@pnpm/hooks.pnpmfile 1100.0.31 → 1100.0.33

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @pnpm/pnpmfile
 
+## 1100.0.33
+
+### Patch Changes
+
+- `pnpm install` now applies changes to or removal of a global `readPackage` hook when an existing lockfile is present [pnpm/pnpm#15136](https://github.com/pnpm/pnpm/issues/15136).
+
+- The project's `.pnpmfile.mjs` or `.pnpmfile.cjs` now runs after the pnpmfiles of config dependency plugins [#9891](https://github.com/pnpm/pnpm/issues/9891).
+
+- A `readPackage` hook that sets a dependency range to a value other than a string, such as `undefined`, now fails the install with an error that names the dependency, the package, and the pnpmfile. Delete the property to remove a dependency [#5517](https://github.com/pnpm/pnpm/issues/5517).
+
+- Updated dependencies:
+  - @pnpm/core-loggers@1101.0.1
+  - @pnpm/crypto.hash@1100.0.6
+  - @pnpm/error@1100.2.0
+  - @pnpm/hooks.types@1101.0.4
+  - @pnpm/lockfile.types@1100.1.3
+  - @pnpm/store.controller-types@1101.3.1
+  - @pnpm/types@1102.1.1
+
+## 1100.0.32
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/core-loggers@1101.0.0
+  - @pnpm/crypto.hash@1100.0.5
+  - @pnpm/hooks.types@1101.0.3
+  - @pnpm/lockfile.types@1100.1.2
+  - @pnpm/store.controller-types@1101.3.0
+
 ## 1100.0.31
 
 ### Patch Changes

package/lib/requireHooks.d.ts

@@ -22,7 +22,7 @@ export interface CookedHooks {
      * `pnpmfileChecksum` comparisons, so nothing downstream may treat the
      * checksum as proof the hooks are unchanged.
      */
-    hasUntrackedReadPackageHook?: boolean;
+    untrackedPnpmfileReadPackageHook?: boolean;
 }
 export interface RequireHooksResult {
     hooks: CookedHooks;

package/lib/requireHooks.js

@@ -12,31 +12,6 @@ export async function requireHooks(prefix, opts) {
             includeInChecksum: false,
         });
     }
-    const entries = [];
-    const loadedFiles = [];
-    if (opts.tryLoadDefaultPnpmfile) {
-        // Prefer .pnpmfile.mjs over .pnpmfile.cjs. Only load one.
-        const mjsPath = pathAbsolute('.pnpmfile.mjs', prefix);
-        const mjsResult = await requirePnpmfile(mjsPath, prefix);
-        if (mjsResult != null) {
-            loadedFiles.push(mjsPath);
-            entries.push({
-                file: mjsPath,
-                includeInChecksum: true,
-                hooks: mjsResult.pnpmfileModule?.hooks,
-                finders: mjsResult.pnpmfileModule?.finders,
-                resolvers: mjsResult.pnpmfileModule?.resolvers,
-                fetchers: mjsResult.pnpmfileModule?.fetchers,
-            });
-        }
-        else {
-            pnpmfiles.push({
-                path: '.pnpmfile.cjs',
-                includeInChecksum: true,
-                optional: true,
-            });
-        }
-    }
     if (opts.pnpmfiles) {
         for (const pnpmfile of opts.pnpmfiles) {
             pnpmfiles.push({
@@ -45,11 +20,30 @@ export async function requireHooks(prefix, opts) {
             });
         }
     }
-    await Promise.all(pnpmfiles.map(async ({ path, includeInChecksum, optional }) => {
-        const file = pathAbsolute(path, prefix);
-        if (!loadedFiles.includes(file)) {
-            loadedFiles.push(file);
-            const requirePnpmfileResult = await requirePnpmfile(file, prefix);
+    // The default pnpmfile goes after the listed ones, which include the
+    // pnpmfiles of config dependency plugins, so that its hooks run last and can
+    // extend or override what the plugins set.
+    if (opts.tryLoadDefaultPnpmfile) {
+        // Prefer .pnpmfile.mjs over .pnpmfile.cjs. Only load one.
+        pnpmfiles.push({
+            path: '.pnpmfile.mjs',
+            fallbackPath: '.pnpmfile.cjs',
+            includeInChecksum: true,
+            optional: true,
+        });
+    }
+    const entries = [];
+    // Must stay sequential: loading in parallel registers .mjs pnpmfiles in import
+    // completion order, not in the order listed above.
+    for (const { path, fallbackPath, includeInChecksum, optional } of pnpmfiles) {
+        for (const candidate of fallbackPath == null ? [path] : [path, fallbackPath]) {
+            const file = pathAbsolute(candidate, prefix);
+            const loadedEntry = entries.find((entry) => entry.file === file);
+            if (loadedEntry != null) {
+                loadedEntry.includeInChecksum ||= includeInChecksum;
+                break;
+            }
+            const requirePnpmfileResult = await requirePnpmfile(file, prefix); // eslint-disable-line no-await-in-loop
             if (requirePnpmfileResult != null) {
                 entries.push({
                     file,
@@ -59,12 +53,13 @@ export async function requireHooks(prefix, opts) {
                     resolvers: requirePnpmfileResult.pnpmfileModule?.resolvers,
                     fetchers: requirePnpmfileResult.pnpmfileModule?.fetchers,
                 });
+                break;
             }
-            else if (!optional) {
+            if (candidate === (fallbackPath ?? path) && !optional) {
                 throw new PnpmError('PNPMFILE_NOT_FOUND', `pnpmfile at "${file}" is not found`);
             }
         }
-    }));
+    }
     const mergedFinders = {};
     const cookedHooks = {
         readPackage: [],
@@ -74,7 +69,9 @@ export async function requireHooks(prefix, opts) {
         filterLog: [],
         updateConfig: [],
     };
-    cookedHooks.hasUntrackedReadPackageHook = entries.some((entry) => entry.hooks?.readPackage != null && !entry.includeInChecksum);
+    if (entries.some((entry) => !entry.includeInChecksum)) {
+        cookedHooks.untrackedPnpmfileReadPackageHook = entries.some((entry) => entry.hooks?.readPackage != null && !entry.includeInChecksum);
+    }
     // calculate combined checksum for all included files
     if (entries.some((entry) => entry.hooks != null)) {
         cookedHooks.calculatePnpmfileChecksum = async () => {

package/lib/requirePnpmfile.js

@@ -53,7 +53,7 @@ export async function requirePnpmfile(pnpmFilePath, prefix) {
                 pkg.optionalDependencies = pkg.optionalDependencies ?? {};
                 pkg.peerDependencies = pkg.peerDependencies ?? {};
                 const newPkg = await readPackage(pkg, ...args);
-                if (!newPkg) {
+                if (!newPkg || typeof newPkg !== 'object' || Array.isArray(newPkg)) {
                     throw new BadReadPackageHookError(pnpmFilePath, 'readPackage hook did not return a package manifest object.');
                 }
                 const dependencies = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];
@@ -61,6 +61,11 @@ export async function requirePnpmfile(pnpmFilePath, prefix) {
                     if (newPkg[dep] != null && (typeof newPkg[dep] !== 'object' || Array.isArray(newPkg[dep]))) {
                         throw new BadReadPackageHookError(pnpmFilePath, `readPackage hook returned package manifest object's property '${dep}' must be an object.`);
                     }
+                    for (const [depName, range] of Object.entries(newPkg[dep] ?? {})) {
+                        if (typeof range !== 'string') {
+                            throw new BadReadPackageHookError(pnpmFilePath, `readPackage hook returned an invalid range for '${depName}' in the '${dep}' of ${describePackage(newPkg)}. Expected a string, got ${range === null ? 'null' : typeof range}. To remove the dependency, delete the property.`);
+                        }
+                    }
                 }
                 return newPkg;
             };
@@ -82,6 +87,11 @@ export async function requirePnpmfile(pnpmFilePath, prefix) {
         throw new PnpmFileFailError(pnpmFilePath, toError(err));
     }
 }
+function describePackage(pkg) {
+    if (typeof pkg.name !== 'string' || !pkg.name)
+        return 'an unnamed package';
+    return typeof pkg.version === 'string' && pkg.version ? `${pkg.name}@${pkg.version}` : pkg.name;
+}
 /**
  * Errors are matched by shape, not by class, because asynchronous module customization
  * hooks forward them from their own realm, where `util.types.isNativeError()` returns false.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/hooks.pnpmfile",
-  "version": "1100.0.31",
+  "version": "1100.0.33",
   "description": "Reading a .pnpmfile.cjs",
   "keywords": [
     "pnpm",
@@ -27,13 +27,13 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/core-loggers": "1100.3.4",
-    "@pnpm/crypto.hash": "1100.0.4",
-    "@pnpm/error": "1100.1.4",
-    "@pnpm/hooks.types": "1101.0.2",
-    "@pnpm/lockfile.types": "1100.1.1",
-    "@pnpm/store.controller-types": "1101.2.0",
-    "@pnpm/types": "1102.1.0",
+    "@pnpm/core-loggers": "1101.0.1",
+    "@pnpm/crypto.hash": "1100.0.6",
+    "@pnpm/error": "1100.2.0",
+    "@pnpm/hooks.types": "1101.0.4",
+    "@pnpm/lockfile.types": "1100.1.3",
+    "@pnpm/store.controller-types": "1101.3.1",
+    "@pnpm/types": "1102.1.1",
     "chalk": "^6.0.0",
     "path-absolute": "^2.0.0"
   },
@@ -42,8 +42,8 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/fetching.fetcher-base": "1100.2.9",
-    "@pnpm/hooks.pnpmfile": "1100.0.31",
+    "@pnpm/fetching.fetcher-base": "1100.2.11",
+    "@pnpm/hooks.pnpmfile": "1100.0.33",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/test-fixtures": "1100.0.1"
   },