@pnpm/engine.pm.commands 1101.2.0 → 1101.2.1

package/lib/self-updater/selfUpdate.js

@@ -4,7 +4,7 @@ import { linkBins } from '@pnpm/bins.linker';
 import { isExecutedByCorepack, packageManager } from '@pnpm/cli.meta';
 import { docsUrl } from '@pnpm/cli.utils';
 import { parsePackageManager, shouldPersistLockfile, types as allTypes } from '@pnpm/config.reader';
-import { getPublishedByPolicy } from '@pnpm/config.version-policy';
+import { createPackageVersionPolicyOrThrow, getPublishedByPolicy } from '@pnpm/config.version-policy';
 import { PnpmError } from '@pnpm/error';
 import { createResolver, makeResolutionStrict } from '@pnpm/installing.client';
 import { resolvePackageManagerIntegrities } from '@pnpm/installing.env-installer';
@@ -52,9 +52,20 @@ export async function handler(opts, params) {
         throw new PnpmError('CANT_SELF_UPDATE_IN_COREPACK', 'You should update pnpm with corepack');
     }
     globalInfo('Checking for updates...');
+    // Resolve the engine version exactly as a regular install would. The
+    // no-downgrade trust check reads per-version trust evidence (`_npmUser` /
+    // `dist.attestations`) that abbreviated metadata never carries — so it
+    // always needs full metadata, regardless of `registrySupportsTimeField`
+    // (which only concerns the `time` field). Time-based resolution needs
+    // only `time`. `minimumReleaseAge` is handled by the resolver's on-demand
+    // abbreviated→full upgrade, so it isn't requested up front here.
+    const fullMetadata = (opts.trustPolicy === 'no-downgrade' ||
+        (opts.resolutionMode === 'time-based' && !opts.registrySupportsTimeField));
     const { resolve: baseResolve } = createResolver({
         ...opts,
         configByUri: opts.configByUri,
+        fullMetadata,
+        filterMetadata: fullMetadata,
         ignoreMissingTimeField: opts.minimumReleaseAgeIgnoreMissingTime,
     });
     // self-update has nowhere to "defer to" either — wrap the resolver
@@ -81,6 +92,15 @@ export async function handler(opts, params) {
         projectDir: opts.dir,
         publishedBy,
         publishedByExclude,
+        // Unlike `dlx` (whose real install re-resolves through the store
+        // controller), this `resolve` is self-update's only version selection,
+        // so the trust policy has to be passed here for the no-downgrade check
+        // to run.
+        trustPolicy: opts.trustPolicy,
+        trustPolicyExclude: opts.trustPolicyExclude
+            ? createPackageVersionPolicyOrThrow(opts.trustPolicyExclude, 'trustPolicyExclude')
+            : undefined,
+        trustPolicyIgnoreAfter: opts.trustPolicyIgnoreAfter,
     });
     if (!resolution?.manifest) {
         throw new PnpmError('CANNOT_RESOLVE_PNPM', `Cannot find "${bareSpecifier}" version of pnpm`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/engine.pm.commands",
-  "version": "1101.2.0",
+  "version": "1101.2.1",
   "description": "pnpm commands for self-updating and setting up pnpm",
   "keywords": [
     "pnpm",
@@ -36,29 +36,29 @@
     "semver": "^7.8.4",
     "symlink-dir": "^10.0.1",
     "@pnpm/bins.linker": "1100.0.16",
+    "@pnpm/building.policy": "1100.0.12",
+    "@pnpm/cli.meta": "1100.0.8",
     "@pnpm/cli.utils": "1101.0.13",
     "@pnpm/config.pick-registry-for-package": "1100.0.9",
-    "@pnpm/building.policy": "1100.0.11",
-    "@pnpm/cli.meta": "1100.0.8",
-    "@pnpm/config.reader": "1101.11.0",
+    "@pnpm/config.reader": "1101.11.1",
     "@pnpm/config.version-policy": "1100.1.6",
-    "@pnpm/deps.graph-hasher": "1100.2.7",
-    "@pnpm/error": "1100.0.1",
+    "@pnpm/deps.graph-hasher": "1100.2.8",
     "@pnpm/deps.security.signatures": "1101.2.3",
-    "@pnpm/global.commands": "1100.0.31",
     "@pnpm/global.packages": "1100.0.10",
-    "@pnpm/installing.client": "1100.2.11",
-    "@pnpm/installing.deps-restorer": "1102.1.2",
-    "@pnpm/lockfile.fs": "1100.1.8",
-    "@pnpm/installing.env-installer": "1102.0.3",
+    "@pnpm/global.commands": "1100.0.32",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/installing.env-installer": "1102.0.4",
+    "@pnpm/lockfile.fs": "1100.1.9",
+    "@pnpm/installing.deps-restorer": "1102.1.3",
     "@pnpm/lockfile.types": "1100.0.13",
-    "@pnpm/network.auth-header": "1101.1.3",
-    "@pnpm/resolving.npm-resolver": "1102.1.1",
+    "@pnpm/resolving.npm-resolver": "1102.1.2",
     "@pnpm/shell.path": "1100.0.1",
-    "@pnpm/store.connection-manager": "1100.3.3",
-    "@pnpm/store.controller": "1102.0.3",
+    "@pnpm/network.auth-header": "1101.1.3",
+    "@pnpm/store.connection-manager": "1100.3.4",
     "@pnpm/types": "1101.3.2",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.14"
+    "@pnpm/workspace.project-manifest-reader": "1100.0.14",
+    "@pnpm/store.controller": "1102.0.3",
+    "@pnpm/installing.client": "1100.2.12"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
@@ -69,9 +69,9 @@
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/engine.pm.commands": "1101.2.0",
     "@pnpm/error": "1100.0.1",
     "@pnpm/logger": "1100.0.0",
+    "@pnpm/engine.pm.commands": "1101.2.1",
     "@pnpm/prepare": "1100.0.18",
     "@pnpm/testing.mock-agent": "1101.0.4"
   },