@pnpm/installing.commands 1100.8.0 → 1100.10.0

package/lib/add.js

@@ -49,6 +49,8 @@ export function rcOptionsTypes() {
         'lockfile',
         'modules-dir',
         'network-concurrency',
+        'node-experimental-package-map',
+        'node-package-map-type',
         'node-linker',
         'noproxy',
         'npm-path',
@@ -275,21 +277,26 @@ export async function handler(opts, params, commands) {
         for (const pkg of opts.allowBuild) {
             mergedAllowBuilds[pkg] = true;
         }
-        return installDeps({
+        await installDeps({
             ...opts,
             allowBuilds: mergedAllowBuilds,
             rebuildHandler: commands?.rebuild,
             fetchFullMetadata: getFetchFullMetadata(opts),
             include,
             includeDirect: include,
+            // `--dry-run` is an `install`-only preview; never let a config-level
+            // `dry-run` turn `add` into a no-op check.
+            dryRun: false,
         }, params);
+        return;
     }
-    return installDeps({
+    await installDeps({
         ...opts,
         rebuildHandler: commands?.rebuild,
         fetchFullMetadata: getFetchFullMetadata(opts),
         include,
         includeDirect: include,
+        dryRun: false,
     }, params);
 }
 //# sourceMappingURL=add.js.map

package/lib/dedupe.js

@@ -49,13 +49,15 @@ export async function handler(opts, _params, commands) {
         devDependencies: opts.dev !== false,
         optionalDependencies: opts.optional !== false,
     };
-    return installDeps({
+    await installDeps({
         ...opts,
         rebuildHandler: commands?.rebuild,
         dedupe: true,
         include,
         includeDirect: include,
         lockfileCheck: opts.check ? dedupeDiffCheck : undefined,
+        // `--dry-run` is an `install`-only preview; `dedupe` has its own `--check`.
+        dryRun: false,
     }, []);
 }
 //# sourceMappingURL=dedupe.js.map

package/lib/import/index.js

@@ -12,8 +12,8 @@ import { findWorkspaceProjects } from '@pnpm/workspace.projects-reader';
 import { sequenceGraph } from '@pnpm/workspace.projects-sorter';
 import * as structUtils from '@yarnpkg/core/structUtils';
 import { parse as parseYarnLockfile } from '@yarnpkg/lockfile';
-import { parseSyml } from '@yarnpkg/parsers';
 import { rimraf } from '@zkochan/rimraf';
+import yaml from 'js-yaml';
 import { loadJsonFile } from 'load-json-file';
 import { map as mapValues } from 'ramda';
 import { renderHelp } from 'render-help';
@@ -135,7 +135,7 @@ async function readYarnLockFile(dir) {
     throw new PnpmError('YARN_LOCKFILE_NOT_FOUND', 'No yarn.lock found');
 }
 function parseYarn2Lock(lockFileContents) {
-    const parseYarnLock = parseSyml(lockFileContents);
+    const parseYarnLock = parseYarn2Yaml(lockFileContents);
     delete parseYarnLock.__metadata;
     const dependencies = {};
     const { parseDescriptor, parseRange } = structUtils;
@@ -151,6 +151,18 @@ function parseYarn2Lock(lockFileContents) {
         type: YarnLockType.yarn2,
     };
 }
+function parseYarn2Yaml(lockFileContents) {
+    const parseYarnLock = yaml.load(lockFileContents, {
+        schema: yaml.FAILSAFE_SCHEMA,
+        json: true,
+    });
+    if (parseYarnLock == null)
+        return {};
+    if (typeof parseYarnLock !== 'object' || Array.isArray(parseYarnLock)) {
+        throw new PnpmError('YARN_LOCKFILE_PARSE_FAILED', `Expected an indexed object, got ${Array.isArray(parseYarnLock) ? 'an array' : `a ${typeof parseYarnLock}`} instead. Does your file follow YAML's rules?`);
+    }
+    return parseYarnLock;
+}
 async function readNpmLockfile(dir) {
     try {
         return await loadJsonFile(path.join(dir, 'package-lock.json'));
@@ -230,7 +242,7 @@ function selectProjectByDir(projects, searchedDir) {
     const project = projects.find(({ rootDir }) => path.relative(rootDir, searchedDir) === '');
     if (project == null)
         return undefined;
-    return { [searchedDir]: { dependencies: [], package: project } };
+    return { [project.rootDir]: { dependencies: [], package: project } };
 }
 function getYarnLockfileType(lockFileContents) {
     return lockFileContents.includes('__metadata')

package/lib/install.d.ts

@@ -7,7 +7,7 @@ export declare const shorthands: Record<string, string>;
 export declare const commandNames: string[];
 export declare const recursiveByDefault = true;
 export declare function help(): string;
-export type InstallCommandOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'configDependencies' | 'dedupeInjectedDeps' | 'dedupeDirectDeps' | 'dedupePeerDependents' | 'dedupePeers' | 'deployAllFiles' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'engineStrict' | 'excludeLinksFromLockfile' | 'frozenLockfile' | 'global' | 'globalPnpmfile' | 'hoistPattern' | 'hoistingLimits' | 'publicHoistPattern' | 'ignorePnpmfile' | 'ignoreScripts' | 'injectWorkspacePackages' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'optimisticRepeatInstall' | 'modulesDir' | 'nodeLinker' | 'patchedDependencies' | 'preferFrozenLockfile' | 'preferWorkspacePackages' | 'production' | 'registries' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveCatalogName' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'virtualStoreDir' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'resolutionMode' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'updateConfig' | 'overrides' | 'packageExtensions' | 'pnprServer' | 'supportedArchitectures' | 'packageConfigs'> & Pick<ConfigContext, 'allProjects' | 'cliOptions' | 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'allProjectsGraph' | 'selectedProjectsGraph'> & CreateStoreControllerOptions & Partial<Pick<Config, 'globalPkgDir'>> & {
+export type InstallCommandOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'configDependencies' | 'dedupeInjectedDeps' | 'dedupeDirectDeps' | 'dedupePeerDependents' | 'dedupePeers' | 'deployAllFiles' | 'depth' | 'dev' | 'dryRun' | 'enableGlobalVirtualStore' | 'engineStrict' | 'excludeLinksFromLockfile' | 'frozenLockfile' | 'global' | 'globalPnpmfile' | 'hoistPattern' | 'hoistingLimits' | 'publicHoistPattern' | 'ignorePnpmfile' | 'ignoreScripts' | 'injectWorkspacePackages' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'optimisticRepeatInstall' | 'modulesDir' | 'nodeLinker' | 'patchedDependencies' | 'preferFrozenLockfile' | 'preferWorkspacePackages' | 'production' | 'registries' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveCatalogName' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'virtualStoreDir' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'resolutionMode' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'updateConfig' | 'overrides' | 'packageExtensions' | 'pnprServer' | 'supportedArchitectures' | 'packageConfigs'> & Pick<ConfigContext, 'allProjects' | 'cliOptions' | 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'allProjectsGraph' | 'selectedProjectsGraph'> & CreateStoreControllerOptions & Partial<Pick<Config, 'globalPkgDir'>> & {
     argv: {
         cooked?: string[];
         original: string[];
@@ -30,4 +30,4 @@ export type InstallCommandOptions = Pick<Config, 'autoInstallPeers' | 'bail' | '
 } & Partial<Pick<Config, 'ci' | 'modulesCacheMaxAge' | 'pnpmHomeDir' | 'preferWorkspacePackages' | 'strictDepBuilds' | 'useLockfile' | 'symlink'>>;
 export declare function handler(opts: InstallCommandOptions & {
     _calledFromLink?: boolean;
-}, _params?: string[], commands?: CommandHandlerMap): Promise<void>;
+}, _params?: string[], commands?: CommandHandlerMap): Promise<void | string>;

package/lib/install.js

@@ -3,6 +3,8 @@ import { docsUrl } from '@pnpm/cli.utils';
 import { types as allTypes } from '@pnpm/config.reader';
 import { WANTED_LOCKFILE } from '@pnpm/constants';
 import { PnpmError } from '@pnpm/error';
+import { calcDedupeCheckIssues, countDedupeCheckIssues } from '@pnpm/installing.dedupe.check';
+import { renderDedupeCheckIssues } from '@pnpm/installing.dedupe.issues-renderer';
 import { pick } from 'ramda';
 import { renderHelp } from 'render-help';
 import { getFetchFullMetadata } from './getFetchFullMetadata.js';
@@ -41,6 +43,8 @@ export function rcOptionsTypes() {
         'merge-git-branch-lockfiles-branch-pattern',
         'modules-dir',
         'network-concurrency',
+        'node-experimental-package-map',
+        'node-package-map-type',
         'node-linker',
         'noproxy',
         'package-import-method',
@@ -71,6 +75,7 @@ export function rcOptionsTypes() {
         'optional',
         'unsafe-perm',
         'verify-store-integrity',
+        'frozen-store',
         'virtual-store-dir',
         'virtual-store-only',
     ], allTypes);
@@ -78,6 +83,7 @@ export function rcOptionsTypes() {
 export const cliOptionsTypes = () => ({
     ...rcOptionsTypes(),
     ...pick(['force'], allTypes),
+    'dry-run': Boolean,
     'fix-lockfile': Boolean,
     'update-checksums': Boolean,
     'resolution-only': Boolean,
@@ -127,6 +133,10 @@ For options that may be used with `-r`, see "pnpm help recursive"',
                         description: 'Skip reinstall if the workspace state is up-to-date',
                         name: '--optimistic-repeat-install',
                     },
+                    {
+                        description: 'Report what an install would change without writing anything to disk (no lockfile, no node_modules). Resolution still runs against the registry.',
+                        name: '--dry-run',
+                    },
                     {
                         description: '`optionalDependencies` are not installed',
                         name: '--no-optional',
@@ -211,6 +221,10 @@ by any dependencies, so it is an emulation of a flat node_modules',
                         description: 'If false, skips store integrity checks. These checks detect accidental corruption, not tampering by untrusted users with write access to the store',
                         name: '--[no-]verify-store-integrity',
                     },
+                    {
+                        description: 'Open the package store read-only (immutable) and skip all store writes. For installs against a store on a read-only filesystem (e.g. a Nix store); pair with --offline --frozen-lockfile. Incompatible with --force',
+                        name: '--frozen-store',
+                    },
                     {
                         description: 'Fail on missing or invalid peer dependencies',
                         name: '--strict-peer-dependencies',
@@ -265,6 +279,18 @@ Install all optionalDependencies even when they don\'t satisfy the current envir
                         description: 'Re-runs resolution: useful for printing out peer dependency issues',
                         name: '--resolution-only',
                     },
+                    {
+                        description: 'Override CPU architecture of native modules to install. Acceptable values are the same as the `cpu` field of `package.json` (from `process.arch`)',
+                        name: '--cpu <arch>',
+                    },
+                    {
+                        description: 'Override OS of native modules to install. Acceptable values are the same as the `os` field of `package.json` (from `process.platform`)',
+                        name: '--os <os>',
+                    },
+                    {
+                        description: 'Override libc of native modules to install. Acceptable values are the same as the `libc` field of `package.json`',
+                        name: '--libc <libc>',
+                    },
                     ...UNIVERSAL_OPTIONS,
                 ],
             },
@@ -299,6 +325,48 @@ export async function handler(opts, _params, commands) {
         installDepsOptions.lockfileOnly = true;
         installDepsOptions.forceFullResolution = true;
     }
-    return installDeps(installDepsOptions, []);
+    if (opts.dryRun) {
+        return dryRunInstall(installDepsOptions, opts);
+    }
+    await installDeps(installDepsOptions, []);
+}
+/**
+ * Runs a full resolution but writes nothing to disk (no lockfile, no
+ * `node_modules`), then reports what a real install would change. Exits
+ * successfully regardless of whether changes were found — mirroring the
+ * preview semantics of `npm install --dry-run`.
+ */
+async function dryRunInstall(installDepsOptions, opts) {
+    if (opts.pnprServer) {
+        throw new PnpmError('CONFIG_CONFLICT_DRY_RUN_WITH_PNPR_SERVER', 'Cannot use --dry-run with a configured pnpr server because the pnpr install path resolves and links through the server');
+    }
+    // `dryRun` makes the installer resolve fully and return the before/after
+    // wanted lockfile without writing anything. `lockfileOnly` keeps it from
+    // materializing `node_modules` and skips the metadata cache (resolution
+    // skips fetching). The optimistic fast path is disabled so resolution
+    // always runs.
+    installDepsOptions.optimisticRepeatInstall = false;
+    installDepsOptions.lockfileOnly = true;
+    installDepsOptions.dryRun = true;
+    const dryRunResult = await installDeps(installDepsOptions, []);
+    if (dryRunResult == null) {
+        // No comparison was produced — this install configuration's resolve path
+        // doesn't surface the dry-run lockfiles (e.g. a workspace without a
+        // shared lockfile). Report that explicitly instead of claiming "up to
+        // date", but keep `--dry-run`'s exit-0 contract.
+        return 'Dry run complete. Could not compute the changes for this install configuration (no shared lockfile to compare).';
+    }
+    return renderDryRunReport(dryRunResult);
+}
+function renderDryRunReport(dryRunResult) {
+    const issues = calcDedupeCheckIssues(dryRunResult.originalLockfile, dryRunResult.wantedLockfile, { includeImporterSpecifiers: true });
+    if (countDedupeCheckIssues(issues) === 0) {
+        return `Dry run complete. ${WANTED_LOCKFILE} is up to date; a real install would make no changes.`;
+    }
+    return [
+        'Dry run complete. A real install would make the following changes (nothing was written to disk):',
+        '',
+        renderDedupeCheckIssues(issues),
+    ].join('\n');
 }
 //# sourceMappingURL=install.js.map

package/lib/installDeps.d.ts

@@ -1,10 +1,10 @@
 import type { CommandHandler } from '@pnpm/cli.command';
 import type { Config, ConfigContext } from '@pnpm/config.reader';
-import { type UpdateMatchingFunction } from '@pnpm/installing.deps-installer';
+import { type DryRunInstallResult, type UpdateMatchingFunction } from '@pnpm/installing.deps-installer';
 import type { LockfileObject } from '@pnpm/lockfile.types';
 import { type CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import type { IncludedDependencies, PackageVulnerabilityAudit } from '@pnpm/types';
-export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'pnprServer' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & Partial<Pick<Config, 'ci'>> & CreateStoreControllerOptions & {
+export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'pnprServer' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & Partial<Pick<Config, 'ci'>> & CreateStoreControllerOptions & {
     argv: {
         cooked?: string[];
         original: string[];
@@ -48,5 +48,5 @@ export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin
      * subcommand — see `runPacquet.ts`'s `noRuntime` opt.
      */
     isInstallCommand?: boolean;
-} & Partial<Pick<Config, 'pnpmHomeDir' | 'strictDepBuilds' | 'useLockfile' | 'useGitBranchLockfile'>>;
-export declare function installDeps(opts: InstallDepsOptions, params: string[]): Promise<void>;
+} & Partial<Pick<Config, 'dryRun' | 'pnpmHomeDir' | 'strictDepBuilds' | 'useLockfile' | 'useGitBranchLockfile' | 'mergeGitBranchLockfiles'>>;
+export declare function installDeps(opts: InstallDepsOptions, params: string[]): Promise<DryRunInstallResult | undefined>;

package/lib/installDeps.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { buildProjects } from '@pnpm/building.after-install';
+import { mergeCatalogs } from '@pnpm/catalogs.config';
 import { readProjectManifestOnly, tryReadProjectManifest, } from '@pnpm/cli.utils';
 import { checkDepsStatus } from '@pnpm/deps.status';
 import { PnpmError } from '@pnpm/error';
@@ -32,6 +33,7 @@ export async function installDeps(opts, params) {
         const { upToDate, wantedLockfileToRestore } = await checkDepsStatus({
             ...opts,
             ignoreFilteredInstallCache: true,
+            treatLocalFileDepsAsOutdated: true,
         });
         if (upToDate && await restoreWantedLockfileIfMissing(wantedLockfileToRestore, opts)) {
             if (opts.hooks?.customResolvers?.some(r => r.shouldRefreshResolution)) {
@@ -95,6 +97,7 @@ export async function installDeps(opts, params) {
             packageName: pacquetConfigDepName,
             argv: { original: opts.argv.original, remain: opts.argv.remain ?? [] },
             isInstallCommand: opts.isInstallCommand === true,
+            virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
         })
         : undefined;
     const includeDirect = opts.includeDirect ?? {
@@ -130,7 +133,7 @@ export async function installDeps(opts, params) {
             const allProjectsGraph = opts.allProjectsGraph ?? createProjectsGraph(allProjects, {
                 linkWorkspacePackages: Boolean(opts.linkWorkspacePackages),
             }).graph;
-            await recursiveInstallThenUpdateWorkspaceState(allProjects, params, {
+            return recursiveInstallThenUpdateWorkspaceState(allProjects, params, {
                 ...opts,
                 preferredVersions: opts.packageVulnerabilityAudit ? preferNonvulnerablePackageVersions(opts.packageVulnerabilityAudit) : undefined,
                 allProjectsGraph,
@@ -139,7 +142,6 @@ export async function installDeps(opts, params) {
                 workspaceDir: opts.workspaceDir,
                 runPacquet,
             }, opts.update ? 'update' : (params.length === 0 ? 'install' : 'add'));
-            return;
         }
     }
     // `pnpm install ""` is going to be just `pnpm install`
@@ -240,8 +242,8 @@ export async function installDeps(opts, params) {
             rootDir: opts.dir,
             targetDependenciesField: getSaveType(opts),
         };
-        const { updatedCatalogs, updatedProject, ignoredBuilds, resolutionPolicyViolations } = await mutateModulesInSingleProject(mutatedProject, installOpts);
-        if (opts.save !== false) {
+        const { updatedCatalogs, updatedProject, ignoredBuilds, resolutionPolicyViolations, dryRunResult } = await mutateModulesInSingleProject(mutatedProject, installOpts);
+        if (opts.save !== false && !opts.dryRun) {
             // Only pick entries when we'll actually persist. Otherwise the
             // info log would claim we added entries the workspace manifest
             // never saw, and the next install would re-prompt or fail
@@ -260,7 +262,7 @@ export async function installDeps(opts, params) {
         if (!opts.lockfileOnly) {
             await updateWorkspaceState({
                 allProjects,
-                settings: opts,
+                settings: withUpdatedCatalogs(opts, updatedCatalogs),
                 workspaceDir: opts.workspaceDir ?? opts.lockfileDir ?? opts.dir,
                 pnpmfiles: opts.pnpmfile,
                 filteredInstall: allProjects.length !== Object.keys(opts.selectedProjectsGraph ?? {}).length,
@@ -268,9 +270,9 @@ export async function installDeps(opts, params) {
             });
         }
         await handleIgnoredBuilds(opts, ignoredBuilds);
-        return;
+        return dryRunResult;
     }
-    const { updatedCatalogs, updatedManifest, ignoredBuilds, resolutionPolicyViolations } = await install(manifest, {
+    const { updatedCatalogs, updatedManifest, ignoredBuilds, resolutionPolicyViolations, dryRunResult } = await install(manifest, {
         ...installOpts,
         updatePackageManifest,
         updateMatching,
@@ -279,7 +281,7 @@ export async function installDeps(opts, params) {
     // from this install" — both package.json and the workspace manifest.
     // Skip the pick so the info log doesn't claim entries were added that
     // were never written; the next install will resurface them.
-    if (opts.save !== false) {
+    if (opts.save !== false && !opts.dryRun) {
         const policyUpdates = policyHandlers?.pickManifestUpdates(resolutionPolicyViolations);
         if (opts.update === true) {
             await Promise.all([
@@ -318,7 +320,7 @@ export async function installDeps(opts, params) {
             selectedProjectsGraph,
             workspaceDir: opts.workspaceDir, // Otherwise TypeScript doesn't understand that is not undefined
             runPacquet,
-        }, 'install');
+        }, 'install', updatedCatalogs);
         if (opts.ignoreScripts)
             return;
         await buildProjects([
@@ -339,7 +341,7 @@ export async function installDeps(opts, params) {
         if (!opts.lockfileOnly) {
             await updateWorkspaceState({
                 allProjects,
-                settings: opts,
+                settings: withUpdatedCatalogs(opts, updatedCatalogs),
                 workspaceDir: opts.workspaceDir ?? opts.lockfileDir ?? opts.dir,
                 pnpmfiles: opts.pnpmfile,
                 filteredInstall: allProjects.length !== Object.keys(opts.selectedProjectsGraph ?? {}).length,
@@ -347,26 +349,39 @@ export async function installDeps(opts, params) {
             });
         }
     }
+    return dryRunResult;
 }
 function selectProjectByDir(projects, searchedDir) {
     const project = projects.find(({ rootDir }) => path.relative(rootDir, searchedDir) === '');
     if (project == null)
         return undefined;
-    return { [searchedDir]: { dependencies: [], package: project } };
+    return { [project.rootDir]: { dependencies: [], package: project } };
 }
-async function recursiveInstallThenUpdateWorkspaceState(allProjects, params, opts, cmdFullName) {
+async function recursiveInstallThenUpdateWorkspaceState(allProjects, params, opts, cmdFullName, updatedCatalogs) {
     const recursiveResult = await recursive(allProjects, params, opts, cmdFullName);
     if (!opts.lockfileOnly) {
         await updateWorkspaceState({
             allProjects,
-            settings: opts,
+            settings: withUpdatedCatalogs(opts, updatedCatalogs, recursiveResult.updatedCatalogs),
             workspaceDir: opts.workspaceDir,
             pnpmfiles: opts.pnpmfile,
             filteredInstall: allProjects.length !== Object.keys(opts.selectedProjectsGraph ?? {}).length,
             configDependencies: opts.configDependencies,
         });
     }
-    return recursiveResult;
+    return recursiveResult.dryRunResult;
+}
+/**
+ * Folds the catalog entries written to `pnpm-workspace.yaml` during this
+ * install into the catalogs read at startup. The workspace state cache records
+ * these so a later install detects when a catalog entry was reverted; without
+ * this, the cache would keep the stale pre-install catalogs and report
+ * "Already up to date" even though the manifest changed.
+ */
+function withUpdatedCatalogs(settings, ...updatedCatalogs) {
+    if (updatedCatalogs.every((catalogs) => catalogs == null))
+        return settings;
+    return { ...settings, catalogs: mergeCatalogs(settings.catalogs, ...updatedCatalogs) };
 }
 function severityStringToNumber(severity) {
     switch (severity) {

package/lib/link.js

@@ -31,6 +31,7 @@ export function cliOptionsTypes() {
         'save-exact',
         'save-optional',
         'save-prefix',
+        'trust-lockfile',
         'unsafe-perm',
     ], allTypes);
 }

package/lib/prune.js

@@ -39,7 +39,7 @@ export function help() {
     });
 }
 export async function handler(opts) {
-    return install.handler({
+    await install.handler({
         ...opts,
         modulesCacheMaxAge: 0,
         pruneDirectDependencies: true,

package/lib/recursive.d.ts

@@ -1,12 +1,13 @@
+import type { Catalogs } from '@pnpm/catalogs.types';
 import type { CommandHandler } from '@pnpm/cli.command';
 import { type Config, type ConfigContext } from '@pnpm/config.reader';
-import { type UpdateMatchingFunction } from '@pnpm/installing.deps-installer';
+import { type DryRunInstallResult, type UpdateMatchingFunction } from '@pnpm/installing.deps-installer';
 import type { PreferredVersions } from '@pnpm/resolving.resolver-base';
 import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 import { type CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import type { StoreController } from '@pnpm/store.controller';
 import type { IncludedDependencies, Project, ProjectManifest, ProjectsGraph } from '@pnpm/types';
-export type RecursiveOptions = CreateStoreControllerOptions & Pick<Config, 'bail' | 'configDependencies' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'globalPnpmfile' | 'hoistPattern' | 'hoistingLimits' | 'ignorePnpmfile' | 'ignoreScripts' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'modulesDir' | 'pnprServer' | 'allowBuilds' | 'registries' | 'runtime' | 'save' | 'saveCatalogName' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sharedWorkspaceLockfile' | 'tag' | 'trustLockfile' | 'cleanupUnusedCatalogs' | 'packageConfigs' | 'updateConfig'> & Pick<ConfigContext, 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir'> & {
+export type RecursiveOptions = CreateStoreControllerOptions & Pick<Config, 'bail' | 'configDependencies' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dryRun' | 'globalPnpmfile' | 'hoistPattern' | 'hoistingLimits' | 'ignorePnpmfile' | 'ignoreScripts' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'modulesDir' | 'pnprServer' | 'allowBuilds' | 'registries' | 'runtime' | 'save' | 'saveCatalogName' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sharedWorkspaceLockfile' | 'tag' | 'trustLockfile' | 'cleanupUnusedCatalogs' | 'packageConfigs' | 'updateConfig'> & Pick<ConfigContext, 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir'> & {
     rebuildHandler?: CommandHandler;
     include?: IncludedDependencies;
     includeDirect?: IncludedDependencies;
@@ -32,14 +33,34 @@ export type RecursiveOptions = CreateStoreControllerOptions & Pick<Config, 'bail
     pnpmfile: string[];
     /**
      * Alternative install engine (today: pacquet) the deps-installer
-     * delegates the materialization phase to. Built in `installDeps`
-     * when `configDependencies.pacquet` is declared, threaded through
-     * here so the recursive workspace path picks it up too.
+     * delegates the install to. Built in `installDeps` when
+     * `configDependencies.pacquet` is declared, threaded through here so
+     * the recursive workspace path picks it up too.
      */
-    runPacquet?: () => Promise<void>;
+    runPacquet?: {
+        supportsResolution: boolean;
+        run: (opts?: {
+            filterResolvedProgress?: boolean;
+            resolve?: boolean;
+        }) => Promise<void>;
+    };
 } & Partial<Pick<Config, 'ci' | 'sort' | 'strictDepBuilds' | 'workspaceConcurrency'>> & Required<Pick<Config, 'workspaceDir'>>;
 export type CommandFullName = 'install' | 'add' | 'remove' | 'update' | 'import';
-export declare function recursive(allProjects: Project[], params: string[], opts: RecursiveOptions, cmdFullName: CommandFullName): Promise<boolean | string>;
+export interface RecursiveResult {
+    passed: boolean | string;
+    /**
+     * Catalog entries written to `pnpm-workspace.yaml` during this install.
+     * The caller folds these into the catalogs recorded in the workspace state
+     * cache so that reverting a catalog entry is detected as an outdated state.
+     */
+    updatedCatalogs?: Catalogs;
+    /**
+     * Present only for a `dryRun` install over a shared workspace lockfile:
+     * the before/after wanted lockfiles for the caller to diff.
+     */
+    dryRunResult?: DryRunInstallResult;
+}
+export declare function recursive(allProjects: Project[], params: string[], opts: RecursiveOptions, cmdFullName: CommandFullName): Promise<RecursiveResult>;
 export declare function matchDependencies(match: (input: string) => string | null, manifest: ProjectManifest, include: IncludedDependencies): string[];
 export type UpdateDepsMatcher = (input: string) => string | null;
 export declare function createMatcher(params: string[]): UpdateDepsMatcher;

package/lib/recursive.js

@@ -1,5 +1,6 @@
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
+import { mergeCatalogs } from '@pnpm/catalogs.config';
 import { throwOnCommandFail, } from '@pnpm/cli.utils';
 import { createMatcherWithIndex } from '@pnpm/config.matcher';
 import { createProjectConfigRecord, getWorkspaceConcurrency, } from '@pnpm/config.reader';
@@ -23,11 +24,11 @@ import { createWorkspaceSpecs, updateToWorkspacePackagesFromManifest } from './u
 export async function recursive(allProjects, params, opts, cmdFullName) {
     if (allProjects.length === 0) {
         // It might make sense to throw an exception in this case
-        return false;
+        return { passed: false };
     }
     const pkgs = Object.values(opts.selectedProjectsGraph).map((wsPkg) => wsPkg.package);
     if (pkgs.length === 0) {
-        return false;
+        return { passed: false };
     }
     const manifestsByPath = getManifestsByPath(allProjects);
     const throwOnFail = throwOnCommandFail.bind(null, `pnpm recursive ${cmdFullName}`);
@@ -88,7 +89,7 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
         const isFromWorkspace = isSubdir.bind(null, calculatedRepositoryRoot);
         importers = await pFilter(importers, async ({ rootDirRealPath }) => isFromWorkspace(rootDirRealPath));
         if (importers.length === 0)
-            return true;
+            return { passed: true };
         let mutation;
         switch (cmdFullName) {
             case 'remove':
@@ -176,12 +177,12 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
         if ((mutatedImporters.length === 0) && cmdFullName === 'update' && opts.depth === 0) {
             throw new PnpmError('NO_PACKAGE_IN_DEPENDENCIES', 'None of the specified packages were found in the dependencies of any of the projects.');
         }
-        const { updatedCatalogs, updatedProjects: mutatedPkgs, ignoredBuilds, resolutionPolicyViolations, } = await mutateModules(mutatedImporters, {
+        const { updatedCatalogs, updatedProjects: mutatedPkgs, ignoredBuilds, resolutionPolicyViolations, dryRunResult, } = await mutateModules(mutatedImporters, {
             ...installOpts,
             storeController: store.ctrl,
             resolutionVerifiers: store.resolutionVerifiers,
         });
-        if (opts.save !== false) {
+        if (opts.save !== false && !opts.dryRun) {
             // Only pick entries when we'll actually persist. Otherwise the
             // info log would claim entries were added that the workspace
             // manifest never saw, and the next install would re-prompt or
@@ -199,7 +200,7 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
             await Promise.all(promises);
         }
         await handleIgnoredBuilds(opts, ignoredBuilds);
-        return true;
+        return { passed: true, updatedCatalogs, dryRunResult };
     }
     const pkgPaths = Object.keys(opts.selectedProjectsGraph).sort();
     let updatedCatalogs;
@@ -289,8 +290,10 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
             if (opts.save !== false) {
                 await writeProjectManifest(newManifest);
                 if (newCatalogsAddition) {
-                    updatedCatalogs ??= {};
-                    Object.assign(updatedCatalogs, newCatalogsAddition);
+                    // Per-project additions are partial maps keyed by catalog name then
+                    // dependency. Merge at the dependency level so two projects updating
+                    // different entries of the same catalog don't clobber each other.
+                    updatedCatalogs = mergeCatalogs(updatedCatalogs, newCatalogsAddition);
                 }
             }
             if (ignoredBuilds?.size) {
@@ -346,7 +349,7 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
     if (!Object.values(result).filter(({ status }) => status === 'passed').length && cmdFullName === 'update' && opts.depth === 0) {
         throw new PnpmError('NO_PACKAGE_IN_DEPENDENCIES', 'None of the specified packages were found in the dependencies of any of the projects.');
     }
-    return true;
+    return { passed: true, updatedCatalogs };
 }
 function calculateRepositoryRoot(workspaceDir, projectDirs) {
     // assume repo root is workspace dir

package/lib/remove.js

@@ -39,6 +39,8 @@ export function rcOptionsTypes() {
         'lockfile-dir',
         'lockfile-only',
         'lockfile',
+        'node-experimental-package-map',
+        'node-package-map-type',
         'node-linker',
         'package-import-method',
         'pnpmfile',
@@ -137,6 +139,9 @@ export async function handler(opts, params) {
         storeDir: store.dir,
         resolutionVerifiers: store.resolutionVerifiers,
         include,
+        // `--dry-run` is an `install`-only preview; never let a config-level
+        // `dry-run` turn `remove` into a no-op check.
+        dryRun: false,
     });
     const allProjects = opts.allProjects ?? (opts.workspaceDir
         ? await findWorkspaceProjects(opts.workspaceDir, { ...opts, patterns: opts.workspacePackagePatterns })

package/lib/runPacquet.d.ts

@@ -1,5 +1,12 @@
 export interface MakeRunPacquetOpts {
     lockfileDir: string;
+    /**
+     * Effective pnpm config value. Forwarded through `PNPM_CONFIG_*` so
+     * pacquet writes the same `.modules.yaml` and virtual-store paths as
+     * the pnpm process that delegated to it, including Windows' shorter
+     * default.
+     */
+    virtualStoreDirMaxLength: number;
     /**
      * Which `configDependencies` entry installed pacquet: either the
      * original unscoped `pacquet` or the official scoped
@@ -32,21 +39,6 @@ export interface MakeRunPacquetOpts {
      */
     isInstallCommand: boolean;
 }
-/**
- * Build the install-engine callback `mutateModules` invokes when
- * `configDependencies` declares pacquet.
- *
- * The callback spawns the pacquet binary installed under
- * `node_modules/.pnpm-config/pacquet`. From `pnpm install`/`pnpm i` it
- * forwards the user's own pnpm CLI flags to pacquet's `install`
- * subcommand; from `add`/`update`/`dedupe` it doesn't forward (warning
- * instead). Pacquet's NDJSON stderr is parsed line-by-line and the
- * valid JSON records are re-emitted on pnpm's global `streamParser` so
- * `@pnpm/cli.default-reporter` renders pacquet's events the same way it
- * renders pnpm's own. Non-JSON stderr lines (panic backtraces,
- * unexpected diagnostics) are forwarded to the real stderr verbatim so
- * they reach the user.
- */
 /** Args the deps-installer passes per pacquet invocation. */
 export interface RunPacquetCallOpts {
     /**
@@ -60,5 +52,51 @@ export interface RunPacquetCallOpts {
      * source.
      */
     filterResolvedProgress?: boolean;
+    /**
+     * `true` to let pacquet perform the resolution itself rather than
+     * materialize an already-resolved lockfile. Drops the injected
+     * `--frozen-lockfile`, so pacquet resolves the manifests, writes
+     * `pnpm-lock.yaml`, and materializes in a single pass. Only valid
+     * when {@link PacquetEngine.supportsResolution} is `true` (pacquet
+     * >= 0.11.7).
+     */
+    resolve?: boolean;
 }
-export declare function makeRunPacquet(opts: MakeRunPacquetOpts): (callOpts?: RunPacquetCallOpts) => Promise<void>;
+/**
+ * Handle to the pacquet install engine: its capabilities plus the
+ * callback `mutateModules` invokes to run it.
+ */
+export interface PacquetEngine {
+    /**
+     * `true` when the installed pacquet is new enough (>= 0.11.7) to
+     * perform dependency resolution itself. When `false`, pacquet can
+     * only materialize an already-resolved lockfile, so the deps-installer
+     * runs its own resolve pass first and hands the written lockfile to
+     * pacquet.
+     */
+    supportsResolution: boolean;
+    run: (callOpts?: RunPacquetCallOpts) => Promise<void>;
+}
+/**
+ * Build the pacquet install engine `mutateModules` delegates to when
+ * `configDependencies` declares pacquet.
+ *
+ * `run` spawns the pacquet binary installed under
+ * `node_modules/.pnpm-config/pacquet`. From `pnpm install`/`pnpm i` it
+ * forwards the user's own pnpm CLI flags to pacquet's `install`
+ * subcommand; from `add`/`update`/`dedupe` it doesn't forward (warning
+ * instead). Pacquet's NDJSON stderr is parsed line-by-line and the
+ * valid JSON records are re-emitted on pnpm's global `streamParser` so
+ * `@pnpm/cli.default-reporter` renders pacquet's events the same way it
+ * renders pnpm's own. Non-JSON stderr lines (panic backtraces,
+ * unexpected diagnostics) are forwarded to the real stderr verbatim so
+ * they reach the user.
+ */
+export declare function makeRunPacquet(opts: MakeRunPacquetOpts): PacquetEngine;
+/**
+ * Name of the `@pacquet/<platform>-<arch>[-musl]` package that holds the
+ * native pacquet binary for the host. On linux the binary packages are
+ * split by libc and only the matching one is installed, so spawning and
+ * signature verification must agree on this exact name.
+ */
+export declare function pacquetPlatformPkgName(): string;

package/lib/runPacquet.js

@@ -6,12 +6,34 @@ import readline from 'node:readline';
 import { PnpmError } from '@pnpm/error';
 import { logger, streamParser } from '@pnpm/logger';
 import chalk from 'chalk';
+import { familySync as getLibcFamilySync, MUSL } from 'detect-libc';
 // The runtime `streamParser` is a `Transform` stream (split2 + JSON.parse).
 // Its public typing only exposes `on`/`removeListener`, so we narrow to the
 // writable side here to feed pacquet's NDJSON lines back through the same
 // parser that `@pnpm/cli.default-reporter` listens on.
 const streamParserWritable = streamParser;
+/**
+ * Build the pacquet install engine `mutateModules` delegates to when
+ * `configDependencies` declares pacquet.
+ *
+ * `run` spawns the pacquet binary installed under
+ * `node_modules/.pnpm-config/pacquet`. From `pnpm install`/`pnpm i` it
+ * forwards the user's own pnpm CLI flags to pacquet's `install`
+ * subcommand; from `add`/`update`/`dedupe` it doesn't forward (warning
+ * instead). Pacquet's NDJSON stderr is parsed line-by-line and the
+ * valid JSON records are re-emitted on pnpm's global `streamParser` so
+ * `@pnpm/cli.default-reporter` renders pacquet's events the same way it
+ * renders pnpm's own. Non-JSON stderr lines (panic backtraces,
+ * unexpected diagnostics) are forwarded to the real stderr verbatim so
+ * they reach the user.
+ */
 export function makeRunPacquet(opts) {
+    return {
+        supportsResolution: pacquetSupportsResolution(resolvePacquetVersion(opts.lockfileDir, opts.packageName)),
+        run: makeRun(opts),
+    };
+}
+function makeRun(opts) {
     return async (callOpts) => {
         const pacquetBin = resolvePacquetBin(opts.lockfileDir, opts.packageName);
         // From `pnpm install`/`pnpm i` we forward the user's flags through to
@@ -19,21 +41,23 @@ export function makeRunPacquet(opts) {
         // surface closely enough on that command that they're safe to pass
         // along. From `add`/`update`/`dedupe` we don't forward anything: those
         // commands carry flags pacquet's `install` doesn't recognize
-        // (`--save-dev`, `--save-peer`, etc.) which clap would reject. Either
-        // way pacquet picks up the settings users care about from
-        // `pnpm-workspace.yaml` / `.npmrc` on its own, so a non-install
-        // delegation isn't broken by the omission.
+        // (`--save-dev`, `--save-peer`, etc.) which clap would reject.
         const forwardedFlags = opts.isInstallCommand ? collectForwardedFlags(opts.argv) : [];
-        // `--ignore-manifest-check` tells pacquet to skip its per-importer
-        // `package.json` ↔ `pnpm-lock.yaml` freshness gate. pnpm just
-        // resolved and wrote the lockfile itself; on `pnpm up` / `add` /
-        // `remove` the manifest on disk is still the pre-mutation copy
-        // (pnpm writes it after `mutateModules` returns), so pacquet's own
-        // check would always fire here. See
+        // In resolve mode pacquet does the resolution itself, so it must not
+        // be pinned to the existing lockfile — drop both injected flags.
+        //
+        // Otherwise (frozen materialization) inject `--frozen-lockfile` plus
+        // `--ignore-manifest-check`. The latter tells pacquet to skip its
+        // per-importer `package.json` ↔ `pnpm-lock.yaml` freshness gate:
+        // pnpm just resolved and wrote the lockfile itself; on `pnpm up` /
+        // `add` / `remove` the manifest on disk is still the pre-mutation
+        // copy (pnpm writes it after `mutateModules` returns), so pacquet's
+        // own check would always fire here. See
         // https://github.com/pnpm/pnpm/issues/11797. The flag is narrow
         // (only the manifest check); settings drift like `overrides` is
         // still enforced and was already re-validated by pnpm.
-        const args = ['--reporter=ndjson', 'install', '--frozen-lockfile', '--ignore-manifest-check', ...forwardedFlags];
+        const frozenArgs = callOpts?.resolve === true ? [] : ['--frozen-lockfile', '--ignore-manifest-check'];
+        const args = ['--reporter=ndjson', 'install', ...frozenArgs, ...forwardedFlags];
         const droppedFlags = opts.isInstallCommand ? [] : collectDroppedFlags(opts.argv);
         if (droppedFlags.length > 0) {
             logger.warn({
@@ -53,6 +77,7 @@ export function makeRunPacquet(opts) {
         logger.info({ message: banner, prefix: opts.lockfileDir });
         const child = spawn(pacquetBin, args, {
             cwd: opts.lockfileDir,
+            env: makePacquetEnv(opts),
             stdio: ['ignore', 'inherit', 'pipe'],
         });
         const filterResolved = callOpts?.filterResolvedProgress === true;
@@ -89,6 +114,16 @@ export function makeRunPacquet(opts) {
         });
     };
 }
+function makePacquetEnv(opts) {
+    const env = { ...process.env };
+    for (const key of Object.keys(env)) {
+        if (key.toLowerCase() === 'pnpm_config_virtual_store_dir_max_length') {
+            delete env[key];
+        }
+    }
+    env.PNPM_CONFIG_VIRTUAL_STORE_DIR_MAX_LENGTH = String(opts.virtualStoreDirMaxLength);
+    return env;
+}
 /**
  * Path of the platform-specific native pacquet binary for the host. The
  * pacquet npm package ships a Node wrapper at `bin/pacquet` that uses
@@ -108,7 +143,47 @@ export function makeRunPacquet(opts) {
 function resolvePacquetBin(lockfileDir, packageName) {
     const ext = process.platform === 'win32' ? '.exe' : '';
     const pacquetPkg = fs.realpathSync(path.join(lockfileDir, 'node_modules/.pnpm-config', packageName, 'package.json'));
-    return createRequire(pacquetPkg).resolve(`@pacquet/${process.platform}-${process.arch}/pacquet${ext}`);
+    return createRequire(pacquetPkg).resolve(`${pacquetPlatformPkgName()}/pacquet${ext}`);
+}
+/**
+ * Name of the `@pacquet/<platform>-<arch>[-musl]` package that holds the
+ * native pacquet binary for the host. On linux the binary packages are
+ * split by libc and only the matching one is installed, so spawning and
+ * signature verification must agree on this exact name.
+ */
+export function pacquetPlatformPkgName() {
+    const libc = process.platform === 'linux' && getLibcFamilySync() === MUSL ? '-musl' : '';
+    return `@pacquet/${process.platform}-${process.arch}${libc}`;
+}
+/**
+ * Read the installed pacquet's version from its `package.json` under
+ * `node_modules/.pnpm-config/<packageName>`. Returns `undefined` if it
+ * can't be read — callers treat that as "assume the older,
+ * materialization-only pacquet" so a missing/garbled manifest degrades
+ * to the safe path rather than failing the install.
+ */
+function resolvePacquetVersion(lockfileDir, packageName) {
+    try {
+        const pacquetPkg = fs.realpathSync(path.join(lockfileDir, 'node_modules/.pnpm-config', packageName, 'package.json'));
+        const { version } = JSON.parse(fs.readFileSync(pacquetPkg, 'utf8'));
+        return version;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * pacquet gained full resolving installs in 0.11.7; earlier releases
+ * stay on pnpm's resolve-then-materialize path. Pre-release builds of
+ * 0.11.7 (e.g. `0.11.7-rc.1`) count as supporting it.
+ */
+function pacquetSupportsResolution(version) {
+    if (version == null)
+        return false;
+    const [major, minor, patch] = version.split('.', 3).map((part) => parseInt(part, 10));
+    if (Number.isNaN(major) || Number.isNaN(minor) || Number.isNaN(patch))
+        return false;
+    return major > 0 || (major === 0 && (minor > 11 || (minor === 11 && patch >= 7)));
 }
 /**
  * From `pnpm install`/`pnpm i`, return everything in argv that should

package/lib/update/index.js

@@ -38,6 +38,8 @@ export function rcOptionsTypes() {
         'lockfile',
         'lockfile-include-tarball-url',
         'network-concurrency',
+        'node-experimental-package-map',
+        'node-package-map-type',
         'noproxy',
         'npm-path',
         'offline',
@@ -135,6 +137,10 @@ dependencies is not found inside the workspace',
                         name: '--interactive',
                         shortAlias: '-i',
                     },
+                    {
+                        description: 'Don\'t update the ranges in package.json.',
+                        name: '--no-save',
+                    },
                     OPTIONS.globalDir,
                     ...UNIVERSAL_OPTIONS,
                 ],
@@ -205,6 +211,11 @@ async function interactiveUpdate(input, opts, rebuildHandler) {
                 flatChoices.push({
                     name: choice.message,
                     value: choice.value,
+                    // `name` is the rendered table row (label + versions + workspace + url)
+                    // that lays out a single choice during selection. After submission
+                    // @inquirer/prompts comma-joins each choice's `short`, which without
+                    // this defaults to `name` and dumps the whole table back to stdout.
+                    short: choice.value,
                 });
             }
         }
@@ -271,7 +282,7 @@ async function update(dependencies, opts, rebuildHandler) {
     else if ((dependencies.length > 0) && dependencies.every(dep => !dep.substring(1).includes('@')) && depth > 0 && !opts.latest) {
         updateMatching = createMatcher(dependencies);
     }
-    return installDeps({
+    await installDeps({
         ...opts,
         rebuildHandler,
         allowNew: false,
@@ -284,6 +295,9 @@ async function update(dependencies, opts, rebuildHandler) {
         updateMatching,
         updatePackageManifest: opts.save !== false,
         resolutionMode: opts.save === false ? 'highest' : opts.resolutionMode,
+        // `--dry-run` is an `install`-only preview; never let a config-level
+        // `dry-run` turn `update` into a no-op check.
+        dryRun: false,
     }, dependencies);
 }
 function makeIncludeDependenciesFromCLI(opts) {

package/lib/verifyPacquetIdentity.js

@@ -4,6 +4,7 @@ import { PnpmError } from '@pnpm/error';
 import { readEnvLockfile } from '@pnpm/lockfile.fs';
 import { logger } from '@pnpm/logger';
 import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { pacquetPlatformPkgName } from './runPacquet.js';
 /**
  * Decides whether pnpm may spawn the pacquet binary installed under
  * `node_modules/.pnpm-config/<packageName>` as an install engine.
@@ -60,7 +61,7 @@ async function collectPacquetPackagesToVerify(packageName, rootDir, registries)
         return undefined;
     // Only the host's platform binary is ever spawned, so that's the one whose
     // identity matters. If it isn't in the lockfile, pacquet couldn't run here.
-    const platformPkgName = `@pacquet/${process.platform}-${process.arch}`;
+    const platformPkgName = pacquetPlatformPkgName();
     const platformVersion = envLockfile.snapshots[shimKey]?.optionalDependencies?.[platformPkgName];
     if (platformVersion == null)
         return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.commands",
-  "version": "1100.8.0",
+  "version": "1100.10.0",
   "description": "Commands for installation",
   "keywords": [
     "pnpm",
@@ -30,16 +30,17 @@
     "@inquirer/prompts": "^8.4.3",
     "@pnpm/colorize-semver-diff": "^2.0.0",
     "@pnpm/semver-diff": "^2.0.0",
-    "@pnpm/util.lex-comparator": "^3.0.2",
-    "@yarnpkg/core": "4.5.0",
+    "@pnpm/util.lex-comparator": "^4.0.1",
+    "@yarnpkg/core": "4.8.0",
     "@yarnpkg/lockfile": "^1.1.0",
-    "@yarnpkg/parsers": "3.0.3",
     "@zkochan/rimraf": "^4.0.0",
     "@zkochan/table": "^2.0.1",
     "chalk": "^5.6.2",
     "ci-info": "^4.4.0",
+    "detect-libc": "^2.1.2",
     "get-npm-tarball-url": "^2.1.0",
     "is-subdir": "^2.0.0",
+    "js-yaml": "npm:@zkochan/js-yaml@0.0.11",
     "load-json-file": "^7.0.1",
     "normalize-path": "^3.0.0",
     "p-filter": "^4.1.0",
@@ -47,62 +48,65 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "version-selector-type": "^3.0.0",
-    "@pnpm/building.after-install": "1101.0.21",
+    "@pnpm/building.after-install": "1102.0.1",
+    "@pnpm/building.policy": "1100.0.10",
+    "@pnpm/catalogs.config": "1100.0.1",
     "@pnpm/cli.command": "1100.0.1",
-    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/cli.common-cli-options-help": "1100.0.2",
+    "@pnpm/cli.utils": "1101.0.12",
     "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/cli.utils": "1101.0.11",
-    "@pnpm/config.pick-registry-for-package": "1100.0.8",
+    "@pnpm/config.pick-registry-for-package": "1100.0.9",
+    "@pnpm/config.reader": "1101.10.0",
+    "@pnpm/config.writer": "1100.0.13",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/config.reader": "1101.8.0",
-    "@pnpm/deps.inspection.outdated": "1100.1.7",
-    "@pnpm/config.writer": "1100.0.12",
-    "@pnpm/deps.path": "1100.0.7",
-    "@pnpm/deps.status": "1100.1.0",
+    "@pnpm/deps.inspection.outdated": "1100.1.9",
+    "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/deps.status": "1100.1.2",
+    "@pnpm/deps.security.signatures": "1101.2.2",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/fs.read-modules-dir": "1100.0.1",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/deps.security.signatures": "1101.2.1",
+    "@pnpm/global.commands": "1100.0.29",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/hooks.pnpmfile": "1100.0.14",
-    "@pnpm/installing.context": "1100.0.17",
-    "@pnpm/installing.dedupe.check": "1100.0.10",
-    "@pnpm/global.commands": "1100.0.27",
-    "@pnpm/installing.env-installer": "1101.1.8",
-    "@pnpm/lockfile.fs": "1100.1.4",
-    "@pnpm/network.fetch": "1100.1.2",
-    "@pnpm/pkg-manifest.reader": "1100.0.7",
-    "@pnpm/pkg-manifest.utils": "1100.2.4",
-    "@pnpm/resolving.npm-resolver": "1101.5.2",
-    "@pnpm/installing.deps-installer": "1101.9.0",
+    "@pnpm/hooks.pnpmfile": "1100.0.15",
+    "@pnpm/installing.dedupe.check": "1100.1.0",
+    "@pnpm/installing.dedupe.issues-renderer": "1100.0.1",
+    "@pnpm/installing.deps-installer": "1102.1.0",
+    "@pnpm/installing.context": "1100.0.19",
+    "@pnpm/lockfile.fs": "1100.1.6",
+    "@pnpm/lockfile.types": "1100.0.11",
+    "@pnpm/installing.env-installer": "1102.0.1",
+    "@pnpm/network.fetch": "1100.1.3",
+    "@pnpm/pkg-manifest.reader": "1100.0.8",
+    "@pnpm/network.auth-header": "1101.1.2",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/resolving.resolver-base": "1100.4.1",
-    "@pnpm/store.connection-manager": "1100.2.8",
-    "@pnpm/network.auth-header": "1101.1.1",
-    "@pnpm/store.controller": "1101.0.13",
-    "@pnpm/types": "1101.3.1",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.12",
-    "@pnpm/workspace.project-manifest-writer": "1100.0.7",
-    "@pnpm/workspace.projects-graph": "1100.0.17",
-    "@pnpm/workspace.projects-reader": "1101.0.11",
-    "@pnpm/workspace.projects-sorter": "1100.0.6",
-    "@pnpm/workspace.root-finder": "1100.0.1",
-    "@pnpm/workspace.state": "1100.0.21",
-    "@pnpm/workspace.workspace-manifest-writer": "1100.0.12",
-    "@pnpm/workspace.projects-filter": "1100.0.20",
-    "@pnpm/building.policy": "1100.0.9",
-    "@pnpm/lockfile.types": "1100.0.10"
+    "@pnpm/resolving.npm-resolver": "1102.0.1",
+    "@pnpm/store.connection-manager": "1100.3.1",
+    "@pnpm/resolving.resolver-base": "1100.4.2",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
+    "@pnpm/pkg-manifest.utils": "1100.2.5",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/workspace.project-manifest-writer": "1100.0.8",
+    "@pnpm/workspace.projects-sorter": "1100.0.7",
+    "@pnpm/workspace.projects-graph": "1100.0.19",
+    "@pnpm/workspace.projects-reader": "1101.0.12",
+    "@pnpm/workspace.state": "1100.0.23",
+    "@pnpm/workspace.projects-filter": "1100.0.22",
+    "@pnpm/workspace.root-finder": "1100.0.2",
+    "@pnpm/store.controller": "1102.0.1",
+    "@pnpm/workspace.workspace-manifest-writer": "1100.0.13"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1"
+    "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
+    "@types/js-yaml": "^4.0.9",
     "@types/normalize-path": "^3.0.2",
     "@types/proxyquire": "^1.3.31",
     "@types/ramda": "0.31.1",
     "@types/yarnpkg__lockfile": "^1.1.9",
-    "@types/zkochan__table": "npm:@types/table@6.0.0",
+    "@types/zkochan__table": "npm:@types/table@6.3.2",
     "delay": "^7.0.0",
     "jest-diff": "^30.4.1",
     "path-name": "^1.0.0",
@@ -113,19 +117,19 @@
     "write-json-file": "^7.0.0",
     "write-package": "7.2.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.15",
-    "@pnpm/installing.commands": "1100.8.0",
+    "@pnpm/installing.commands": "1100.10.0",
+    "@pnpm/installing.modules-yaml": "1100.0.9",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/installing.modules-yaml": "1100.0.8",
-    "@pnpm/store.index": "1100.1.0",
-    "@pnpm/prepare": "1100.0.15",
-    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/assert-project": "1100.0.16",
+    "@pnpm/store.index": "1100.2.0",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1101.0.2",
-    "@pnpm/testing.command-defaults": "1100.0.5",
-    "@pnpm/worker": "1100.1.11",
-    "@pnpm/workspace.projects-filter": "1100.0.20",
-    "@pnpm/testing.registry-mock": "1100.0.5"
+    "@pnpm/prepare": "1100.0.16",
+    "@pnpm/testing.registry-mock": "1100.0.6",
+    "@pnpm/testing.command-defaults": "1100.0.6",
+    "@pnpm/testing.mock-agent": "1101.0.3",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/worker": "1100.2.1",
+    "@pnpm/workspace.projects-filter": "1100.0.22"
   },
   "engines": {
     "node": ">=22.13"