@pnpm/exe 12.7.0 → 12.8.1

package/dist/node_modules/.bin/get-pnpm

@@ -7,6 +7,24 @@
 # path instead. A dependency's bin cannot stand in for one of them and take over
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
+#
+# Where no default path is compiled in, as on Nix, `command -p` searches PATH
+# instead, so the helpers run with node_modules and relative entries dropped from
+# PATH.
+caller_path_set=${PATH+set}
+caller_path=${PATH-}
+helper_path=
+rest=$caller_path:
+while [ -n "$rest" ]; do
+  dir=${rest%%:*}
+  rest=${rest#*:}
+  case "$dir" in
+    */node_modules/*|*/node_modules) ;;
+    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
+  esac
+done
+# An empty PATH searches the current directory.
+PATH=${helper_path:-/}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -53,6 +71,7 @@ case `command -p uname -a` in
     fi
   ;;
 esac
+if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then

package/dist/node_modules/.bin/node-gyp

@@ -7,6 +7,24 @@
 # path instead. A dependency's bin cannot stand in for one of them and take over
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
+#
+# Where no default path is compiled in, as on Nix, `command -p` searches PATH
+# instead, so the helpers run with node_modules and relative entries dropped from
+# PATH.
+caller_path_set=${PATH+set}
+caller_path=${PATH-}
+helper_path=
+rest=$caller_path:
+while [ -n "$rest" ]; do
+  dir=${rest%%:*}
+  rest=${rest#*:}
+  case "$dir" in
+    */node_modules/*|*/node_modules) ;;
+    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
+  esac
+done
+# An empty PATH searches the current directory.
+PATH=${helper_path:-/}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -53,6 +71,7 @@ case `command -p uname -a` in
     fi
   ;;
 esac
+if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then

package/dist/node_modules/.bin/node-which

@@ -7,6 +7,24 @@
 # path instead. A dependency's bin cannot stand in for one of them and take over
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
+#
+# Where no default path is compiled in, as on Nix, `command -p` searches PATH
+# instead, so the helpers run with node_modules and relative entries dropped from
+# PATH.
+caller_path_set=${PATH+set}
+caller_path=${PATH-}
+helper_path=
+rest=$caller_path:
+while [ -n "$rest" ]; do
+  dir=${rest%%:*}
+  rest=${rest#*:}
+  case "$dir" in
+    */node_modules/*|*/node_modules) ;;
+    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
+  esac
+done
+# An empty PATH searches the current directory.
+PATH=${helper_path:-/}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -53,6 +71,7 @@ case `command -p uname -a` in
     fi
   ;;
 esac
+if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then

package/dist/node_modules/.bin/nopt

@@ -7,6 +7,24 @@
 # path instead. A dependency's bin cannot stand in for one of them and take over
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
+#
+# Where no default path is compiled in, as on Nix, `command -p` searches PATH
+# instead, so the helpers run with node_modules and relative entries dropped from
+# PATH.
+caller_path_set=${PATH+set}
+caller_path=${PATH-}
+helper_path=
+rest=$caller_path:
+while [ -n "$rest" ]; do
+  dir=${rest%%:*}
+  rest=${rest#*:}
+  case "$dir" in
+    */node_modules/*|*/node_modules) ;;
+    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
+  esac
+done
+# An empty PATH searches the current directory.
+PATH=${helper_path:-/}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -53,6 +71,7 @@ case `command -p uname -a` in
     fi
   ;;
 esac
+if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then

package/dist/node_modules/.bin/semver

@@ -7,6 +7,24 @@
 # path instead. A dependency's bin cannot stand in for one of them and take over
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
+#
+# Where no default path is compiled in, as on Nix, `command -p` searches PATH
+# instead, so the helpers run with node_modules and relative entries dropped from
+# PATH.
+caller_path_set=${PATH+set}
+caller_path=${PATH-}
+helper_path=
+rest=$caller_path:
+while [ -n "$rest" ]; do
+  dir=${rest%%:*}
+  rest=${rest#*:}
+  case "$dir" in
+    */node_modules/*|*/node_modules) ;;
+    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
+  esac
+done
+# An empty PATH searches the current directory.
+PATH=${helper_path:-/}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -53,6 +71,7 @@ case `command -p uname -a` in
     fi
   ;;
 esac
+if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,9 +1,9 @@
 {
-  "lastValidatedTimestamp": 1790330643831,
+  "lastValidatedTimestamp": 1790613358937,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.7.0"
+      "version": "12.8.1"
     }
   },
   "pnpmfiles": [],
@@ -34,14 +34,11 @@
         "@openpgp/web-stream-tools": "0.3.1",
         "@pnpm/byline": "^1.0.0",
         "@pnpm/colorize-semver-diff": "^2.0.0",
-        "@pnpm/config.env-replace": "^4.1.0",
         "@pnpm/exec": "^4.0.0",
-        "@pnpm/log.group": "4.0.1",
         "@pnpm/logger": "^1100.0.0",
         "@pnpm/meta-updater": "2.0.6",
         "@pnpm/nopt": "^0.3.1",
         "@pnpm/npm-package-arg": "^2.0.0",
-        "@pnpm/os.env.path-extender": "^3.0.1",
         "@pnpm/patch-package": "0.0.1",
         "@pnpm/semver-diff": "^2.0.0",
         "@pnpm/tabtab": "^0.5.4",
@@ -86,6 +83,7 @@
         "@types/which": "^3.0.4",
         "@types/write-file-atomic": "^4.0.3",
         "@types/yarnpkg__lockfile": "^1.1.9",
+        "@types/yauzl": "^3.4.0",
         "@types/zkochan__table": "npm:@types/table@6.3.2",
         "@typescript-eslint/utils": "^8.70.1",
         "@typescript/native-preview": "7.0.0-dev.20260707.2",
@@ -100,6 +98,7 @@
         "@zkochan/rimraf": "^4.0.0",
         "@zkochan/table": "^2.0.1",
         "adm-zip": "^0.6.1",
+        "agentkeepalive": "^4.6.0",
         "amaro": "^1.2.1",
         "ansi-diff": "^1.2.0",
         "archy": "^1.0.0",
@@ -150,6 +149,8 @@
         "graceful-fs": "^4.2.11",
         "graph-cycles": "3.0.0",
         "hosted-git-info": "npm:@pnpm/hosted-git-info@1.0.0",
+        "http-proxy-agent": "^7.0.2",
+        "https-proxy-agent": "^7.0.6",
         "https-proxy-server-express": "0.1.2",
         "human-id": "^4.2.1",
         "husky": "^9.1.7",
@@ -157,7 +158,7 @@
         "ini": "6.0.0",
         "is-gzip": "2.0.0",
         "is-inner-link": "^5.0.0",
-        "is-subdir": "^2.0.0",
+        "is-subdir": "^2.0.1",
         "is-windows": "^1.0.2",
         "isexe": "4.0.0",
         "jest": "30.4.2",
@@ -201,10 +202,11 @@
         "path-name": "^1.0.0",
         "path-temp": "^3.0.0",
         "pidtree": "^1.0.0",
-        "preferred-pm": "^5.0.0",
+        "preferred-pm": "^5.0.1",
         "pretty-bytes": "^7.1.3",
         "pretty-ms": "^9.3.1",
         "promise-share": "^2.0.1",
+        "proxy": "^4.1.0",
         "proxyquire": "^2.1.3",
         "ps-list": "^9.0.0",
         "qrcode-terminal": "^0.12.0",
@@ -231,6 +233,7 @@
         "shx": "^0.4.0",
         "signal-exit": "^4.1.0",
         "socks": "^2.8.10",
+        "socks-proxy-agent": "^8.0.5",
         "sort-keys": "^6.0.1",
         "spdx-expression-parse": "5.0.0",
         "split-cmd": "^1.1.0",
@@ -266,7 +269,8 @@
         "write-package": "7.2.0",
         "write-yaml-file": "^6.0.0",
         "yaml": "^2.9.1",
-        "yaml-tag": "1.1.0"
+        "yaml-tag": "1.1.0",
+        "yauzl": "^3.4.0"
       }
     },
     "dedupeDirectDeps": false,

package/install.js

@@ -5,7 +5,10 @@
 // stay shebang-less because pnpm 11 records its interpreter before installing
 // the native binary at the same path. npm's global Windows shims still target
 // the extensionless path after the `bin` rewrite, so postinstall asks npm to
-// regenerate them against `pnpm.exe`. When lifecycle scripts are blocked
+// regenerate them against `pnpm.exe`. A global install uses `npm rebuild
+// --global`. A project install passes the project prefix, because the
+// script's working directory is the installed package. Any other install,
+// such as `npm exec`, keeps its shims. When lifecycle scripts are blocked
 // (`--ignore-scripts`, pnpm/Bun default), the placeholder remains and runs pnpm
 // through Node.js wherever a shell reaches it (see the `pnpm` file).
 //
@@ -125,7 +128,6 @@ function relinkNpmWindowsShims () {
   const npmExecPath = process.env.npm_execpath
   if (
     process.platform !== 'win32' ||
-    process.env.npm_config_global !== 'true' ||
     npmExecPath == null ||
     path.basename(npmExecPath).toLowerCase() !== 'npm-cli.js'
   ) {
@@ -136,13 +138,21 @@ function relinkNpmWindowsShims () {
   if (typeof packageName !== 'string') {
     fail('Could not determine the pnpm wrapper package name when regenerating npm shims.')
   }
-  const result = spawnSync(process.execPath, [
+  const args = [
     npmExecPath,
     'rebuild',
-    '--global',
     '--ignore-scripts',
-    packageName,
-  ], { stdio: 'inherit' })
+  ]
+  if (process.env.npm_config_global === 'true' || process.env.npm_config_location === 'global') {
+    args.push('--global', packageName)
+  } else {
+    const prefix = findNpmProjectPrefix()
+    if (prefix == null) {
+      return
+    }
+    args.push('--prefix', prefix, packageName)
+  }
+  const result = spawnSync(process.execPath, args, { stdio: 'inherit' })
   if (result.error != null) {
     fail(`Could not regenerate the npm shims for pnpm: ${result.error.message}`)
   }
@@ -151,6 +161,36 @@ function relinkNpmWindowsShims () {
   }
 }
 
+/**
+ * The resolved path of the npm project whose `node_modules` holds this
+ * wrapper. Returns `null` when npm names no project, when its `node_modules`
+ * cannot be resolved, or when it does not contain the wrapper. `npm exec`
+ * installs into its own cache while the prefix still names the caller's
+ * project, and rebuilding there would touch an unrelated project.
+ *
+ * @returns {string | null}
+ */
+function findNpmProjectPrefix () {
+  const prefix = process.env.npm_config_local_prefix
+  if (typeof prefix !== 'string' || prefix === '') {
+    return null
+  }
+  let realPrefix
+  let realModulesDir
+  try {
+    realPrefix = fs.realpathSync(prefix)
+    realModulesDir = fs.realpathSync(path.join(realPrefix, 'node_modules'))
+  } catch {
+    return null
+  }
+  // `wrapperDir` comes from the module URL, which Node resolves through symlinks.
+  const relative = path.relative(realModulesDir, wrapperDir)
+  if (relative === '' || relative.split(path.sep)[0] === '..' || path.isAbsolute(relative)) {
+    return null
+  }
+  return realPrefix
+}
+
 function removeFileIfPossible (filePath) {
   try {
     fs.rmSync(filePath, { force: true })

package/package.json

@@ -9,7 +9,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.7.0",
+  "version": "12.8.1",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -46,20 +46,20 @@
     "THIRD-PARTY-NOTICES.md"
   ],
   "optionalDependencies": {
-    "@pnpm/exe.win32-x64": "12.7.0",
-    "@pnpm/exe.win32-arm64": "12.7.0",
-    "@pnpm/exe.darwin-x64": "12.7.0",
-    "@pnpm/exe.darwin-arm64": "12.7.0",
-    "@pnpm/exe.linux-x64": "12.7.0",
-    "@pnpm/exe.linux-arm64": "12.7.0",
-    "@pnpm/exe.linux-riscv64": "12.7.0",
-    "@pnpm/exe.linux-ppc64": "12.7.0",
-    "@pnpm/exe.linux-s390x": "12.7.0",
-    "@pnpm/exe.linux-x64-musl": "12.7.0",
-    "@pnpm/exe.linux-arm64-musl": "12.7.0",
-    "@pnpm/exe.freebsd-x64": "12.7.0",
-    "@pnpm/exe.android-arm64": "12.7.0",
-    "@pnpm/exe.android-x64": "12.7.0"
+    "@pnpm/exe.win32-x64": "12.8.1",
+    "@pnpm/exe.win32-arm64": "12.8.1",
+    "@pnpm/exe.darwin-x64": "12.8.1",
+    "@pnpm/exe.darwin-arm64": "12.8.1",
+    "@pnpm/exe.linux-x64": "12.8.1",
+    "@pnpm/exe.linux-arm64": "12.8.1",
+    "@pnpm/exe.linux-riscv64": "12.8.1",
+    "@pnpm/exe.linux-ppc64": "12.8.1",
+    "@pnpm/exe.linux-s390x": "12.8.1",
+    "@pnpm/exe.linux-x64-musl": "12.8.1",
+    "@pnpm/exe.linux-arm64-musl": "12.8.1",
+    "@pnpm/exe.freebsd-x64": "12.8.1",
+    "@pnpm/exe.android-arm64": "12.8.1",
+    "@pnpm/exe.android-x64": "12.8.1"
   },
   "scripts": {
     "preinstall": "node install.js",