@pnpm/installing.commands 1100.10.0 → 1100.10.2

package/lib/add.js

@@ -5,6 +5,7 @@ import { writeSettings } from '@pnpm/config.writer';
 import { PnpmError } from '@pnpm/error';
 import { handleGlobalAdd } from '@pnpm/global.commands';
 import { resolveConfigDeps } from '@pnpm/installing.env-installer';
+import { parseWantedDependency } from '@pnpm/resolving.parse-wanted-dependency';
 import { createStoreController } from '@pnpm/store.connection-manager';
 import { pick } from 'ramda';
 import { renderHelp } from 'render-help';
@@ -230,7 +231,12 @@ export async function handler(opts, params, commands) {
                 hint: 'Run "pnpm setup" to create it automatically, or set the global-bin-dir setting, or the PNPM_HOME env variable. The global bin directory should be in the PATH.',
             });
         }
-        if (params.includes('pnpm') || params.includes('@pnpm/exe')) {
+        // Normalize each selector to its package name first, so versioned
+        // forms like `pnpm@9` or `@pnpm/exe@1` can't bypass the guard.
+        if (params.some((param) => {
+            const { alias } = parseWantedDependency(param);
+            return alias === 'pnpm' || alias === '@pnpm/exe';
+        })) {
             throw new PnpmError('GLOBAL_PNPM_INSTALL', 'Use the "pnpm self-update" command to install or update pnpm');
         }
         return handleGlobalAdd({

package/lib/handleIgnoredBuilds.d.ts

@@ -1,6 +1,7 @@
 import type { IgnoredBuilds } from '@pnpm/types';
 export interface HandleIgnoredBuildsOpts {
     allowBuilds?: Record<string, boolean | string>;
+    ignoreWorkspace?: boolean;
     rootProjectManifestDir?: string;
     workspaceDir?: string;
     strictDepBuilds?: boolean;

package/lib/handleIgnoredBuilds.js

@@ -5,7 +5,9 @@ import { lexCompare } from '@pnpm/util.lex-comparator';
 export async function handleIgnoredBuilds(opts, ignoredBuilds) {
     if (!ignoredBuilds?.size)
         return;
-    await writeIgnoredBuildsToAllowBuilds(opts, ignoredBuilds);
+    if (!opts.ignoreWorkspace) {
+        await writeIgnoredBuildsToAllowBuilds(opts, ignoredBuilds);
+    }
     if (opts.strictDepBuilds) {
         throw new IgnoredBuildsError(ignoredBuilds);
     }

package/lib/installDeps.d.ts

@@ -4,7 +4,7 @@ import { type DryRunInstallResult, type UpdateMatchingFunction } from '@pnpm/ins
 import type { LockfileObject } from '@pnpm/lockfile.types';
 import { type CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import type { IncludedDependencies, PackageVulnerabilityAudit } from '@pnpm/types';
-export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'pnprServer' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & Partial<Pick<Config, 'ci'>> & CreateStoreControllerOptions & {
+export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'pnprServer' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspace' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & Partial<Pick<Config, 'ci'>> & CreateStoreControllerOptions & {
     argv: {
         cooked?: string[];
         original: string[];
@@ -50,3 +50,13 @@ export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin
     isInstallCommand?: boolean;
 } & Partial<Pick<Config, 'dryRun' | 'pnpmHomeDir' | 'strictDepBuilds' | 'useLockfile' | 'useGitBranchLockfile' | 'mergeGitBranchLockfiles'>>;
 export declare function installDeps(opts: InstallDepsOptions, params: string[]): Promise<DryRunInstallResult | undefined>;
+/**
+ * The `updateMatching` predicate of `pnpm audit --fix`: a package is an
+ * update target when its resolved version is vulnerable. The resolver calls
+ * it without a version when the edge has no lockfile reference — e.g. after
+ * the vulnerable pin was widened, which forgets the reference — so a
+ * version-less call matches by name against the vulnerable set: such an
+ * edge belongs to a package under vulnerability management and must
+ * re-resolve without its seeded lockfile pins.
+ */
+export declare function createVulnerabilityUpdateMatching(packageVulnerabilityAudit: PackageVulnerabilityAudit): UpdateMatchingFunction;

package/lib/installDeps.js

@@ -7,7 +7,7 @@ import { PnpmError } from '@pnpm/error';
 import { arrayOfWorkspacePackagesToMap } from '@pnpm/installing.context';
 import { install, mutateModulesInSingleProject, } from '@pnpm/installing.deps-installer';
 import { writeWantedLockfile } from '@pnpm/lockfile.fs';
-import { globalInfo, logger } from '@pnpm/logger';
+import { globalInfo, globalWarn, logger } from '@pnpm/logger';
 import { applyRuntimeOnFailOverride, filterDependenciesByType } from '@pnpm/pkg-manifest.utils';
 import { createStoreController } from '@pnpm/store.connection-manager';
 import { filterProjectsBySelectorObjects } from '@pnpm/workspace.projects-filter';
@@ -20,7 +20,7 @@ import { getPinnedVersion } from './getPinnedVersion.js';
 import { getSaveType } from './getSaveType.js';
 import { handleIgnoredBuilds } from './handleIgnoredBuilds.js';
 import { setupPolicyHandlers } from './policyHandlers.js';
-import { createMatcher, makeIgnorePatterns, matchDependencies, recursive, } from './recursive.js';
+import { createMatcher, makeIgnorePatterns, matchDependencies, parseUpdateParam, recursive, } from './recursive.js';
 import { makeRunPacquet } from './runPacquet.js';
 import { createWorkspaceSpecs, updateToWorkspacePackagesFromManifest } from './updateWorkspaceDependencies.js';
 import { verifyPacquetIdentity } from './verifyPacquetIdentity.js';
@@ -202,10 +202,10 @@ export async function installDeps(opts, params) {
     }
     if (opts.packageVulnerabilityAudit != null) {
         updateMatch = null;
-        const { packageVulnerabilityAudit } = opts;
-        updateMatching = (pkgName, version) => version != null && packageVulnerabilityAudit.isVulnerable(pkgName, version);
+        updateMatching = createVulnerabilityUpdateMatching(opts.packageVulnerabilityAudit);
     }
     if (updateMatch != null) {
+        const updateSpecs = params;
         params = matchDependencies(updateMatch, manifest, includeDirect);
         if (params.length === 0) {
             if (opts.latest)
@@ -217,6 +217,7 @@ export async function installDeps(opts, params) {
             // Don't update package.json in this case, and limit updates to only matching dependencies
             updatePackageManifest = false;
             updateMatching = (pkgName) => updateMatch(pkgName) != null;
+            warnAboutIgnoredVersionsOfIndirectUpdateSpecs(updateSpecs);
         }
     }
     if (opts.update && opts.latest && (!params || (params.length === 0))) {
@@ -402,6 +403,40 @@ function getVulnerabilityPenalty(severity) {
         default: return -1100;
     }
 }
+/**
+ * `pnpm update <dep>@<version>` where `<dep>` matches only transitive
+ * dependencies has no manifest entry to write the version into, and an
+ * update resolves the target the same way a fresh install would — which a
+ * command-line version cannot influence. Tell the user the version part is
+ * ignored, and that an override is the mechanism that does pin a
+ * transitive dependency. The recommended override is scoped to the
+ * dependents' declared range so it cannot violate any consumer's range;
+ * the range itself is not known at this layer (it lives in the dependents'
+ * manifests), hence the placeholder.
+ */
+function warnAboutIgnoredVersionsOfIndirectUpdateSpecs(updateSpecs) {
+    for (const spec of updateSpecs) {
+        const { pattern, versionSpec } = parseUpdateParam(spec);
+        if (versionSpec == null)
+            continue;
+        globalWarn(`"${pattern}" is not a direct dependency, so the requested version "${versionSpec}" is ignored — "${pattern}" is updated to what a fresh install would resolve. To force a version of a transitive dependency, add an override scoped to the range its dependents declare to pnpm-workspace.yaml, e.g.: overrides: { "${pattern}@<declared range>": "${versionSpec}" }`);
+    }
+}
+/**
+ * The `updateMatching` predicate of `pnpm audit --fix`: a package is an
+ * update target when its resolved version is vulnerable. The resolver calls
+ * it without a version when the edge has no lockfile reference — e.g. after
+ * the vulnerable pin was widened, which forgets the reference — so a
+ * version-less call matches by name against the vulnerable set: such an
+ * edge belongs to a package under vulnerability management and must
+ * re-resolve without its seeded lockfile pins.
+ */
+export function createVulnerabilityUpdateMatching(packageVulnerabilityAudit) {
+    const vulnerablePackageNames = new Set(packageVulnerabilityAudit.getVulnerabilities().keys());
+    return (pkgName, version) => version != null
+        ? packageVulnerabilityAudit.isVulnerable(pkgName, version)
+        : vulnerablePackageNames.has(pkgName);
+}
 function preferNonvulnerablePackageVersions(packageVulnerabilityAudit) {
     const preferredVersions = {};
     for (const [packageName, vulnerabilities] of packageVulnerabilityAudit.getVulnerabilities()) {

package/lib/policyHandlers.js

@@ -1,4 +1,5 @@
 import { confirm } from '@inquirer/prompts';
+import { mergePackageVersionSpecs } from '@pnpm/config.version-policy';
 import { PnpmError } from '@pnpm/error';
 import { globalInfo } from '@pnpm/logger';
 import { MINIMUM_RELEASE_AGE_VIOLATION_CODE } from '@pnpm/resolving.npm-resolver';
@@ -120,7 +121,12 @@ function pickImmatureEntries(violations, promptRequired) {
     const immature = filterImmatureViolations(violations);
     if (immature.length === 0)
         return undefined;
-    const sorted = [...new Set(immature.map((v) => `${v.name}@${v.version}`))].sort();
+    // Combine into the canonical per-package form the workspace writer
+    // persists (`name@v1 || v2`), so the logged count and list match the
+    // entries that actually land in pnpm-workspace.yaml even when multiple
+    // immature versions belong to the same package. The pre-sort keeps the
+    // cross-package order stable regardless of resolution order.
+    const entries = mergePackageVersionSpecs(immature.map((v) => `${v.name}@${v.version}`).sort());
     // Strict-mode picks already passed through the approval prompt, so
     // the log here only confirms what was persisted. Loose-mode picks
     // haven't been announced anywhere else, so the same log doubles as
@@ -128,9 +134,9 @@ function pickImmatureEntries(violations, promptRequired) {
     const reason = promptRequired
         ? '(approved at the prompt)'
         : '(set minimumReleaseAgeStrict to true to gate these updates with a prompt)';
-    globalInfo(`Added ${sorted.length} ${sorted.length === 1 ? 'entry' : 'entries'} to minimumReleaseAgeExclude in pnpm-workspace.yaml ` +
-        `${reason}:\n  ${sorted.join('\n  ')}`);
-    return sorted;
+    globalInfo(`Added ${entries.length} ${entries.length === 1 ? 'entry' : 'entries'} to minimumReleaseAgeExclude in pnpm-workspace.yaml ` +
+        `${reason}:\n  ${entries.join('\n  ')}`);
+    return entries;
 }
 function failOnImmature(immature) {
     const sorted = [...immature].sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));

package/lib/runPacquet.js

@@ -126,13 +126,14 @@ function makePacquetEnv(opts) {
 }
 /**
  * Path of the platform-specific native pacquet binary for the host. The
- * pacquet npm package ships a Node wrapper at `bin/pacquet` that uses
- * `require.resolve('@pacquet/<platform>-<arch>/pacquet[.exe]')` to find
- * the binary — so the platform package lands as a *sibling* of pacquet,
- * not inside its own `node_modules` (pacquet's own `node_modules` is
- * empty after configDependencies install). Use Node's resolver rooted
- * at pacquet's own `package.json` so we follow the same path the
- * wrapper would have.
+ * pacquet npm package declares the `@pacquet/<platform>-<arch>` binary as
+ * an `optionalDependency`, so it lands as a *sibling* of pacquet, not
+ * inside its own `node_modules` (pacquet's own `node_modules` is empty
+ * after configDependencies install). Resolve it directly here rather than
+ * through pacquet's `bin/pacquet`, which is only a placeholder until the
+ * package's preinstall relinks it to the native binary — a step that does
+ * not run for configDependencies. Use Node's resolver rooted at pacquet's
+ * own `package.json` so we find the same sibling package.
  *
  * The `realpathSync` is required: `.pnpm-config/pacquet` is a symlink
  * into the global virtual store, and Node's `createRequire` builds its

package/lib/update/index.js

@@ -10,7 +10,7 @@ import { globalInfo } from '@pnpm/logger';
 import chalk from 'chalk';
 import { pick, unnest } from 'ramda';
 import { renderHelp } from 'render-help';
-import { installDeps } from '../installDeps.js';
+import { createVulnerabilityUpdateMatching, installDeps } from '../installDeps.js';
 import { parseUpdateParam } from '../recursive.js';
 import { createGlobalPolicyCallbacks } from '../resolutionPolicyManifest.js';
 import { getUpdateChoices } from './getUpdateChoices.js';
@@ -276,8 +276,7 @@ async function update(dependencies, opts, rebuildHandler) {
     const depth = opts.depth ?? Infinity;
     let updateMatching;
     if (opts.packageVulnerabilityAudit != null) {
-        const { packageVulnerabilityAudit } = opts;
-        updateMatching = (pkgName, version) => version != null && packageVulnerabilityAudit.isVulnerable(pkgName, version);
+        updateMatching = createVulnerabilityUpdateMatching(opts.packageVulnerabilityAudit);
     }
     else if ((dependencies.length > 0) && dependencies.every(dep => !dep.substring(1).includes('@')) && depth > 0 && !opts.latest) {
         updateMatching = createMatcher(dependencies);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.commands",
-  "version": "1100.10.0",
+  "version": "1100.10.2",
   "description": "Commands for installation",
   "keywords": [
     "pnpm",
@@ -10,9 +10,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/installing/commands"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/installing/commands"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/installing/commands#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/installing/commands#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -38,7 +38,6 @@
     "chalk": "^5.6.2",
     "ci-info": "^4.4.0",
     "detect-libc": "^2.1.2",
-    "get-npm-tarball-url": "^2.1.0",
     "is-subdir": "^2.0.0",
     "js-yaml": "npm:@zkochan/js-yaml@0.0.11",
     "load-json-file": "^7.0.1",
@@ -48,53 +47,54 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "version-selector-type": "^3.0.0",
-    "@pnpm/building.after-install": "1102.0.1",
-    "@pnpm/building.policy": "1100.0.10",
-    "@pnpm/catalogs.config": "1100.0.1",
+    "@pnpm/building.policy": "1100.0.11",
+    "@pnpm/catalogs.config": "1100.0.2",
     "@pnpm/cli.command": "1100.0.1",
+    "@pnpm/building.after-install": "1102.0.3",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/cli.utils": "1101.0.13",
     "@pnpm/cli.common-cli-options-help": "1100.0.2",
-    "@pnpm/cli.utils": "1101.0.12",
     "@pnpm/config.matcher": "1100.0.1",
     "@pnpm/config.pick-registry-for-package": "1100.0.9",
-    "@pnpm/config.reader": "1101.10.0",
-    "@pnpm/config.writer": "1100.0.13",
+    "@pnpm/config.reader": "1101.11.0",
+    "@pnpm/config.writer": "1100.0.15",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.inspection.outdated": "1100.1.9",
+    "@pnpm/deps.security.signatures": "1101.2.3",
+    "@pnpm/config.version-policy": "1100.1.6",
     "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/deps.status": "1100.1.2",
-    "@pnpm/deps.security.signatures": "1101.2.2",
-    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/error": "1100.0.1",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/global.commands": "1100.0.29",
+    "@pnpm/deps.status": "1100.1.4",
+    "@pnpm/deps.inspection.outdated": "1100.1.11",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/hooks.pnpmfile": "1100.0.15",
-    "@pnpm/installing.dedupe.check": "1100.1.0",
+    "@pnpm/hooks.pnpmfile": "1100.0.17",
+    "@pnpm/global.commands": "1100.0.31",
+    "@pnpm/installing.dedupe.check": "1100.1.2",
     "@pnpm/installing.dedupe.issues-renderer": "1100.0.1",
-    "@pnpm/installing.deps-installer": "1102.1.0",
-    "@pnpm/installing.context": "1100.0.19",
-    "@pnpm/lockfile.fs": "1100.1.6",
-    "@pnpm/lockfile.types": "1100.0.11",
-    "@pnpm/installing.env-installer": "1102.0.1",
-    "@pnpm/network.fetch": "1100.1.3",
-    "@pnpm/pkg-manifest.reader": "1100.0.8",
-    "@pnpm/network.auth-header": "1101.1.2",
+    "@pnpm/installing.context": "1100.0.21",
+    "@pnpm/installing.deps-installer": "1102.2.0",
+    "@pnpm/lockfile.fs": "1100.1.8",
+    "@pnpm/network.auth-header": "1101.1.3",
+    "@pnpm/installing.env-installer": "1102.0.3",
+    "@pnpm/network.fetch": "1100.1.4",
+    "@pnpm/lockfile.types": "1100.0.13",
+    "@pnpm/pkg-manifest.reader": "1100.0.9",
+    "@pnpm/pkg-manifest.utils": "1100.2.6",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/resolving.npm-resolver": "1102.0.1",
-    "@pnpm/store.connection-manager": "1100.3.1",
-    "@pnpm/resolving.resolver-base": "1100.4.2",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
-    "@pnpm/pkg-manifest.utils": "1100.2.5",
+    "@pnpm/store.connection-manager": "1100.3.3",
+    "@pnpm/resolving.npm-resolver": "1102.1.1",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
+    "@pnpm/store.controller": "1102.0.3",
     "@pnpm/types": "1101.3.2",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.14",
     "@pnpm/workspace.project-manifest-writer": "1100.0.8",
-    "@pnpm/workspace.projects-sorter": "1100.0.7",
-    "@pnpm/workspace.projects-graph": "1100.0.19",
-    "@pnpm/workspace.projects-reader": "1101.0.12",
-    "@pnpm/workspace.state": "1100.0.23",
-    "@pnpm/workspace.projects-filter": "1100.0.22",
-    "@pnpm/workspace.root-finder": "1100.0.2",
-    "@pnpm/store.controller": "1102.0.1",
-    "@pnpm/workspace.workspace-manifest-writer": "1100.0.13"
+    "@pnpm/workspace.projects-filter": "1100.0.24",
+    "@pnpm/workspace.projects-graph": "1100.0.21",
+    "@pnpm/workspace.projects-reader": "1101.0.13",
+    "@pnpm/workspace.root-finder": "1100.0.3",
+    "@pnpm/workspace.projects-sorter": "1100.0.8",
+    "@pnpm/workspace.state": "1100.0.25",
+    "@pnpm/workspace.workspace-manifest-writer": "1100.0.15"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
@@ -117,19 +117,19 @@
     "write-json-file": "^7.0.0",
     "write-package": "7.2.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/installing.commands": "1100.10.0",
-    "@pnpm/installing.modules-yaml": "1100.0.9",
+    "@pnpm/assert-project": "1100.0.18",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/assert-project": "1100.0.16",
-    "@pnpm/store.index": "1100.2.0",
-    "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/prepare": "1100.0.16",
-    "@pnpm/testing.registry-mock": "1100.0.6",
-    "@pnpm/testing.command-defaults": "1100.0.6",
-    "@pnpm/testing.mock-agent": "1101.0.3",
+    "@pnpm/installing.modules-yaml": "1100.0.9",
+    "@pnpm/installing.commands": "1100.10.2",
+    "@pnpm/store.index": "1100.2.1",
+    "@pnpm/prepare": "1100.0.18",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/worker": "1100.2.1",
-    "@pnpm/workspace.projects-filter": "1100.0.22"
+    "@pnpm/testing.command-defaults": "1100.0.8",
+    "@pnpm/testing.mock-agent": "1101.0.4",
+    "@pnpm/testing.registry-mock": "1100.0.8",
+    "@pnpm/test-ipc-server": "1100.0.0",
+    "@pnpm/worker": "1100.2.3",
+    "@pnpm/workspace.projects-filter": "1100.0.24"
   },
   "engines": {
     "node": ">=22.13"