@pnpm/installing.deps-installer 1101.1.2 → 1101.3.0

package/lib/install/verifyLockfileResolutionsCache.js

@@ -0,0 +1,335 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import util from 'node:util';
+import { logger } from '@pnpm/logger';
+/**
+ * On-disk cache of verifyLockfileResolutions results, keyed by lockfile
+ * content hash. Lets repeat installs against an unchanged lockfile skip
+ * the per-package registry round trips entirely — including across git
+ * worktrees, where the same lockfile content lives at different paths.
+ *
+ * Two indexes share the same JSONL records:
+ *
+ * - **by content hash** — the primary index. Recognizing the same
+ *   lockfile content regardless of where it sits on disk is what makes
+ *   worktrees and lockfile copies hit.
+ * - **by absolute path** — a same-machine stat shortcut. When we've
+ *   seen this exact path before with these exact stat values, we
+ *   trust the cached hash and skip reading the lockfile entirely
+ *   (microseconds vs. ms-per-MB). Worktrees that get reinstalled in
+ *   pay the hash cost once, then hit the stat fast path.
+ *
+ * All filesystem operations are synchronous: the cache is consulted
+ * once before verification fan-out and recorded once after — there's
+ * no concurrent install work to overlap with, so blocking the event
+ * loop for the brief read/stat/hash is fine and keeps the call sites
+ * straight-line.
+ *
+ * Persisted as JSON Lines: each verification appends one record;
+ * later records overwrite earlier ones on key collision when read.
+ * Appends of a single line are atomic on POSIX and NTFS, so parallel
+ * pnpm processes (monorepo installs, CI matrices sharing a cache) can
+ * write without coordination.
+ *
+ * Policy-neutral. Every active verifier's `policy` contribution merges
+ * into a single `policy` bag on the record; verifiers sharing a
+ * logical policy (same field name) share the slot — no resolver-level
+ * namespacing.
+ */
+const CACHE_FILE_NAME = 'lockfile-verified.jsonl';
+// Cap the file before it grows large enough to slow down reads. When the
+// cap is exceeded we rewrite the file keeping the N most recently
+// verified entries. The number is generous — a developer machine that
+// touches a thousand distinct (path, content) tuples is far past steady
+// state.
+const MAX_CACHE_ENTRIES = 1000;
+// Records cluster around 250–400 bytes; budget 1 KiB per entry as a
+// conservative upper bound. The compaction check uses `stat().size` to
+// decide whether to read+rewrite, so we never parse the file unless it
+// has actually grown past the cap.
+const COMPACT_TRIGGER_BYTES = MAX_CACHE_ENTRIES * 1024 * 3 / 2;
+/**
+ * Build two indexes over the JSONL records in one pass: by content
+ * hash (primary) and by absolute path (stat shortcut). Records are
+ * walked in file order so the last record for any key wins.
+ */
+function readCache(cacheDir) {
+    const cacheFilePath = path.join(cacheDir, CACHE_FILE_NAME);
+    let contents;
+    try {
+        contents = fs.readFileSync(cacheFilePath, 'utf8');
+    }
+    catch (err) {
+        if (isNodeError(err) && err.code === 'ENOENT')
+            return { byHash: new Map(), byPath: new Map() };
+        throw err;
+    }
+    const byHash = new Map();
+    const byPath = new Map();
+    for (const line of contents.split('\n')) {
+        if (!line)
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            const hash = parsed?.lockfile?.hash;
+            const lockfilePath = parsed?.lockfile?.path;
+            if (typeof hash !== 'string' || typeof lockfilePath !== 'string')
+                continue;
+            const record = normalizeRecord(parsed);
+            byHash.set(hash, record);
+            byPath.set(lockfilePath, record);
+        }
+        catch {
+            // Skip malformed lines; the next clean append will still work.
+        }
+    }
+    return { byHash, byPath };
+}
+function normalizeRecord(parsed) {
+    const lockfile = parsed.lockfile ?? {};
+    return {
+        lockfile: {
+            hash: lockfile.hash ?? '',
+            path: lockfile.path ?? '',
+            size: lockfile.size ?? -1,
+            mtimeNs: lockfile.mtimeNs ?? '',
+            inode: lockfile.inode ?? '',
+        },
+        verifiedAt: parsed.verifiedAt ?? '',
+        policy: parsed.policy && typeof parsed.policy === 'object' ? parsed.policy : {},
+    };
+}
+function statLockfile(lockfilePath) {
+    try {
+        const stat = fs.statSync(lockfilePath, { bigint: true });
+        return {
+            size: Number(stat.size),
+            mtimeNs: stat.mtimeNs.toString(),
+            inode: stat.ino.toString(),
+        };
+    }
+    catch (err) {
+        if (isNodeError(err) && err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+function statMatches(stat, lockfile) {
+    return stat.size === lockfile.size &&
+        stat.mtimeNs === lockfile.mtimeNs &&
+        stat.inode === lockfile.inode;
+}
+/**
+ * Try to confirm a cached verification covers the lockfile as it
+ * currently sits on disk and the policies currently in effect. Returns
+ * `{ hit: true }` to skip the gate; `{ hit: false }` means the caller
+ * should run the verifier and persist the result with
+ * {@link recordVerification}.
+ *
+ * Lookup order:
+ *
+ * 1. **Stat shortcut** — if we've previously verified this exact path
+ *    with these exact stat values, trust the cached hash and skip
+ *    reading the lockfile.
+ * 2. **Content lookup** — hash the lockfile and look up by hash.
+ *    Catches the worktree case (same content, different path) and
+ *    CI checkouts where stat fields got reset. Refreshes the
+ *    stat-shortcut entry on hit so the next install at this path
+ *    skips the hash.
+ *
+ * Every active verifier must agree the cached policy snapshot is still
+ * trustworthy under what it currently demands; if any rejects, the
+ * full gate runs.
+ */
+export function tryLockfileVerificationCache(cacheDir, key) {
+    let indexes;
+    try {
+        indexes = readCache(cacheDir);
+    }
+    catch (err) {
+        // A corrupt cache file should never block the install; fall
+        // through to verification so the gate still runs.
+        logger.debug({ msg: 'lockfile-verified cache: read failed', err });
+        return { hit: false, precomputed: {} };
+    }
+    const stat = statLockfile(key.lockfilePath);
+    if (!stat)
+        return { hit: false, precomputed: {} };
+    // Stat shortcut: same path + same stat means we trust the cached
+    // hash without reading the file. Microseconds.
+    const byPathRecord = indexes.byPath.get(key.lockfilePath);
+    if (byPathRecord && statMatches(stat, byPathRecord.lockfile)) {
+        return {
+            hit: everyVerifierTrustsCachedRun(byPathRecord, key.verifiers),
+            // The stat-match implies the file content is unchanged since the
+            // cached record was written, so its hash is still correct. Pass
+            // it through to skip hashing on the miss-then-record path.
+            precomputed: { stat, hash: byPathRecord.lockfile.hash },
+        };
+    }
+    // Content lookup: hash the in-memory lockfile, look up by content
+    // hash. Catches worktrees (same content, different path) and CI
+    // checkouts (same content, reset stat). On hit, refresh the
+    // path/stat entry so the next install at this path takes the stat
+    // shortcut above.
+    let hash;
+    try {
+        hash = key.hashLockfile();
+    }
+    catch (err) {
+        logger.debug({ msg: 'lockfile-verified cache: lockfile hash failed', err });
+        return { hit: false, precomputed: { stat } };
+    }
+    const byHashRecord = indexes.byHash.get(hash);
+    if (!byHashRecord)
+        return { hit: false, precomputed: { stat, hash } };
+    if (!everyVerifierTrustsCachedRun(byHashRecord, key.verifiers)) {
+        return { hit: false, precomputed: { stat, hash } };
+    }
+    appendRecord(cacheDir, {
+        ...byHashRecord,
+        lockfile: { ...byHashRecord.lockfile, path: key.lockfilePath, size: stat.size, mtimeNs: stat.mtimeNs, inode: stat.inode },
+    });
+    return { hit: true, precomputed: { stat, hash } };
+}
+function everyVerifierTrustsCachedRun(record, verifiers) {
+    for (const verifier of verifiers) {
+        if (!verifier.canTrustPastCheck(record.policy))
+            return false;
+    }
+    return true;
+}
+function mergePolicies(verifiers) {
+    // Later verifiers overwrite earlier ones on conflict — a shared field
+    // should carry the same value across verifiers by convention; mismatch
+    // is a config bug and we don't try to reconcile it here.
+    const merged = {};
+    for (const verifier of verifiers) {
+        Object.assign(merged, verifier.policy);
+    }
+    return merged;
+}
+/**
+ * Persist a successful verification. Called after the gate passes; the
+ * lockfile is hashed once and the resulting record is appended to the
+ * cache file. If the file is past {@link MAX_CACHE_ENTRIES}, it is
+ * rewritten keeping the most recent entries.
+ *
+ * Reuses `precomputed` values from a prior
+ * {@link tryLockfileVerificationCache} lookup so we don't re-stat or
+ * (especially) re-hash the lockfile a second time on the miss-then-
+ * record path.
+ */
+export function recordVerification(cacheDir, key, precomputed) {
+    let stat;
+    let hash;
+    try {
+        stat = precomputed?.stat ?? statLockfile(key.lockfilePath);
+        if (!stat)
+            return;
+        hash = precomputed?.hash ?? key.hashLockfile();
+    }
+    catch (err) {
+        // The gate has already passed; if we can't record the cache entry we
+        // just won't get the speedup next time. Not a reason to fail install.
+        logger.debug({ msg: 'lockfile-verified cache: could not record verification', err });
+        return;
+    }
+    const record = {
+        lockfile: {
+            hash,
+            path: key.lockfilePath,
+            size: stat.size,
+            mtimeNs: stat.mtimeNs,
+            inode: stat.inode,
+        },
+        verifiedAt: new Date().toISOString(),
+        policy: mergePolicies(key.verifiers),
+    };
+    appendRecord(cacheDir, record);
+}
+function appendRecord(cacheDir, record) {
+    const cacheFilePath = path.join(cacheDir, CACHE_FILE_NAME);
+    const line = `${JSON.stringify(record)}\n`;
+    try {
+        fs.mkdirSync(cacheDir, { recursive: true });
+        fs.appendFileSync(cacheFilePath, line);
+    }
+    catch (err) {
+        logger.debug({ msg: 'lockfile-verified cache: append failed', err });
+        return;
+    }
+    maybeCompactCache(cacheDir);
+}
+function maybeCompactCache(cacheDir) {
+    const cacheFilePath = path.join(cacheDir, CACHE_FILE_NAME);
+    // Decide whether to compact from the file size alone — avoids reading
+    // and parsing the file on every successful install. Records cluster
+    // around a few hundred bytes; the byte budget translates directly to
+    // the entry cap with generous slack so we don't trigger a rewrite on
+    // every append once we cross the line.
+    let size;
+    try {
+        size = fs.statSync(cacheFilePath).size;
+    }
+    catch (err) {
+        if (isNodeError(err) && err.code === 'ENOENT')
+            return;
+        logger.debug({ msg: 'lockfile-verified cache: stat for compaction failed', err });
+        return;
+    }
+    if (size <= COMPACT_TRIGGER_BYTES)
+        return;
+    let contents;
+    try {
+        contents = fs.readFileSync(cacheFilePath, 'utf8');
+    }
+    catch (err) {
+        if (isNodeError(err) && err.code === 'ENOENT')
+            return;
+        logger.debug({ msg: 'lockfile-verified cache: read for compaction failed', err });
+        return;
+    }
+    const lines = contents.split('\n').filter(Boolean);
+    // Dedup by (path, hash) — that's the unit both indexes care about.
+    // Walking reverse keeps the newest record per tuple; we then trim to
+    // MAX_CACHE_ENTRIES and write back in original order.
+    const seen = new Set();
+    const reversed = [];
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i];
+        try {
+            const parsed = JSON.parse(line);
+            const lockfilePath = parsed?.lockfile?.path;
+            const hash = parsed?.lockfile?.hash;
+            if (typeof lockfilePath !== 'string' || typeof hash !== 'string')
+                continue;
+            const tupleKey = `${lockfilePath}${hash}`;
+            if (seen.has(tupleKey))
+                continue;
+            seen.add(tupleKey);
+            reversed.push(line);
+        }
+        catch {
+            // Skip malformed lines.
+        }
+    }
+    reversed.reverse();
+    const kept = reversed.slice(-MAX_CACHE_ENTRIES);
+    try {
+        // Write to a sibling tempfile + rename so a concurrent pnpm process
+        // can't observe a half-written file.
+        const tmpPath = `${cacheFilePath}.${process.pid}.tmp`;
+        fs.writeFileSync(tmpPath, kept.map((line) => `${line}\n`).join(''));
+        fs.renameSync(tmpPath, cacheFilePath);
+    }
+    catch (err) {
+        logger.debug({ msg: 'lockfile-verified cache: compaction failed', err });
+    }
+}
+function isNodeError(err) {
+    // `instanceof Error` is unreliable across realms (Jest's VM context), so
+    // route through util.types.isNativeError per the repo guideline.
+    return util.types.isNativeError(err) && 'code' in err;
+}
+//# sourceMappingURL=verifyLockfileResolutionsCache.js.map

package/lib/install/writeLockfilesAndRecordVerified.d.ts

@@ -0,0 +1,14 @@
+import { type LockfileObject, type WriteLockfilesResult } from '@pnpm/lockfile.fs';
+import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
+export interface WriteLockfilesAndRecordVerifiedOptions {
+    wantedLockfile: LockfileObject;
+    wantedLockfileDir: string;
+    currentLockfile: LockfileObject;
+    currentLockfileDir: string;
+    useGitBranchLockfile?: boolean;
+    mergeGitBranchLockfiles?: boolean;
+    cacheDir?: string;
+    resolutionVerifiers: readonly ResolutionVerifier[] | undefined;
+}
+/** Plural counterpart of {@link writeWantedLockfileAndRecordVerified}. */
+export declare function writeLockfilesAndRecordVerified(opts: WriteLockfilesAndRecordVerifiedOptions): Promise<WriteLockfilesResult>;

package/lib/install/writeLockfilesAndRecordVerified.js

@@ -0,0 +1,32 @@
+import path from 'node:path';
+import { getWantedLockfileName, writeLockfiles } from '@pnpm/lockfile.fs';
+import { recordLockfileVerified } from './recordLockfileVerified.js';
+/** Plural counterpart of {@link writeWantedLockfileAndRecordVerified}. */
+export async function writeLockfilesAndRecordVerified(opts) {
+    const cacheActive = opts.cacheDir != null && (opts.resolutionVerifiers?.length ?? 0) > 0;
+    const wantedLockfileName = cacheActive
+        ? await getWantedLockfileName({
+            useGitBranchLockfile: opts.useGitBranchLockfile,
+            mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
+        })
+        : undefined;
+    const written = await writeLockfiles({
+        wantedLockfile: opts.wantedLockfile,
+        wantedLockfileDir: opts.wantedLockfileDir,
+        currentLockfile: opts.currentLockfile,
+        currentLockfileDir: opts.currentLockfileDir,
+        useGitBranchLockfile: opts.useGitBranchLockfile,
+        mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
+        wantedLockfileName,
+    });
+    if (cacheActive) {
+        recordLockfileVerified({
+            cacheDir: opts.cacheDir,
+            lockfilePath: path.resolve(opts.wantedLockfileDir, wantedLockfileName),
+            lockfile: written.wantedLockfile,
+            resolutionVerifiers: opts.resolutionVerifiers,
+        });
+    }
+    return written;
+}
+//# sourceMappingURL=writeLockfilesAndRecordVerified.js.map

package/lib/install/writeWantedLockfileAndRecordVerified.d.ts

@@ -0,0 +1,12 @@
+import { type LockfileObject } from '@pnpm/lockfile.fs';
+import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
+export interface WriteWantedLockfileAndRecordVerifiedOptions {
+    lockfileDir: string;
+    lockfile: LockfileObject;
+    cacheDir?: string;
+    resolutionVerifiers: readonly ResolutionVerifier[] | undefined;
+    useGitBranchLockfile?: boolean;
+    mergeGitBranchLockfiles?: boolean;
+}
+/** Combines {@link writeWantedLockfile} and {@link recordLockfileVerified} — see each for semantics. */
+export declare function writeWantedLockfileAndRecordVerified(opts: WriteWantedLockfileAndRecordVerifiedOptions): Promise<LockfileObject>;

package/lib/install/writeWantedLockfileAndRecordVerified.js

@@ -0,0 +1,28 @@
+import path from 'node:path';
+import { getWantedLockfileName, writeWantedLockfile } from '@pnpm/lockfile.fs';
+import { recordLockfileVerified } from './recordLockfileVerified.js';
+/** Combines {@link writeWantedLockfile} and {@link recordLockfileVerified} — see each for semantics. */
+export async function writeWantedLockfileAndRecordVerified(opts) {
+    const cacheActive = opts.cacheDir != null && (opts.resolutionVerifiers?.length ?? 0) > 0;
+    const lockfileName = cacheActive
+        ? await getWantedLockfileName({
+            useGitBranchLockfile: opts.useGitBranchLockfile,
+            mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
+        })
+        : undefined;
+    const written = await writeWantedLockfile(opts.lockfileDir, opts.lockfile, {
+        useGitBranchLockfile: opts.useGitBranchLockfile,
+        mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
+        lockfileName,
+    });
+    if (cacheActive) {
+        recordLockfileVerified({
+            cacheDir: opts.cacheDir,
+            lockfilePath: path.resolve(opts.lockfileDir, lockfileName),
+            lockfile: written,
+            resolutionVerifiers: opts.resolutionVerifiers,
+        });
+    }
+    return written;
+}
+//# sourceMappingURL=writeWantedLockfileAndRecordVerified.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1101.1.2",
+  "version": "1101.3.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -62,60 +62,60 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
     "semver": "^7.7.2",
-    "@pnpm/bins.linker": "1100.0.6",
-    "@pnpm/agent.client": "1.0.5",
-    "@pnpm/building.after-install": "1101.0.12",
-    "@pnpm/bins.remover": "1100.0.3",
-    "@pnpm/building.policy": "1100.0.4",
-    "@pnpm/building.during-install": "1101.0.10",
+    "@pnpm/agent.client": "1.0.7",
+    "@pnpm/bins.linker": "1100.0.8",
+    "@pnpm/bins.remover": "1100.0.5",
+    "@pnpm/building.after-install": "1101.0.14",
+    "@pnpm/building.during-install": "1101.0.12",
+    "@pnpm/building.policy": "1100.0.6",
     "@pnpm/catalogs.protocol-parser": "1100.0.0",
     "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/config.matcher": "1100.0.1",
     "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/config.normalize-registries": "1100.0.3",
-    "@pnpm/constants": "1100.0.0",
+    "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/config.normalize-registries": "1100.0.4",
     "@pnpm/config.parse-overrides": "1100.0.1",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/core-loggers": "1100.1.1",
     "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/core-loggers": "1100.0.2",
-    "@pnpm/crypto.object-hasher": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.1.5",
+    "@pnpm/deps.graph-hasher": "1100.2.1",
+    "@pnpm/deps.path": "1100.0.4",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.3",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/exec.lifecycle": "1100.0.10",
+    "@pnpm/exec.lifecycle": "1100.0.12",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/fs.symlink-dependency": "1100.0.3",
-    "@pnpm/hooks.read-package-hook": "1100.0.3",
-    "@pnpm/hooks.types": "1100.0.6",
-    "@pnpm/installing.deps-resolver": "1100.0.10",
-    "@pnpm/installing.deps-restorer": "1101.1.2",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.3",
-    "@pnpm/installing.context": "1100.0.10",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.1",
-    "@pnpm/installing.linking.hoist": "1100.0.6",
-    "@pnpm/installing.modules-yaml": "1100.0.4",
-    "@pnpm/installing.package-requester": "1101.0.6",
-    "@pnpm/lockfile.filtering": "1100.1.0",
-    "@pnpm/lockfile.fs": "1100.0.8",
-    "@pnpm/lockfile.preferred-versions": "1100.0.9",
-    "@pnpm/lockfile.pruner": "1100.0.5",
-    "@pnpm/lockfile.to-pnp": "1100.0.8",
-    "@pnpm/lockfile.settings-checker": "1100.0.10",
-    "@pnpm/lockfile.utils": "1100.0.7",
-    "@pnpm/lockfile.verification": "1100.0.10",
-    "@pnpm/lockfile.walker": "1100.0.5",
-    "@pnpm/patching.config": "1100.0.3",
-    "@pnpm/resolving.resolver-base": "1100.1.3",
-    "@pnpm/store.controller-types": "1100.0.7",
+    "@pnpm/fs.symlink-dependency": "1100.0.5",
+    "@pnpm/installing.context": "1100.0.12",
+    "@pnpm/crypto.object-hasher": "1100.0.0",
+    "@pnpm/installing.deps-restorer": "1101.1.4",
+    "@pnpm/hooks.types": "1100.0.8",
+    "@pnpm/installing.deps-resolver": "1100.1.1",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.5",
+    "@pnpm/installing.linking.hoist": "1100.0.8",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.3",
+    "@pnpm/installing.package-requester": "1101.0.8",
+    "@pnpm/installing.modules-yaml": "1100.0.5",
+    "@pnpm/lockfile.filtering": "1100.1.2",
+    "@pnpm/hooks.read-package-hook": "1100.0.4",
+    "@pnpm/lockfile.fs": "1100.1.1",
+    "@pnpm/lockfile.preferred-versions": "1100.0.11",
+    "@pnpm/lockfile.pruner": "1100.0.7",
+    "@pnpm/lockfile.to-pnp": "1100.0.10",
+    "@pnpm/lockfile.utils": "1100.0.9",
+    "@pnpm/lockfile.walker": "1100.0.7",
+    "@pnpm/lockfile.settings-checker": "1100.0.12",
+    "@pnpm/lockfile.verification": "1100.0.12",
+    "@pnpm/patching.config": "1100.0.4",
+    "@pnpm/pkg-manifest.utils": "1100.2.0",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/types": "1101.1.0",
+    "@pnpm/resolving.resolver-base": "1100.3.0",
+    "@pnpm/store.controller-types": "1100.1.1",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/pkg-manifest.utils": "1100.1.3",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.5"
+    "@pnpm/types": "1101.1.1",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.7"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.5"
+    "@pnpm/worker": "^1100.1.7"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -138,21 +138,21 @@
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.8",
-    "@pnpm/installing.deps-installer": "1101.1.2",
-    "@pnpm/assert-store": "1100.0.8",
-    "@pnpm/lockfile.types": "1100.0.5",
-    "@pnpm/network.git-utils": "1100.0.1",
+    "@pnpm/assert-project": "1100.0.10",
+    "@pnpm/assert-store": "1100.0.10",
+    "@pnpm/installing.deps-installer": "1101.3.0",
+    "@pnpm/lockfile.types": "1100.0.7",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/resolving.registry.types": "1100.0.3",
-    "@pnpm/pkg-manifest.reader": "1100.0.3",
-    "@pnpm/store.cafs": "1100.1.4",
-    "@pnpm/prepare": "1100.0.8",
+    "@pnpm/network.git-utils": "1100.0.1",
+    "@pnpm/pkg-manifest.reader": "1100.0.4",
+    "@pnpm/prepare": "1100.0.10",
+    "@pnpm/resolving.registry.types": "1100.0.4",
     "@pnpm/store.path": "1100.0.1",
+    "@pnpm/store.cafs": "1100.1.6",
     "@pnpm/test-fixtures": "1100.0.0",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.4",
-    "@pnpm/testing.temp-store": "1100.0.16"
+    "@pnpm/testing.mock-agent": "1100.0.6",
+    "@pnpm/testing.temp-store": "1100.1.1"
   },
   "engines": {
     "node": ">=22.13"