@pnpm/engine.pm.commands 1101.1.2 → 1101.1.4

package/lib/self-updater/selfUpdate.js

@@ -6,6 +6,7 @@ import { parsePackageManager, types as allTypes } from '@pnpm/config.reader';
 import { PnpmError } from '@pnpm/error';
 import { createResolver } from '@pnpm/installing.client';
 import { resolvePackageManagerIntegrities } from '@pnpm/installing.env-installer';
+import { readEnvLockfile } from '@pnpm/lockfile.fs';
 import { globalInfo, globalWarn } from '@pnpm/logger';
 import { whichVersionIsPinned } from '@pnpm/resolving.npm-resolver';
 import { createStoreController } from '@pnpm/store.connection-manager';
@@ -51,6 +52,12 @@ export async function handler(opts, params) {
     globalInfo('Checking for updates...');
     const { resolve } = createResolver({ ...opts, configByUri: opts.configByUri });
     const pkgName = 'pnpm';
+    // `pnpm self-update` (no args) defaults to the `latest` dist-tag, but we
+    // refuse to downgrade in that case — `latest` on the registry can lag the
+    // installed version when a new major has shipped without being tagged.
+    // `pnpm self-update latest` (explicit) bypasses the guard so users can
+    // still force a downgrade when they want one.
+    const isImplicitLatest = params.length === 0;
     const bareSpecifier = params[0] ?? 'latest';
     const resolution = await resolve({ alias: pkgName, bareSpecifier }, {
         lockfileDir: opts.lockfileDir ?? opts.dir,
@@ -87,6 +94,15 @@ export async function handler(opts, params) {
     }
     if (opts.wantedPackageManager?.name === packageManager.name) {
         if (opts.wantedPackageManager?.version !== resolution.manifest.version) {
+            if (isImplicitLatest) {
+                // Prefer the lockfile-pinned version when available — for range
+                // specs like `>=8.0.0`, the spec's lower bound understates the
+                // version that was actually installed (see #11418 review).
+                const projectCurrentVersion = await readProjectPinnedPnpmVersion(opts.rootProjectManifestDir, opts.wantedPackageManager?.version);
+                if (projectCurrentVersion != null && semver.lt(resolution.manifest.version, projectCurrentVersion)) {
+                    return `The current project is set to use pnpm v${projectCurrentVersion}, which is newer than the "latest" version on the registry (v${resolution.manifest.version}). No update performed. Run "pnpm self-update latest" to downgrade.`;
+                }
+            }
             const { manifest, writeProjectManifest } = await readProjectManifest(opts.rootProjectManifestDir);
             if (manifest.devEngines?.packageManager) {
                 let manifestChanged = false;
@@ -143,6 +159,9 @@ export async function handler(opts, params) {
     if (resolution.manifest.version === packageManager.version) {
         return `The currently active ${packageManager.name} v${packageManager.version} is already "${bareSpecifier}" and doesn't need an update`;
     }
+    if (isImplicitLatest && semver.lt(resolution.manifest.version, packageManager.version)) {
+        return `The currently active ${packageManager.name} v${packageManager.version} is newer than the "latest" version on the registry (v${resolution.manifest.version}). No update performed. Run "pnpm self-update latest" to downgrade.`;
+    }
     globalInfo(`Updating pnpm from v${packageManager.version} to v${resolution.manifest.version}...`);
     const store = await createStoreController(opts);
     // Resolve integrities and write env lockfile to pnpm-lock.yaml
@@ -196,4 +215,32 @@ function versionSpecFromPinned(version, pinnedVersion) {
         case 'patch': return version;
     }
 }
+async function readProjectPinnedPnpmVersion(rootProjectManifestDir, spec) {
+    // The env lockfile is the most accurate source for the actually-installed
+    // pnpm version when the spec is a range. Fall back to the spec's minimum
+    // version when there's no lockfile entry (e.g. exact `packageManager` pins
+    // below v12 don't write to the lockfile). Take the max of the two so we
+    // pick whichever signal is more restrictive.
+    let lockfilePinned;
+    try {
+        const envLockfile = await readEnvLockfile(rootProjectManifestDir);
+        lockfilePinned = envLockfile?.importers['.'].packageManagerDependencies?.pnpm?.version;
+    }
+    catch {
+        // ignore — fall through to spec min version
+    }
+    let specMin;
+    if (spec != null) {
+        try {
+            specMin = semver.minVersion(spec)?.version;
+        }
+        catch {
+            // invalid range — ignore
+        }
+    }
+    if (lockfilePinned != null && specMin != null) {
+        return semver.gt(lockfilePinned, specMin) ? lockfilePinned : specMin;
+    }
+    return lockfilePinned ?? specMin;
+}
 //# sourceMappingURL=selfUpdate.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/engine.pm.commands",
-  "version": "1101.1.2",
+  "version": "1101.1.4",
   "description": "pnpm commands for self-updating and setting up pnpm",
   "keywords": [
     "pnpm",
@@ -32,25 +32,26 @@
     "render-help": "^2.0.0",
     "semver": "^7.7.2",
     "symlink-dir": "^10.0.1",
-    "@pnpm/bins.linker": "1100.0.2",
-    "@pnpm/building.policy": "1100.0.1",
-    "@pnpm/cli.meta": "1100.0.1",
-    "@pnpm/cli.utils": "1101.0.1",
-    "@pnpm/config.reader": "1101.1.2",
-    "@pnpm/global.commands": "1100.0.7",
+    "@pnpm/bins.linker": "1100.0.3",
+    "@pnpm/building.policy": "1100.0.2",
+    "@pnpm/cli.meta": "1100.0.2",
+    "@pnpm/config.reader": "1101.1.4",
+    "@pnpm/deps.graph-hasher": "1100.1.2",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/installing.client": "1100.0.6",
-    "@pnpm/global.packages": "1100.0.1",
-    "@pnpm/installing.deps-restorer": "1101.0.2",
-    "@pnpm/installing.env-installer": "1101.0.2",
-    "@pnpm/resolving.npm-resolver": "1101.0.0",
-    "@pnpm/lockfile.types": "1100.0.2",
-    "@pnpm/deps.graph-hasher": "1100.1.1",
-    "@pnpm/shell.path": "1100.0.0",
-    "@pnpm/store.controller": "1101.0.1",
+    "@pnpm/cli.utils": "1101.0.2",
+    "@pnpm/global.commands": "1100.0.9",
+    "@pnpm/installing.client": "1100.0.8",
+    "@pnpm/global.packages": "1100.0.2",
+    "@pnpm/installing.deps-restorer": "1101.0.4",
+    "@pnpm/installing.env-installer": "1101.0.3",
+    "@pnpm/lockfile.fs": "1100.0.4",
+    "@pnpm/lockfile.types": "1100.0.3",
+    "@pnpm/shell.path": "1100.0.1",
+    "@pnpm/store.connection-manager": "1100.0.9",
+    "@pnpm/store.controller": "1101.0.2",
     "@pnpm/types": "1101.0.0",
-    "@pnpm/store.connection-manager": "1100.0.7",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.2"
+    "@pnpm/workspace.project-manifest-reader": "1100.0.3",
+    "@pnpm/resolving.npm-resolver": "1101.0.1"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -60,12 +61,12 @@
     "@types/cross-spawn": "^6.0.6",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/engine.pm.commands": "1101.1.2",
     "@pnpm/constants": "1100.0.0",
+    "@pnpm/engine.pm.commands": "1101.1.4",
+    "@pnpm/error": "1100.0.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.3",
-    "@pnpm/testing.mock-agent": "1100.0.1"
+    "@pnpm/prepare": "1100.0.4",
+    "@pnpm/testing.mock-agent": "1100.0.2"
   },
   "engines": {
     "node": ">=22.13"