@pnpm/installing.commands 1100.10.1 → 1100.10.3

package/lib/add.js

@@ -5,6 +5,7 @@ import { writeSettings } from '@pnpm/config.writer';
 import { PnpmError } from '@pnpm/error';
 import { handleGlobalAdd } from '@pnpm/global.commands';
 import { resolveConfigDeps } from '@pnpm/installing.env-installer';
+import { parseWantedDependency } from '@pnpm/resolving.parse-wanted-dependency';
 import { createStoreController } from '@pnpm/store.connection-manager';
 import { pick } from 'ramda';
 import { renderHelp } from 'render-help';
@@ -230,7 +231,12 @@ export async function handler(opts, params, commands) {
                 hint: 'Run "pnpm setup" to create it automatically, or set the global-bin-dir setting, or the PNPM_HOME env variable. The global bin directory should be in the PATH.',
             });
         }
-        if (params.includes('pnpm') || params.includes('@pnpm/exe')) {
+        // Normalize each selector to its package name first, so versioned
+        // forms like `pnpm@9` or `@pnpm/exe@1` can't bypass the guard.
+        if (params.some((param) => {
+            const { alias } = parseWantedDependency(param);
+            return alias === 'pnpm' || alias === '@pnpm/exe';
+        })) {
             throw new PnpmError('GLOBAL_PNPM_INSTALL', 'Use the "pnpm self-update" command to install or update pnpm');
         }
         return handleGlobalAdd({

package/lib/installDeps.d.ts

@@ -50,3 +50,13 @@ export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin
     isInstallCommand?: boolean;
 } & Partial<Pick<Config, 'dryRun' | 'pnpmHomeDir' | 'strictDepBuilds' | 'useLockfile' | 'useGitBranchLockfile' | 'mergeGitBranchLockfiles'>>;
 export declare function installDeps(opts: InstallDepsOptions, params: string[]): Promise<DryRunInstallResult | undefined>;
+/**
+ * The `updateMatching` predicate of `pnpm audit --fix`: a package is an
+ * update target when its resolved version is vulnerable. The resolver calls
+ * it without a version when the edge has no lockfile reference — e.g. after
+ * the vulnerable pin was widened, which forgets the reference — so a
+ * version-less call matches by name against the vulnerable set: such an
+ * edge belongs to a package under vulnerability management and must
+ * re-resolve without its seeded lockfile pins.
+ */
+export declare function createVulnerabilityUpdateMatching(packageVulnerabilityAudit: PackageVulnerabilityAudit): UpdateMatchingFunction;

package/lib/installDeps.js

@@ -7,7 +7,7 @@ import { PnpmError } from '@pnpm/error';
 import { arrayOfWorkspacePackagesToMap } from '@pnpm/installing.context';
 import { install, mutateModulesInSingleProject, } from '@pnpm/installing.deps-installer';
 import { writeWantedLockfile } from '@pnpm/lockfile.fs';
-import { globalInfo, logger } from '@pnpm/logger';
+import { globalInfo, globalWarn, logger } from '@pnpm/logger';
 import { applyRuntimeOnFailOverride, filterDependenciesByType } from '@pnpm/pkg-manifest.utils';
 import { createStoreController } from '@pnpm/store.connection-manager';
 import { filterProjectsBySelectorObjects } from '@pnpm/workspace.projects-filter';
@@ -20,7 +20,7 @@ import { getPinnedVersion } from './getPinnedVersion.js';
 import { getSaveType } from './getSaveType.js';
 import { handleIgnoredBuilds } from './handleIgnoredBuilds.js';
 import { setupPolicyHandlers } from './policyHandlers.js';
-import { createMatcher, makeIgnorePatterns, matchDependencies, recursive, } from './recursive.js';
+import { createMatcher, makeIgnorePatterns, matchDependencies, parseUpdateParam, recursive, } from './recursive.js';
 import { makeRunPacquet } from './runPacquet.js';
 import { createWorkspaceSpecs, updateToWorkspacePackagesFromManifest } from './updateWorkspaceDependencies.js';
 import { verifyPacquetIdentity } from './verifyPacquetIdentity.js';
@@ -202,10 +202,10 @@ export async function installDeps(opts, params) {
     }
     if (opts.packageVulnerabilityAudit != null) {
         updateMatch = null;
-        const { packageVulnerabilityAudit } = opts;
-        updateMatching = (pkgName, version) => version != null && packageVulnerabilityAudit.isVulnerable(pkgName, version);
+        updateMatching = createVulnerabilityUpdateMatching(opts.packageVulnerabilityAudit);
     }
     if (updateMatch != null) {
+        const updateSpecs = params;
         params = matchDependencies(updateMatch, manifest, includeDirect);
         if (params.length === 0) {
             if (opts.latest)
@@ -217,6 +217,7 @@ export async function installDeps(opts, params) {
             // Don't update package.json in this case, and limit updates to only matching dependencies
             updatePackageManifest = false;
             updateMatching = (pkgName) => updateMatch(pkgName) != null;
+            warnAboutIgnoredVersionsOfIndirectUpdateSpecs(updateSpecs);
         }
     }
     if (opts.update && opts.latest && (!params || (params.length === 0))) {
@@ -402,6 +403,40 @@ function getVulnerabilityPenalty(severity) {
         default: return -1100;
     }
 }
+/**
+ * `pnpm update <dep>@<version>` where `<dep>` matches only transitive
+ * dependencies has no manifest entry to write the version into, and an
+ * update resolves the target the same way a fresh install would — which a
+ * command-line version cannot influence. Tell the user the version part is
+ * ignored, and that an override is the mechanism that does pin a
+ * transitive dependency. The recommended override is scoped to the
+ * dependents' declared range so it cannot violate any consumer's range;
+ * the range itself is not known at this layer (it lives in the dependents'
+ * manifests), hence the placeholder.
+ */
+function warnAboutIgnoredVersionsOfIndirectUpdateSpecs(updateSpecs) {
+    for (const spec of updateSpecs) {
+        const { pattern, versionSpec } = parseUpdateParam(spec);
+        if (versionSpec == null)
+            continue;
+        globalWarn(`"${pattern}" is not a direct dependency, so the requested version "${versionSpec}" is ignored — "${pattern}" is updated to what a fresh install would resolve. To force a version of a transitive dependency, add an override scoped to the range its dependents declare to pnpm-workspace.yaml, e.g.: overrides: { "${pattern}@<declared range>": "${versionSpec}" }`);
+    }
+}
+/**
+ * The `updateMatching` predicate of `pnpm audit --fix`: a package is an
+ * update target when its resolved version is vulnerable. The resolver calls
+ * it without a version when the edge has no lockfile reference — e.g. after
+ * the vulnerable pin was widened, which forgets the reference — so a
+ * version-less call matches by name against the vulnerable set: such an
+ * edge belongs to a package under vulnerability management and must
+ * re-resolve without its seeded lockfile pins.
+ */
+export function createVulnerabilityUpdateMatching(packageVulnerabilityAudit) {
+    const vulnerablePackageNames = new Set(packageVulnerabilityAudit.getVulnerabilities().keys());
+    return (pkgName, version) => version != null
+        ? packageVulnerabilityAudit.isVulnerable(pkgName, version)
+        : vulnerablePackageNames.has(pkgName);
+}
 function preferNonvulnerablePackageVersions(packageVulnerabilityAudit) {
     const preferredVersions = {};
     for (const [packageName, vulnerabilities] of packageVulnerabilityAudit.getVulnerabilities()) {

package/lib/runPacquet.js

@@ -126,13 +126,14 @@ function makePacquetEnv(opts) {
 }
 /**
  * Path of the platform-specific native pacquet binary for the host. The
- * pacquet npm package ships a Node wrapper at `bin/pacquet` that uses
- * `require.resolve('@pacquet/<platform>-<arch>/pacquet[.exe]')` to find
- * the binary — so the platform package lands as a *sibling* of pacquet,
- * not inside its own `node_modules` (pacquet's own `node_modules` is
- * empty after configDependencies install). Use Node's resolver rooted
- * at pacquet's own `package.json` so we follow the same path the
- * wrapper would have.
+ * pacquet npm package declares the `@pacquet/<platform>-<arch>` binary as
+ * an `optionalDependency`, so it lands as a *sibling* of pacquet, not
+ * inside its own `node_modules` (pacquet's own `node_modules` is empty
+ * after configDependencies install). Resolve it directly here rather than
+ * through pacquet's `bin/pacquet`, which is only a placeholder until the
+ * package's preinstall relinks it to the native binary — a step that does
+ * not run for configDependencies. Use Node's resolver rooted at pacquet's
+ * own `package.json` so we find the same sibling package.
  *
  * The `realpathSync` is required: `.pnpm-config/pacquet` is a symlink
  * into the global virtual store, and Node's `createRequire` builds its
@@ -197,16 +198,19 @@ function pacquetSupportsResolution(version) {
  * surface pnpm itself accepts on `install`, so the flags don't need
  * reshaping.
  *
- * Flags we always inject ourselves (`--frozen-lockfile`,
+ * Flags we manage ourselves (`--frozen-lockfile`,
  * `--ignore-manifest-check`) are dropped in every form the user can
  * type them — positive (`--frozen-lockfile`), negated
- * (`--no-frozen-lockfile`), and any `=value` form. Pacquet's clap
- * defines these as plain `#[clap(long)] bool` flags, so a duplicate
- * `--frozen-lockfile` or a conflicting `--no-frozen-lockfile`
- * crashes the parser with "used multiple times" / "unexpected
- * argument". The user's `--no-frozen-lockfile` intent is already
- * honored upstream (pnpm did a fresh resolve before delegating);
- * pacquet's role here is just lockfile-driven materialization.
+ * (`--no-frozen-lockfile`), and any `=value` form. pnpm resolves the
+ * frozen-lockfile setting itself and encodes the decision in the mode
+ * it hands pacquet: a resolving install (pacquet resolves and writes
+ * the lockfile, no `--frozen-lockfile` injected) or a frozen
+ * materialization (pacquet is pinned to the lockfile via an injected
+ * `--frozen-lockfile`) — see `frozenArgs` in `makeRun`. Forwarding the
+ * user's own token would contradict that choice: pacquet accepts a
+ * `--no-<flag>` negation for every boolean flag with last-one-wins
+ * override semantics, so a user `--no-frozen-lockfile` sitting next to
+ * our injected `--frozen-lockfile` would flip the pinning back off.
  *
  * `--reporter` is stripped in any form (`--reporter=foo`,
  * `--reporter foo`): pacquet's `reporter` is a clap value option

package/lib/update/index.js

@@ -10,7 +10,7 @@ import { globalInfo } from '@pnpm/logger';
 import chalk from 'chalk';
 import { pick, unnest } from 'ramda';
 import { renderHelp } from 'render-help';
-import { installDeps } from '../installDeps.js';
+import { createVulnerabilityUpdateMatching, installDeps } from '../installDeps.js';
 import { parseUpdateParam } from '../recursive.js';
 import { createGlobalPolicyCallbacks } from '../resolutionPolicyManifest.js';
 import { getUpdateChoices } from './getUpdateChoices.js';
@@ -276,8 +276,7 @@ async function update(dependencies, opts, rebuildHandler) {
     const depth = opts.depth ?? Infinity;
     let updateMatching;
     if (opts.packageVulnerabilityAudit != null) {
-        const { packageVulnerabilityAudit } = opts;
-        updateMatching = (pkgName, version) => version != null && packageVulnerabilityAudit.isVulnerable(pkgName, version);
+        updateMatching = createVulnerabilityUpdateMatching(opts.packageVulnerabilityAudit);
     }
     else if ((dependencies.length > 0) && dependencies.every(dep => !dep.substring(1).includes('@')) && depth > 0 && !opts.latest) {
         updateMatching = createMatcher(dependencies);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.commands",
-  "version": "1100.10.1",
+  "version": "1100.10.3",
   "description": "Commands for installation",
   "keywords": [
     "pnpm",
@@ -47,54 +47,54 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "version-selector-type": "^3.0.0",
-    "@pnpm/building.policy": "1100.0.11",
     "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/catalogs.config": "1100.0.2",
-    "@pnpm/cli.command": "1100.0.1",
-    "@pnpm/cli.utils": "1101.0.13",
-    "@pnpm/config.pick-registry-for-package": "1100.0.9",
+    "@pnpm/building.policy": "1100.0.12",
+    "@pnpm/building.after-install": "1102.0.4",
     "@pnpm/cli.common-cli-options-help": "1100.0.2",
-    "@pnpm/config.reader": "1101.10.1",
-    "@pnpm/building.after-install": "1102.0.2",
-    "@pnpm/config.writer": "1100.0.14",
-    "@pnpm/constants": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.1.6",
-    "@pnpm/deps.inspection.outdated": "1100.1.10",
     "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/config.pick-registry-for-package": "1100.0.9",
+    "@pnpm/config.reader": "1101.11.1",
+    "@pnpm/config.version-policy": "1100.1.6",
+    "@pnpm/config.writer": "1100.0.15",
+    "@pnpm/cli.utils": "1101.0.13",
+    "@pnpm/constants": "1100.0.0",
     "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/error": "1100.0.1",
     "@pnpm/deps.security.signatures": "1101.2.3",
+    "@pnpm/deps.inspection.outdated": "1100.1.12",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/global.commands": "1100.0.30",
-    "@pnpm/deps.status": "1100.1.3",
-    "@pnpm/hooks.pnpmfile": "1100.0.16",
-    "@pnpm/installing.context": "1100.0.20",
-    "@pnpm/installing.dedupe.check": "1100.1.1",
-    "@pnpm/installing.deps-installer": "1102.1.1",
+    "@pnpm/fs.read-modules-dir": "1100.0.1",
+    "@pnpm/global.commands": "1100.0.32",
+    "@pnpm/hooks.pnpmfile": "1100.0.17",
+    "@pnpm/installing.context": "1100.0.22",
+    "@pnpm/installing.dedupe.check": "1100.1.2",
+    "@pnpm/deps.status": "1100.1.5",
+    "@pnpm/installing.deps-installer": "1102.2.1",
+    "@pnpm/installing.env-installer": "1102.0.4",
+    "@pnpm/lockfile.fs": "1100.1.9",
     "@pnpm/installing.dedupe.issues-renderer": "1100.0.1",
-    "@pnpm/lockfile.types": "1100.0.12",
-    "@pnpm/lockfile.fs": "1100.1.7",
-    "@pnpm/network.fetch": "1100.1.4",
     "@pnpm/network.auth-header": "1101.1.3",
+    "@pnpm/network.fetch": "1100.1.4",
+    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
     "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/installing.env-installer": "1102.0.2",
     "@pnpm/pkg-manifest.utils": "1100.2.6",
-    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/store.controller": "1102.0.2",
-    "@pnpm/resolving.npm-resolver": "1102.1.0",
-    "@pnpm/store.connection-manager": "1100.3.2",
-    "@pnpm/resolving.resolver-base": "1100.5.0",
-    "@pnpm/types": "1101.3.2",
-    "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/workspace.project-manifest-writer": "1100.0.8",
-    "@pnpm/workspace.projects-filter": "1100.0.23",
+    "@pnpm/store.connection-manager": "1100.3.4",
+    "@pnpm/store.controller": "1102.0.3",
+    "@pnpm/lockfile.types": "1100.0.13",
     "@pnpm/workspace.project-manifest-reader": "1100.0.14",
-    "@pnpm/workspace.projects-reader": "1101.0.13",
-    "@pnpm/workspace.projects-graph": "1100.0.20",
-    "@pnpm/workspace.state": "1100.0.24",
-    "@pnpm/workspace.projects-sorter": "1100.0.7",
+    "@pnpm/workspace.project-manifest-writer": "1100.0.8",
+    "@pnpm/workspace.projects-filter": "1100.0.25",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
+    "@pnpm/workspace.projects-sorter": "1100.0.8",
+    "@pnpm/resolving.npm-resolver": "1102.1.2",
     "@pnpm/workspace.root-finder": "1100.0.3",
-    "@pnpm/workspace.workspace-manifest-writer": "1100.0.14"
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/workspace.projects-reader": "1101.0.13",
+    "@pnpm/workspace.state": "1100.0.26",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/workspace.workspace-manifest-writer": "1100.0.15",
+    "@pnpm/cli.command": "1100.0.1",
+    "@pnpm/workspace.projects-graph": "1100.0.22"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
@@ -117,19 +117,19 @@
     "write-json-file": "^7.0.0",
     "write-package": "7.2.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/installing.modules-yaml": "1100.0.9",
-    "@pnpm/installing.commands": "1100.10.1",
-    "@pnpm/assert-project": "1100.0.17",
-    "@pnpm/store.index": "1100.2.1",
+    "@pnpm/assert-project": "1100.0.18",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.17",
-    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/store.index": "1100.2.1",
+    "@pnpm/prepare": "1100.0.18",
+    "@pnpm/installing.commands": "1100.10.3",
+    "@pnpm/testing.command-defaults": "1100.0.8",
     "@pnpm/test-ipc-server": "1100.0.0",
+    "@pnpm/test-fixtures": "1100.0.0",
     "@pnpm/testing.mock-agent": "1101.0.4",
-    "@pnpm/testing.registry-mock": "1100.0.7",
-    "@pnpm/testing.command-defaults": "1100.0.7",
-    "@pnpm/workspace.projects-filter": "1100.0.23",
-    "@pnpm/worker": "1100.2.2"
+    "@pnpm/worker": "1100.2.3",
+    "@pnpm/testing.registry-mock": "1100.0.8",
+    "@pnpm/workspace.projects-filter": "1100.0.25",
+    "@pnpm/installing.modules-yaml": "1100.0.9"
   },
   "engines": {
     "node": ">=22.13"