@pnpm/exe 12.9.1 → 12.10.0

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,9 +1,9 @@
 {
-  "lastValidatedTimestamp": 1791058509474,
+  "lastValidatedTimestamp": 1791244929665,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.9.1",
+      "version": "12.10.0",
       "hasModulesDir": true
     }
   },
@@ -28,7 +28,7 @@
         "@commitlint/config-conventional": "^21.2.3",
         "@commitlint/prompt-cli": "^21.2.3",
         "@cyclonedx/cyclonedx-library": "10.3.0",
-        "@emnapi/wasi-threads": "1.2.1",
+        "@emnapi/wasi-threads": "2.1.0",
         "@eslint/js": "^10.0.1",
         "@inquirer/prompts": "^8.7.2",
         "@jest/globals": "30.4.1",
@@ -46,7 +46,7 @@
         "@pnpm/tabtab": "^0.5.4",
         "@pnpm/tgz-fixtures": "0.0.0",
         "@reflink/reflink": "0.1.19",
-        "@rushstack/worker-pool": "0.7.28",
+        "@rushstack/worker-pool": "0.7.29",
         "@stylistic/eslint-plugin": "^5.10.0",
         "@tybys/wasm-util": "0.10.4",
         "@types/adm-zip": "^0.5.8",
@@ -80,7 +80,7 @@
         "@types/semver": "7.8.0",
         "@types/spdx-expression-parse": "4.0.0",
         "@types/ssri": "^7.1.5",
-        "@types/tar-stream": "^3.1.4",
+        "@types/tar-stream": "^3.1.5",
         "@types/touch": "^3.1.5",
         "@types/validate-npm-package-name": "^4.0.2",
         "@types/which": "^3.0.4",
@@ -88,7 +88,7 @@
         "@types/yarnpkg__lockfile": "^1.1.9",
         "@types/yauzl": "^3.4.0",
         "@types/zkochan__table": "npm:@types/table@6.3.2",
-        "@typescript-eslint/utils": "^8.70.1",
+        "@typescript-eslint/utils": "^8.71.0",
         "@typescript/native-preview": "7.0.0-dev.20260707.2",
         "@webcontainer/api": "^1.6.4",
         "@yarnpkg/core": "4.9.1",
@@ -111,7 +111,6 @@
         "bin-links": "^6.0.2",
         "bole": "^5.0.29",
         "boxen": "npm:@zkochan/boxen@5.1.2",
-        "bz2": "1.0.1",
         "c8": "^12.0.0",
         "camelcase": "^9.0.0",
         "camelcase-keys": "^10.0.3",
@@ -135,10 +134,10 @@
         "empathic": "^2.1.0",
         "esbuild": "^0.28.2",
         "escape-string-regexp": "^5.0.0",
-        "eslint": "^10.11.0",
+        "eslint": "^10.12.0",
         "eslint-plugin-import-x": "^4.17.1",
         "eslint-plugin-jest": "^29.16.6",
-        "eslint-plugin-n": "^18.4.0",
+        "eslint-plugin-n": "^18.4.1",
         "eslint-plugin-promise": "^7.3.0",
         "eslint-plugin-regexp": "^3.1.1",
         "eslint-plugin-simple-import-sort": "^14.0.0",
@@ -180,7 +179,7 @@
         "lru-cache": "^11.5.3",
         "make-empty-dir": "^4.0.0",
         "mdast-util-to-string": "^4.0.0",
-        "memfs": "^4.79.0",
+        "memfs": "^4.80.0",
         "memoize": "^11.0.0",
         "micromatch": "^4.0.8",
         "msgpackr": "2.1.0",
@@ -232,6 +231,7 @@
         "safe-execa": "^0.3.0",
         "safe-promise-defer": "^2.0.0",
         "sanitize-filename": "^1.6.4",
+        "seek-bzip": "2.0.0",
         "semver": "^7.8.5",
         "semver-range-intersect": "^0.3.1",
         "semver-utils": "^1.1.4",
@@ -252,7 +252,7 @@
         "strip-comments-strings": "1.2.0",
         "symlink-dir": "^10.0.3",
         "tar": "^7.5.22",
-        "tar-stream": "^3.2.1",
+        "tar-stream": "^3.2.2",
         "tempy": "3.0.0",
         "terminal-link": "^5.0.0",
         "tinyglobby": "^0.2.17",
@@ -260,7 +260,7 @@
         "tree-kill": "^1.2.2",
         "ts-jest-resolver": "2.0.1",
         "typescript": "6.0.3",
-        "typescript-eslint": "^8.70.1",
+        "typescript-eslint": "^8.71.0",
         "uid-number": "0.0.6",
         "undici": "^7.29.1",
         "unified": "^11.0.5",
@@ -336,7 +336,8 @@
     "patchedDependencies": {
       "@tybys/wasm-util@0.10.4": "../../../../__patches__/@tybys__wasm-util@0.10.4.patch",
       "graceful-fs@4.2.11": "../../../../__patches__/graceful-fs@4.2.11.patch",
-      "normalize-registry-url@2.0.1": "../../../../__patches__/normalize-registry-url@2.0.1.patch"
+      "normalize-registry-url@2.0.1": "../../../../__patches__/normalize-registry-url@2.0.1.patch",
+      "unrs-resolver@1.12.2": "../../../../__patches__/unrs-resolver@1.12.2.patch"
     },
     "peersSuffixMaxLength": 1000,
     "preferWorkspacePackages": false,

package/install.js

@@ -1,7 +1,11 @@
 #!/usr/bin/env node
-// Native installs replace the Node entry points with the host binary. npm's
-// Windows shims must then be regenerated against pnpm.exe; Corepack and
-// installations that block lifecycle scripts keep the Node entry points.
+// Native installs replace every bin with the host binary, so `pnpm` runs with
+// no Node.js startup per call. The bins it replaces are shebang-less for the
+// reason ./pnpm gives. npm's Windows shims still target the extensionless path
+// after the `bin` rewrite, so postinstall asks npm to regenerate them against
+// `pnpm.exe`. Installs that block lifecycle scripts keep the placeholders,
+// which reach pnpm through Node.js wherever a shell runs them. Corepack runs no
+// lifecycle scripts and enters through `bin/pnpm.mjs`.
 import console from 'node:console'
 import { spawnSync } from 'node:child_process'
 import fs from 'node:fs'
@@ -32,7 +36,7 @@ function setup () {
     return
   }
 
-  // The Node launchers stay in place there and point to `@pnpm/wasm`.
+  // The placeholders stay in place there and point to `@pnpm/wasm`.
   if ('webcontainer' in process.versions) {
     return
   }

package/package.json

@@ -9,7 +9,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.9.1",
+  "version": "12.10.0",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -46,20 +46,20 @@
     "THIRD-PARTY-NOTICES.md"
   ],
   "optionalDependencies": {
-    "@pnpm/exe.win32-x64": "12.9.1",
-    "@pnpm/exe.win32-arm64": "12.9.1",
-    "@pnpm/exe.darwin-x64": "12.9.1",
-    "@pnpm/exe.darwin-arm64": "12.9.1",
-    "@pnpm/exe.linux-x64": "12.9.1",
-    "@pnpm/exe.linux-arm64": "12.9.1",
-    "@pnpm/exe.linux-riscv64": "12.9.1",
-    "@pnpm/exe.linux-ppc64": "12.9.1",
-    "@pnpm/exe.linux-s390x": "12.9.1",
-    "@pnpm/exe.linux-x64-musl": "12.9.1",
-    "@pnpm/exe.linux-arm64-musl": "12.9.1",
-    "@pnpm/exe.freebsd-x64": "12.9.1",
-    "@pnpm/exe.android-arm64": "12.9.1",
-    "@pnpm/exe.android-x64": "12.9.1"
+    "@pnpm/exe.win32-x64": "12.10.0",
+    "@pnpm/exe.win32-arm64": "12.10.0",
+    "@pnpm/exe.darwin-x64": "12.10.0",
+    "@pnpm/exe.darwin-arm64": "12.10.0",
+    "@pnpm/exe.linux-x64": "12.10.0",
+    "@pnpm/exe.linux-arm64": "12.10.0",
+    "@pnpm/exe.linux-riscv64": "12.10.0",
+    "@pnpm/exe.linux-ppc64": "12.10.0",
+    "@pnpm/exe.linux-s390x": "12.10.0",
+    "@pnpm/exe.linux-x64-musl": "12.10.0",
+    "@pnpm/exe.linux-arm64-musl": "12.10.0",
+    "@pnpm/exe.freebsd-x64": "12.10.0",
+    "@pnpm/exe.android-arm64": "12.10.0",
+    "@pnpm/exe.android-x64": "12.10.0"
   },
   "scripts": {
     "preinstall": "node install.js",

package/pn

@@ -1,2 +1,76 @@
-#!/usr/bin/env node
-import './bin/pnpm.mjs'
+# Shebang-less for the reason ./pnpm gives: install.js puts the native binary
+# at this path too.
+#
+# `pn` is `pnpm`. The pnpm it hands over to is the one installed alongside it,
+# found relative to this file: a `PATH` lookup would run whatever other pnpm
+# comes first there, and would find nothing at all when the directory holding
+# these bins is not on `PATH`.
+#
+# $0 is whatever shim or symlink `pn` was launched through, so walk to the file
+# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
+# hang the script. Directories come from `${self%/*}` and `readlink` runs through
+# `command -p`, so the caller's `PATH` decides nothing here.
+#
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
+caller_path_set=${PATH+set}
+caller_path=${PATH-}
+helper_path=
+rest=$caller_path:
+while [ -n "$rest" ]; do
+  dir=${rest%%:*}
+  rest=${rest#*:}
+  case "$dir" in
+    */node_modules/*|*/node_modules) ;;
+    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
+  esac
+done
+# An empty PATH searches the current directory.
+PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
+self=$0
+# MSYS and Cygwin can launch this with a native Windows path, which has no slash
+# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
+# backslash anywhere else is an ordinary character in a Unix file name, so the
+# path is left alone. The separators are swapped in the shell rather than through
+# `echo`, which mangles a `\t` or `\b` in a path under dash.
+case $self in
+  [A-Za-z]:\\*|\\\\*)
+    while :; do
+      case $self in
+        *\\*) self=${self%%\\*}/${self#*\\} ;;
+        *) break ;;
+      esac
+    done
+    ;;
+esac
+# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(run_helper readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=${self%/*}/$link ;;
+  esac
+done
+if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
+# The walk has to end at a regular file. Running out of hops leaves $self a
+# symlink; a chain that changed under us can leave it dangling or a directory, and
+# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
+# wrong directory — the substitution this script exists to prevent.
+if [ -L "$self" ] || [ ! -f "$self" ]; then
+  echo "pn: could not resolve $0 to a regular file within 40 symlink hops." >&2
+  exit 1
+fi
+
+exec "${self%/*}/pnpm" "$@"

package/pnpm

@@ -1,2 +1,98 @@
-#!/usr/bin/env node
-import './bin/pnpm.mjs'
+# pnpm's native binary replaces this file during installation (see
+# ./install.js). Until then this hands over to ./bin/pnpm.mjs, which finds the
+# installed binary or downloads one and spawns it.
+#
+# Shebang-less on purpose, and therefore an `sh` script: a bin shim generated
+# from a shebang records that interpreter, and keeps running the native binary
+# through it once the binary takes this path. Every pnpm 11 release before
+# 11.28.4 generates the shim first when it installs the pnpm that a
+# `packageManager` field pins, and released versions cannot be fixed
+# (https://github.com/pnpm/pnpm/issues/16594). test/install.test.mjs holds
+# every bin to this.
+#
+# Something has to retry this file under a shell, because the kernel answers
+# ENOEXEC for it. A bin shim and a shell both do, and so does glibc's `execvp`.
+# Apple's libc does not, so on macOS a program that spawns this path itself gets
+# ENOEXEC; Windows has neither and cannot reach it at all.
+if ! command -v node > /dev/null 2>&1; then
+  echo "pnpm's native binary was not installed, and there is no Node.js to run pnpm without it." >&2
+  echo "Reinstall pnpm with build scripts enabled (allow-list pnpm's build under pnpm or Bun, or drop --ignore-scripts)." >&2
+  exit 1
+fi
+
+if [ -t 2 ]; then
+  echo "pnpm is running through Node.js because the script that installs its native binary was skipped." >&2
+  echo "Reinstall pnpm with its build scripts allowed to run the binary directly." >&2
+fi
+
+# $0 is whatever shim or symlink pnpm was launched through; ./bin/pnpm.mjs is
+# found relative to this file. The hop cap matches the kernel's ELOOP limit, so
+# a cycle cannot hang the script.
+#
+# `readlink` runs through `command -p`, which searches the system default path,
+# and directories come from `${self%/*}`, which runs nothing at all. The caller's
+# PATH therefore decides only which `node` runs, which is what it is for.
+#
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
+caller_path_set=${PATH+set}
+caller_path=${PATH-}
+helper_path=
+rest=$caller_path:
+while [ -n "$rest" ]; do
+  dir=${rest%%:*}
+  rest=${rest#*:}
+  case "$dir" in
+    */node_modules/*|*/node_modules) ;;
+    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
+  esac
+done
+# An empty PATH searches the current directory.
+PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
+self=$0
+# MSYS and Cygwin can launch this with a native Windows path, which has no slash
+# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
+# backslash anywhere else is an ordinary character in a Unix file name, so the
+# path is left alone. The separators are swapped in the shell rather than through
+# `echo`, which mangles a `\t` or `\b` in a path under dash.
+case $self in
+  [A-Za-z]:\\*|\\\\*)
+    while :; do
+      case $self in
+        *\\*) self=${self%%\\*}/${self#*\\} ;;
+        *) break ;;
+      esac
+    done
+    ;;
+esac
+# `${self%/*}` needs a slash to strip. A bare name came from a PATH lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(run_helper readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=${self%/*}/$link ;;
+  esac
+done
+if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
+# The walk has to end at a regular file. Running out of hops leaves $self a
+# symlink; a chain that changed under us can leave it dangling or a directory, and
+# a failed readlink leaves a trailing slash. Each case would take `bin/pnpm.mjs`
+# from the wrong directory.
+if [ -L "$self" ] || [ ! -f "$self" ]; then
+  echo "pnpm: could not resolve $0 to a regular file within 40 symlink hops." >&2
+  exit 1
+fi
+
+exec node "${self%/*}/bin/pnpm.mjs" "$@"

package/pnpx

@@ -1,2 +1,76 @@
-#!/usr/bin/env node
-import './bin/pnpx.mjs'
+# Shebang-less for the reason ./pnpm gives: install.js puts the native binary
+# at this path too.
+#
+# `pnpx` is `pnpm dlx`. The pnpm it hands over to is the one installed alongside
+# it, found relative to this file: a `PATH` lookup would run whatever other pnpm
+# comes first there, and would find nothing at all when the directory holding
+# these bins is not on `PATH`.
+#
+# $0 is whatever shim or symlink `pnpx` was launched through, so walk to the file
+# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
+# hang the script. Directories come from `${self%/*}` and `readlink` runs through
+# `command -p`, so the caller's `PATH` decides nothing here.
+#
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
+caller_path_set=${PATH+set}
+caller_path=${PATH-}
+helper_path=
+rest=$caller_path:
+while [ -n "$rest" ]; do
+  dir=${rest%%:*}
+  rest=${rest#*:}
+  case "$dir" in
+    */node_modules/*|*/node_modules) ;;
+    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
+  esac
+done
+# An empty PATH searches the current directory.
+PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
+self=$0
+# MSYS and Cygwin can launch this with a native Windows path, which has no slash
+# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
+# backslash anywhere else is an ordinary character in a Unix file name, so the
+# path is left alone. The separators are swapped in the shell rather than through
+# `echo`, which mangles a `\t` or `\b` in a path under dash.
+case $self in
+  [A-Za-z]:\\*|\\\\*)
+    while :; do
+      case $self in
+        *\\*) self=${self%%\\*}/${self#*\\} ;;
+        *) break ;;
+      esac
+    done
+    ;;
+esac
+# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(run_helper readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=${self%/*}/$link ;;
+  esac
+done
+if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
+# The walk has to end at a regular file. Running out of hops leaves $self a
+# symlink; a chain that changed under us can leave it dangling or a directory, and
+# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
+# wrong directory — the substitution this script exists to prevent.
+if [ -L "$self" ] || [ ! -f "$self" ]; then
+  echo "pnpx: could not resolve $0 to a regular file within 40 symlink hops." >&2
+  exit 1
+fi
+
+exec "${self%/*}/pnpm" dlx "$@"

package/pnx

@@ -1,2 +1,76 @@
-#!/usr/bin/env node
-import './bin/pnpx.mjs'
+# Shebang-less for the reason ./pnpm gives: install.js puts the native binary
+# at this path too.
+#
+# `pnx` is `pnpm dlx`. The pnpm it hands over to is the one installed alongside
+# it, found relative to this file: a `PATH` lookup would run whatever other pnpm
+# comes first there, and would find nothing at all when the directory holding
+# these bins is not on `PATH`.
+#
+# $0 is whatever shim or symlink `pnx` was launched through, so walk to the file
+# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
+# hang the script. Directories come from `${self%/*}` and `readlink` runs through
+# `command -p`, so the caller's `PATH` decides nothing here.
+#
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
+caller_path_set=${PATH+set}
+caller_path=${PATH-}
+helper_path=
+rest=$caller_path:
+while [ -n "$rest" ]; do
+  dir=${rest%%:*}
+  rest=${rest#*:}
+  case "$dir" in
+    */node_modules/*|*/node_modules) ;;
+    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
+  esac
+done
+# An empty PATH searches the current directory.
+PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
+self=$0
+# MSYS and Cygwin can launch this with a native Windows path, which has no slash
+# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
+# backslash anywhere else is an ordinary character in a Unix file name, so the
+# path is left alone. The separators are swapped in the shell rather than through
+# `echo`, which mangles a `\t` or `\b` in a path under dash.
+case $self in
+  [A-Za-z]:\\*|\\\\*)
+    while :; do
+      case $self in
+        *\\*) self=${self%%\\*}/${self#*\\} ;;
+        *) break ;;
+      esac
+    done
+    ;;
+esac
+# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(run_helper readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=${self%/*}/$link ;;
+  esac
+done
+if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
+# The walk has to end at a regular file. Running out of hops leaves $self a
+# symlink; a chain that changed under us can leave it dangling or a directory, and
+# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
+# wrong directory — the substitution this script exists to prevent.
+if [ -L "$self" ] || [ ! -f "$self" ]; then
+  echo "pnx: could not resolve $0 to a regular file within 40 symlink hops." >&2
+  exit 1
+fi
+
+exec "${self%/*}/pnpm" dlx "$@"