@pnpm/global.packages 1100.0.10 → 1100.0.12

package/CHANGELOG.md

@@ -0,0 +1,166 @@
+# @pnpm/global.packages
+
+## 1100.0.12
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/bins.resolver@1100.0.10
+  - @pnpm/pkg-manifest.reader@1100.0.11
+  - @pnpm/types@1101.5.0
+
+## 1100.0.11
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/bins.resolver@1100.0.9
+  - @pnpm/pkg-manifest.reader@1100.0.10
+  - @pnpm/types@1101.4.0
+
+## 1100.0.10
+
+### Patch Changes
+
+- be6505a: Hardened global package management:
+
+  - On Windows, removing or updating a global package now also cleans up the `node.exe` flavor of a bin, so a stale `node.exe` no longer survives on `PATH` after uninstall, and a new global install no longer silently overwrites an existing `node.exe`.
+  - `pnpm add -g pnpm@<version>` (and `@pnpm/exe@<version>`) is now rejected like the bare `pnpm` form, pointing to `pnpm self-update`.
+  - Dependency aliases read from a global package's manifest are validated before being joined onto `node_modules` paths, preventing a tampered manifest from escaping the install directory.
+  - Each global install group is created in its own freshly-made directory (no longer reusing a colliding or pre-existing path).
+  - Removing or updating a global package no longer unlinks a bin that belongs to a different globally installed package.
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.9
+
+### Patch Changes
+
+- @pnpm/pkg-manifest.reader@1100.0.9
+- @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.8
+
+### Patch Changes
+
+- a31faa7: Updated dependency ranges. Notably:
+
+  - `@pnpm/logger` peer dependency range moved to `^1100.0.0`.
+  - `msgpackr` 1.11.8 → 2.0.4 (store index files remain byte-compatible in both directions).
+  - `open` ^7.4.2 → ^11.0.0, `memoize` ^10 → ^11, `cli-truncate` ^5 → ^6, `pidtree` ^0.6 → ^1.
+  - `@yarnpkg/core` 4.5.0 → 4.8.0, `@rushstack/worker-pool` 0.7.7 → 0.7.18, `@cyclonedx/cyclonedx-library` 10.0.0 → 10.1.0, `@pnpm/config.nerf-dart` ^1 → ^2, `@pnpm/log.group` 3.0.2 → 4.0.1, `@pnpm/util.lex-comparator` ^3 → ^4.
+
+- Updated dependencies [681b593]
+  - @pnpm/types@1101.3.2
+  - @pnpm/bins.resolver@1100.0.8
+  - @pnpm/pkg-manifest.reader@1100.0.8
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.7
+
+### Patch Changes
+
+- Updated dependencies [230df57]
+- Updated dependencies [bf1b731]
+  - @pnpm/bins.resolver@1100.0.7
+  - @pnpm/types@1101.3.1
+  - @pnpm/pkg-manifest.reader@1100.0.7
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.6
+
+### Patch Changes
+
+- Updated dependencies [a017bf3]
+  - @pnpm/types@1101.3.0
+  - @pnpm/bins.resolver@1100.0.6
+  - @pnpm/pkg-manifest.reader@1100.0.6
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.5
+
+### Patch Changes
+
+- Updated dependencies [35d2355]
+  - @pnpm/types@1101.2.0
+  - @pnpm/bins.resolver@1100.0.5
+  - @pnpm/pkg-manifest.reader@1100.0.5
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.4
+
+### Patch Changes
+
+- Updated dependencies [64afc92]
+  - @pnpm/types@1101.1.1
+  - @pnpm/bins.resolver@1100.0.4
+  - @pnpm/pkg-manifest.reader@1100.0.4
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.3
+
+### Patch Changes
+
+- Updated dependencies [b61e268]
+  - @pnpm/types@1101.1.0
+  - @pnpm/bins.resolver@1100.0.3
+  - @pnpm/pkg-manifest.reader@1100.0.3
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.2
+
+### Patch Changes
+
+- Updated dependencies [184ce26]
+  - @pnpm/pkg-manifest.reader@1100.0.2
+  - @pnpm/bins.resolver@1100.0.2
+  - @pnpm/crypto.hash@1100.0.1
+
+## 1100.0.1
+
+### Patch Changes
+
+- Updated dependencies [ff28085]
+  - @pnpm/types@1101.0.0
+  - @pnpm/bins.resolver@1100.0.1
+  - @pnpm/pkg-manifest.reader@1100.0.1
+  - @pnpm/crypto.hash@1100.0.0
+
+## 1000.0.0
+
+### Minor Changes
+
+- fd511e4: Isolated global packages. Each globally installed package (or group of packages installed together) now gets its own isolated installation directory with its own `package.json`, `node_modules/`, and lockfile. This prevents global packages from interfering with each other through peer dependency conflicts, hoisting changes, or version resolution shifts.
+
+  Key changes:
+
+  - `pnpm add -g <pkg>` creates an isolated installation in `{pnpmHomeDir}/global/v11/{hash}/`
+  - `pnpm remove -g <pkg>` removes the entire installation group containing the package
+  - `pnpm update -g [pkg]` re-installs packages in new isolated directories
+  - `pnpm list -g` scans isolated directories to show all installed global packages
+  - `pnpm install -g` (no args) is no longer supported; use `pnpm add -g <pkg>` instead
+
+### Patch Changes
+
+- Updated dependencies [449dacf]
+- Updated dependencies [76718b3]
+- Updated dependencies [a8f016c]
+- Updated dependencies [cc1b8e3]
+- Updated dependencies [491a84f]
+- Updated dependencies [13855ac]
+- Updated dependencies [d7b8be4]
+- Updated dependencies [7d2fd48]
+- Updated dependencies [efb48dc]
+- Updated dependencies [cb367b9]
+- Updated dependencies [7b1c189]
+- Updated dependencies [8ffb1a7]
+- Updated dependencies [05fb1ae]
+- Updated dependencies [71de2b3]
+- Updated dependencies [10bc391]
+- Updated dependencies [2df8b71]
+- Updated dependencies [15549a9]
+- Updated dependencies [cc7c0d2]
+- Updated dependencies [efb48dc]
+  - @pnpm/bins.resolver@1001.0.0
+  - @pnpm/types@1001.0.0
+  - @pnpm/pkg-manifest.reader@1001.0.0
+  - @pnpm/crypto.hash@1001.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/global.packages",
-  "version": "1100.0.10",
+  "version": "1100.0.12",
   "description": "Utilities for managing isolated global packages",
   "keywords": [
     "pnpm",
@@ -28,14 +28,14 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/util.lex-comparator": "^4.0.1",
-    "@pnpm/bins.resolver": "1100.0.8",
+    "@pnpm/bins.resolver": "1100.0.10",
     "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/types": "1101.3.2"
+    "@pnpm/pkg-manifest.reader": "1100.0.11",
+    "@pnpm/types": "1101.5.0",
+    "@pnpm/util.lex-comparator": "^4.0.1"
   },
   "devDependencies": {
-    "@pnpm/global.packages": "1100.0.10"
+    "@pnpm/global.packages": "1100.0.12"
   },
   "engines": {
     "node": ">=22.13"

package/lib/cacheKey.d.ts

@@ -1,4 +0,0 @@
-export declare function createGlobalCacheKey(opts: {
-    aliases: string[];
-    registries: Record<string, string>;
-}): string;

package/lib/cacheKey.js

@@ -1,9 +0,0 @@
-import { createHexHash } from '@pnpm/crypto.hash';
-import { lexCompare } from '@pnpm/util.lex-comparator';
-export function createGlobalCacheKey(opts) {
-    const sortedAliases = [...opts.aliases].sort(lexCompare);
-    const sortedRegistries = Object.entries(opts.registries).sort(([k1], [k2]) => lexCompare(k1, k2));
-    const hashStr = JSON.stringify([sortedAliases, sortedRegistries]);
-    return createHexHash(hashStr);
-}
-//# sourceMappingURL=cacheKey.js.map

package/lib/globalPackageDir.d.ts

@@ -1,3 +0,0 @@
-export declare function getHashLink(globalDir: string, hash: string): string;
-export declare function resolveInstallDir(globalDir: string, hash: string): string | null;
-export declare function createInstallDir(globalDir: string): string;

package/lib/globalPackageDir.js

@@ -1,44 +0,0 @@
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import util from 'node:util';
-export function getHashLink(globalDir, hash) {
-    return path.join(globalDir, hash);
-}
-export function resolveInstallDir(globalDir, hash) {
-    const linkPath = getHashLink(globalDir, hash);
-    try {
-        const stats = fs.lstatSync(linkPath);
-        if (!stats.isSymbolicLink())
-            return null;
-        return fs.realpathSync(linkPath);
-    }
-    catch (err) {
-        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ENOENT') {
-            return null;
-        }
-        throw err;
-    }
-}
-export function createInstallDir(globalDir) {
-    // Ensure the parent exists, then create the per-group dir *exclusively*
-    // (no `recursive`, which would silently reuse an existing entry or follow
-    // a pre-existing symlink). The name adds random bytes on top of pid+time
-    // so it isn't predictable and can't collide within the same millisecond.
-    fs.mkdirSync(globalDir, { recursive: true });
-    for (let i = 0; i < 10; i++) {
-        const name = `${process.pid.toString(16)}-${Date.now().toString(16)}-${crypto.randomBytes(8).toString('hex')}`;
-        const dir = path.join(globalDir, name);
-        try {
-            fs.mkdirSync(dir);
-            return dir;
-        }
-        catch (err) {
-            if (util.types.isNativeError(err) && 'code' in err && err.code === 'EEXIST')
-                continue;
-            throw err;
-        }
-    }
-    throw new Error('Could not create a unique global install directory');
-}
-//# sourceMappingURL=globalPackageDir.js.map

package/lib/index.d.ts

@@ -1,3 +0,0 @@
-export { createGlobalCacheKey } from './cacheKey.js';
-export { createInstallDir, getHashLink, resolveInstallDir, } from './globalPackageDir.js';
-export { cleanOrphanedInstallDirs, findGlobalPackage, getGlobalPackageDetails, getInstalledBinNames, type GlobalPackageInfo, type InstalledGlobalPackage, isValidGlobalDependencyAlias, scanGlobalPackages, } from './scanGlobalPackages.js';

package/lib/scanGlobalPackages.d.ts

@@ -1,17 +0,0 @@
-import type { PackageManifest } from '@pnpm/types';
-export declare function isValidGlobalDependencyAlias(alias: string): boolean;
-export interface GlobalPackageInfo {
-    hash: string;
-    installDir: string;
-    dependencies: Record<string, string>;
-}
-export interface InstalledGlobalPackage {
-    alias: string;
-    version: string;
-    manifest: PackageManifest;
-}
-export declare function scanGlobalPackages(globalDir: string): GlobalPackageInfo[];
-export declare function findGlobalPackage(globalDir: string, alias: string): GlobalPackageInfo | null;
-export declare function getGlobalPackageDetails(info: GlobalPackageInfo): Promise<InstalledGlobalPackage[]>;
-export declare function cleanOrphanedInstallDirs(globalDir: string): void;
-export declare function getInstalledBinNames(info: GlobalPackageInfo): Promise<string[]>;

package/lib/scanGlobalPackages.js

@@ -1,158 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import util from 'node:util';
-import { getBinsFromPackageManifest } from '@pnpm/bins.resolver';
-import { readPackageJsonFromDirRawSync, safeReadPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
-const RESERVED_ALIASES = new Set(['node_modules', 'favicon.ico']);
-const isUrlFriendly = (segment) => encodeURIComponent(segment) === segment;
-// A dependency alias from a global group's package.json becomes a directory
-// name under `node_modules` at every join site (list, conflict-check,
-// remove, update). A tampered manifest could use an alias like `../x` or an
-// absolute path to escape the install dir, so only valid npm package names
-// are trusted. This applies the same `validForOldPackages` rules that
-// `validate-npm-package-name` (and `@pnpm/fs.symlink-dependency`'s
-// `safeJoinModulesDir`) enforce — implemented inline to avoid adding a
-// dependency to this low-level package.
-export function isValidGlobalDependencyAlias(alias) {
-    if (alias.length === 0)
-        return false;
-    if (/^[._-]/.test(alias))
-        return false;
-    if (alias.trim() !== alias)
-        return false;
-    if (RESERVED_ALIASES.has(alias.toLowerCase()))
-        return false;
-    if (isUrlFriendly(alias))
-        return true;
-    const scoped = /^@([^/]+)\/([^/]+)$/.exec(alias);
-    if (scoped) {
-        const [, scope, name] = scoped;
-        return !name.startsWith('.') && isUrlFriendly(scope) && isUrlFriendly(name);
-    }
-    return false;
-}
-function pickValidDependencies(dependencies) {
-    const result = {};
-    for (const [alias, spec] of Object.entries(dependencies)) {
-        if (isValidGlobalDependencyAlias(alias)) {
-            result[alias] = spec;
-        }
-    }
-    return result;
-}
-export function scanGlobalPackages(globalDir) {
-    let entries;
-    try {
-        entries = fs.readdirSync(globalDir, { withFileTypes: true });
-    }
-    catch (err) {
-        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ENOENT') {
-            return [];
-        }
-        throw err;
-    }
-    const result = [];
-    for (const entry of entries) {
-        // Hash entries are symlinks pointing to install dirs
-        if (!entry.isSymbolicLink())
-            continue;
-        const linkPath = path.join(globalDir, entry.name);
-        let installDir;
-        try {
-            installDir = fs.realpathSync(linkPath);
-        }
-        catch {
-            continue;
-        }
-        let pkgJson;
-        try {
-            pkgJson = readPackageJsonFromDirRawSync(installDir);
-        }
-        catch {
-            continue;
-        }
-        if (!pkgJson.dependencies)
-            continue;
-        const dependencies = pickValidDependencies(pkgJson.dependencies);
-        if (Object.keys(dependencies).length === 0)
-            continue;
-        result.push({
-            hash: entry.name,
-            installDir,
-            dependencies,
-        });
-    }
-    return result;
-}
-export function findGlobalPackage(globalDir, alias) {
-    const packages = scanGlobalPackages(globalDir);
-    return packages.find((pkg) => alias in pkg.dependencies) ?? null;
-}
-export async function getGlobalPackageDetails(info) {
-    const aliases = Object.keys(info.dependencies);
-    const installedPackages = await Promise.all(aliases.map(async (alias) => {
-        const manifest = await safeReadPackageJsonFromDir(path.join(info.installDir, 'node_modules', alias));
-        if (!manifest)
-            return null;
-        return { alias, version: manifest.version, manifest };
-    }));
-    return installedPackages.filter((pkg) => pkg !== null);
-}
-export function cleanOrphanedInstallDirs(globalDir) {
-    globalDir = path.resolve(globalDir);
-    let entries;
-    try {
-        entries = fs.readdirSync(globalDir, { withFileTypes: true });
-    }
-    catch {
-        return;
-    }
-    // Collect real paths of all symlink targets
-    const referenced = new Set();
-    for (const entry of entries) {
-        if (!entry.isSymbolicLink())
-            continue;
-        try {
-            referenced.add(fs.realpathSync(path.join(globalDir, entry.name)));
-        }
-        catch { }
-    }
-    // Remove directories that no symlink points to.
-    // Skip recently-created dirs to avoid racing with a concurrent install
-    // that hasn't created its hash symlink yet.
-    const now = Date.now();
-    const SAFETY_WINDOW_MS = 5 * 60 * 1000;
-    for (const entry of entries) {
-        if (!entry.isDirectory())
-            continue;
-        const dirPath = path.join(globalDir, entry.name);
-        if (referenced.has(dirPath))
-            continue;
-        try {
-            const stat = fs.statSync(dirPath);
-            if (now - Math.max(stat.birthtimeMs, stat.ctimeMs) < SAFETY_WINDOW_MS)
-                continue;
-        }
-        catch {
-            continue;
-        }
-        fs.rmSync(dirPath, { recursive: true, force: true });
-    }
-}
-export async function getInstalledBinNames(info) {
-    const bins = new Set();
-    const aliases = Object.keys(info.dependencies);
-    const modulesDir = path.join(info.installDir, 'node_modules');
-    await Promise.all(aliases.map(async (alias) => {
-        const depDir = path.join(modulesDir, alias);
-        const manifest = await safeReadPackageJsonFromDir(depDir);
-        if (!manifest)
-            return;
-        const binsOfPkg = await getBinsFromPackageManifest(manifest, depDir);
-        for (const bin of binsOfPkg) {
-            bins.add(bin.name);
-        }
-    }));
-    return [...bins];
-}
-//# sourceMappingURL=scanGlobalPackages.js.map