@pnpm/exec.commands 1100.1.6 → 1100.1.8

package/lib/dlx.js

@@ -7,10 +7,10 @@ import { resolveFromCatalog, } from '@pnpm/catalogs.resolver';
 import { OUTPUT_OPTIONS } from '@pnpm/cli.common-cli-options-help';
 import { docsUrl, readProjectManifestOnly } from '@pnpm/cli.utils';
 import { types } from '@pnpm/config.reader';
-import { createPackageVersionPolicy } from '@pnpm/config.version-policy';
+import { getPublishedByPolicy } from '@pnpm/config.version-policy';
 import { createHexHash } from '@pnpm/crypto.hash';
 import { PnpmError } from '@pnpm/error';
-import { createResolver } from '@pnpm/installing.client';
+import { createResolver, makeResolutionStrict } from '@pnpm/installing.client';
 import { add } from '@pnpm/installing.commands';
 import { readPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
 import { parseWantedDependency } from '@pnpm/resolving.parse-wanted-dependency';
@@ -84,12 +84,11 @@ export async function handler(opts, [command, ...args], commands) {
         opts.trustPolicy === 'no-downgrade' ||
         Boolean(opts.minimumReleaseAge)) && !opts.registrySupportsTimeField);
     const catalogResolver = resolveFromCatalog.bind(null, opts.catalogs ?? {});
-    const { resolve } = createResolver({
+    const { resolve: baseResolve } = createResolver({
         ...opts,
         configByUri: opts.configByUri,
         fullMetadata,
         filterMetadata: fullMetadata,
-        strictPublishedByCheck: Boolean(opts.minimumReleaseAge) && opts.minimumReleaseAgeStrict === true,
         ignoreMissingTimeField: opts.minimumReleaseAgeIgnoreMissingTime,
         retry: {
             factor: opts.fetchRetryFactor,
@@ -99,11 +98,18 @@ export async function handler(opts, [command, ...args], commands) {
         },
         timeout: opts.fetchTimeout,
     });
+    // dlx has nowhere to "defer to" — it runs the resolved package directly.
+    // Wrap the resolver under any policy that wants to reject violations
+    // up-front: strict minimumReleaseAge (refuse immature picks) and
+    // `trustPolicy: 'no-downgrade'` (refuse versions whose trust evidence
+    // weakened). Without the trust-policy arm, a downgraded version would
+    // resolve to a `policyViolation` that dlx silently ignored and then
+    // executed.
+    const strictResolution = (Boolean(opts.minimumReleaseAge) && opts.minimumReleaseAgeStrict === true) ||
+        opts.trustPolicy === 'no-downgrade';
+    const resolve = strictResolution ? makeResolutionStrict(baseResolve) : baseResolve;
     const resolvedPkgAliases = [];
-    const publishedBy = opts.minimumReleaseAge ? new Date(Date.now() - opts.minimumReleaseAge * 60 * 1000) : undefined;
-    const publishedByExclude = opts.minimumReleaseAgeExclude
-        ? createPackageVersionPolicy(opts.minimumReleaseAgeExclude)
-        : undefined;
+    const { publishedBy, publishedByExclude } = getPublishedByPolicy(opts);
     const resolvedPkgs = await Promise.all(pkgs.map(async (pkg) => {
         const { alias, bareSpecifier } = parseWantedDependency(pkg) || {};
         if (alias == null)

package/lib/exec.d.ts

@@ -28,7 +28,7 @@ export type ExecOpts = Required<Pick<ConfigContext, 'selectedProjectsGraph'>> &
     resumeFrom?: string;
     reportSummary?: boolean;
     implicitlyFellbackFromRun?: boolean;
-} & Pick<Config, 'bin' | 'dir' | 'extraBinPaths' | 'extraEnv' | 'lockfileDir' | 'modulesDir' | 'nodeOptions' | 'pnpmHomeDir' | 'recursive' | 'reporterHidePrefix' | 'userAgent' | 'verifyDepsBeforeRun' | 'workspaceDir'> & Pick<ConfigContext, 'cliOptions'> & CheckDepsStatusOptions;
+} & Pick<Config, 'bin' | 'dir' | 'extraBinPaths' | 'extraEnv' | 'lockfileDir' | 'modulesDir' | 'nodeOptions' | 'pnpmHomeDir' | 'recursive' | 'reporter' | 'reporterHidePrefix' | 'userAgent' | 'verifyDepsBeforeRun' | 'workspaceDir'> & Pick<ConfigContext, 'cliOptions'> & CheckDepsStatusOptions;
 export declare function handler(opts: ExecOpts, params: string[]): Promise<{
     exitCode: number;
 }>;

package/lib/runDepsStatusCheck.d.ts

@@ -1,7 +1,8 @@
-import type { VerifyDepsBeforeRun } from '@pnpm/config.reader';
+import type { Config, VerifyDepsBeforeRun } from '@pnpm/config.reader';
 import { type CheckDepsStatusOptions, type WorkspaceStateSettings } from '@pnpm/deps.status';
 export interface RunDepsStatusCheckOptions extends CheckDepsStatusOptions {
     dir: string;
+    reporter?: Config['reporter'];
     verifyDepsBeforeRun?: VerifyDepsBeforeRun;
 }
 export declare function runDepsStatusCheck(opts: RunDepsStatusCheckOptions): Promise<void>;

package/lib/runDepsStatusCheck.js

@@ -12,7 +12,7 @@ export async function runDepsStatusCheck(opts) {
     if (upToDate)
         return;
     const command = ['install', ...createInstallArgs(workspaceState?.settings)];
-    const install = runPnpmCli.bind(null, command, { cwd: opts.dir });
+    const install = runPnpmCli.bind(null, command, { cwd: opts.dir, reporter: opts.reporter });
     switch (opts.verifyDepsBeforeRun) {
         case 'install':
             install();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/exec.commands",
-  "version": "1100.1.6",
+  "version": "1100.1.8",
   "description": "Commands for running scripts",
   "keywords": [
     "pnpm",
@@ -38,31 +38,31 @@
     "symlink-dir": "^10.0.1",
     "which": "npm:@pnpm/which@^3.0.1",
     "write-json-file": "^7.0.0",
-    "@pnpm/building.commands": "1100.0.16",
     "@pnpm/bins.resolver": "1100.0.3",
+    "@pnpm/building.commands": "1100.0.18",
     "@pnpm/catalogs.resolver": "1100.0.0",
     "@pnpm/cli.command": "1100.0.1",
     "@pnpm/cli.common-cli-options-help": "1100.0.1",
-    "@pnpm/config.reader": "1101.3.0",
-    "@pnpm/cli.utils": "1101.0.3",
-    "@pnpm/config.version-policy": "1100.0.3",
-    "@pnpm/core-loggers": "1100.0.2",
+    "@pnpm/cli.utils": "1101.0.5",
+    "@pnpm/config.reader": "1101.3.2",
+    "@pnpm/config.version-policy": "1100.1.0",
+    "@pnpm/core-loggers": "1100.1.0",
     "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/deps.status": "1100.0.14",
+    "@pnpm/deps.status": "1100.0.16",
+    "@pnpm/engine.runtime.commands": "1100.0.15",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/engine.runtime.commands": "1100.0.13",
-    "@pnpm/installing.commands": "1100.2.1",
-    "@pnpm/installing.client": "1100.0.14",
-    "@pnpm/exec.pnpm-cli-runner": "1100.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.3",
+    "@pnpm/exec.lifecycle": "1100.0.11",
+    "@pnpm/exec.pnpm-cli-runner": "1100.0.1",
+    "@pnpm/installing.client": "1100.1.0",
+    "@pnpm/installing.commands": "1100.3.0",
+    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
     "@pnpm/shell.path": "1100.0.1",
+    "@pnpm/pkg-manifest.reader": "1100.0.3",
     "@pnpm/store.path": "1100.0.1",
-    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/workspace.projects-sorter": "1100.0.2",
     "@pnpm/types": "1101.1.0",
-    "@pnpm/workspace.injected-deps-syncer": "1100.0.10",
-    "@pnpm/exec.lifecycle": "1100.0.9",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.4"
+    "@pnpm/workspace.injected-deps-syncer": "1100.0.12",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.6",
+    "@pnpm/workspace.projects-sorter": "1100.0.2"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -75,13 +75,13 @@
     "@types/which": "^3.0.4",
     "is-windows": "^1.0.2",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/exec.commands": "1100.1.6",
+    "@pnpm/exec.commands": "1100.1.8",
+    "@pnpm/engine.runtime.system-node-version": "1100.1.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/engine.runtime.system-node-version": "1100.0.3",
+    "@pnpm/prepare": "1100.0.9",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/workspace.projects-filter": "1100.0.10",
-    "@pnpm/prepare": "1100.0.7",
-    "@pnpm/testing.command-defaults": "1100.0.1"
+    "@pnpm/testing.command-defaults": "1100.0.1",
+    "@pnpm/workspace.projects-filter": "1100.0.12"
   },
   "engines": {
     "node": ">=22.13"