@pnpm/installing.commands 1100.4.2 → 1100.6.0

package/lib/add.js

@@ -74,6 +74,7 @@ export function rcOptionsTypes() {
         'side-effects-cache',
         'store-dir',
         'strict-peer-dependencies',
+        'trust-lockfile',
         'trust-policy',
         'trust-policy-exclude',
         'trust-policy-ignore-after',

package/lib/install.d.ts

@@ -7,13 +7,14 @@ export declare const shorthands: Record<string, string>;
 export declare const commandNames: string[];
 export declare const recursiveByDefault = true;
 export declare function help(): string;
-export type InstallCommandOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'configDependencies' | 'dedupeInjectedDeps' | 'dedupeDirectDeps' | 'dedupePeerDependents' | 'dedupePeers' | 'deployAllFiles' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'engineStrict' | 'excludeLinksFromLockfile' | 'frozenLockfile' | 'global' | 'globalPnpmfile' | 'hoistPattern' | 'publicHoistPattern' | 'ignorePnpmfile' | 'ignoreScripts' | 'injectWorkspacePackages' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'modulesDir' | 'nodeLinker' | 'patchedDependencies' | 'preferFrozenLockfile' | 'preferWorkspacePackages' | 'production' | 'registries' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveCatalogName' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'tag' | 'allowBuilds' | 'optional' | 'virtualStoreDir' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'resolutionMode' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'updateConfig' | 'overrides' | 'packageExtensions' | 'agent' | 'supportedArchitectures' | 'packageConfigs'> & Pick<ConfigContext, 'allProjects' | 'cliOptions' | 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'allProjectsGraph' | 'selectedProjectsGraph'> & CreateStoreControllerOptions & Partial<Pick<Config, 'globalPkgDir'>> & {
+export type InstallCommandOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'configDependencies' | 'dedupeInjectedDeps' | 'dedupeDirectDeps' | 'dedupePeerDependents' | 'dedupePeers' | 'deployAllFiles' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'engineStrict' | 'excludeLinksFromLockfile' | 'frozenLockfile' | 'global' | 'globalPnpmfile' | 'hoistPattern' | 'publicHoistPattern' | 'ignorePnpmfile' | 'ignoreScripts' | 'injectWorkspacePackages' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'modulesDir' | 'nodeLinker' | 'patchedDependencies' | 'preferFrozenLockfile' | 'preferWorkspacePackages' | 'production' | 'registries' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveCatalogName' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'virtualStoreDir' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'resolutionMode' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'updateConfig' | 'overrides' | 'packageExtensions' | 'agent' | 'supportedArchitectures' | 'packageConfigs'> & Pick<ConfigContext, 'allProjects' | 'cliOptions' | 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'allProjectsGraph' | 'selectedProjectsGraph'> & CreateStoreControllerOptions & Partial<Pick<Config, 'globalPkgDir'>> & {
     argv: {
         cooked?: string[];
         original: string[];
         remain?: string[];
     };
     fixLockfile?: boolean;
+    updateChecksums?: boolean;
     frozenLockfileIfExists?: boolean;
     useBetaCli?: boolean;
     pruneDirectDependencies?: boolean;

package/lib/install.js

@@ -61,6 +61,7 @@ export function rcOptionsTypes() {
         'side-effects-cache',
         'store-dir',
         'strict-peer-dependencies',
+        'trust-lockfile',
         'trust-policy',
         'trust-policy-exclude',
         'trust-policy-ignore-after',
@@ -77,6 +78,7 @@ export const cliOptionsTypes = () => ({
     ...rcOptionsTypes(),
     ...pick(['force'], allTypes),
     'fix-lockfile': Boolean,
+    'update-checksums': Boolean,
     'resolution-only': Boolean,
     recursive: Boolean,
     // `--no-save` lets `pnpm install` skip writing to package.json /
@@ -156,6 +158,10 @@ For options that may be used with `-r`, see "pnpm help recursive"',
                         description: 'Fix broken lockfile entries automatically',
                         name: '--fix-lockfile',
                     },
+                    {
+                        description: 'Refresh integrity checksums recorded in the lockfile from the registry',
+                        name: '--update-checksums',
+                    },
                     {
                         description: 'Merge lockfiles were generated on git branch',
                         name: '--merge-git-branch-lockfiles',
@@ -220,6 +226,10 @@ by any dependencies, so it is an emulation of a flat node_modules',
                         description: 'Ignore trust downgrades for packages published more than specified minutes ago',
                         name: '--trust-policy-ignore-after <minutes>',
                     },
+                    {
+                        description: 'Trust the lockfile and skip the supply-chain verification step that re-applies minimumReleaseAge / trustPolicy to each lockfile entry. Use only when the lockfile is part of the trusted base (closed-source projects, CI runs against an already-verified lockfile)',
+                        name: '--trust-lockfile',
+                    },
                     {
                         description: 'Clones/hardlinks or copies packages. The selected method depends from the file system',
                         name: '--package-import-method auto',

package/lib/installDeps.d.ts

@@ -4,7 +4,7 @@ import { type UpdateMatchingFunction } from '@pnpm/installing.deps-installer';
 import type { LockfileObject } from '@pnpm/lockfile.types';
 import { type CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import type { IncludedDependencies, PackageVulnerabilityAudit } from '@pnpm/types';
-export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'agent' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & Partial<Pick<Config, 'ci'>> & CreateStoreControllerOptions & {
+export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'agent' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & Partial<Pick<Config, 'ci'>> & CreateStoreControllerOptions & {
     argv: {
         cooked?: string[];
         original: string[];

package/lib/policyHandlers.js

@@ -127,7 +127,7 @@ function pickImmatureEntries(violations, promptRequired) {
     // the discovery notice.
     const reason = promptRequired
         ? '(approved at the prompt)'
-        : '(loose mode allowed these immature versions)';
+        : '(set minimumReleaseAgeStrict to true to gate these updates with a prompt)';
     globalInfo(`Added ${sorted.length} ${sorted.length === 1 ? 'entry' : 'entries'} to minimumReleaseAgeExclude in pnpm-workspace.yaml ` +
         `${reason}:\n  ${sorted.join('\n  ')}`);
     return sorted;

package/lib/recursive.d.ts

@@ -6,7 +6,7 @@ import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 import { type CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import type { StoreController } from '@pnpm/store.controller';
 import type { IncludedDependencies, Project, ProjectManifest, ProjectsGraph } from '@pnpm/types';
-export type RecursiveOptions = CreateStoreControllerOptions & Pick<Config, 'bail' | 'configDependencies' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'globalPnpmfile' | 'hoistPattern' | 'ignorePnpmfile' | 'ignoreScripts' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'modulesDir' | 'agent' | 'allowBuilds' | 'registries' | 'runtime' | 'save' | 'saveCatalogName' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sharedWorkspaceLockfile' | 'tag' | 'cleanupUnusedCatalogs' | 'packageConfigs' | 'updateConfig'> & Pick<ConfigContext, 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir'> & {
+export type RecursiveOptions = CreateStoreControllerOptions & Pick<Config, 'bail' | 'configDependencies' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'globalPnpmfile' | 'hoistPattern' | 'ignorePnpmfile' | 'ignoreScripts' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'modulesDir' | 'agent' | 'allowBuilds' | 'registries' | 'runtime' | 'save' | 'saveCatalogName' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sharedWorkspaceLockfile' | 'tag' | 'trustLockfile' | 'cleanupUnusedCatalogs' | 'packageConfigs' | 'updateConfig'> & Pick<ConfigContext, 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir'> & {
     rebuildHandler?: CommandHandler;
     include?: IncludedDependencies;
     includeDirect?: IncludedDependencies;

package/lib/remove.d.ts

@@ -6,7 +6,7 @@ export declare const cliOptionsTypes: () => Record<string, unknown>;
 export declare function help(): string;
 export declare const commandNames: string[];
 export declare const completion: CompletionFunc;
-export declare function handler(opts: CreateStoreControllerOptions & Pick<Config, 'bail' | 'bin' | 'configDependencies' | 'dev' | 'engineStrict' | 'globalPnpmfile' | 'ignorePnpmfile' | 'linkWorkspacePackages' | 'lockfileDir' | 'optional' | 'production' | 'registries' | 'saveDev' | 'saveOptional' | 'saveProd' | 'workspaceDir' | 'workspacePackagePatterns' | 'sharedWorkspaceLockfile' | 'cleanupUnusedCatalogs'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'selectedProjectsGraph'> & {
+export declare function handler(opts: CreateStoreControllerOptions & Pick<Config, 'bail' | 'bin' | 'configDependencies' | 'dev' | 'engineStrict' | 'globalPnpmfile' | 'ignorePnpmfile' | 'linkWorkspacePackages' | 'lockfileDir' | 'optional' | 'production' | 'registries' | 'saveDev' | 'saveOptional' | 'saveProd' | 'workspaceDir' | 'workspacePackagePatterns' | 'sharedWorkspaceLockfile' | 'cleanupUnusedCatalogs' | 'trustLockfile'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'selectedProjectsGraph'> & {
     recursive?: boolean;
     pnpmfile: string[];
 } & Partial<Pick<Config, 'global' | 'globalPkgDir'>>, params: string[]): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.commands",
-  "version": "1100.4.2",
+  "version": "1100.6.0",
   "description": "Commands for installation",
   "keywords": [
     "pnpm",
@@ -32,61 +32,61 @@
     "@yarnpkg/parsers": "3.0.3",
     "@zkochan/rimraf": "^4.0.0",
     "@zkochan/table": "^2.0.1",
-    "chalk": "^5.6.0",
-    "ci-info": "^4.3.0",
+    "chalk": "^5.6.2",
+    "ci-info": "^4.4.0",
     "enquirer": "^2.4.1",
     "get-npm-tarball-url": "^2.1.0",
     "is-subdir": "^2.0.0",
     "load-json-file": "^7.0.1",
     "normalize-path": "^3.0.0",
     "p-filter": "^4.1.0",
-    "p-limit": "^7.1.0",
+    "p-limit": "^7.3.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "version-selector-type": "^3.0.0",
-    "@pnpm/building.after-install": "1101.0.15",
+    "@pnpm/building.after-install": "1101.0.17",
     "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/cli.command": "1100.0.1",
+    "@pnpm/cli.utils": "1101.0.8",
     "@pnpm/cli.common-cli-options-help": "1100.0.1",
-    "@pnpm/cli.utils": "1101.0.6",
-    "@pnpm/config.pick-registry-for-package": "1100.0.5",
-    "@pnpm/config.writer": "1100.0.9",
+    "@pnpm/config.reader": "1101.4.1",
     "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/deps.path": "1100.0.4",
+    "@pnpm/config.pick-registry-for-package": "1100.0.6",
+    "@pnpm/config.writer": "1100.0.10",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.status": "1100.0.17",
-    "@pnpm/deps.inspection.outdated": "1100.1.1",
+    "@pnpm/deps.path": "1100.0.5",
+    "@pnpm/deps.inspection.outdated": "1100.1.3",
+    "@pnpm/deps.status": "1100.0.19",
     "@pnpm/error": "1100.0.0",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/global.commands": "1100.0.20",
-    "@pnpm/hooks.pnpmfile": "1100.0.10",
-    "@pnpm/installing.context": "1100.0.12",
-    "@pnpm/installing.dedupe.check": "1100.0.7",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/lockfile.types": "1100.0.7",
-    "@pnpm/pkg-manifest.reader": "1100.0.4",
-    "@pnpm/installing.deps-installer": "1101.3.1",
-    "@pnpm/cli.command": "1100.0.1",
+    "@pnpm/global.commands": "1100.0.22",
+    "@pnpm/hooks.pnpmfile": "1100.0.11",
+    "@pnpm/installing.context": "1100.0.13",
+    "@pnpm/installing.deps-installer": "1101.5.0",
+    "@pnpm/installing.dedupe.check": "1100.0.8",
+    "@pnpm/lockfile.types": "1100.0.8",
+    "@pnpm/pkg-manifest.utils": "1100.2.1",
+    "@pnpm/pkg-manifest.reader": "1100.0.5",
+    "@pnpm/resolving.npm-resolver": "1101.3.3",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/resolving.npm-resolver": "1101.3.1",
-    "@pnpm/pkg-manifest.utils": "1100.2.0",
-    "@pnpm/store.connection-manager": "1100.2.2",
-    "@pnpm/config.reader": "1101.3.3",
-    "@pnpm/store.controller": "1101.0.8",
-    "@pnpm/types": "1101.1.1",
-    "@pnpm/workspace.project-manifest-writer": "1100.0.4",
-    "@pnpm/resolving.resolver-base": "1100.3.0",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.7",
-    "@pnpm/workspace.projects-reader": "1101.0.6",
-    "@pnpm/workspace.projects-sorter": "1100.0.3",
-    "@pnpm/workspace.projects-graph": "1100.0.11",
-    "@pnpm/workspace.state": "1100.0.14",
-    "@pnpm/workspace.root-finder": "1100.0.1",
-    "@pnpm/workspace.workspace-manifest-writer": "1100.0.9",
-    "@pnpm/installing.env-installer": "1101.1.1",
-    "@pnpm/workspace.projects-filter": "1100.0.14"
+    "@pnpm/resolving.resolver-base": "1100.3.1",
+    "@pnpm/store.controller": "1101.0.9",
+    "@pnpm/installing.env-installer": "1101.1.3",
+    "@pnpm/store.connection-manager": "1100.2.4",
+    "@pnpm/types": "1101.2.0",
+    "@pnpm/workspace.projects-filter": "1100.0.16",
+    "@pnpm/workspace.project-manifest-writer": "1100.0.5",
+    "@pnpm/workspace.projects-graph": "1100.0.13",
+    "@pnpm/workspace.projects-reader": "1101.0.8",
+    "@pnpm/workspace.state": "1100.0.16",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.9",
+    "@pnpm/workspace.projects-sorter": "1100.0.4",
+    "@pnpm/workspace.workspace-manifest-writer": "1100.0.10",
+    "@pnpm/workspace.root-finder": "1100.0.1"
   },
   "peerDependencies": {
-    "@pnpm/logger": ">=1001.0.0 <1002.0.0"
+    "@pnpm/logger": "^1001.0.1"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -97,7 +97,7 @@
     "@types/yarnpkg__lockfile": "^1.1.9",
     "@types/zkochan__table": "npm:@types/table@6.0.0",
     "delay": "^7.0.0",
-    "jest-diff": "^30.3.0",
+    "jest-diff": "^30.4.1",
     "path-name": "^1.0.0",
     "proxyquire": "^2.1.3",
     "read-yaml-file": "^3.0.0",
@@ -106,18 +106,19 @@
     "write-json-file": "^7.0.0",
     "write-package": "7.2.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/installing.modules-yaml": "1100.0.5",
-    "@pnpm/assert-project": "1100.0.10",
-    "@pnpm/installing.commands": "1100.4.2",
+    "@pnpm/assert-project": "1100.0.11",
+    "@pnpm/installing.commands": "1100.6.0",
+    "@pnpm/installing.modules-yaml": "1100.0.6",
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/prepare": "1100.0.11",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/prepare": "1100.0.10",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.command-defaults": "1100.0.1",
-    "@pnpm/testing.mock-agent": "1100.0.6",
-    "@pnpm/worker": "1100.1.7",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/workspace.projects-filter": "1100.0.14"
+    "@pnpm/testing.mock-agent": "1100.0.7",
+    "@pnpm/testing.registry-mock": "1100.0.1",
+    "@pnpm/testing.command-defaults": "1100.0.1",
+    "@pnpm/worker": "1100.1.8",
+    "@pnpm/workspace.projects-filter": "1100.0.16"
   },
   "engines": {
     "node": ">=22.13"