@pnpm/installing.deps-installer 1101.3.0 → 1101.4.0

package/lib/install/extendInstallOptions.d.ts

@@ -184,6 +184,23 @@ export interface StrictInstallOptions {
     trustPolicy?: TrustPolicy;
     trustPolicyExclude?: string[];
     trustPolicyIgnoreAfter?: number;
+    /**
+     * Skip the lockfile supply-chain verification pass entirely. When
+     * true, `verifyLockfileResolutions` is not called even if
+     * `resolutionVerifiers` is non-empty — the install trusts the
+     * lockfile as-is. Trade-off: a poisoned lockfile (e.g. one a
+     * contributor authored under a weaker policy than CI enforces) can
+     * slip through. Use only in environments where the lockfile is
+     * effectively part of the trusted base — closed-source projects
+     * where every commit comes from a trusted author, fully reproducible
+     * CI runs against an already-verified lockfile, etc.
+     *
+     * Added for #11860: on workspaces with thousands of locked entries,
+     * the verification pass holds the per-package registry metadata
+     * needed for the trust check resident in memory and can OOM CI
+     * runners with a 2GB heap cap.
+     */
+    trustLockfile?: boolean;
     packageVulnerabilityAudit?: PackageVulnerabilityAudit;
     blockExoticSubdeps?: boolean;
     /**

package/lib/install/index.js

@@ -193,7 +193,7 @@ export async function mutateModules(projects, maybeOpts) {
         !ctx.lockfileHadConflicts &&
         ctx.existsNonEmptyWantedLockfile &&
         (opts.frozenLockfile === true || opts.frozenLockfileIfExists === true);
-    if (!willDelegateToPacquet) {
+    if (!willDelegateToPacquet && !opts.trustLockfile) {
         const cacheActive = opts.cacheDir != null && opts.resolutionVerifiers.length > 0;
         const wantedLockfilePath = cacheActive
             ? path.resolve(ctx.lockfileDir, await getWantedLockfileName({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1101.3.0",
+  "version": "1101.4.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -63,55 +63,55 @@
     "run-groups": "^5.0.0",
     "semver": "^7.7.2",
     "@pnpm/agent.client": "1.0.7",
-    "@pnpm/bins.linker": "1100.0.8",
+    "@pnpm/bins.linker": "1100.0.9",
     "@pnpm/bins.remover": "1100.0.5",
-    "@pnpm/building.after-install": "1101.0.14",
-    "@pnpm/building.during-install": "1101.0.12",
+    "@pnpm/building.after-install": "1101.0.16",
+    "@pnpm/building.during-install": "1101.0.13",
     "@pnpm/building.policy": "1100.0.6",
-    "@pnpm/catalogs.protocol-parser": "1100.0.0",
     "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/catalogs.protocol-parser": "1100.0.0",
     "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/config.normalize-registries": "1100.0.4",
     "@pnpm/config.parse-overrides": "1100.0.1",
-    "@pnpm/constants": "1100.0.0",
     "@pnpm/core-loggers": "1100.1.1",
+    "@pnpm/constants": "1100.0.0",
     "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/config.normalize-registries": "1100.0.4",
     "@pnpm/deps.graph-hasher": "1100.2.1",
-    "@pnpm/deps.path": "1100.0.4",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
+    "@pnpm/deps.path": "1100.0.4",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/exec.lifecycle": "1100.0.12",
+    "@pnpm/exec.lifecycle": "1100.0.13",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
     "@pnpm/fs.symlink-dependency": "1100.0.5",
-    "@pnpm/installing.context": "1100.0.12",
-    "@pnpm/crypto.object-hasher": "1100.0.0",
-    "@pnpm/installing.deps-restorer": "1101.1.4",
+    "@pnpm/hooks.read-package-hook": "1100.0.4",
     "@pnpm/hooks.types": "1100.0.8",
-    "@pnpm/installing.deps-resolver": "1100.1.1",
+    "@pnpm/installing.deps-resolver": "1100.1.3",
+    "@pnpm/installing.context": "1100.0.12",
     "@pnpm/installing.linking.direct-dep-linker": "1100.0.5",
-    "@pnpm/installing.linking.hoist": "1100.0.8",
+    "@pnpm/installing.deps-restorer": "1101.1.5",
     "@pnpm/installing.linking.modules-cleaner": "1100.1.3",
-    "@pnpm/installing.package-requester": "1101.0.8",
+    "@pnpm/installing.linking.hoist": "1100.0.9",
+    "@pnpm/crypto.object-hasher": "1100.0.0",
     "@pnpm/installing.modules-yaml": "1100.0.5",
-    "@pnpm/lockfile.filtering": "1100.1.2",
-    "@pnpm/hooks.read-package-hook": "1100.0.4",
+    "@pnpm/installing.package-requester": "1101.0.8",
     "@pnpm/lockfile.fs": "1100.1.1",
+    "@pnpm/lockfile.filtering": "1100.1.2",
     "@pnpm/lockfile.preferred-versions": "1100.0.11",
     "@pnpm/lockfile.pruner": "1100.0.7",
     "@pnpm/lockfile.to-pnp": "1100.0.10",
     "@pnpm/lockfile.utils": "1100.0.9",
-    "@pnpm/lockfile.walker": "1100.0.7",
-    "@pnpm/lockfile.settings-checker": "1100.0.12",
     "@pnpm/lockfile.verification": "1100.0.12",
+    "@pnpm/lockfile.walker": "1100.0.7",
     "@pnpm/patching.config": "1100.0.4",
     "@pnpm/pkg-manifest.utils": "1100.2.0",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
+    "@pnpm/lockfile.settings-checker": "1100.0.12",
     "@pnpm/resolving.resolver-base": "1100.3.0",
     "@pnpm/store.controller-types": "1100.1.1",
     "@pnpm/store.index": "1100.1.0",
     "@pnpm/types": "1101.1.1",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.7"
+    "@pnpm/workspace.project-manifest-reader": "1100.0.8"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
@@ -140,19 +140,19 @@
     "write-yaml-file": "^6.0.0",
     "@pnpm/assert-project": "1100.0.10",
     "@pnpm/assert-store": "1100.0.10",
-    "@pnpm/installing.deps-installer": "1101.3.0",
+    "@pnpm/installing.deps-installer": "1101.4.0",
     "@pnpm/lockfile.types": "1100.0.7",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/network.git-utils": "1100.0.1",
     "@pnpm/pkg-manifest.reader": "1100.0.4",
     "@pnpm/prepare": "1100.0.10",
     "@pnpm/resolving.registry.types": "1100.0.4",
-    "@pnpm/store.path": "1100.0.1",
     "@pnpm/store.cafs": "1100.1.6",
     "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/store.path": "1100.0.1",
     "@pnpm/test-ipc-server": "1100.0.0",
     "@pnpm/testing.mock-agent": "1100.0.6",
-    "@pnpm/testing.temp-store": "1100.1.1"
+    "@pnpm/testing.temp-store": "1100.1.3"
   },
   "engines": {
     "node": ">=22.13"