@pnpm/fetching.tarball-fetcher 1102.0.14 → 1102.1.0

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # @pnpm/tarball-fetcher
 
+## 1102.1.0
+
+### Minor Changes
+
+- Added support for registry replacement tarballs using standard integrity values, explicit revision fields, registry routing from the `registries` setting, non-redirecting integrity-addressed URLs, canonical safe-integer revision numbers, and pnpr proxying for immutable upstream revision artifacts.
+
+### Patch Changes
+
+- Enforce `allowBuilds` when a prepared git dependency is reused from the shared store, and use the lockfile's canonical git resolution ID in approval suggestions.
+
+- Updated dependencies:
+  - @pnpm/core-loggers@1100.3.4
+  - @pnpm/exec.prepare-package@1100.0.34
+  - @pnpm/fetching.fetcher-base@1100.2.9
+  - @pnpm/fs.graceful-fs@1100.2.0
+  - @pnpm/store.index@1100.3.0
+  - @pnpm/types@1102.1.0
+
+## 1102.0.15
+
+### Patch Changes
+
+- Added `fetchWarnTimeoutMs` and `fetchMinSpeedKiBps` to the Rust pnpm CLI and its N-API bindings. Slow registry metadata requests and tarball downloads now emit pnpm-compatible warnings without exposing URL credentials, query parameters, fragments, or control characters [pnpm/pnpm#12042](https://github.com/pnpm/pnpm/issues/12042).
+
+- Updated dependencies:
+  - @pnpm/core-loggers@1100.3.3
+  - @pnpm/error@1100.1.3
+  - @pnpm/exec.prepare-package@1100.0.33
+  - @pnpm/fetching.fetcher-base@1100.2.8
+  - @pnpm/store.index@1100.2.5
+  - @pnpm/types@1102.0.0
+
 ## 1102.0.14
 
 ### Patch Changes

package/lib/gitHostedTarballFetcher.js

@@ -23,6 +23,7 @@ export function createGitHostedTarballFetcher(fetchRemoteTarball, fetcherOpts) {
                 filesMap: prepareResult.filesMap,
                 manifest: prepareResult.manifest ?? manifest,
                 requiresBuild,
+                requiresPrepare: prepareResult.requiresPrepare,
                 // Propagate the raw tarball integrity so the lockfile pins it and
                 // future installs detect a tampered tarball from the git host.
                 integrity,
@@ -49,7 +50,7 @@ async function prepareGitHostedPkg(filesMap, cafs, rawFilesIndexFile, filesIndex
     const { shouldBeBuilt, pkgDir } = await preparePackage({
         ...opts,
         allowBuild: fetcherOpts.allowBuild,
-        pkgResolutionId: createGitHostedTarballPkgResolutionId(resolution),
+        pkgResolutionId: fetcherOpts.pkgResolutionId ?? createGitHostedTarballPkgResolutionId(resolution),
     }, tempLocation, resolution.path ?? '');
     const files = await packlist(pkgDir);
     const { storeIndex } = opts;
@@ -57,12 +58,14 @@ async function prepareGitHostedPkg(filesMap, cafs, rawFilesIndexFile, filesIndex
         if (!shouldBeBuilt) {
             const data = storeIndex.get(rawFilesIndexFile);
             if (data) {
+                data.requiresPrepare = false;
                 storeIndex.set(filesIndexFile, data);
                 storeIndex.delete(rawFilesIndexFile);
             }
             return {
                 filesMap,
                 ignoredBuild: false,
+                requiresPrepare: false,
             };
         }
         if (opts.ignoreScripts) {
@@ -70,6 +73,7 @@ async function prepareGitHostedPkg(filesMap, cafs, rawFilesIndexFile, filesIndex
             return {
                 filesMap,
                 ignoredBuild: true,
+                requiresPrepare: true,
             };
         }
     }
@@ -86,8 +90,10 @@ async function prepareGitHostedPkg(filesMap, cafs, rawFilesIndexFile, filesIndex
             filesIndexFile,
             pkg: fetcherOpts.pkg,
             readManifest: fetcherOpts.readManifest,
+            requiresPrepare: shouldBeBuilt,
         }),
         ignoredBuild: Boolean(opts.ignoreScripts),
+        requiresPrepare: shouldBeBuilt,
     };
 }
 function createGitHostedTarballPkgResolutionId(resolution) {

package/lib/index.js

@@ -46,6 +46,8 @@ async function fetchFromTarball(ctx, cafs, resolution, opts) {
         registry: resolution.registry,
         filesIndexFile: opts.filesIndexFile,
         pkg: opts.pkg,
+        redirect: resolution.revision == null ? undefined : 'manual',
+        retry: resolution.revision == null ? undefined : { retries: 0 },
         appendManifest: opts.appendManifest,
         ignoreFilePattern: opts.ignoreFilePattern,
     });

package/lib/remoteTarballFetcher.d.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage } from 'node:http';
 import type { FetchOptions, FetchResult } from '@pnpm/fetching.fetcher-base';
-import type { FetchFromRegistry, GetAuthHeader } from '@pnpm/fetching.types';
+import type { FetchFromRegistry, GetAuthHeader, RetryTimeoutOptions } from '@pnpm/fetching.types';
 import type { Cafs } from '@pnpm/store.cafs-types';
 import type { StoreIndex } from '@pnpm/store.index';
 export interface HttpResponse {
@@ -13,6 +13,8 @@ export type DownloadOptions = {
     onStart?: (totalSize: number | null, attempt: number) => void;
     onProgress?: (downloaded: number) => void;
     integrity?: string;
+    redirect?: RequestRedirect;
+    retry?: Pick<RetryTimeoutOptions, 'retries'>;
     storeIndex: StoreIndex;
     pkg?: FetchOptions['pkg'];
 } & Pick<FetchOptions, 'appendManifest' | 'readManifest' | 'filesIndexFile' | 'ignoreFilePattern'>;

package/lib/remoteTarballFetcher.js

@@ -1,6 +1,6 @@
 import util from 'node:util';
 import { requestRetryLogger } from '@pnpm/core-loggers';
-import { FetchError } from '@pnpm/error';
+import { FetchError, redactUrlForDisplay } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import { addFilesFromTarball } from '@pnpm/worker';
 import * as retry from '@zkochan/retry';
@@ -18,14 +18,16 @@ export function createDownloader(fetchFromRegistry, gotOpts) {
     const fetchMinSpeedKiBps = gotOpts.fetchMinSpeedKiBps ?? 50; // 50 KiB/s
     return async function download(url, opts) {
         const authHeaderValue = opts.getAuthHeaderByURI(url, { pkgName: opts.pkg?.name });
-        const op = retry.operation(retryOpts);
+        const downloadRetryOpts = { ...retryOpts, ...opts.retry };
+        const op = retry.operation(downloadRetryOpts);
         return new Promise((resolve, reject) => {
             op.attempt(async (attempt) => {
                 try {
                     resolve(await fetch(attempt));
                 }
                 catch (error) { // eslint-disable-line
-                    if (error.response?.status === 401 ||
+                    if ((opts.redirect === 'manual' && error.response?.status >= 300 && error.response.status < 400) ||
+                        error.response?.status === 401 ||
                         error.response?.status === 403 ||
                         error.response?.status === 404 ||
                         error.code === 'ERR_PNPM_PREPARE_PKG_FAILURE') {
@@ -56,7 +58,7 @@ export function createDownloader(fetchFromRegistry, gotOpts) {
                     requestRetryLogger.debug({
                         attempt,
                         error: errorInfo,
-                        maxRetries: retryOpts.retries,
+                        maxRetries: downloadRetryOpts.retries,
                         method: 'GET',
                         timeout,
                         url,
@@ -79,6 +81,7 @@ export function createDownloader(fetchFromRegistry, gotOpts) {
                     // Hence, we tell fetch to not retry,
                     // and we perform the retries from this function instead.
                     retry: { retries: 0 },
+                    redirect: opts.redirect,
                     timeout: gotOpts.timeout,
                 });
                 if (res.status !== 200) {
@@ -144,7 +147,7 @@ export function createDownloader(fetchFromRegistry, gotOpts) {
                 const avgKiBps = Math.floor((downloaded / elapsedSec) / 1024);
                 if (downloaded > 0 && elapsedSec > 1 && avgKiBps < fetchMinSpeedKiBps) {
                     const sizeKb = Math.floor(downloaded / 1024);
-                    globalWarn(`Tarball download average speed ${avgKiBps} KiB/s (size ${sizeKb} KiB) is below ${fetchMinSpeedKiBps} KiB/s: ${url} (GET)`);
+                    globalWarn(`Tarball download average speed ${avgKiBps} KiB/s (size ${sizeKb} KiB) is below ${fetchMinSpeedKiBps} KiB/s: ${redactUrlForDisplay(url)} (GET)`);
                 }
             }
             catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/fetching.tarball-fetcher",
-  "version": "1102.0.14",
+  "version": "1102.1.0",
   "description": "Fetcher for packages hosted as tarballs",
   "keywords": [
     "pnpm",
@@ -29,34 +29,33 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/core-loggers": "1100.3.2",
-    "@pnpm/error": "1100.1.2",
-    "@pnpm/exec.prepare-package": "1100.0.32",
-    "@pnpm/fetching.fetcher-base": "1100.2.7",
+    "@pnpm/core-loggers": "1100.3.4",
+    "@pnpm/error": "1100.1.3",
+    "@pnpm/exec.prepare-package": "1100.0.34",
+    "@pnpm/fetching.fetcher-base": "1100.2.9",
     "@pnpm/fetching.types": "1100.0.3",
-    "@pnpm/fs.graceful-fs": "1100.1.1",
+    "@pnpm/fs.graceful-fs": "1100.2.0",
     "@pnpm/fs.packlist": "1100.0.4",
-    "@pnpm/store.index": "1100.2.4",
-    "@pnpm/types": "1101.9.0",
+    "@pnpm/store.index": "1100.3.0",
+    "@pnpm/types": "1102.1.0",
     "@zkochan/retry": "^0.2.0",
     "lodash.throttle": "4.1.1",
-    "p-map-values": "^0.1.0",
     "ramda": "npm:@pnpm/ramda@0.28.1"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.11"
+    "@pnpm/worker": "^1100.4.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/fetching.tarball-fetcher": "1102.0.14",
+    "@pnpm/fetching.tarball-fetcher": "1102.1.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.12",
-    "@pnpm/store.cafs-types": "1100.0.2",
-    "@pnpm/store.create-cafs-store": "1100.0.25",
+    "@pnpm/network.fetch": "1100.1.14",
+    "@pnpm/store.cafs-types": "1100.1.0",
+    "@pnpm/store.create-cafs-store": "1100.0.27",
     "@pnpm/test-fixtures": "1100.0.1",
     "@pnpm/text.ordinal-comparator": "1100.0.0",
-    "@pnpm/types": "1101.9.0",
+    "@pnpm/types": "1102.1.0",
     "@types/lodash.throttle": "4.1.9",
     "@types/ramda": "0.32.0",
     "@types/retry": "^0.12.5",