@pnpm/installing.deps-installer 1101.1.1 → 1101.2.0

package/lib/install/writeWantedLockfileAndRecordVerified.d.ts

@@ -0,0 +1,12 @@
+import { type LockfileObject } from '@pnpm/lockfile.fs';
+import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
+export interface WriteWantedLockfileAndRecordVerifiedOptions {
+    lockfileDir: string;
+    lockfile: LockfileObject;
+    cacheDir?: string;
+    resolutionVerifiers: readonly ResolutionVerifier[] | undefined;
+    useGitBranchLockfile?: boolean;
+    mergeGitBranchLockfiles?: boolean;
+}
+/** Combines {@link writeWantedLockfile} and {@link recordLockfileVerified} — see each for semantics. */
+export declare function writeWantedLockfileAndRecordVerified(opts: WriteWantedLockfileAndRecordVerifiedOptions): Promise<LockfileObject>;

package/lib/install/writeWantedLockfileAndRecordVerified.js

@@ -0,0 +1,28 @@
+import path from 'node:path';
+import { getWantedLockfileName, writeWantedLockfile } from '@pnpm/lockfile.fs';
+import { recordLockfileVerified } from './recordLockfileVerified.js';
+/** Combines {@link writeWantedLockfile} and {@link recordLockfileVerified} — see each for semantics. */
+export async function writeWantedLockfileAndRecordVerified(opts) {
+    const cacheActive = opts.cacheDir != null && (opts.resolutionVerifiers?.length ?? 0) > 0;
+    const lockfileName = cacheActive
+        ? await getWantedLockfileName({
+            useGitBranchLockfile: opts.useGitBranchLockfile,
+            mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
+        })
+        : undefined;
+    const written = await writeWantedLockfile(opts.lockfileDir, opts.lockfile, {
+        useGitBranchLockfile: opts.useGitBranchLockfile,
+        mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
+        lockfileName,
+    });
+    if (cacheActive) {
+        recordLockfileVerified({
+            cacheDir: opts.cacheDir,
+            lockfilePath: path.resolve(opts.lockfileDir, lockfileName),
+            lockfile: written,
+            resolutionVerifiers: opts.resolutionVerifiers,
+        });
+    }
+    return written;
+}
+//# sourceMappingURL=writeWantedLockfileAndRecordVerified.js.map

package/lib/uninstall/removeDeps.js

@@ -2,29 +2,37 @@ import { packageManifestLogger } from '@pnpm/core-loggers';
 import { DEPENDENCIES_FIELDS, } from '@pnpm/types';
 export async function removeDeps(packageManifest, removedPackages, opts) {
     if (opts.saveType) {
-        if (packageManifest[opts.saveType] == null)
+        // `Object.hasOwn` rules out `__proto__`, `constructor`, etc. on `opts.saveType`,
+        // so the dynamic read can never land on `Object.prototype`.
+        if (!Object.hasOwn(packageManifest, opts.saveType))
+            return packageManifest;
+        const targetDeps = packageManifest[opts.saveType];
+        if (targetDeps == null)
             return packageManifest;
         for (const dependency of removedPackages) {
-            delete packageManifest[opts.saveType][dependency];
+            removeOwnEntry(targetDeps, dependency);
         }
     }
     else {
         for (const depField of DEPENDENCIES_FIELDS) {
-            if (!packageManifest[depField])
+            const fieldDeps = packageManifest[depField];
+            if (!fieldDeps)
                 continue;
             for (const dependency of removedPackages) {
-                delete packageManifest[depField][dependency];
+                removeOwnEntry(fieldDeps, dependency);
             }
         }
     }
     if (packageManifest.peerDependencies != null) {
+        const peerDeps = packageManifest.peerDependencies;
         for (const removedDependency of removedPackages) {
-            delete packageManifest.peerDependencies[removedDependency];
+            removeOwnEntry(peerDeps, removedDependency);
         }
     }
     if (packageManifest.dependenciesMeta != null) {
+        const depsMeta = packageManifest.dependenciesMeta;
         for (const removedDependency of removedPackages) {
-            delete packageManifest.dependenciesMeta[removedDependency];
+            removeOwnEntry(depsMeta, removedDependency);
         }
     }
     packageManifestLogger.debug({
@@ -33,4 +41,15 @@ export async function removeDeps(packageManifest, removedPackages, opts) {
     });
     return packageManifest;
 }
+/**
+ * Remove an entry from a dependency-like record by its key, but only when the
+ * key is an own property. The `Object.hasOwn` guard keeps the `delete` from
+ * reaching into the prototype chain even when the dependency name matches an
+ * inherited property like `__proto__` or `constructor`.
+ */
+function removeOwnEntry(target, key) {
+    if (Object.hasOwn(target, key)) {
+        delete target[key];
+    }
+}
 //# sourceMappingURL=removeDeps.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1101.1.1",
+  "version": "1101.2.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -62,12 +62,12 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
     "semver": "^7.7.2",
-    "@pnpm/agent.client": "1.0.4",
-    "@pnpm/bins.linker": "1100.0.5",
-    "@pnpm/bins.remover": "1100.0.3",
-    "@pnpm/building.after-install": "1101.0.11",
-    "@pnpm/building.during-install": "1101.0.9",
-    "@pnpm/building.policy": "1100.0.4",
+    "@pnpm/agent.client": "1.0.6",
+    "@pnpm/bins.linker": "1100.0.7",
+    "@pnpm/bins.remover": "1100.0.4",
+    "@pnpm/building.after-install": "1101.0.13",
+    "@pnpm/building.during-install": "1101.0.11",
+    "@pnpm/building.policy": "1100.0.5",
     "@pnpm/catalogs.protocol-parser": "1100.0.0",
     "@pnpm/catalogs.resolver": "1100.0.0",
     "@pnpm/catalogs.types": "1100.0.0",
@@ -75,47 +75,47 @@
     "@pnpm/config.normalize-registries": "1100.0.3",
     "@pnpm/config.parse-overrides": "1100.0.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.0.2",
+    "@pnpm/core-loggers": "1100.1.0",
     "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/crypto.object-hasher": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.1.5",
+    "@pnpm/deps.graph-hasher": "1100.2.0",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
     "@pnpm/deps.path": "1100.0.3",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/exec.lifecycle": "1100.0.9",
+    "@pnpm/exec.lifecycle": "1100.0.11",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/fs.symlink-dependency": "1100.0.3",
+    "@pnpm/fs.symlink-dependency": "1100.0.4",
     "@pnpm/hooks.read-package-hook": "1100.0.3",
-    "@pnpm/hooks.types": "1100.0.6",
-    "@pnpm/installing.context": "1100.0.9",
-    "@pnpm/installing.deps-resolver": "1100.0.9",
-    "@pnpm/installing.deps-restorer": "1101.1.1",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.3",
-    "@pnpm/installing.linking.hoist": "1100.0.5",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.0",
+    "@pnpm/hooks.types": "1100.0.7",
+    "@pnpm/installing.context": "1100.0.11",
+    "@pnpm/installing.deps-resolver": "1100.1.0",
+    "@pnpm/installing.deps-restorer": "1101.1.3",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.4",
+    "@pnpm/installing.linking.hoist": "1100.0.7",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.2",
     "@pnpm/installing.modules-yaml": "1100.0.4",
-    "@pnpm/installing.package-requester": "1101.0.5",
-    "@pnpm/lockfile.filtering": "1100.1.0",
-    "@pnpm/lockfile.fs": "1100.0.7",
-    "@pnpm/lockfile.preferred-versions": "1100.0.8",
-    "@pnpm/lockfile.pruner": "1100.0.5",
-    "@pnpm/lockfile.settings-checker": "1100.0.9",
-    "@pnpm/lockfile.to-pnp": "1100.0.7",
-    "@pnpm/lockfile.utils": "1100.0.7",
-    "@pnpm/lockfile.verification": "1100.0.9",
-    "@pnpm/lockfile.walker": "1100.0.5",
+    "@pnpm/installing.package-requester": "1101.0.7",
+    "@pnpm/lockfile.filtering": "1100.1.1",
+    "@pnpm/lockfile.fs": "1100.1.0",
+    "@pnpm/lockfile.preferred-versions": "1100.0.10",
+    "@pnpm/lockfile.pruner": "1100.0.6",
+    "@pnpm/lockfile.settings-checker": "1100.0.11",
+    "@pnpm/lockfile.to-pnp": "1100.0.9",
+    "@pnpm/lockfile.utils": "1100.0.8",
+    "@pnpm/lockfile.verification": "1100.0.11",
+    "@pnpm/lockfile.walker": "1100.0.6",
     "@pnpm/patching.config": "1100.0.3",
-    "@pnpm/pkg-manifest.utils": "1100.1.2",
+    "@pnpm/pkg-manifest.utils": "1100.1.4",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/resolving.resolver-base": "1100.1.3",
-    "@pnpm/store.controller-types": "1100.0.6",
-    "@pnpm/types": "1101.1.0",
+    "@pnpm/resolving.resolver-base": "1100.2.0",
+    "@pnpm/store.controller-types": "1100.1.0",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.4"
+    "@pnpm/types": "1101.1.0",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.6"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.4"
+    "@pnpm/worker": "^1100.1.6"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -138,21 +138,21 @@
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.7",
-    "@pnpm/assert-store": "1100.0.7",
-    "@pnpm/installing.deps-installer": "1101.1.1",
-    "@pnpm/lockfile.types": "1100.0.5",
+    "@pnpm/assert-project": "1100.0.9",
+    "@pnpm/assert-store": "1100.0.9",
+    "@pnpm/installing.deps-installer": "1101.2.0",
+    "@pnpm/lockfile.types": "1100.0.6",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/network.git-utils": "1100.0.1",
     "@pnpm/pkg-manifest.reader": "1100.0.3",
-    "@pnpm/prepare": "1100.0.7",
+    "@pnpm/prepare": "1100.0.9",
     "@pnpm/resolving.registry.types": "1100.0.3",
-    "@pnpm/store.cafs": "1100.1.3",
+    "@pnpm/store.cafs": "1100.1.5",
     "@pnpm/store.path": "1100.0.1",
     "@pnpm/test-fixtures": "1100.0.0",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.3",
-    "@pnpm/testing.temp-store": "1100.0.15"
+    "@pnpm/testing.mock-agent": "1100.0.5",
+    "@pnpm/testing.temp-store": "1100.1.0"
   },
   "engines": {
     "node": ">=22.13"