManager'>;
 export declare function handler(opts: SelfUpdateCommandOptions, params: string[]): Promise<undefined | string>;

package/lib/self-updater/selfUpdate.js

@@ -4,8 +4,9 @@ import { linkBins } from '@pnpm/bins.linker';
 import { isExecutedByCorepack, packageManager } from '@pnpm/cli.meta';
 import { docsUrl } from '@pnpm/cli.utils';
 import { parsePackageManager, types as allTypes } from '@pnpm/config.reader';
+import { getPublishedByPolicy } from '@pnpm/config.version-policy';
 import { PnpmError } from '@pnpm/error';
-import { createResolver } from '@pnpm/installing.client';
+import { createResolver, makeResolutionStrict } from '@pnpm/installing.client';
 import { resolvePackageManagerIntegrities } from '@pnpm/installing.env-installer';
 import { readEnvLockfile } from '@pnpm/lockfile.fs';
 import { globalInfo, globalWarn } from '@pnpm/logger';
@@ -51,8 +52,22 @@ export async function handler(opts, params) {
         throw new PnpmError('CANT_SELF_UPDATE_IN_COREPACK', 'You should update pnpm with corepack');
     }
     globalInfo('Checking for updates...');
-    const { resolve } = createResolver({ ...opts, configByUri: opts.configByUri });
+    const { resolve: baseResolve } = createResolver({
+        ...opts,
+        configByUri: opts.configByUri,
+        ignoreMissingTimeField: opts.minimumReleaseAgeIgnoreMissingTime,
+    });
+    // self-update has nowhere to "defer to" either — wrap the resolver
+    // under any policy that wants to reject violations up-front. Strict
+    // minimumReleaseAge keeps self-update from switching to an immature
+    // pnpm; `trustPolicy: 'no-downgrade'` keeps it from switching to a
+    // pnpm whose trust evidence weakened relative to the installed
+    // version.
+    const strictResolution = (Boolean(opts.minimumReleaseAge) && opts.minimumReleaseAgeStrict === true) ||
+        opts.trustPolicy === 'no-downgrade';
+    const resolve = strictResolution ? makeResolutionStrict(baseResolve) : baseResolve;
     const pkgName = 'pnpm';
+    const { publishedBy, publishedByExclude } = getPublishedByPolicy(opts);
     // `pnpm self-update` (no args) defaults to the `latest` dist-tag, but we
     // refuse to downgrade in that case — `latest` on the registry can lag the
     // installed version when a new major has shipped without being tagged.
@@ -64,6 +79,8 @@ export async function handler(opts, params) {
         lockfileDir: opts.lockfileDir ?? opts.dir,
         preferredVersions: {},
         projectDir: opts.dir,
+        publishedBy,
+        publishedByExclude,
     });
     if (!resolution?.manifest) {
         throw new PnpmError('CANNOT_RESOLVE_PNPM', `Cannot find "${bareSpecifier}" version of pnpm`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/engine.pm.commands",
-  "version": "1101.1.11",
+  "version": "1101.1.13",
   "description": "pnpm commands for self-updating and setting up pnpm",
   "keywords": [
     "pnpm",
@@ -32,26 +32,27 @@
     "render-help": "^2.0.0",
     "semver": "^7.7.2",
     "symlink-dir": "^10.0.1",
-    "@pnpm/building.policy": "1100.0.4",
+    "@pnpm/building.policy": "1100.0.5",
+    "@pnpm/bins.linker": "1100.0.7",
     "@pnpm/cli.meta": "1100.0.3",
-    "@pnpm/cli.utils": "1101.0.3",
-    "@pnpm/config.reader": "1101.3.0",
-    "@pnpm/deps.graph-hasher": "1100.1.5",
+    "@pnpm/config.reader": "1101.3.2",
+    "@pnpm/cli.utils": "1101.0.5",
+    "@pnpm/config.version-policy": "1100.1.0",
+    "@pnpm/deps.graph-hasher": "1100.2.0",
+    "@pnpm/global.commands": "1100.0.18",
     "@pnpm/global.packages": "1100.0.3",
-    "@pnpm/installing.client": "1100.0.14",
-    "@pnpm/installing.deps-restorer": "1101.1.1",
-    "@pnpm/lockfile.fs": "1100.0.7",
-    "@pnpm/lockfile.types": "1100.0.5",
-    "@pnpm/installing.env-installer": "1101.0.8",
-    "@pnpm/resolving.npm-resolver": "1101.1.0",
-    "@pnpm/store.connection-manager": "1100.1.1",
+    "@pnpm/installing.client": "1100.1.0",
+    "@pnpm/installing.env-installer": "1101.0.10",
+    "@pnpm/installing.deps-restorer": "1101.1.3",
+    "@pnpm/lockfile.fs": "1100.1.0",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/lockfile.types": "1100.0.6",
     "@pnpm/shell.path": "1100.0.1",
-    "@pnpm/store.controller": "1101.0.5",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.4",
+    "@pnpm/store.connection-manager": "1100.2.0",
+    "@pnpm/resolving.npm-resolver": "1101.2.0",
+    "@pnpm/store.controller": "1101.0.7",
     "@pnpm/types": "1101.1.0",
-    "@pnpm/bins.linker": "1100.0.5",
-    "@pnpm/global.commands": "1100.0.16",
-    "@pnpm/error": "1100.0.0"
+    "@pnpm/workspace.project-manifest-reader": "1100.0.6"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -62,11 +63,11 @@
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/engine.pm.commands": "1101.1.11",
-    "@pnpm/logger": "1100.0.0",
+    "@pnpm/engine.pm.commands": "1101.1.13",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/prepare": "1100.0.7",
-    "@pnpm/testing.mock-agent": "1100.0.3"
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/prepare": "1100.0.9",
+    "@pnpm/testing.mock-agent": "1100.0.5"
   },
   "engines": {
     "node": ">=22.13"