@pnpm/installing.commands 1100.2.2 → 1100.4.0

package/lib/add.js

@@ -10,6 +10,7 @@ import { pick } from 'ramda';
 import { renderHelp } from 'render-help';
 import { getFetchFullMetadata } from './getFetchFullMetadata.js';
 import { installDeps } from './installDeps.js';
+import { createGlobalPolicyCallbacks } from './resolutionPolicyManifest.js';
 export const shorthands = {
     'save-catalog': '--save-catalog-name=default',
     d: '--save-dev',
@@ -228,7 +229,10 @@ export async function handler(opts, params, commands) {
         if (params.includes('pnpm') || params.includes('@pnpm/exe')) {
             throw new PnpmError('GLOBAL_PNPM_INSTALL', 'Use the "pnpm self-update" command to install or update pnpm');
         }
-        return handleGlobalAdd(opts, params, commands ?? {});
+        return handleGlobalAdd({
+            ...opts,
+            ...createGlobalPolicyCallbacks(opts),
+        }, params, commands ?? {});
     }
     const include = {
         dependencies: opts.production !== false,

package/lib/fetch.js

@@ -58,6 +58,7 @@ export async function handler(opts) {
         pruneStore: true,
         storeController: store.ctrl,
         storeDir: store.dir,
+        resolutionVerifiers: store.resolutionVerifiers,
         // Hoisting is skipped anyway,
         // so we store these empty patterns in node_modules/.modules.yaml
         // to let the subsequent install know that hoisting should be performed.

package/lib/import/index.js

@@ -104,6 +104,7 @@ export async function handler(opts, params) {
         preferredVersions,
         storeController: store.ctrl,
         storeDir: store.dir,
+        resolutionVerifiers: store.resolutionVerifiers,
     };
     await install(manifest, installOpts);
 }

package/lib/install.js

@@ -79,6 +79,11 @@ export const cliOptionsTypes = () => ({
     'fix-lockfile': Boolean,
     'resolution-only': Boolean,
     recursive: Boolean,
+    // `--no-save` lets `pnpm install` skip writing to package.json /
+    // pnpm-workspace.yaml. Without registering it here, nopt drops the
+    // flag, `opts.save` stays undefined, and the auto-add path treats
+    // it as "save enabled".
+    save: Boolean,
 });
 export const shorthands = {
     D: '--dev',

package/lib/installDeps.d.ts

@@ -4,7 +4,7 @@ import { type UpdateMatchingFunction } from '@pnpm/installing.deps-installer';
 import type { LockfileObject } from '@pnpm/lockfile.types';
 import { type CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import type { IncludedDependencies, PackageVulnerabilityAudit } from '@pnpm/types';
-export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'agent' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & CreateStoreControllerOptions & {
+export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'agent' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & Partial<Pick<Config, 'ci'>> & CreateStoreControllerOptions & {
     argv: {
         original: string[];
     };

package/lib/installDeps.js

@@ -17,7 +17,9 @@ import { updateWorkspaceManifest } from '@pnpm/workspace.workspace-manifest-writ
 import { getPinnedVersion } from './getPinnedVersion.js';
 import { getSaveType } from './getSaveType.js';
 import { handleIgnoredBuilds } from './handleIgnoredBuilds.js';
+import { setupPolicyHandlers } from './policyHandlers.js';
 import { createMatcher, makeIgnorePatterns, matchDependencies, recursive, } from './recursive.js';
+import { makeRunPacquet } from './runPacquet.js';
 import { createWorkspaceSpecs, updateToWorkspacePackagesFromManifest } from './updateWorkspaceDependencies.js';
 const OVERWRITE_UPDATE_OPTIONS = {
     allowNew: true,
@@ -54,6 +56,29 @@ export async function installDeps(opts, params) {
         opts['preserveWorkspaceProtocol'] = !opts.linkWorkspacePackages;
     }
     const store = await createStoreController(opts);
+    // When `configDependencies` declares pacquet, build the alternative
+    // install engine the deps-installer delegates to. The CLI layer owns
+    // the construction so the installer doesn't need to know about
+    // pacquet's binary path, CLI surface, or any settings that only
+    // pacquet consumes. Threaded through both the workspace recursive
+    // path and the single-project path below. Two declaration names are
+    // accepted: the original unscoped `pacquet` and the official scoped
+    // `@pnpm/pacquet` mirror. Both packages ship the same JS shim and
+    // optional `@pacquet/<plat>-<arch>` binary sub-packages, so the
+    // resolved \`node_modules/.pnpm-config/<name>\` layout pacquet's
+    // wrapper expects is identical either way.
+    const pacquetConfigDepName = opts.configDependencies?.['@pnpm/pacquet'] != null
+        ? '@pnpm/pacquet'
+        : opts.configDependencies?.pacquet != null
+            ? 'pacquet'
+            : undefined;
+    const runPacquet = pacquetConfigDepName != null
+        ? makeRunPacquet({
+            lockfileDir: opts.lockfileDir ?? opts.dir,
+            packageName: pacquetConfigDepName,
+            argv: opts.argv.original,
+        })
+        : undefined;
     const includeDirect = opts.includeDirect ?? {
         dependencies: true,
         devDependencies: true,
@@ -94,6 +119,7 @@ export async function installDeps(opts, params) {
                 selectedProjectsGraph,
                 storeControllerAndDir: store,
                 workspaceDir: opts.workspaceDir,
+                runPacquet,
             }, opts.update ? 'update' : (params.length === 0 ? 'install' : 'add'));
             return;
         }
@@ -115,6 +141,12 @@ export async function installDeps(opts, params) {
     else if (opts.runtimeOnFail) {
         applyRuntimeOnFailOverride(manifest, opts.runtimeOnFail);
     }
+    // `setupPolicyHandlers` composes the per-policy handlers the install
+    // needs for the current opts (today: minimumReleaseAge; future:
+    // trustPolicy UX, license policy, etc.). Returns `undefined` when no
+    // handler is active so the install skips the empty no-op call at
+    // every checkpoint when no policies are configured.
+    const policyHandlers = setupPolicyHandlers(opts);
     const installOpts = {
         ...opts,
         // In case installation is done in a multi-package repository
@@ -127,8 +159,11 @@ export async function installDeps(opts, params) {
         skipRuntimes: opts.runtime === false,
         storeController: store.ctrl,
         storeDir: store.dir,
+        resolutionVerifiers: store.resolutionVerifiers,
         workspacePackages,
         preferredVersions: opts.packageVulnerabilityAudit ? preferNonvulnerablePackageVersions(opts.packageVulnerabilityAudit) : undefined,
+        handleResolutionPolicyViolations: policyHandlers?.handleResolutionPolicyViolations,
+        runPacquet,
     };
     let updateMatch;
     let updatePackageManifest = opts.updatePackageManifest;
@@ -187,14 +222,20 @@ export async function installDeps(opts, params) {
             rootDir: opts.dir,
             targetDependenciesField: getSaveType(opts),
         };
-        const { updatedCatalogs, updatedProject, ignoredBuilds } = await mutateModulesInSingleProject(mutatedProject, installOpts);
+        const { updatedCatalogs, updatedProject, ignoredBuilds, resolutionPolicyViolations } = await mutateModulesInSingleProject(mutatedProject, installOpts);
         if (opts.save !== false) {
+            // Only pick entries when we'll actually persist. Otherwise the
+            // info log would claim we added entries the workspace manifest
+            // never saw, and the next install would re-prompt or fail
+            // verification.
+            const policyUpdates = policyHandlers?.pickManifestUpdates(resolutionPolicyViolations);
             await Promise.all([
                 writeProjectManifest(updatedProject.manifest),
                 updateWorkspaceManifest(opts.workspaceDir ?? opts.dir, {
                     updatedCatalogs,
                     cleanupUnusedCatalogs: opts.cleanupUnusedCatalogs,
                     allProjects: opts.allProjects,
+                    ...policyUpdates,
                 }),
             ]);
         }
@@ -211,20 +252,35 @@ export async function installDeps(opts, params) {
         await handleIgnoredBuilds(opts, ignoredBuilds);
         return;
     }
-    const { updatedCatalogs, updatedManifest, ignoredBuilds } = await install(manifest, {
+    const { updatedCatalogs, updatedManifest, ignoredBuilds, resolutionPolicyViolations } = await install(manifest, {
         ...installOpts,
         updatePackageManifest,
         updateMatching,
     });
-    if (opts.update === true && opts.save !== false) {
-        await Promise.all([
-            writeProjectManifest(updatedManifest),
-            updateWorkspaceManifest(opts.workspaceDir ?? opts.dir, {
-                updatedCatalogs,
-                cleanupUnusedCatalogs: opts.cleanupUnusedCatalogs,
-                allProjects,
-            }),
-        ]);
+    // `opts.save === false` (e.g. `--no-save`) means "don't persist anything
+    // from this install" — both package.json and the workspace manifest.
+    // Skip the pick so the info log doesn't claim entries were added that
+    // were never written; the next install will resurface them.
+    if (opts.save !== false) {
+        const policyUpdates = policyHandlers?.pickManifestUpdates(resolutionPolicyViolations);
+        if (opts.update === true) {
+            await Promise.all([
+                writeProjectManifest(updatedManifest),
+                updateWorkspaceManifest(opts.workspaceDir ?? opts.dir, {
+                    updatedCatalogs,
+                    cleanupUnusedCatalogs: opts.cleanupUnusedCatalogs,
+                    allProjects,
+                    ...policyUpdates,
+                }),
+            ]);
+        }
+        else if (policyUpdates != null) {
+            // Plain `pnpm install` (no --update, no params) wouldn't otherwise touch
+            // the workspace manifest. Persist the auto-policy patches anyway so any
+            // loose bypass (today: minimumReleaseAgeExclude) remains explicit on
+            // subsequent installs.
+            await updateWorkspaceManifest(opts.workspaceDir ?? opts.dir, policyUpdates);
+        }
     }
     await handleIgnoredBuilds(opts, ignoredBuilds);
     if (opts.linkWorkspacePackages && opts.workspaceDir) {
@@ -243,6 +299,7 @@ export async function installDeps(opts, params) {
             allProjectsGraph: opts.allProjectsGraph,
             selectedProjectsGraph,
             workspaceDir: opts.workspaceDir, // Otherwise TypeScript doesn't understand that is not undefined
+            runPacquet,
         }, 'install');
         if (opts.ignoreScripts)
             return;

package/lib/link.js

@@ -69,6 +69,9 @@ This might cause issues in your project. To resolve this, you may use the "file:
     }
 }
 export async function handler(opts, params) {
+    if ((params == null) || (params.length === 0)) {
+        throw new PnpmError('LINK_BAD_PARAMS', 'You must provide a parameter. Usage: pnpm link <dir>');
+    }
     let workspacePackagesArr;
     let workspacePackages;
     if (opts.workspaceDir) {
@@ -87,9 +90,6 @@ export async function handler(opts, params) {
         binsDir: opts.bin,
     });
     const writeProjectManifest = await createProjectManifestWriter(opts.rootProjectManifestDir);
-    if ((params == null) || (params.length === 0)) {
-        throw new PnpmError('LINK_BAD_PARAMS', 'You must provide a parameter. Usage: pnpm link <dir>');
-    }
     const [pkgPaths, pkgNames] = partition((inp) => isFilespec.test(inp), params);
     if (pkgNames.length > 0) {
         throw new PnpmError('LINK_BAD_PARAMS', `Cannot link by package name. Use a relative or absolute path instead, e.g. "pnpm link ./${pkgNames[0]}"`);

package/lib/policyHandlers.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Shape returned by `installing/deps-installer`'s
+ * `collectResolutionPolicyViolations` and the inline accumulator on
+ * the resolveDependencies result. Re-declared locally so the commands
+ * layer can react without depending on the deps-installer's private
+ * install types.
+ *
+ * Verifier codes (today: `MINIMUM_RELEASE_AGE_VIOLATION` and
+ * `TRUST_DOWNGRADE`) are the contract surface for downstream UX.
+ * Each `PolicyHandler` below filters violations by code to decide
+ * what to do with them (prompt, persist to an exclude list, log,
+ * abort).
+ */
+export interface PolicyViolation {
+    name: string;
+    version: string;
+    code: string;
+    reason: string;
+}
+/**
+ * Workspace-manifest patch a per-policy handler can request. Each
+ * field maps to a `pnpm-workspace.yaml` exclude-list array; the
+ * install command forwards these to `updateWorkspaceManifest` so the
+ * workspace writer dedupes and appends them in one pass.
+ *
+ * New policies that want auto-persistence add their field here AND
+ * teach `updateWorkspaceManifest` how to honor it.
+ */
+export interface WorkspaceManifestPolicyUpdates {
+    addedMinimumReleaseAgeExcludes?: string[];
+}
+/**
+ * Aggregated plan the install command consumes. The `handleResolutionPolicyViolations`
+ * call fans out across every registered handler in registration order;
+ * any handler can throw to abort. `pickManifestUpdates` merges the
+ * per-handler patches into one bag so the workspace writer runs once.
+ */
+export interface PolicyHandlersPlan {
+    handleResolutionPolicyViolations: (violations: readonly PolicyViolation[]) => Promise<void>;
+    pickManifestUpdates: (violations: readonly PolicyViolation[]) => WorkspaceManifestPolicyUpdates | undefined;
+}
+export interface PolicyHandlersOptions {
+    minimumReleaseAge?: number;
+    minimumReleaseAgeStrict?: boolean;
+    /**
+     * Pass `false` for `--no-save` installs. Handlers that would
+     * persist to the workspace manifest refuse to enter modes where
+     * approval is durably required (today: strict minimumReleaseAge)
+     * so the prompt never offers an action it can't honor.
+     */
+    save?: boolean;
+    /**
+     * Override for CI detection. Defaults to `ci-info`'s `isCI` flag.
+     */
+    ci?: boolean;
+}
+/**
+ * Composes the per-policy handlers the install command needs for the
+ * current opts. Returns `undefined` only when no handler reports
+ * activity — saves the install command an empty no-op call at every
+ * checkpoint when no policies are configured.
+ *
+ * Today only the minimumReleaseAge handler is registered. Future
+ * policies (trustPolicy UX, license policy, etc.) plug in by
+ * exporting a sibling `create<Name>PolicyHandler(opts)` and getting
+ * pushed into the `handlers` list below.
+ */
+export declare function setupPolicyHandlers(opts: PolicyHandlersOptions): PolicyHandlersPlan | undefined;

package/lib/policyHandlers.js

@@ -0,0 +1,162 @@
+import { PnpmError } from '@pnpm/error';
+import { globalInfo } from '@pnpm/logger';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE } from '@pnpm/resolving.npm-resolver';
+import { isCI } from 'ci-info';
+import enquirer from 'enquirer';
+/**
+ * Composes the per-policy handlers the install command needs for the
+ * current opts. Returns `undefined` only when no handler reports
+ * activity — saves the install command an empty no-op call at every
+ * checkpoint when no policies are configured.
+ *
+ * Today only the minimumReleaseAge handler is registered. Future
+ * policies (trustPolicy UX, license policy, etc.) plug in by
+ * exporting a sibling `create<Name>PolicyHandler(opts)` and getting
+ * pushed into the `handlers` list below.
+ */
+export function setupPolicyHandlers(opts) {
+    const handlers = [];
+    const minimumReleaseAge = createMinimumReleaseAgeHandler(opts);
+    if (minimumReleaseAge)
+        handlers.push(minimumReleaseAge);
+    if (handlers.length === 0)
+        return undefined;
+    return {
+        handleResolutionPolicyViolations: async (violations) => {
+            // Sequential, not parallel: a TTY prompt from handler N would
+            // race with a different prompt from N+1, and we want a clean
+            // throw to short-circuit before later handlers ask for input.
+            for (const handler of handlers) {
+                if (handler.handleResolutionPolicyViolations) {
+                    // eslint-disable-next-line no-await-in-loop
+                    await handler.handleResolutionPolicyViolations(violations);
+                }
+            }
+        },
+        pickManifestUpdates: (violations) => {
+            const merged = {};
+            let any = false;
+            for (const handler of handlers) {
+                if (!handler.pickManifestUpdates)
+                    continue;
+                const patch = handler.pickManifestUpdates(violations);
+                if (patch == null)
+                    continue;
+                // Shallow merge — handlers own disjoint fields by convention,
+                // so there's no collision policy to encode here yet.
+                for (const [key, value] of Object.entries(patch)) {
+                    if (value == null)
+                        continue;
+                    merged[key] = value;
+                    any = true;
+                }
+            }
+            return any ? merged : undefined;
+        },
+    };
+}
+/**
+ * minimumReleaseAge policy handler.
+ *
+ * Loose mode (`minimumReleaseAgeStrict: false`) lets the resolver
+ * install versions newer than the cutoff and auto-persists them to
+ * `minimumReleaseAgeExclude`. Strict mode + an interactive TTY
+ * surfaces the full set of immature picks (direct AND transitive) at
+ * once via a confirm prompt — the install proceeds if the user
+ * approves, otherwise it aborts before touching the lockfile or
+ * package.json (#10488). Strict mode in CI or any other non-TTY
+ * context aborts hard with the same violation list so the failure
+ * pinpoints every offending entry, not just the first one the
+ * resolver picked.
+ *
+ * Strict mode combined with `--no-save` is rejected up-front — the
+ * approval prompt promises persistence the install command's
+ * `opts.save !== false` gate would block, leaving the lockfile
+ * holding approved-but-unlisted immature picks that the next install
+ * would reject.
+ *
+ * Returns `undefined` when minimumReleaseAge is not active.
+ */
+function createMinimumReleaseAgeHandler(opts) {
+    if (!opts.minimumReleaseAge)
+        return undefined;
+    const strictMode = opts.minimumReleaseAgeStrict === true;
+    const persistenceEnabled = opts.save !== false;
+    const inCi = opts.ci ?? isCI;
+    const canPrompt = !inCi && Boolean(process.stdin.isTTY);
+    return {
+        handleResolutionPolicyViolations: async (violations) => {
+            if (!strictMode)
+                return;
+            const immature = filterImmatureViolations(violations);
+            if (immature.length === 0)
+                return;
+            if (!persistenceEnabled) {
+                throw new PnpmError('STRICT_MIN_RELEASE_AGE_REQUIRES_SAVE', 'minimumReleaseAgeStrict cannot be combined with --no-save: ' +
+                    'approval would require writing to minimumReleaseAgeExclude in pnpm-workspace.yaml, ' +
+                    'which --no-save prevents.', {
+                    hint: 'Drop --no-save so the exclude list can be persisted, or set ' +
+                        'minimumReleaseAgeStrict: false to let the install proceed without prompting ' +
+                        '(the lockfile would still trigger the auto-collect on the next normal install).',
+                });
+            }
+            if (canPrompt) {
+                await promptForApproval(immature);
+            }
+            else {
+                throw failOnImmature(immature);
+            }
+        },
+        pickManifestUpdates: (violations) => {
+            const entries = pickImmatureEntries(violations, strictMode);
+            return entries ? { addedMinimumReleaseAgeExcludes: entries } : undefined;
+        },
+    };
+}
+function filterImmatureViolations(violations) {
+    return violations.filter((v) => v.code === MINIMUM_RELEASE_AGE_VIOLATION_CODE);
+}
+function pickImmatureEntries(violations, promptRequired) {
+    const immature = filterImmatureViolations(violations);
+    if (immature.length === 0)
+        return undefined;
+    const sorted = [...new Set(immature.map((v) => `${v.name}@${v.version}`))].sort();
+    // Strict-mode picks already passed through the approval prompt, so
+    // the log here only confirms what was persisted. Loose-mode picks
+    // haven't been announced anywhere else, so the same log doubles as
+    // the discovery notice.
+    const reason = promptRequired
+        ? '(approved at the prompt)'
+        : '(loose mode allowed these immature versions)';
+    globalInfo(`Added ${sorted.length} ${sorted.length === 1 ? 'entry' : 'entries'} to minimumReleaseAgeExclude in pnpm-workspace.yaml ` +
+        `${reason}:\n  ${sorted.join('\n  ')}`);
+    return sorted;
+}
+function failOnImmature(immature) {
+    const sorted = [...immature].sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
+    const list = sorted.map((v) => `  ${v.name}@${v.version} ${v.reason}`).join('\n');
+    return new PnpmError('NO_MATURE_MATCHING_VERSION', `${sorted.length} ${sorted.length === 1 ? 'version does' : 'versions do'} not meet the minimumReleaseAge constraint:\n${list}`, {
+        hint: 'Run the install interactively to approve these picks, or add them to ' +
+            'minimumReleaseAgeExclude in pnpm-workspace.yaml, or wait for the packages ' +
+            'to mature past the configured cutoff.',
+    });
+}
+async function promptForApproval(immature) {
+    const sorted = [...immature].sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
+    const message = `${sorted.length} ${sorted.length === 1 ? 'version does' : 'versions do'} not meet the minimumReleaseAge constraint:\n` +
+        sorted.map((v) => `  ${v.name}@${v.version}`).join('\n') + '\n' +
+        'Add to minimumReleaseAgeExclude in pnpm-workspace.yaml and proceed with the install?';
+    const answer = await enquirer.prompt({
+        type: 'confirm',
+        name: 'confirmed',
+        message,
+        initial: false,
+    });
+    if (!answer.confirmed) {
+        throw new PnpmError('MINIMUM_RELEASE_AGE_DENIED', 'Aborted: the immature versions were not approved.', {
+            hint: 'Re-run the install without `minimumReleaseAgeStrict: true` to allow these versions, ' +
+                'or wait for the packages to mature past the configured cutoff.',
+        });
+    }
+}
+//# sourceMappingURL=policyHandlers.js.map

package/lib/recursive.d.ts

@@ -2,6 +2,7 @@ import type { CommandHandler } from '@pnpm/cli.command';
 import { type Config, type ConfigContext } from '@pnpm/config.reader';
 import { type UpdateMatchingFunction } from '@pnpm/installing.deps-installer';
 import type { PreferredVersions } from '@pnpm/resolving.resolver-base';
+import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 import { type CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import type { StoreController } from '@pnpm/store.controller';
 import type { IncludedDependencies, Project, ProjectManifest, ProjectsGraph } from '@pnpm/types';
@@ -26,9 +27,17 @@ export type RecursiveOptions = CreateStoreControllerOptions & Pick<Config, 'bail
     storeControllerAndDir?: {
         ctrl: StoreController;
         dir: string;
+        resolutionVerifiers: ResolutionVerifier[];
     };
     pnpmfile: string[];
-} & Partial<Pick<Config, 'sort' | 'strictDepBuilds' | 'workspaceConcurrency'>> & Required<Pick<Config, 'workspaceDir'>>;
+    /**
+     * Alternative install engine (today: pacquet) the deps-installer
+     * delegates the materialization phase to. Built in `installDeps`
+     * when `configDependencies.pacquet` is declared, threaded through
+     * here so the recursive workspace path picks it up too.
+     */
+    runPacquet?: () => Promise<void>;
+} & Partial<Pick<Config, 'ci' | 'sort' | 'strictDepBuilds' | 'workspaceConcurrency'>> & Required<Pick<Config, 'workspaceDir'>>;
 export type CommandFullName = 'install' | 'add' | 'remove' | 'update' | 'import';
 export declare function recursive(allProjects: Project[], params: string[], opts: RecursiveOptions, cmdFullName: CommandFullName): Promise<boolean | string>;
 export declare function matchDependencies(match: (input: string) => string | null, manifest: ProjectManifest, include: IncludedDependencies): string[];

package/lib/recursive.js

@@ -18,6 +18,7 @@ import pLimit from 'p-limit';
 import { getPinnedVersion } from './getPinnedVersion.js';
 import { getSaveType } from './getSaveType.js';
 import { handleIgnoredBuilds } from './handleIgnoredBuilds.js';
+import { setupPolicyHandlers } from './policyHandlers.js';
 import { createWorkspaceSpecs, updateToWorkspacePackagesFromManifest } from './updateWorkspaceDependencies.js';
 export async function recursive(allProjects, params, opts, cmdFullName) {
     if (allProjects.length === 0) {
@@ -33,6 +34,12 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
     const store = opts.storeControllerAndDir ?? await createStoreController(opts);
     const workspacePackages = arrayOfWorkspacePackagesToMap(allProjects);
     const targetDependenciesField = getSaveType(opts);
+    // See `installDeps.ts` for context; mirrored here so workspace-recursive
+    // installs also surface immature picks (loose-mode auto-persist or
+    // strict-mode prompt). The workspace manifest writer dedupes against the
+    // existing list, so a single drain at the end captures additions across
+    // every project.
+    const policyHandlers = setupPolicyHandlers(opts);
     const installOpts = Object.assign(opts, {
         allProjects: getAllProjects(manifestsByPath, opts.allProjectsGraph, opts.sort),
         linkWorkspacePackagesDepth: opts.linkWorkspacePackages === 'deep' ? Infinity : opts.linkWorkspacePackages ? 0 : -1,
@@ -46,7 +53,9 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
         storeController: store.ctrl,
         storeDir: store.dir,
         targetDependenciesField,
+        resolutionVerifiers: store.resolutionVerifiers,
         workspacePackages,
+        handleResolutionPolicyViolations: policyHandlers?.handleResolutionPolicyViolations,
     });
     const result = {};
     const projectConfigRecord = createProjectConfigRecord(opts);
@@ -167,11 +176,17 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
         if ((mutatedImporters.length === 0) && cmdFullName === 'update' && opts.depth === 0) {
             throw new PnpmError('NO_PACKAGE_IN_DEPENDENCIES', 'None of the specified packages were found in the dependencies of any of the projects.');
         }
-        const { updatedCatalogs, updatedProjects: mutatedPkgs, ignoredBuilds, } = await mutateModules(mutatedImporters, {
+        const { updatedCatalogs, updatedProjects: mutatedPkgs, ignoredBuilds, resolutionPolicyViolations, } = await mutateModules(mutatedImporters, {
             ...installOpts,
             storeController: store.ctrl,
+            resolutionVerifiers: store.resolutionVerifiers,
         });
         if (opts.save !== false) {
+            // Only pick entries when we'll actually persist. Otherwise the
+            // info log would claim entries were added that the workspace
+            // manifest never saw, and the next install would re-prompt or
+            // fail verification.
+            const policyUpdates = policyHandlers?.pickManifestUpdates(resolutionPolicyViolations);
             const promises = mutatedPkgs.map(async ({ originalManifest, manifest, rootDir }) => {
                 return manifestsByPath[rootDir].writeProjectManifest(originalManifest ?? manifest);
             });
@@ -179,6 +194,7 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
                 updatedCatalogs,
                 cleanupUnusedCatalogs: opts.cleanupUnusedCatalogs,
                 allProjects,
+                ...policyUpdates,
             }));
             await Promise.all(promises);
         }
@@ -188,6 +204,10 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
     const pkgPaths = Object.keys(opts.selectedProjectsGraph).sort();
     let updatedCatalogs;
     const allIgnoredBuilds = new Set();
+    // Each per-project install returns its own slice of lockfile-resolution
+    // violations; accumulate them here so the post-loop persist step can
+    // dedup and write a single batch to the workspace manifest.
+    const allResolutionPolicyViolations = [];
     const limitInstallation = pLimit(getWorkspaceConcurrency(opts.workspaceConcurrency));
     await Promise.all(pkgPaths.map(async (rootDir) => limitInstallation(async () => {
         const hooks = opts.ignorePnpmfile
@@ -239,6 +259,7 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
                             updatedCatalogs: undefined, // there's no reason to add new or update catalogs on `pnpm remove`
                             updatedManifest: mutationResult.updatedProjects[0].manifest,
                             ignoredBuilds: mutationResult.ignoredBuilds,
+                            resolutionPolicyViolations: mutationResult.resolutionPolicyViolations,
                         };
                     };
                     break;
@@ -249,7 +270,7 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
                     break;
             }
             const localConfig = getProjectConfig(manifest) ?? {};
-            const { updatedCatalogs: newCatalogsAddition, updatedManifest: newManifest, ignoredBuilds, } = await action(manifest, {
+            const { updatedCatalogs: newCatalogsAddition, updatedManifest: newManifest, ignoredBuilds, resolutionPolicyViolations, } = await action(manifest, {
                 ...installOpts,
                 ...localConfig,
                 ...opts.allProjectsGraph[rootDir]?.package,
@@ -263,6 +284,7 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
                 }),
                 configByUri: installOpts.configByUri,
                 storeController: store.ctrl,
+                resolutionVerifiers: store.resolutionVerifiers,
             });
             if (opts.save !== false) {
                 await writeProjectManifest(newManifest);
@@ -276,6 +298,11 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
                     allIgnoredBuilds.add(depPath);
                 }
             }
+            if (resolutionPolicyViolations?.length) {
+                for (const violation of resolutionPolicyViolations) {
+                    allResolutionPolicyViolations.push(violation);
+                }
+            }
             result[rootDir].status = 'passed';
         }
         catch (err) { // eslint-disable-line
@@ -294,11 +321,18 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
         }
     })));
     await handleIgnoredBuilds(opts, allIgnoredBuilds.size ? allIgnoredBuilds : undefined);
-    await updateWorkspaceManifest(opts.workspaceDir, {
-        updatedCatalogs,
-        cleanupUnusedCatalogs: opts.cleanupUnusedCatalogs,
-        allProjects,
-    });
+    if (opts.save !== false) {
+        // Only pick entries when we'll actually persist. Otherwise the
+        // info log would claim entries were added that the workspace
+        // manifest never saw, mirroring the gate the shared-lockfile
+        // branch + installDeps already apply.
+        await updateWorkspaceManifest(opts.workspaceDir, {
+            updatedCatalogs,
+            cleanupUnusedCatalogs: opts.cleanupUnusedCatalogs,
+            allProjects,
+            ...policyHandlers?.pickManifestUpdates(allResolutionPolicyViolations),
+        });
+    }
     if (!opts.lockfileOnly && !opts.ignoreScripts && (cmdFullName === 'add' ||
         cmdFullName === 'install' ||
         cmdFullName === 'update')) {

package/lib/remove.js

@@ -135,6 +135,7 @@ export async function handler(opts, params) {
         linkWorkspacePackagesDepth: opts.linkWorkspacePackages === 'deep' ? Infinity : opts.linkWorkspacePackages ? 0 : -1,
         storeController: store.ctrl,
         storeDir: store.dir,
+        resolutionVerifiers: store.resolutionVerifiers,
         include,
     });
     const allProjects = opts.allProjects ?? (opts.workspaceDir

package/lib/resolutionPolicyManifest.d.ts

@@ -0,0 +1,6 @@
+import { type PolicyHandlersOptions, type PolicyViolation } from './policyHandlers.js';
+export interface GlobalPolicyCallbacks {
+    handleResolutionPolicyViolations?: (violations: readonly PolicyViolation[]) => Promise<void>;
+    updateResolutionPolicyManifest?: (violations: readonly PolicyViolation[], dir: string) => Promise<void>;
+}
+export declare function createGlobalPolicyCallbacks(opts: PolicyHandlersOptions): GlobalPolicyCallbacks;

package/lib/resolutionPolicyManifest.js

@@ -0,0 +1,17 @@
+import { updateWorkspaceManifest } from '@pnpm/workspace.workspace-manifest-writer';
+import { setupPolicyHandlers, } from './policyHandlers.js';
+export function createGlobalPolicyCallbacks(opts) {
+    const policyHandlers = setupPolicyHandlers(opts);
+    if (policyHandlers == null)
+        return {};
+    return {
+        handleResolutionPolicyViolations: policyHandlers.handleResolutionPolicyViolations,
+        updateResolutionPolicyManifest: async (violations, dir) => {
+            const policyUpdates = policyHandlers.pickManifestUpdates(violations);
+            if (policyUpdates != null) {
+                await updateWorkspaceManifest(dir, policyUpdates);
+            }
+        },
+    };
+}
+//# sourceMappingURL=resolutionPolicyManifest.js.map

package/lib/runPacquet.d.ts

@@ -0,0 +1,48 @@
+export interface MakeRunPacquetOpts {
+    lockfileDir: string;
+    /**
+     * Which `configDependencies` entry installed pacquet: either the
+     * original unscoped `pacquet` or the official scoped
+     * `@pnpm/pacquet` mirror. Drives the directory we look in under
+     * `node_modules/.pnpm-config/<packageName>/`. Both packages ship
+     * the same shim and the same `@pacquet/<plat>-<arch>` binary
+     * sub-packages, so the rest of the lookup is identical.
+     */
+    packageName: 'pacquet' | '@pnpm/pacquet';
+    /**
+     * The user's original `pnpm` argv (`process.argv.slice(2)`). Not
+     * forwarded to pacquet — we only inspect it to warn about flags
+     * pacquet won't see.
+     */
+    argv: string[];
+}
+/**
+ * Build the install-engine callback `mutateModules` invokes when
+ * `configDependencies` declares pacquet. Returns `undefined` when no
+ * pacquet binary is on disk — the caller falls back to the JS path in
+ * that case.
+ *
+ * The callback spawns the pacquet binary installed under
+ * `node_modules/.pnpm-config/pacquet` and forwards the user's own
+ * pnpm CLI flags. Pacquet's NDJSON stderr is parsed line-by-line and
+ * the valid JSON records are re-emitted on pnpm's global
+ * `streamParser` so `@pnpm/cli.default-reporter` renders pacquet's
+ * events the same way it renders pnpm's own. Non-JSON stderr lines
+ * (panic backtraces, unexpected diagnostics) are forwarded to the
+ * real stderr verbatim so they reach the user.
+ */
+/** Args the deps-installer passes per pacquet invocation. */
+export interface RunPacquetCallOpts {
+    /**
+     * `true` when pnpm has already run a lockfileOnly resolve pass and
+     * the reporter has already accumulated one `pnpm:progress
+     * status:resolved` per package. Pacquet's own `resolved` events
+     * (emitted for wire-format parity as it walks the lockfile) are
+     * dropped on the way back through the reader so the reporter
+     * doesn't double-count. The frozen-install path passes `false`:
+     * pnpm did no resolution there, so pacquet's events are the only
+     * source.
+     */
+    filterResolvedProgress?: boolean;
+}
+export declare function makeRunPacquet(opts: MakeRunPacquetOpts): (callOpts?: RunPacquetCallOpts) => Promise<void>;

package/lib/runPacquet.js

@@ -0,0 +1,126 @@
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import readline from 'node:readline';
+import { PnpmError } from '@pnpm/error';
+import { logger, streamParser } from '@pnpm/logger';
+import chalk from 'chalk';
+// The runtime `streamParser` is a `Transform` stream (split2 + JSON.parse).
+// Its public typing only exposes `on`/`removeListener`, so we narrow to the
+// writable side here to feed pacquet's NDJSON lines back through the same
+// parser that `@pnpm/cli.default-reporter` listens on.
+const streamParserWritable = streamParser;
+export function makeRunPacquet(opts) {
+    return async (callOpts) => {
+        const pacquetBin = resolvePacquetBin(opts.lockfileDir, opts.packageName);
+        // Always the same fixed args. We don't forward pnpm's CLI flags
+        // even though pacquet's `install` subcommand mirrors most of them:
+        // pnpm has commands like `add` and `update` that carry flags
+        // pacquet's `install` doesn't recognize (e.g., `--save-dev`,
+        // `--save-peer`), and clap would reject them. The settings users
+        // care about live in `pnpm-workspace.yaml` / `.npmrc`, which
+        // pacquet reads on its own.
+        const args = ['--reporter=ndjson', 'install', '--frozen-lockfile'];
+        const droppedFlags = collectDroppedFlags(opts.argv);
+        if (droppedFlags.length > 0) {
+            logger.warn({
+                message: `The following CLI flags are not forwarded to pacquet and may not be honored: ${droppedFlags.join(' ')}. Move the equivalent settings into pnpm-workspace.yaml (or .npmrc for auth/registry) if pacquet needs them.`,
+                prefix: opts.lockfileDir,
+            });
+        }
+        // Banner so users can tell at a glance their install is going
+        // through the Rust engine rather than the JS path. Chalk is the
+        // same dependency the default reporter uses for the "+ pkg
+        // version" summary, so colorization respects the user's TTY
+        // settings consistently.
+        const banner = [
+            chalk.magentaBright('▶ Using pacquet for this install'),
+            chalk.gray('  pacquet is pnpm\'s Rust install engine (preview); declared in configDependencies.'),
+        ].join('\n');
+        logger.info({ message: banner, prefix: opts.lockfileDir });
+        const child = spawn(pacquetBin, args, {
+            cwd: opts.lockfileDir,
+            stdio: ['ignore', 'inherit', 'pipe'],
+        });
+        const filterResolved = callOpts?.filterResolvedProgress === true;
+        const rl = readline.createInterface({ input: child.stderr, crlfDelay: Infinity });
+        rl.on('line', (line) => {
+            if (!line)
+                return;
+            let parsed;
+            try {
+                parsed = JSON.parse(line);
+            }
+            catch {
+                process.stderr.write(`${line}\n`);
+                return;
+            }
+            if (filterResolved &&
+                typeof parsed === 'object' && parsed !== null &&
+                parsed.name === 'pnpm:progress' &&
+                parsed.status === 'resolved') {
+                return;
+            }
+            streamParserWritable.write(`${line}\n`);
+        });
+        await new Promise((resolve, reject) => {
+            child.once('error', reject);
+            child.once('close', (code) => {
+                rl.close();
+                if (code === 0) {
+                    resolve();
+                    return;
+                }
+                reject(new PnpmError('PACQUET_INSTALL_FAILED', `pacquet exited with code ${code ?? 'null'}`));
+            });
+        });
+    };
+}
+/**
+ * Path of the platform-specific native pacquet binary for the host. The
+ * pacquet npm package ships a Node wrapper at `bin/pacquet` that uses
+ * `require.resolve('@pacquet/<platform>-<arch>/pacquet[.exe]')` to find
+ * the binary — so the platform package lands as a *sibling* of pacquet,
+ * not inside its own `node_modules` (pacquet's own `node_modules` is
+ * empty after configDependencies install). Use Node's resolver rooted
+ * at pacquet's own `package.json` so we follow the same path the
+ * wrapper would have.
+ *
+ * The `realpathSync` is required: `.pnpm-config/pacquet` is a symlink
+ * into the global virtual store, and Node's `createRequire` builds its
+ * search paths from the *literal* ancestors of the path it's given —
+ * it won't follow the symlink up into the store dir where the
+ * `@pacquet/<plat>-<arch>` sibling actually lives.
+ */
+function resolvePacquetBin(lockfileDir, packageName) {
+    const ext = process.platform === 'win32' ? '.exe' : '';
+    const pacquetPkg = fs.realpathSync(path.join(lockfileDir, 'node_modules/.pnpm-config', packageName, 'package.json'));
+    return createRequire(pacquetPkg).resolve(`@pacquet/${process.platform}-${process.arch}/pacquet${ext}`);
+}
+/**
+ * Pull the CLI flags out of pnpm's argv so we can warn about them
+ * before pacquet runs. We don't forward any of them — pacquet always
+ * gets `install --frozen-lockfile --reporter=ndjson` — but most are
+ * handled by pnpm itself before delegation (`--save-dev` rewrites
+ * `package.json`, `--filter` selects projects, etc.) so listing them
+ * to the user makes the "not forwarded" surface concrete.
+ *
+ * Flags we explicitly emit ourselves (`--frozen-lockfile`,
+ * `--reporter=ndjson`) are filtered out: they're honored, so warning
+ * about them would be misleading. `--config.*` is filtered too —
+ * those configure pnpm's runtime and aren't intended for the install
+ * engine.
+ */
+function collectDroppedFlags(argv) {
+    return argv.filter((arg) => {
+        if (!arg.startsWith('-'))
+            return false;
+        if (arg === '--frozen-lockfile' || arg === '--reporter=ndjson')
+            return false;
+        if (arg.startsWith('--config.'))
+            return false;
+        return true;
+    });
+}
+//# sourceMappingURL=runPacquet.js.map

package/lib/update/index.js

@@ -12,6 +12,7 @@ import { pick, pluck, unnest } from 'ramda';
 import { renderHelp } from 'render-help';
 import { installDeps } from '../installDeps.js';
 import { parseUpdateParam } from '../recursive.js';
+import { createGlobalPolicyCallbacks } from '../resolutionPolicyManifest.js';
 import { getUpdateChoices } from './getUpdateChoices.js';
 export function rcOptionsTypes() {
     return pick([
@@ -151,7 +152,10 @@ export async function handler(opts, params = [], commands) {
                 hint: 'Run "pnpm setup" to create it automatically, or set the global-bin-dir setting, or the PNPM_HOME env variable. The global bin directory should be in the PATH.',
             });
         }
-        return handleGlobalUpdate(opts, params, commands ?? {});
+        return handleGlobalUpdate({
+            ...opts,
+            ...createGlobalPolicyCallbacks(opts),
+        }, params, commands ?? {});
     }
     const rebuildHandler = commands?.rebuild;
     if (opts.interactive) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.commands",
-  "version": "1100.2.2",
+  "version": "1100.4.0",
   "description": "Commands for installation",
   "keywords": [
     "pnpm",
@@ -33,6 +33,7 @@
     "@zkochan/rimraf": "^4.0.0",
     "@zkochan/table": "^2.0.1",
     "chalk": "^5.6.0",
+    "ci-info": "^4.3.0",
     "enquirer": "^2.4.1",
     "get-npm-tarball-url": "^2.1.0",
     "is-subdir": "^2.0.0",
@@ -43,45 +44,46 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "version-selector-type": "^3.0.0",
-    "@pnpm/building.after-install": "1101.0.12",
+    "@pnpm/building.after-install": "1101.0.14",
     "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/cli.command": "1100.0.1",
     "@pnpm/cli.common-cli-options-help": "1100.0.1",
-    "@pnpm/cli.utils": "1101.0.4",
+    "@pnpm/cli.utils": "1101.0.6",
+    "@pnpm/config.pick-registry-for-package": "1100.0.4",
     "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/config.pick-registry-for-package": "1100.0.3",
-    "@pnpm/config.writer": "1100.0.7",
+    "@pnpm/config.reader": "1101.3.3",
+    "@pnpm/cli.command": "1100.0.1",
+    "@pnpm/config.writer": "1100.0.9",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.inspection.outdated": "1100.0.15",
-    "@pnpm/deps.path": "1100.0.3",
-    "@pnpm/deps.status": "1100.0.15",
-    "@pnpm/fs.graceful-fs": "1100.1.0",
+    "@pnpm/deps.inspection.outdated": "1100.1.0",
+    "@pnpm/deps.path": "1100.0.4",
+    "@pnpm/deps.status": "1100.0.17",
     "@pnpm/error": "1100.0.0",
+    "@pnpm/fs.graceful-fs": "1100.1.0",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/global.commands": "1100.0.17",
-    "@pnpm/installing.context": "1100.0.10",
-    "@pnpm/hooks.pnpmfile": "1100.0.8",
-    "@pnpm/installing.dedupe.check": "1100.0.5",
-    "@pnpm/installing.env-installer": "1101.0.9",
-    "@pnpm/installing.deps-installer": "1101.1.2",
-    "@pnpm/lockfile.types": "1100.0.5",
-    "@pnpm/pkg-manifest.reader": "1100.0.3",
-    "@pnpm/pkg-manifest.utils": "1100.1.3",
+    "@pnpm/global.commands": "1100.0.19",
+    "@pnpm/hooks.pnpmfile": "1100.0.10",
+    "@pnpm/installing.context": "1100.0.12",
+    "@pnpm/installing.dedupe.check": "1100.0.7",
+    "@pnpm/installing.env-installer": "1101.1.0",
+    "@pnpm/installing.deps-installer": "1101.3.0",
+    "@pnpm/lockfile.types": "1100.0.7",
+    "@pnpm/pkg-manifest.utils": "1100.2.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.4",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/resolving.resolver-base": "1100.1.3",
-    "@pnpm/store.controller": "1101.0.6",
-    "@pnpm/types": "1101.1.0",
-    "@pnpm/workspace.projects-filter": "1100.0.11",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.5",
-    "@pnpm/workspace.project-manifest-writer": "1100.0.3",
-    "@pnpm/store.connection-manager": "1100.1.2",
-    "@pnpm/workspace.projects-reader": "1101.0.4",
-    "@pnpm/workspace.state": "1100.0.12",
-    "@pnpm/workspace.workspace-manifest-writer": "1100.0.7",
-    "@pnpm/workspace.projects-sorter": "1100.0.2",
-    "@pnpm/config.reader": "1101.3.1",
-    "@pnpm/workspace.projects-graph": "1100.0.8",
-    "@pnpm/workspace.root-finder": "1100.0.1"
+    "@pnpm/resolving.resolver-base": "1100.3.0",
+    "@pnpm/store.connection-manager": "1100.2.1",
+    "@pnpm/resolving.npm-resolver": "1101.3.0",
+    "@pnpm/store.controller": "1101.0.8",
+    "@pnpm/types": "1101.1.1",
+    "@pnpm/workspace.projects-filter": "1100.0.13",
+    "@pnpm/workspace.projects-graph": "1100.0.10",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.7",
+    "@pnpm/workspace.projects-sorter": "1100.0.3",
+    "@pnpm/workspace.projects-reader": "1101.0.6",
+    "@pnpm/workspace.root-finder": "1100.0.1",
+    "@pnpm/workspace.project-manifest-writer": "1100.0.4",
+    "@pnpm/workspace.state": "1100.0.14",
+    "@pnpm/workspace.workspace-manifest-writer": "1100.0.9"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -94,7 +96,6 @@
     "@types/ramda": "0.31.1",
     "@types/yarnpkg__lockfile": "^1.1.9",
     "@types/zkochan__table": "npm:@types/table@6.0.0",
-    "ci-info": "^4.3.0",
     "delay": "^7.0.0",
     "jest-diff": "^30.3.0",
     "path-name": "^1.0.0",
@@ -105,18 +106,18 @@
     "write-json-file": "^7.0.0",
     "write-package": "7.2.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/installing.commands": "1100.2.2",
-    "@pnpm/assert-project": "1100.0.8",
-    "@pnpm/prepare": "1100.0.8",
-    "@pnpm/store.index": "1100.1.0",
+    "@pnpm/assert-project": "1100.0.10",
+    "@pnpm/installing.commands": "1100.4.0",
+    "@pnpm/installing.modules-yaml": "1100.0.5",
+    "@pnpm/prepare": "1100.0.10",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/store.index": "1100.1.0",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/installing.modules-yaml": "1100.0.4",
+    "@pnpm/testing.mock-agent": "1100.0.6",
     "@pnpm/testing.command-defaults": "1100.0.1",
-    "@pnpm/testing.mock-agent": "1100.0.4",
-    "@pnpm/worker": "1100.1.5",
-    "@pnpm/workspace.projects-filter": "1100.0.11"
+    "@pnpm/worker": "1100.1.7",
+    "@pnpm/workspace.projects-filter": "1100.0.13"
   },
   "engines": {
     "node": ">=22.13"