@pnpm/engine.pm.commands 1101.2.2 → 1101.2.3

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @pnpm/engine.pm.commands
 
+## 1101.2.3
+
+### Patch Changes
+
+- `pnpm add -g`, `pnpm update -g`, `pnpm setup`, and the self-updater no longer fail with `ERR_PNPM_MISSING_TIME` when `trustPolicy: no-downgrade` or `resolutionMode: time-based` is set in the global config [#12883](https://github.com/pnpm/pnpm/issues/12883). The decision to fetch full registry metadata now lives in one place, and the `no-downgrade` trust policy always requests full metadata (matching the self-updater), since the trust evidence it checks is missing from abbreviated metadata even on registries that include the `time` field.
+
+- Updated dependencies:
+  - @pnpm/bins.linker@1100.0.17
+  - @pnpm/building.policy@1100.0.13
+  - @pnpm/cli.meta@1100.0.9
+  - @pnpm/cli.utils@1101.0.14
+  - @pnpm/config.pick-registry-for-package@1100.0.10
+  - @pnpm/config.reader@1101.12.0
+  - @pnpm/config.version-policy@1100.1.7
+  - @pnpm/deps.graph-hasher@1100.2.10
+  - @pnpm/deps.security.signatures@1101.2.4
+  - @pnpm/global.commands@1100.0.34
+  - @pnpm/global.packages@1100.0.11
+  - @pnpm/installing.client@1100.2.14
+  - @pnpm/installing.deps-restorer@1102.1.5
+  - @pnpm/installing.env-installer@1102.0.6
+  - @pnpm/lockfile.fs@1100.1.11
+  - @pnpm/lockfile.types@1100.0.14
+  - @pnpm/network.auth-header@1101.1.4
+  - @pnpm/resolving.npm-resolver@1102.1.3
+  - @pnpm/store.connection-manager@1100.3.6
+  - @pnpm/store.controller@1102.0.5
+  - @pnpm/types@1101.4.0
+  - @pnpm/workspace.project-manifest-reader@1100.0.15
+
 ## 1101.2.2
 
 ### Patch Changes

package/lib/self-updater/installPnpm.js

@@ -237,7 +237,6 @@ async function installFromResolution(installDir, opts, params) {
         devDependencies: false,
         optionalDependencies: true,
     };
-    const fetchFullMetadata = Boolean(opts.supportedArchitectures?.libc);
     await installGlobalPackages({
         ...opts,
         global: false,
@@ -253,7 +252,6 @@ async function installFromResolution(installDir, opts, params) {
         workspaceDir: undefined,
         sharedWorkspaceLockfile: false,
         lockfileOnly: false,
-        fetchFullMetadata,
         include,
         includeDirect: include,
         allowBuilds: {},

package/lib/self-updater/selfUpdate.js

@@ -11,7 +11,7 @@ import { resolvePackageManagerIntegrities } from '@pnpm/installing.env-installer
 import { readEnvLockfile } from '@pnpm/lockfile.fs';
 import { globalInfo, globalWarn } from '@pnpm/logger';
 import { whichVersionIsPinned } from '@pnpm/resolving.npm-resolver';
-import { createStoreController } from '@pnpm/store.connection-manager';
+import { createStoreController, shouldFetchFullMetadata } from '@pnpm/store.connection-manager';
 import { readProjectManifest } from '@pnpm/workspace.project-manifest-reader';
 import { pick } from 'ramda';
 import { renderHelp } from 'render-help';
@@ -52,15 +52,11 @@ export async function handler(opts, params) {
         throw new PnpmError('CANT_SELF_UPDATE_IN_COREPACK', 'You should update pnpm with corepack');
     }
     globalInfo('Checking for updates...');
-    // Resolve the engine version exactly as a regular install would. The
-    // no-downgrade trust check reads per-version trust evidence (`_npmUser` /
-    // `dist.attestations`) that abbreviated metadata never carries — so it
-    // always needs full metadata, regardless of `registrySupportsTimeField`
-    // (which only concerns the `time` field). Time-based resolution needs
-    // only `time`. `minimumReleaseAge` is handled by the resolver's on-demand
-    // abbreviated→full upgrade, so it isn't requested up front here.
-    const fullMetadata = (opts.trustPolicy === 'no-downgrade' ||
-        (opts.resolutionMode === 'time-based' && !opts.registrySupportsTimeField));
+    // Resolve the engine version exactly as a regular install would.
+    // `minimumReleaseAge` is not part of `shouldFetchFullMetadata` because the
+    // resolver upgrades abbreviated metadata to full on demand for the
+    // maturity check, so it isn't requested up front here.
+    const fullMetadata = shouldFetchFullMetadata(opts);
     const { resolve: baseResolve } = createResolver({
         ...opts,
         configByUri: opts.configByUri,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/engine.pm.commands",
-  "version": "1101.2.2",
+  "version": "1101.2.3",
   "description": "pnpm commands for self-updating and setting up pnpm",
   "keywords": [
     "pnpm",
@@ -27,31 +27,31 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/bins.linker": "1100.0.16",
-    "@pnpm/building.policy": "1100.0.12",
-    "@pnpm/cli.meta": "1100.0.8",
-    "@pnpm/cli.utils": "1101.0.13",
-    "@pnpm/config.pick-registry-for-package": "1100.0.9",
-    "@pnpm/config.reader": "1101.11.2",
-    "@pnpm/config.version-policy": "1100.1.6",
-    "@pnpm/deps.graph-hasher": "1100.2.9",
-    "@pnpm/deps.security.signatures": "1101.2.3",
+    "@pnpm/bins.linker": "1100.0.17",
+    "@pnpm/building.policy": "1100.0.13",
+    "@pnpm/cli.meta": "1100.0.9",
+    "@pnpm/cli.utils": "1101.0.14",
+    "@pnpm/config.pick-registry-for-package": "1100.0.10",
+    "@pnpm/config.reader": "1101.12.0",
+    "@pnpm/config.version-policy": "1100.1.7",
+    "@pnpm/deps.graph-hasher": "1100.2.10",
+    "@pnpm/deps.security.signatures": "1101.2.4",
     "@pnpm/error": "1100.0.1",
-    "@pnpm/global.commands": "1100.0.33",
-    "@pnpm/global.packages": "1100.0.10",
-    "@pnpm/installing.client": "1100.2.13",
-    "@pnpm/installing.deps-restorer": "1102.1.4",
-    "@pnpm/installing.env-installer": "1102.0.5",
-    "@pnpm/lockfile.fs": "1100.1.10",
-    "@pnpm/lockfile.types": "1100.0.13",
-    "@pnpm/network.auth-header": "1101.1.3",
+    "@pnpm/global.commands": "1100.0.34",
+    "@pnpm/global.packages": "1100.0.11",
+    "@pnpm/installing.client": "1100.2.14",
+    "@pnpm/installing.deps-restorer": "1102.1.5",
+    "@pnpm/installing.env-installer": "1102.0.6",
+    "@pnpm/lockfile.fs": "1100.1.11",
+    "@pnpm/lockfile.types": "1100.0.14",
+    "@pnpm/network.auth-header": "1101.1.4",
     "@pnpm/os.env.path-extender": "^3.0.1",
-    "@pnpm/resolving.npm-resolver": "1102.1.2",
+    "@pnpm/resolving.npm-resolver": "1102.1.3",
     "@pnpm/shell.path": "1100.0.1",
-    "@pnpm/store.connection-manager": "1100.3.5",
-    "@pnpm/store.controller": "1102.0.4",
-    "@pnpm/types": "1101.3.2",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.14",
+    "@pnpm/store.connection-manager": "1100.3.6",
+    "@pnpm/store.controller": "1102.0.5",
+    "@pnpm/types": "1101.4.0",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.15",
     "cross-spawn": "^7.0.6",
     "detect-libc": "^2.1.2",
     "path-name": "^1.0.0",
@@ -66,11 +66,11 @@
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/engine.pm.commands": "1101.2.2",
+    "@pnpm/engine.pm.commands": "1101.2.3",
     "@pnpm/error": "1100.0.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.18",
-    "@pnpm/testing.mock-agent": "1101.0.4",
+    "@pnpm/prepare": "1100.0.19",
+    "@pnpm/testing.mock-agent": "1101.0.5",
     "@types/cross-spawn": "^6.0.6",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1"