@pnpm/installing.deps-installer 1101.1.1 → 1101.1.2

package/lib/install/index.js

@@ -472,8 +472,9 @@ export async function mutateModules(projects, maybeOpts) {
                 defaultCatalog: opts.catalogs?.default,
             });
             if (opts.catalogMode !== 'manual') {
-                const catalogBareSpecifier = `catalog:${opts.saveCatalogName == null || opts.saveCatalogName === 'default' ? '' : opts.saveCatalogName}`;
                 for (const wantedDep of wantedDeps) {
+                    const perDepCatalogName = getPerDepCatalogName(wantedDep, opts.saveCatalogName);
+                    const catalogBareSpecifier = `catalog:${perDepCatalogName === 'default' ? '' : perDepCatalogName}`;
                     const catalog = resolveFromCatalog(opts.catalogs, { ...wantedDep, bareSpecifier: catalogBareSpecifier });
                     const catalogDepSpecifier = matchCatalogResolveResult(catalog, pickCatalogSpecifier);
                     if (!catalogDepSpecifier ||
@@ -481,7 +482,7 @@ export async function mutateModules(projects, maybeOpts) {
                         semver.validRange(wantedDep.bareSpecifier) &&
                             semver.validRange(catalogDepSpecifier) &&
                             semver.eq(wantedDep.bareSpecifier, catalogDepSpecifier)) {
-                        wantedDep.saveCatalogName = opts.saveCatalogName ?? 'default';
+                        wantedDep.saveCatalogName = perDepCatalogName;
                         continue;
                     }
                     switch (opts.catalogMode) {
@@ -791,6 +792,23 @@ function isWantedDepBareSpecifierSame(prevCatalogs, catalogsConfig, alias, prevB
     const nextCatalogEntrySpec = catalogsConfig?.[catalogName]?.[alias];
     return prevCatalogEntrySpec === nextCatalogEntrySpec;
 }
+/**
+ * Determines the catalog name for a dependency during installSome.
+ *
+ * If the dependency's previous specifier already uses a named catalog
+ * (e.g. "catalog:foo"), that catalog name takes priority over the global
+ * saveCatalogName option. This ensures that interactive updates and
+ * `--latest` upgrades preserve the per-dependency catalog group.
+ */
+function getPerDepCatalogName(wantedDep, globalSaveCatalogName) {
+    if (wantedDep.prevSpecifier) {
+        const catalogFromPrev = parseCatalogProtocol(wantedDep.prevSpecifier);
+        if (catalogFromPrev != null) {
+            return catalogFromPrev;
+        }
+    }
+    return globalSaveCatalogName ?? 'default';
+}
 export async function addDependenciesToPackage(manifest, dependencySelectors, opts) {
     const rootDir = (opts.dir ?? process.cwd());
     const { updatedCatalogs, updatedProjects: projects, ignoredBuilds } = await mutateModules([

package/lib/uninstall/removeDeps.js

@@ -2,29 +2,37 @@ import { packageManifestLogger } from '@pnpm/core-loggers';
 import { DEPENDENCIES_FIELDS, } from '@pnpm/types';
 export async function removeDeps(packageManifest, removedPackages, opts) {
     if (opts.saveType) {
-        if (packageManifest[opts.saveType] == null)
+        // `Object.hasOwn` rules out `__proto__`, `constructor`, etc. on `opts.saveType`,
+        // so the dynamic read can never land on `Object.prototype`.
+        if (!Object.hasOwn(packageManifest, opts.saveType))
+            return packageManifest;
+        const targetDeps = packageManifest[opts.saveType];
+        if (targetDeps == null)
             return packageManifest;
         for (const dependency of removedPackages) {
-            delete packageManifest[opts.saveType][dependency];
+            removeOwnEntry(targetDeps, dependency);
         }
     }
     else {
         for (const depField of DEPENDENCIES_FIELDS) {
-            if (!packageManifest[depField])
+            const fieldDeps = packageManifest[depField];
+            if (!fieldDeps)
                 continue;
             for (const dependency of removedPackages) {
-                delete packageManifest[depField][dependency];
+                removeOwnEntry(fieldDeps, dependency);
             }
         }
     }
     if (packageManifest.peerDependencies != null) {
+        const peerDeps = packageManifest.peerDependencies;
         for (const removedDependency of removedPackages) {
-            delete packageManifest.peerDependencies[removedDependency];
+            removeOwnEntry(peerDeps, removedDependency);
         }
     }
     if (packageManifest.dependenciesMeta != null) {
+        const depsMeta = packageManifest.dependenciesMeta;
         for (const removedDependency of removedPackages) {
-            delete packageManifest.dependenciesMeta[removedDependency];
+            removeOwnEntry(depsMeta, removedDependency);
         }
     }
     packageManifestLogger.debug({
@@ -33,4 +41,15 @@ export async function removeDeps(packageManifest, removedPackages, opts) {
     });
     return packageManifest;
 }
+/**
+ * Remove an entry from a dependency-like record by its key, but only when the
+ * key is an own property. The `Object.hasOwn` guard keeps the `delete` from
+ * reaching into the prototype chain even when the dependency name matches an
+ * inherited property like `__proto__` or `constructor`.
+ */
+function removeOwnEntry(target, key) {
+    if (Object.hasOwn(target, key)) {
+        delete target[key];
+    }
+}
 //# sourceMappingURL=removeDeps.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1101.1.1",
+  "version": "1101.1.2",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -62,60 +62,60 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
     "semver": "^7.7.2",
-    "@pnpm/agent.client": "1.0.4",
-    "@pnpm/bins.linker": "1100.0.5",
+    "@pnpm/bins.linker": "1100.0.6",
+    "@pnpm/agent.client": "1.0.5",
+    "@pnpm/building.after-install": "1101.0.12",
     "@pnpm/bins.remover": "1100.0.3",
-    "@pnpm/building.after-install": "1101.0.11",
-    "@pnpm/building.during-install": "1101.0.9",
     "@pnpm/building.policy": "1100.0.4",
+    "@pnpm/building.during-install": "1101.0.10",
     "@pnpm/catalogs.protocol-parser": "1100.0.0",
     "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/config.normalize-registries": "1100.0.3",
-    "@pnpm/config.parse-overrides": "1100.0.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.0.2",
+    "@pnpm/config.parse-overrides": "1100.0.1",
     "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/core-loggers": "1100.0.2",
     "@pnpm/crypto.object-hasher": "1100.0.0",
     "@pnpm/deps.graph-hasher": "1100.1.5",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
     "@pnpm/deps.path": "1100.0.3",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/exec.lifecycle": "1100.0.9",
+    "@pnpm/exec.lifecycle": "1100.0.10",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
     "@pnpm/fs.symlink-dependency": "1100.0.3",
     "@pnpm/hooks.read-package-hook": "1100.0.3",
     "@pnpm/hooks.types": "1100.0.6",
-    "@pnpm/installing.context": "1100.0.9",
-    "@pnpm/installing.deps-resolver": "1100.0.9",
-    "@pnpm/installing.deps-restorer": "1101.1.1",
+    "@pnpm/installing.deps-resolver": "1100.0.10",
+    "@pnpm/installing.deps-restorer": "1101.1.2",
     "@pnpm/installing.linking.direct-dep-linker": "1100.0.3",
-    "@pnpm/installing.linking.hoist": "1100.0.5",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.0",
+    "@pnpm/installing.context": "1100.0.10",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.1",
+    "@pnpm/installing.linking.hoist": "1100.0.6",
     "@pnpm/installing.modules-yaml": "1100.0.4",
-    "@pnpm/installing.package-requester": "1101.0.5",
+    "@pnpm/installing.package-requester": "1101.0.6",
     "@pnpm/lockfile.filtering": "1100.1.0",
-    "@pnpm/lockfile.fs": "1100.0.7",
-    "@pnpm/lockfile.preferred-versions": "1100.0.8",
+    "@pnpm/lockfile.fs": "1100.0.8",
+    "@pnpm/lockfile.preferred-versions": "1100.0.9",
     "@pnpm/lockfile.pruner": "1100.0.5",
-    "@pnpm/lockfile.settings-checker": "1100.0.9",
-    "@pnpm/lockfile.to-pnp": "1100.0.7",
+    "@pnpm/lockfile.to-pnp": "1100.0.8",
+    "@pnpm/lockfile.settings-checker": "1100.0.10",
     "@pnpm/lockfile.utils": "1100.0.7",
-    "@pnpm/lockfile.verification": "1100.0.9",
+    "@pnpm/lockfile.verification": "1100.0.10",
     "@pnpm/lockfile.walker": "1100.0.5",
     "@pnpm/patching.config": "1100.0.3",
-    "@pnpm/pkg-manifest.utils": "1100.1.2",
-    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
     "@pnpm/resolving.resolver-base": "1100.1.3",
-    "@pnpm/store.controller-types": "1100.0.6",
+    "@pnpm/store.controller-types": "1100.0.7",
+    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
     "@pnpm/types": "1101.1.0",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.4"
+    "@pnpm/pkg-manifest.utils": "1100.1.3",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.5"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.4"
+    "@pnpm/worker": "^1100.1.5"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -138,21 +138,21 @@
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.7",
-    "@pnpm/assert-store": "1100.0.7",
-    "@pnpm/installing.deps-installer": "1101.1.1",
+    "@pnpm/assert-project": "1100.0.8",
+    "@pnpm/installing.deps-installer": "1101.1.2",
+    "@pnpm/assert-store": "1100.0.8",
     "@pnpm/lockfile.types": "1100.0.5",
-    "@pnpm/logger": "1100.0.0",
     "@pnpm/network.git-utils": "1100.0.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.3",
-    "@pnpm/prepare": "1100.0.7",
+    "@pnpm/logger": "1100.0.0",
     "@pnpm/resolving.registry.types": "1100.0.3",
-    "@pnpm/store.cafs": "1100.1.3",
+    "@pnpm/pkg-manifest.reader": "1100.0.3",
+    "@pnpm/store.cafs": "1100.1.4",
+    "@pnpm/prepare": "1100.0.8",
     "@pnpm/store.path": "1100.0.1",
     "@pnpm/test-fixtures": "1100.0.0",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.3",
-    "@pnpm/testing.temp-store": "1100.0.15"
+    "@pnpm/testing.mock-agent": "1100.0.4",
+    "@pnpm/testing.temp-store": "1100.0.16"
   },
   "engines": {
     "node": ">=22.13"