@pnpm/hooks.read-package-hook 1100.1.2 → 1100.2.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @pnpm/hooks.read-package-hook
 
+## 1100.2.0
+
+### Minor Changes
+
+- `overrides` now also govern peers that pnpm auto-installs. Previously an override only rewrote dependencies declared in a manifest, so a peer nobody declares — installed because `autoInstallPeers` is on — resolved against its declared peer range and could bring in a second copy of the very package the override pinned. For example, with `overrides: { react: npm:react@19.2.0 }` and a lone `lucide-react` dependency, pnpm installed `react@18.3.1`; it now installs the pinned `react@19.2.0` [#13320](https://github.com/pnpm/pnpm/issues/13320).
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/types@1101.7.0
+
+## 1100.1.3
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/config.matcher@1100.0.2
+  - @pnpm/config.parse-overrides@1100.1.1
+  - @pnpm/deps.peer-range@1100.1.1
+  - @pnpm/error@1100.1.0
+  - @pnpm/resolving.parse-wanted-dependency@1100.0.2
+  - @pnpm/types@1101.6.0
+
 ## 1100.1.2
 
 ### Patch Changes

package/lib/createOptionalDependenciesRemover.d.ts

@@ -0,0 +1,2 @@
+import type { ReadPackageHook } from '@pnpm/types';
+export declare function createOptionalDependenciesRemover(toBeRemoved: string[]): ReadPackageHook;

package/lib/createOptionalDependenciesRemover.js

@@ -0,0 +1,17 @@
+import { createMatcher } from '@pnpm/config.matcher';
+export function createOptionalDependenciesRemover(toBeRemoved) {
+    if (!toBeRemoved.length)
+        return (manifest) => manifest;
+    const shouldBeRemoved = createMatcher(toBeRemoved);
+    return (manifest) => removeOptionalDependencies(manifest, shouldBeRemoved);
+}
+function removeOptionalDependencies(manifest, shouldBeRemoved) {
+    for (const optionalDependency in manifest.optionalDependencies) {
+        if (shouldBeRemoved(optionalDependency)) {
+            delete manifest.optionalDependencies[optionalDependency];
+            delete manifest.dependencies?.[optionalDependency];
+        }
+    }
+    return manifest;
+}
+//# sourceMappingURL=createOptionalDependenciesRemover.js.map

package/lib/createPackageExtender.d.ts

@@ -0,0 +1,2 @@
+import type { PackageExtension, ReadPackageHook } from '@pnpm/types';
+export declare function createPackageExtender(packageExtensions: Record<string, PackageExtension>): ReadPackageHook;

package/lib/createPackageExtender.js

@@ -0,0 +1,36 @@
+import { parseWantedDependency } from '@pnpm/resolving.parse-wanted-dependency';
+import semver from 'semver';
+export function createPackageExtender(packageExtensions) {
+    const extensionsByPkgName = new Map();
+    for (const selector in packageExtensions) {
+        const packageExtension = packageExtensions[selector];
+        const { alias, bareSpecifier } = parseWantedDependency(selector);
+        if (!extensionsByPkgName.has(alias)) {
+            extensionsByPkgName.set(alias, []);
+        }
+        extensionsByPkgName.get(alias).push({ packageExtension, range: bareSpecifier });
+    }
+    return extendPkgHook.bind(null, extensionsByPkgName);
+}
+function extendPkgHook(extensionsByPkgName, manifest) {
+    const extensions = extensionsByPkgName.get(manifest.name);
+    if (extensions == null)
+        return manifest;
+    extendPkg(manifest, extensions);
+    return manifest;
+}
+function extendPkg(manifest, extensions) {
+    for (const { range, packageExtension } of extensions) {
+        if (range != null && !semver.satisfies(manifest.version, range))
+            continue;
+        for (const field of ['dependencies', 'optionalDependencies', 'peerDependencies', 'peerDependenciesMeta']) {
+            if (!packageExtension[field])
+                continue;
+            manifest[field] = {
+                ...packageExtension[field],
+                ...manifest[field],
+            }; // eslint-disable-line @typescript-eslint/no-explicit-any
+        }
+    }
+}
+//# sourceMappingURL=createPackageExtender.js.map

package/lib/createReadPackageHook.d.ts

@@ -0,0 +1,15 @@
+import type { PackageExtension, ReadPackageHook } from '@pnpm/types';
+import { type CreateVersionsOverriderOptions, type VersionOverrideWithoutRawSelector } from './createVersionsOverrider.js';
+export declare function getEffectivePackageExtensions({ ignoreCompatibilityDb, packageExtensions, }: {
+    ignoreCompatibilityDb?: boolean;
+    packageExtensions?: Record<string, PackageExtension>;
+}): Record<string, PackageExtension> | undefined;
+export declare function createReadPackageHook({ ignoreCompatibilityDb, lockfileDir, overrides, convergeDeclaredRanges, ignoredOptionalDependencies, packageExtensions, readPackageHook, }: {
+    ignoreCompatibilityDb?: boolean;
+    lockfileDir: string;
+    overrides?: VersionOverrideWithoutRawSelector[];
+    convergeDeclaredRanges?: CreateVersionsOverriderOptions['convergeDeclaredRanges'];
+    ignoredOptionalDependencies?: string[];
+    packageExtensions?: Record<string, PackageExtension>;
+    readPackageHook?: ReadPackageHook[] | ReadPackageHook;
+}): ReadPackageHook | undefined;

package/lib/createReadPackageHook.js

@@ -0,0 +1,79 @@
+import { packageExtensions as compatPackageExtensions } from '@yarnpkg/extensions';
+import { isEmpty, pipeWith } from 'ramda';
+import { createOptionalDependenciesRemover } from './createOptionalDependenciesRemover.js';
+import { createPackageExtender } from './createPackageExtender.js';
+import { createVersionsOverrider } from './createVersionsOverrider.js';
+const PACKAGE_EXTENSION_FIELDS = [
+    'dependencies',
+    'optionalDependencies',
+    'peerDependencies',
+    'peerDependenciesMeta',
+];
+export function getEffectivePackageExtensions({ ignoreCompatibilityDb, packageExtensions, }) {
+    const effectivePackageExtensions = {};
+    if (!ignoreCompatibilityDb) {
+        mergePackageExtensions(effectivePackageExtensions, compatPackageExtensions);
+    }
+    if (!isEmpty(packageExtensions ?? {})) {
+        mergePackageExtensions(effectivePackageExtensions, Object.entries(packageExtensions));
+    }
+    return isEmpty(effectivePackageExtensions) ? undefined : effectivePackageExtensions;
+}
+export function createReadPackageHook({ ignoreCompatibilityDb, lockfileDir, overrides, convergeDeclaredRanges, ignoredOptionalDependencies, packageExtensions, readPackageHook, }) {
+    const hooks = [];
+    const effectivePackageExtensions = getEffectivePackageExtensions({
+        ignoreCompatibilityDb,
+        packageExtensions,
+    });
+    if (effectivePackageExtensions != null) {
+        hooks.push(createPackageExtender(effectivePackageExtensions));
+    }
+    if (Array.isArray(readPackageHook)) {
+        hooks.push(...readPackageHook);
+    }
+    else if (readPackageHook) {
+        hooks.push(readPackageHook);
+    }
+    if (!isEmpty(overrides ?? {})) {
+        hooks.push(createVersionsOverrider(overrides, lockfileDir, { convergeDeclaredRanges }));
+    }
+    if (ignoredOptionalDependencies && !isEmpty(ignoredOptionalDependencies)) {
+        hooks.push(createOptionalDependenciesRemover(ignoredOptionalDependencies));
+    }
+    if (hooks.length === 0) {
+        return undefined;
+    }
+    const readPackageAndExtend = hooks.length === 1
+        ? hooks[0]
+        : ((pkg, dir) => pipeWith(async (f, res) => f(await res, dir), hooks)(pkg, dir)); // eslint-disable-line @typescript-eslint/no-explicit-any
+    return readPackageAndExtend;
+}
+function mergePackageExtensions(target, entries) {
+    for (const [selector, packageExtension] of entries) {
+        target[selector] = mergePackageExtension(target[selector], packageExtension);
+    }
+}
+function mergePackageExtension(previous, next) {
+    if (previous == null)
+        return clonePackageExtension(next);
+    const merged = clonePackageExtension(previous);
+    for (const field of PACKAGE_EXTENSION_FIELDS) {
+        if (next[field] == null)
+            continue;
+        merged[field] = {
+            ...next[field],
+            ...merged[field],
+        };
+    }
+    return merged;
+}
+function clonePackageExtension(packageExtension) {
+    const cloned = {};
+    for (const field of PACKAGE_EXTENSION_FIELDS) {
+        if (packageExtension[field] == null)
+            continue;
+        cloned[field] = { ...packageExtension[field] };
+    }
+    return cloned;
+}
+//# sourceMappingURL=createReadPackageHook.js.map

package/lib/createVersionsOverrider.d.ts

@@ -0,0 +1,29 @@
+import type { VersionOverride as VersionOverrideBase } from '@pnpm/config.parse-overrides';
+import type { ReadPackageHook } from '@pnpm/types';
+export type VersionOverrideWithoutRawSelector = Omit<VersionOverrideBase, 'selector'>;
+export interface CreateVersionsOverriderOptions {
+    /**
+     * Populated with every declared semver range seen for packages that have a
+     * convergence override, whether or not the override's version satisfied it.
+     * Feeds the staleness check for convergence overrides after a full
+     * resolution. Edges claimed by an explicit override are not recorded — the
+     * convergence override never governs them.
+     */
+    convergeDeclaredRanges?: Map<string, Set<string>>;
+}
+/**
+ * Resolves the specifier an override imposes on a single dependency edge, or
+ * `undefined` when no override claims it. `'-'` means the edge is removed.
+ *
+ * Edges that have no declaring manifest — a peer pnpm auto-installs — reach
+ * the overrides through this function instead of through the read-package
+ * hook, so parent-scoped overrides (`parent>child`) never apply to them.
+ */
+export type DependencyOverrider = (name: string, bareSpecifier: string, dir?: string) => string | undefined;
+/**
+ * `undefined` when no override in the set could ever claim an undeclared
+ * dependency, so the resolver skips the per-peer call in the common case of a
+ * project with no overrides — or with parent-scoped ones only.
+ */
+export declare function createDependencyOverrider(overrides: VersionOverrideWithoutRawSelector[], rootDir: string): DependencyOverrider | undefined;
+export declare function createVersionsOverrider(overrides: VersionOverrideWithoutRawSelector[], rootDir: string, opts?: CreateVersionsOverriderOptions): ReadPackageHook;

package/lib/createVersionsOverrider.js

@@ -0,0 +1,162 @@
+import path from 'node:path';
+import { isValidPeerRange } from '@pnpm/deps.peer-range';
+import normalizePath from 'normalize-path';
+import { partition } from 'ramda';
+import semver from 'semver';
+import { isIntersectingRange } from './isIntersectingRange.js';
+/**
+ * `undefined` when no override in the set could ever claim an undeclared
+ * dependency, so the resolver skips the per-peer call in the common case of a
+ * project with no overrides — or with parent-scoped ones only.
+ */
+export function createDependencyOverrider(overrides, rootDir) {
+    const { genericVersionOverrides, convergeVersions } = splitOverrides(overrides, rootDir);
+    if (genericVersionOverrides.length === 0 && convergeVersions.size === 0)
+        return undefined;
+    return (name, bareSpecifier, dir) => {
+        const versionOverride = pickVersionOverride({ versionOverrides: [], genericVersionOverrides }, name, bareSpecifier);
+        if (versionOverride) {
+            return versionOverride.newBareSpecifier === '-'
+                ? '-'
+                : resolveOverriddenBareSpecifier(versionOverride, dir);
+        }
+        return convergeBareSpecifier(convergeVersions, name, bareSpecifier);
+    };
+}
+export function createVersionsOverrider(overrides, rootDir, opts) {
+    const { versionOverrides, genericVersionOverrides, convergeVersions } = splitOverrides(overrides, rootDir);
+    return ((manifest, dir) => {
+        const versionOverridesWithParent = versionOverrides.filter(({ parentPkg }) => {
+            return (parentPkg.name === manifest.name &&
+                (!parentPkg.bareSpecifier || semver.satisfies(manifest.version, parentPkg.bareSpecifier)));
+        });
+        overrideDepsOfPkg({ manifest, dir }, versionOverridesWithParent, genericVersionOverrides, {
+            convergeVersions,
+            convergeDeclaredRanges: opts?.convergeDeclaredRanges,
+        });
+        return manifest;
+    });
+}
+function splitOverrides(overrides, rootDir) {
+    const [convergeOverrides, explicitOverrides] = partition(({ converge }) => converge === true, overrides);
+    const [versionOverrides, genericVersionOverrides] = partition(({ parentPkg }) => parentPkg != null, explicitOverrides.map((override) => ({
+        ...override,
+        localTarget: createLocalTarget(override, rootDir),
+    })));
+    return {
+        versionOverrides,
+        genericVersionOverrides,
+        convergeVersions: new Map(convergeOverrides.map((override) => [override.targetPkg.name, override.newBareSpecifier])),
+    };
+}
+function createLocalTarget(override, rootDir) {
+    let protocol;
+    if (override.newBareSpecifier.startsWith('file:')) {
+        protocol = 'file:';
+    }
+    else if (override.newBareSpecifier.startsWith('link:')) {
+        protocol = 'link:';
+    }
+    else {
+        return undefined;
+    }
+    const pkgPath = override.newBareSpecifier.substring(protocol.length);
+    const specifiedViaRelativePath = !path.isAbsolute(pkgPath);
+    const absolutePath = specifiedViaRelativePath ? path.join(rootDir, pkgPath) : pkgPath;
+    return { absolutePath, specifiedViaRelativePath, protocol };
+}
+function overrideDepsOfPkg({ manifest, dir }, versionOverrides, genericVersionOverrides, convergeOpts) {
+    const { dependencies, optionalDependencies, devDependencies, peerDependencies } = manifest;
+    const _overrideDeps = overrideDeps.bind(null, { versionOverrides, genericVersionOverrides, dir, convergeOpts });
+    for (const deps of [dependencies, optionalDependencies, devDependencies]) {
+        if (deps) {
+            _overrideDeps(deps, undefined);
+        }
+    }
+    if (peerDependencies) {
+        if (!manifest.dependencies)
+            manifest.dependencies = {};
+        _overrideDeps(manifest.dependencies, peerDependencies);
+    }
+}
+function overrideDeps({ versionOverrides, genericVersionOverrides, dir, convergeOpts }, deps, peerDeps) {
+    for (const [name, bareSpecifier] of Object.entries(peerDeps ?? deps)) {
+        const versionOverride = pickVersionOverride({ versionOverrides, genericVersionOverrides }, name, bareSpecifier);
+        if (!versionOverride) {
+            convergeDep(convergeOpts, { deps, peerDeps }, name, bareSpecifier);
+            continue;
+        }
+        if (versionOverride.newBareSpecifier === '-') {
+            if (peerDeps) {
+                delete peerDeps[versionOverride.targetPkg.name];
+            }
+            else {
+                delete deps[versionOverride.targetPkg.name];
+            }
+            continue;
+        }
+        const newBareSpecifier = resolveOverriddenBareSpecifier(versionOverride, dir);
+        if (peerDeps == null || !isValidPeerRange(newBareSpecifier)) {
+            deps[versionOverride.targetPkg.name] = newBareSpecifier;
+        }
+        else if (isValidPeerRange(newBareSpecifier)) {
+            peerDeps[versionOverride.targetPkg.name] = newBareSpecifier;
+        }
+    }
+}
+function convergeDep(convergeOpts, { deps, peerDeps }, name, bareSpecifier) {
+    recordConvergeDeclaredRange(convergeOpts, name, bareSpecifier);
+    const convergeVersion = convergeBareSpecifier(convergeOpts.convergeVersions, name, bareSpecifier);
+    if (convergeVersion == null)
+        return;
+    if (peerDeps == null) {
+        deps[name] = convergeVersion;
+    }
+    else {
+        peerDeps[name] = convergeVersion;
+    }
+}
+function recordConvergeDeclaredRange({ convergeVersions, convergeDeclaredRanges }, name, bareSpecifier) {
+    if (convergeDeclaredRanges == null)
+        return;
+    if (!convergeVersions.has(name) || semver.validRange(bareSpecifier, true) == null)
+        return;
+    let ranges = convergeDeclaredRanges.get(name);
+    if (ranges == null) {
+        ranges = new Set();
+        convergeDeclaredRanges.set(name, ranges);
+    }
+    ranges.add(bareSpecifier);
+}
+/**
+ * A convergence override (`"pkg@": "<version>"`) rewrites a dependency edge
+ * only when its version satisfies the edge's declared range, so incompatible
+ * consumers keep their own resolution. Only plain semver ranges participate:
+ * `workspace:`, `catalog:`, `npm:`, git/URL, and dist-tag specifiers have no
+ * defined "satisfies" relation and are left untouched.
+ */
+function convergeBareSpecifier(convergeVersions, name, bareSpecifier) {
+    const convergeVersion = convergeVersions.get(name);
+    if (convergeVersion == null || semver.validRange(bareSpecifier, true) == null)
+        return undefined;
+    return semver.satisfies(convergeVersion, bareSpecifier, true) ? convergeVersion : undefined;
+}
+function pickVersionOverride({ versionOverrides, genericVersionOverrides }, name, bareSpecifier) {
+    const matches = (override) => override.targetPkg.name === name && isIntersectingRange(override.targetPkg.bareSpecifier, bareSpecifier);
+    return pickMostSpecificVersionOverride(versionOverrides.filter(matches)) ??
+        pickMostSpecificVersionOverride(genericVersionOverrides.filter(matches));
+}
+function resolveOverriddenBareSpecifier(versionOverride, dir) {
+    return versionOverride.localTarget
+        ? `${versionOverride.localTarget.protocol}${resolveLocalOverride(versionOverride.localTarget, dir)}`
+        : versionOverride.newBareSpecifier;
+}
+function resolveLocalOverride({ specifiedViaRelativePath, absolutePath }, pkgDir) {
+    return specifiedViaRelativePath && pkgDir
+        ? normalizePath(path.relative(pkgDir, absolutePath))
+        : absolutePath;
+}
+function pickMostSpecificVersionOverride(versionOverrides) {
+    return versionOverrides.sort((a, b) => isIntersectingRange(b.targetPkg.bareSpecifier ?? '', a.targetPkg.bareSpecifier ?? '') ? -1 : 1)[0];
+}
+//# sourceMappingURL=createVersionsOverrider.js.map

package/lib/index.d.ts

@@ -0,0 +1,2 @@
+export { createReadPackageHook, getEffectivePackageExtensions } from './createReadPackageHook.js';
+export { createDependencyOverrider, type DependencyOverrider } from './createVersionsOverrider.js';

package/lib/index.js

@@ -1,2 +1,3 @@
 export { createReadPackageHook, getEffectivePackageExtensions } from './createReadPackageHook.js';
+export { createDependencyOverrider } from './createVersionsOverrider.js';
 //# sourceMappingURL=index.js.map

package/lib/isIntersectingRange.d.ts

@@ -0,0 +1 @@
+export declare function isIntersectingRange(range1: string | undefined, range2: string): boolean;

package/lib/isIntersectingRange.js

@@ -0,0 +1,9 @@
+import semver from 'semver';
+export function isIntersectingRange(range1, range2) {
+    return !range1 ||
+        range2 === range1 ||
+        semver.validRange(range2) != null &&
+            semver.validRange(range1) != null &&
+            semver.intersects(range2, range1);
+}
+//# sourceMappingURL=isIntersectingRange.js.map

package/lib/isSubRange.d.ts

@@ -0,0 +1 @@
+export declare function isSubRange(superRange: string | undefined, subRange: string): boolean;

package/lib/isSubRange.js

@@ -0,0 +1,9 @@
+import semver from 'semver';
+export function isSubRange(superRange, subRange) {
+    return !superRange ||
+        subRange === superRange ||
+        semver.validRange(subRange) != null &&
+            semver.validRange(superRange) != null &&
+            semver.subset(subRange, superRange);
+}
+//# sourceMappingURL=isSubRange.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/hooks.read-package-hook",
-  "version": "1100.1.2",
+  "version": "1100.2.0",
   "description": "Creates the default package reader hook used by pnpm",
   "keywords": [
     "pnpm",
@@ -27,24 +27,24 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/config.parse-overrides": "1100.1.0",
-    "@pnpm/deps.peer-range": "1100.1.0",
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/types": "1101.5.0",
+    "@pnpm/config.matcher": "1100.0.2",
+    "@pnpm/config.parse-overrides": "1100.1.1",
+    "@pnpm/deps.peer-range": "1100.1.1",
+    "@pnpm/error": "1100.1.0",
+    "@pnpm/resolving.parse-wanted-dependency": "1100.0.2",
+    "@pnpm/types": "1101.7.0",
     "@yarnpkg/extensions": "2.0.6",
     "normalize-path": "^3.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "semver": "^7.8.4"
+    "semver": "^7.8.5"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/hooks.read-package-hook": "1100.1.2",
+    "@pnpm/hooks.read-package-hook": "1100.2.0",
     "@types/normalize-path": "^3.0.2",
-    "@types/ramda": "0.31.1",
+    "@types/ramda": "0.32.0",
     "@types/semver": "7.7.1",
-    "@yarnpkg/core": "4.8.0"
+    "@yarnpkg/core": "4.9.0"
   },
   "engines": {
     "node": ">=22.13"