@pnpm/installing.deps-installer 1101.3.1 → 1101.5.0

package/lib/install/extendInstallOptions.d.ts

@@ -32,6 +32,7 @@ export interface StrictInstallOptions {
     lockfileOnly: boolean;
     forceFullResolution: boolean;
     fixLockfile: boolean;
+    updateChecksums: boolean;
     dedupe: boolean;
     ignoreCompatibilityDb: boolean;
     ignorePackageManifest: boolean;
@@ -184,6 +185,23 @@ export interface StrictInstallOptions {
     trustPolicy?: TrustPolicy;
     trustPolicyExclude?: string[];
     trustPolicyIgnoreAfter?: number;
+    /**
+     * Skip the lockfile supply-chain verification pass entirely. When
+     * true, `verifyLockfileResolutions` is not called even if
+     * `resolutionVerifiers` is non-empty — the install trusts the
+     * lockfile as-is. Trade-off: a poisoned lockfile (e.g. one a
+     * contributor authored under a weaker policy than CI enforces) can
+     * slip through. Use only in environments where the lockfile is
+     * effectively part of the trusted base — closed-source projects
+     * where every commit comes from a trusted author, fully reproducible
+     * CI runs against an already-verified lockfile, etc.
+     *
+     * Added for #11860: on workspaces with thousands of locked entries,
+     * the verification pass holds the per-package registry metadata
+     * needed for the trust check resident in memory and can OOM CI
+     * runners with a 2GB heap cap.
+     */
+    trustLockfile?: boolean;
     packageVulnerabilityAudit?: PackageVulnerabilityAudit;
     blockExoticSubdeps?: boolean;
     /**

package/lib/install/extendInstallOptions.js

@@ -44,6 +44,7 @@ const defaults = (opts) => {
         },
         lockfileDir: opts.lockfileDir ?? opts.dir ?? process.cwd(),
         lockfileOnly: false,
+        updateChecksums: false,
         nodeVersion: opts.nodeVersion,
         nodeLinker: 'isolated',
         overrides: {},

package/lib/install/index.js

@@ -193,7 +193,7 @@ export async function mutateModules(projects, maybeOpts) {
         !ctx.lockfileHadConflicts &&
         ctx.existsNonEmptyWantedLockfile &&
         (opts.frozenLockfile === true || opts.frozenLockfileIfExists === true);
-    if (!willDelegateToPacquet) {
+    if (!willDelegateToPacquet && !opts.trustLockfile) {
         const cacheActive = opts.cacheDir != null && opts.resolutionVerifiers.length > 0;
         const wantedLockfilePath = cacheActive
             ? path.resolve(ctx.lockfileDir, await getWantedLockfileName({
@@ -370,6 +370,7 @@ export async function mutateModules(projects, maybeOpts) {
         const upToDateLockfileMajorVersion = ctx.wantedLockfile.lockfileVersion.toString().startsWith(`${LOCKFILE_MAJOR_VERSION}.`);
         let needsFullResolution = outdatedLockfileSettings ||
             opts.fixLockfile ||
+            opts.updateChecksums ||
             !upToDateLockfileMajorVersion ||
             opts.forceFullResolution ||
             forceResolutionFromHook;
@@ -760,18 +761,13 @@ Note that in CI environments, this setting is enabled by default.`,
             };
         }
         catch (error) { // eslint-disable-line
+            const isIntegrityError = BROKEN_LOCKFILE_INTEGRITY_ERRORS.has(error.code);
             if (frozenLockfile ||
                 (error.code !== 'ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY' &&
-                    !BROKEN_LOCKFILE_INTEGRITY_ERRORS.has(error.code)) ||
-                (!ctx.existsNonEmptyWantedLockfile && !ctx.existsCurrentLockfile))
+                    !isIntegrityError) ||
+                (!ctx.existsNonEmptyWantedLockfile && !ctx.existsCurrentLockfile) ||
+                (isIntegrityError && !opts.updateChecksums))
                 throw error;
-            if (BROKEN_LOCKFILE_INTEGRITY_ERRORS.has(error.code)) {
-                needsFullResolution = true;
-                // Ideally, we would not update but currently there is no other way to redownload the integrity of the package
-                for (const project of projects) {
-                    project.update = true;
-                }
-            }
             // A broken lockfile may be caused by a badly resolved Git conflict
             logger.warn({
                 error,
@@ -1014,6 +1010,7 @@ const _installInContext = async (projects, ctx, opts) => {
         excludeLinksFromLockfile: opts.excludeLinksFromLockfile,
         force: opts.force,
         forceFullResolution,
+        updateChecksums: opts.updateChecksums,
         ignoreScripts: opts.ignoreScripts,
         hooks: {
             readPackage: opts.readPackageHook,
@@ -1529,19 +1526,16 @@ const installInContext = async (projects, ctx, opts) => {
     }
     catch (error) { // eslint-disable-line
         if (!BROKEN_LOCKFILE_INTEGRITY_ERRORS.has(error.code) ||
-            (!ctx.existsNonEmptyWantedLockfile && !ctx.existsCurrentLockfile))
+            (!ctx.existsNonEmptyWantedLockfile && !ctx.existsCurrentLockfile) ||
+            !opts.updateChecksums)
             throw error;
         opts.needsFullResolution = true;
-        // Ideally, we would not update but currently there is no other way to redownload the integrity of the package
-        for (const project of projects) {
-            project.update = true;
-        }
         logger.warn({
             error,
             message: error.message,
             prefix: ctx.lockfileDir,
         });
-        logger.error(new PnpmError(error.code, 'The lockfile is broken! A full installation will be performed in an attempt to fix it.'));
+        logger.error(new PnpmError(error.code, 'Refreshing the locked integrity from the registry as requested by --update-checksums. A full installation will be performed.'));
         return _installInContext(projects, ctx, opts);
     }
     finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1101.3.1",
+  "version": "1101.5.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -56,66 +56,66 @@
     "load-json-file": "^7.0.1",
     "normalize-path": "^3.0.0",
     "p-filter": "^4.1.0",
-    "p-limit": "^7.1.0",
+    "p-limit": "^7.3.0",
     "path-absolute": "^2.0.0",
     "path-exists": "^5.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
-    "semver": "^7.7.2",
-    "@pnpm/bins.linker": "1100.0.8",
-    "@pnpm/agent.client": "1.0.7",
-    "@pnpm/bins.remover": "1100.0.5",
-    "@pnpm/building.after-install": "1101.0.15",
-    "@pnpm/building.policy": "1100.0.6",
-    "@pnpm/building.during-install": "1101.0.12",
-    "@pnpm/catalogs.resolver": "1100.0.0",
+    "semver": "^7.8.1",
+    "@pnpm/agent.client": "1.0.8",
+    "@pnpm/building.after-install": "1101.0.17",
+    "@pnpm/building.policy": "1100.0.7",
+    "@pnpm/bins.remover": "1100.0.6",
     "@pnpm/catalogs.protocol-parser": "1100.0.0",
+    "@pnpm/building.during-install": "1101.0.14",
     "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/config.normalize-registries": "1100.0.4",
+    "@pnpm/config.normalize-registries": "1100.0.5",
+    "@pnpm/catalogs.resolver": "1100.0.0",
     "@pnpm/config.parse-overrides": "1100.0.1",
-    "@pnpm/core-loggers": "1100.1.1",
     "@pnpm/constants": "1100.0.0",
+    "@pnpm/core-loggers": "1100.1.2",
     "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/deps.graph-hasher": "1100.2.2",
     "@pnpm/crypto.object-hasher": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.2.1",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.4",
-    "@pnpm/exec.lifecycle": "1100.0.12",
+    "@pnpm/deps.path": "1100.0.5",
+    "@pnpm/exec.lifecycle": "1100.0.14",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/hooks.read-package-hook": "1100.0.4",
-    "@pnpm/fs.symlink-dependency": "1100.0.5",
-    "@pnpm/hooks.types": "1100.0.8",
-    "@pnpm/installing.context": "1100.0.12",
-    "@pnpm/installing.deps-restorer": "1101.1.4",
-    "@pnpm/installing.deps-resolver": "1100.1.2",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.5",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.3",
-    "@pnpm/installing.linking.hoist": "1100.0.8",
-    "@pnpm/installing.modules-yaml": "1100.0.5",
-    "@pnpm/installing.package-requester": "1101.0.8",
-    "@pnpm/lockfile.filtering": "1100.1.2",
-    "@pnpm/lockfile.preferred-versions": "1100.0.11",
-    "@pnpm/lockfile.fs": "1100.1.1",
-    "@pnpm/lockfile.pruner": "1100.0.7",
-    "@pnpm/lockfile.settings-checker": "1100.0.12",
-    "@pnpm/lockfile.to-pnp": "1100.0.10",
-    "@pnpm/lockfile.utils": "1100.0.9",
-    "@pnpm/lockfile.verification": "1100.0.12",
-    "@pnpm/lockfile.walker": "1100.0.7",
-    "@pnpm/patching.config": "1100.0.4",
-    "@pnpm/pkg-manifest.utils": "1100.2.0",
-    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/resolving.resolver-base": "1100.3.0",
-    "@pnpm/store.controller-types": "1100.1.1",
+    "@pnpm/fs.symlink-dependency": "1100.0.6",
+    "@pnpm/hooks.read-package-hook": "1100.0.5",
+    "@pnpm/hooks.types": "1100.0.9",
+    "@pnpm/installing.deps-resolver": "1100.1.4",
+    "@pnpm/installing.context": "1100.0.13",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.6",
+    "@pnpm/installing.deps-restorer": "1101.1.6",
+    "@pnpm/installing.linking.hoist": "1100.0.10",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.4",
+    "@pnpm/installing.package-requester": "1101.0.9",
+    "@pnpm/installing.modules-yaml": "1100.0.6",
+    "@pnpm/lockfile.filtering": "1100.1.3",
+    "@pnpm/lockfile.fs": "1100.1.2",
+    "@pnpm/lockfile.settings-checker": "1100.0.13",
+    "@pnpm/lockfile.preferred-versions": "1100.0.12",
+    "@pnpm/lockfile.pruner": "1100.0.8",
+    "@pnpm/lockfile.to-pnp": "1100.0.11",
+    "@pnpm/lockfile.walker": "1100.0.8",
+    "@pnpm/bins.linker": "1100.0.10",
+    "@pnpm/patching.config": "1100.0.5",
+    "@pnpm/resolving.resolver-base": "1100.3.1",
+    "@pnpm/pkg-manifest.utils": "1100.2.1",
+    "@pnpm/store.controller-types": "1100.1.2",
+    "@pnpm/types": "1101.2.0",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.9",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/types": "1101.1.1",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.7"
+    "@pnpm/lockfile.verification": "1100.0.13",
+    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
+    "@pnpm/lockfile.utils": "1100.0.10"
   },
   "peerDependencies": {
-    "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.7"
+    "@pnpm/logger": "^1001.0.1",
+    "@pnpm/worker": "^1100.1.8"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -126,7 +126,7 @@
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@yarnpkg/core": "4.5.0",
-    "ci-info": "^4.3.0",
+    "ci-info": "^4.4.0",
     "deep-require-cwd": "1.0.0",
     "execa": "npm:safe-execa@0.3.0",
     "exists-link": "2.0.0",
@@ -138,21 +138,22 @@
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.10",
-    "@pnpm/assert-store": "1100.0.10",
-    "@pnpm/lockfile.types": "1100.0.7",
+    "@pnpm/assert-project": "1100.0.11",
+    "@pnpm/installing.deps-installer": "1101.5.0",
+    "@pnpm/assert-store": "1100.0.11",
+    "@pnpm/lockfile.types": "1100.0.8",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/network.git-utils": "1100.0.1",
-    "@pnpm/installing.deps-installer": "1101.3.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.4",
-    "@pnpm/prepare": "1100.0.10",
-    "@pnpm/resolving.registry.types": "1100.0.4",
-    "@pnpm/store.cafs": "1100.1.6",
+    "@pnpm/pkg-manifest.reader": "1100.0.5",
+    "@pnpm/prepare": "1100.0.11",
+    "@pnpm/resolving.registry.types": "1100.0.5",
+    "@pnpm/store.cafs": "1100.1.7",
     "@pnpm/store.path": "1100.0.1",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.6",
+    "@pnpm/testing.mock-agent": "1100.0.7",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.temp-store": "1100.1.2"
+    "@pnpm/testing.temp-store": "1100.1.4",
+    "@pnpm/testing.registry-mock": "1100.0.1"
   },
   "engines": {
     "node": ">=22.13"