@pnpm/exec.prepare-package 1100.0.33 → 1100.0.34

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @pnpm/prepare-package
 
+## 1100.0.34
+
+### Patch Changes
+
+- Enforce `allowBuilds` when a prepared git dependency is reused from the shared store, and use the lockfile's canonical git resolution ID in approval suggestions.
+
+- Updated dependencies:
+  - @pnpm/exec.lifecycle@1100.1.15
+  - @pnpm/pkg-manifest.reader@1100.0.18
+  - @pnpm/types@1102.1.0
+
 ## 1100.0.33
 
 ### Patch Changes

package/lib/index.d.ts

@@ -1,4 +1,4 @@
-import type { AllowBuild } from '@pnpm/types';
+import type { AllowBuild, PackageManifest } from '@pnpm/types';
 export interface PreparePackageOptions {
     allowBuild?: AllowBuild;
     ignoreScripts?: boolean;
@@ -10,3 +10,4 @@ export declare function preparePackage(opts: PreparePackageOptions, gitRootDir:
     shouldBeBuilt: boolean;
     pkgDir: string;
 }>;
+export declare function assertPackageBuildIsAllowed(opts: Pick<PreparePackageOptions, 'allowBuild' | 'pkgResolutionId'>, manifest: Partial<PackageManifest>): void;

package/lib/index.js

@@ -22,19 +22,7 @@ export async function preparePackage(opts, gitRootDir, subDir) {
         return { shouldBeBuilt: false, pkgDir };
     if (opts.ignoreScripts)
         return { shouldBeBuilt: true, pkgDir };
-    // Check if the package is allowed to run build scripts
-    // If allowBuild is undefined or returns false, block the build.
-    // The depPath is synthesized from the resolution id rather than read from
-    // a lockfile; resolution ids of git and tarball artifacts are never
-    // semver-shaped, so the policy derives an untrusted package identity.
-    const depPath = `${manifest.name}@${opts.pkgResolutionId}`;
-    if (!opts.allowBuild?.(depPath)) {
-        throw new PnpmError('GIT_DEP_PREPARE_NOT_ALLOWED', `The git-hosted package "${manifest.name}@${manifest.version}" needs to execute build scripts but is not in the "allowBuilds" allowlist.`, {
-            hint: `Add the package to "allowBuilds" in your project's pnpm-workspace.yaml to allow it to run scripts. For example:
-allowBuilds:
-  ${depPath}: true`,
-        });
-    }
+    assertPackageBuildIsAllowed(opts, manifest);
     const pm = (await preferredPM(gitRootDir))?.name ?? 'npm';
     const execOpts = {
         depPath: `${manifest.name}@${manifest.version}`,
@@ -72,6 +60,16 @@ allowBuilds:
     await rimraf(path.join(pkgDir, 'node_modules'));
     return { shouldBeBuilt: true, pkgDir };
 }
+export function assertPackageBuildIsAllowed(opts, manifest) {
+    const depPath = `${manifest.name}@${opts.pkgResolutionId}`;
+    if (!opts.allowBuild?.(depPath)) {
+        throw new PnpmError('GIT_DEP_PREPARE_NOT_ALLOWED', `The git-hosted package "${manifest.name}@${manifest.version}" needs to execute build scripts but is not in the "allowBuilds" allowlist.`, {
+            hint: `Add the package to "allowBuilds" in your project's pnpm-workspace.yaml to allow it to run scripts. For example:
+allowBuilds:
+  ${depPath}: true`,
+        });
+    }
+}
 function packageShouldBeBuilt(manifest, pkgDir) {
     if (manifest.scripts == null)
         return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/exec.prepare-package",
-  "version": "1100.0.33",
+  "version": "1100.0.34",
   "description": "Prepares a Git-hosted package",
   "keywords": [
     "pnpm",
@@ -28,9 +28,9 @@
   ],
   "dependencies": {
     "@pnpm/error": "1100.1.3",
-    "@pnpm/exec.lifecycle": "1100.1.14",
-    "@pnpm/pkg-manifest.reader": "1100.0.17",
-    "@pnpm/types": "1102.0.0",
+    "@pnpm/exec.lifecycle": "1100.1.15",
+    "@pnpm/pkg-manifest.reader": "1100.0.18",
+    "@pnpm/types": "1102.1.0",
     "@zkochan/rimraf": "^4.0.0",
     "execa": "npm:safe-execa@0.3.0",
     "preferred-pm": "^5.0.0",
@@ -38,8 +38,8 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/exec.prepare-package": "1100.0.33",
-    "@pnpm/prepare": "1100.0.27",
+    "@pnpm/exec.prepare-package": "1100.0.34",
+    "@pnpm/prepare": "1100.0.28",
     "@pnpm/test-fixtures": "1100.0.1",
     "@pnpm/test-ipc-server": "1100.0.0",
     "@types/ramda": "0.32.0",