@pnpm/exe 12.2.1 → 12.3.1

package/bin/pnpm.mjs

@@ -3,14 +3,17 @@
 // `./bin/pnpx.mjs` for every pnpm >=11 (see its `config.json`) and loads them
 // into its own Node.js process, which a native executable cannot be loaded into.
 //
-// Nothing else runs this file: `package.json#bin` still points at the native
-// binary, so an ordinary `npm install -g pnpm` never pays for a Node.js startup.
+// The `pnpm` placeholder bin runs it too, when the install script that
+// replaces it with the native binary did not run (build scripts blocked). An
+// ordinary `npm install -g pnpm` never pays for a Node.js startup:
+// `package.json#bin` points at the native binary.
 //
 // Corepack installs no dependencies and runs no lifecycle scripts, so the
 // `@pnpm/exe.<target>` package that carries the binary is absent and
 // `install.js` never ran. The binary is therefore downloaded on first use and
 // kept next to this wrapper — where the native binary also finds the `dist/`
-// payload it ships node-gyp in.
+// payload it ships node-gyp in. The placeholder's installs usually do carry
+// that package, and the binary is taken from there.
 //
 // The download itself is `get-pnpm`, the package behind https://get.pnpm.io,
 // which already knows how to verify one; it travels in that same `dist/`

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,9 +1,9 @@
 {
-  "lastValidatedTimestamp": 1788223005630,
+  "lastValidatedTimestamp": 1788394737104,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.2.1"
+      "version": "12.3.1"
     }
   },
   "pnpmfiles": [],
@@ -87,7 +87,7 @@
         "@types/write-file-atomic": "^4.0.3",
         "@types/yarnpkg__lockfile": "^1.1.9",
         "@types/zkochan__table": "npm:@types/table@6.3.2",
-        "@typescript-eslint/utils": "^8.68.0",
+        "@typescript-eslint/utils": "^8.69.0",
         "@typescript/native-preview": "7.0.0-dev.20260707.2",
         "@yarnpkg/core": "4.9.1",
         "@yarnpkg/extensions": "2.0.7",
@@ -132,7 +132,7 @@
         "escape-string-regexp": "^5.0.0",
         "eslint": "^10.9.1",
         "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jest": "^29.16.5",
+        "eslint-plugin-jest": "^29.16.6",
         "eslint-plugin-n": "^18.3.0",
         "eslint-plugin-promise": "^7.3.0",
         "eslint-plugin-regexp": "^3.1.1",
@@ -190,7 +190,7 @@
         "p-defer": "^4.0.1",
         "p-every": "^2.0.0",
         "p-filter": "^4.1.0",
-        "p-limit": "^7.3.1",
+        "p-limit": "^7.3.2",
         "p-queue": "^9.3.3",
         "parse-json": "^8.3.0",
         "parse-npm-tarball-url": "^5.0.0",
@@ -247,7 +247,7 @@
         "tree-kill": "^1.2.2",
         "ts-jest-resolver": "2.0.1",
         "typescript": "6.0.3",
-        "typescript-eslint": "^8.68.0",
+        "typescript-eslint": "^8.69.0",
         "undici": "^7.29.0",
         "unified": "^11.0.5",
         "validate-npm-package-name": "7.0.2",

package/install.js

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 // Preinstall for the pnpm v12 wrapper (shared verbatim by `pnpm` and
-// `@pnpm/exe`): replace the shebang-less placeholder bins with the host's native
-// binary so `pnpm` runs directly, no Node startup per call. A placeholder (not a
-// Node launcher) is required because the Windows shim is generated from the bin
-// file and npm won't re-read package.json after preinstall; the tradeoff is no
-// fallback when build scripts are blocked (`--ignore-scripts`, pnpm/Bun default).
+// `@pnpm/exe`): replace the placeholder bins with the host's native binary so
+// `pnpm` runs directly, no Node startup per call. Package managers write bin
+// shims after preinstall, so the shims are made from the binary; where build
+// scripts are blocked (`--ignore-scripts`, the pnpm/Bun default) the
+// placeholder stays and runs pnpm through Node.js (see the `pnpm` file). npm
+// does not re-read the rewritten `bin` during the same install pass, so on a
+// global Windows install, postinstall asks it to relink.
 //
 // `pn`/`pnpx`/`pnx` are committed `#!/bin/sh` scripts on Unix (so only `pnpm` is
 // relinked); on Windows the native binary is hardlinked onto each and
@@ -14,6 +16,7 @@
 // Corepack runs no lifecycle scripts, so it never gets here; it enters through
 // `bin/pnpm.mjs` instead.
 import console from 'node:console'
+import { spawnSync } from 'node:child_process'
 import fs from 'node:fs'
 import path from 'node:path'
 import process from 'node:process'
@@ -27,7 +30,11 @@ import {
 
 const BIN_NAMES = ['pnpm', 'pn', 'pnpx', 'pnx']
 
-setup()
+if (process.env.npm_lifecycle_event === 'postinstall') {
+  relinkNpmWindowsShims()
+} else {
+  setup()
+}
 
 function setup () {
   // The committed manifest has no `optionalDependencies`; generate-packages.mjs
@@ -93,9 +100,7 @@ function placeBinary (nativeBinary, destPath, mode) {
     }
     fs.renameSync(tempPath, destPath)
   } catch (err) {
-    try {
-      fs.rmSync(tempPath, { force: true })
-    } catch {}
+    removeFileIfPossible(tempPath)
     fail(`Could not install the pnpm binary at ${destPath}: ${err.message}`)
   }
 }
@@ -110,9 +115,45 @@ function rewriteBin (binMap) {
     fs.writeFileSync(tempPath, JSON.stringify(pkg, null, 2))
     fs.renameSync(tempPath, pkgJsonPath)
   } catch {
-    try {
-      fs.rmSync(tempPath, { force: true })
-    } catch {}
+    removeFileIfPossible(tempPath)
+  }
+}
+
+function relinkNpmWindowsShims () {
+  const npmExecPath = process.env.npm_execpath
+  if (
+    process.platform !== 'win32' ||
+    process.env.npm_config_global !== 'true' ||
+    npmExecPath == null ||
+    path.basename(npmExecPath).toLowerCase() !== 'npm-cli.js'
+  ) {
+    return
+  }
+
+  const packageName = readWrapperManifest().name
+  if (typeof packageName !== 'string') {
+    fail('Could not determine the pnpm wrapper package name when regenerating npm shims.')
+  }
+  const result = spawnSync(process.execPath, [
+    npmExecPath,
+    'rebuild',
+    '--global',
+    '--ignore-scripts',
+    packageName,
+  ], { stdio: 'inherit' })
+  if (result.error != null) {
+    fail(`Could not regenerate the npm shims for pnpm: ${result.error.message}`)
+  }
+  if (result.status !== 0) {
+    fail('npm could not regenerate the shims for pnpm.')
+  }
+}
+
+function removeFileIfPossible (filePath) {
+  try {
+    fs.rmSync(filePath, { force: true })
+  } catch {
+    return
   }
 }
 

package/native-binary.mjs

@@ -2,12 +2,10 @@
 // (`install.js`), which links it over the placeholder bins, and by the Corepack
 // entry (`bin/pnpm.mjs`), which spawns it.
 import fs from 'node:fs'
-import { createRequire } from 'node:module'
 import path from 'node:path'
 import process from 'node:process'
 import { fileURLToPath } from 'node:url'
 
-const require = createRequire(import.meta.url)
 const { platform, arch } = process
 
 /** Directory of the published wrapper; the native binary lives next to it. */
@@ -69,7 +67,14 @@ export function splitBinSpecifier (specifier) {
 
 /**
  * Path to the native binary of whichever platform package the package manager
- * installed, or `null` when none is present (Corepack, `--no-optional`).
+ * installed with this wrapper, or `null` when none is present (Corepack,
+ * `--no-optional`).
+ *
+ * Only the wrapper's own `node_modules` and the one it was installed into are
+ * searched, which is where every package manager puts an optional dependency
+ * of the wrapper. A `require` walk would also reach the ancestors' `node_modules`,
+ * which belong to whatever project the wrapper sits under and are not to be
+ * run in its name.
  *
  * @returns {string | null}
  */
@@ -77,13 +82,34 @@ export function resolveInstalledBinary () {
   // Use whichever platform package the package manager installed: it already
   // filtered by `os`/`cpu`/`libc`, more reliable than re-deriving the host.
   for (const specifier of getBinCandidates()) {
-    try {
-      return require.resolve(specifier)
-    } catch {}
+    const { packageName, binFile } = splitBinSpecifier(specifier)
+    for (const modulesDir of installedModulesDirs()) {
+      const candidate = path.join(modulesDir, ...packageName.split('/'), binFile)
+      if (fs.statSync(candidate, { throwIfNoEntry: false })?.isFile() === true) {
+        return candidate
+      }
+    }
   }
   return null
 }
 
+/**
+ * Where a platform package installed for this wrapper can be: the `node_modules`
+ * nested in the wrapper, then the one the wrapper was installed into (two levels
+ * up for the scoped `@pnpm/exe`). Neither need exist. Throws only when the
+ * wrapper's manifest is unreadable, see {@link readWrapperManifest}.
+ *
+ * @returns {string[]}
+ */
+function installedModulesDirs () {
+  const { name } = readWrapperManifest()
+  const segments = typeof name === 'string' ? name.split('/').length : 1
+  return [
+    path.join(wrapperDir, 'node_modules'),
+    path.resolve(wrapperDir, ...Array(segments).fill('..')),
+  ]
+}
+
 // A successful read with no optionalDependencies is the dev checkout (there is
 // no native binary to link there); a read/parse failure is a corrupt published
 // package and must not be silently swallowed into that same path.

package/package.json

@@ -9,7 +9,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.2.1",
+  "version": "12.3.1",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -46,17 +46,18 @@
     "THIRD-PARTY-NOTICES.md"
   ],
   "optionalDependencies": {
-    "@pnpm/exe.win32-x64": "12.2.1",
-    "@pnpm/exe.win32-arm64": "12.2.1",
-    "@pnpm/exe.darwin-x64": "12.2.1",
-    "@pnpm/exe.darwin-arm64": "12.2.1",
-    "@pnpm/exe.linux-x64": "12.2.1",
-    "@pnpm/exe.linux-arm64": "12.2.1",
-    "@pnpm/exe.linux-x64-musl": "12.2.1",
-    "@pnpm/exe.linux-arm64-musl": "12.2.1"
+    "@pnpm/exe.win32-x64": "12.3.1",
+    "@pnpm/exe.win32-arm64": "12.3.1",
+    "@pnpm/exe.darwin-x64": "12.3.1",
+    "@pnpm/exe.darwin-arm64": "12.3.1",
+    "@pnpm/exe.linux-x64": "12.3.1",
+    "@pnpm/exe.linux-arm64": "12.3.1",
+    "@pnpm/exe.linux-x64-musl": "12.3.1",
+    "@pnpm/exe.linux-arm64-musl": "12.3.1"
   },
   "scripts": {
     "preinstall": "node install.js",
+    "postinstall": "node install.js",
     "bundle-node-gyp": "node scripts/bundle-node-gyp.mjs"
   }
 }

package/pnpm

@@ -1,4 +1,21 @@
-This is a placeholder. pnpm's native binary replaces this file during
-installation (see ./install.js). If you are reading this, the install/build
-script did not run — reinstall with build scripts enabled (e.g. allow-list
-pnpm's build under pnpm or Bun, or drop --ignore-scripts).
+#!/usr/bin/env node
+// pnpm's native binary replaces this file during installation (see
+// ./install.js). If this is running, that install script did not — build
+// scripts were blocked (pnpm and Bun block them by default) or skipped
+// (`--ignore-scripts`) — so pnpm runs through Node.js instead: `bin/pnpm.mjs`
+// finds the installed binary, or downloads one, and spawns it.
+//
+// Package managers write bin shims after preinstall has had its chance to run,
+// so a shim made from this file's shebang exists only where the binary never
+// arrived. That is also why this file is left in place once it is running: a
+// binary put here under such a shim would be run through `node`.
+import process from 'node:process'
+
+if (process.stderr.isTTY) {
+  process.stderr.write(
+    'pnpm is running through Node.js because the script that installs its native binary was skipped. ' +
+    'Reinstall pnpm with its build scripts allowed to run the binary directly.\n'
+  )
+}
+
+await import('./bin/pnpm.mjs')