@pnpm/installing.deps-installer 1101.4.0 → 1101.6.0

package/lib/install/extendInstallOptions.d.ts

@@ -32,6 +32,7 @@ export interface StrictInstallOptions {
     lockfileOnly: boolean;
     forceFullResolution: boolean;
     fixLockfile: boolean;
+    updateChecksums: boolean;
     dedupe: boolean;
     ignoreCompatibilityDb: boolean;
     ignorePackageManifest: boolean;

package/lib/install/extendInstallOptions.js

@@ -44,6 +44,7 @@ const defaults = (opts) => {
         },
         lockfileDir: opts.lockfileDir ?? opts.dir ?? process.cwd(),
         lockfileOnly: false,
+        updateChecksums: false,
         nodeVersion: opts.nodeVersion,
         nodeLinker: 'isolated',
         overrides: {},

package/lib/install/index.js

@@ -15,7 +15,7 @@ import { getContext } from '@pnpm/installing.context';
 import { getWantedDependencies, resolveDependencies, } from '@pnpm/installing.deps-resolver';
 import { extendProjectsWithTargetDirs, headlessInstall } from '@pnpm/installing.deps-restorer';
 import { writeModulesManifest } from '@pnpm/installing.modules-yaml';
-import { cleanGitBranchLockfiles, getWantedLockfileName, readWantedLockfile, writeCurrentLockfile, writeLockfiles, writeWantedLockfile, } from '@pnpm/lockfile.fs';
+import { cleanGitBranchLockfiles, getWantedLockfileName, isEmptyLockfile, readWantedLockfile, writeCurrentLockfile, writeLockfiles, writeWantedLockfile, } from '@pnpm/lockfile.fs';
 import { getPreferredVersionsFromLockfileAndManifests } from '@pnpm/lockfile.preferred-versions';
 import { calcPatchHashes, createOverridesMapFromParsed, getOutdatedLockfileSetting, } from '@pnpm/lockfile.settings-checker';
 import { writePnpFile } from '@pnpm/lockfile.to-pnp';
@@ -370,6 +370,7 @@ export async function mutateModules(projects, maybeOpts) {
         const upToDateLockfileMajorVersion = ctx.wantedLockfile.lockfileVersion.toString().startsWith(`${LOCKFILE_MAJOR_VERSION}.`);
         let needsFullResolution = outdatedLockfileSettings ||
             opts.fixLockfile ||
+            opts.updateChecksums ||
             !upToDateLockfileMajorVersion ||
             opts.forceFullResolution ||
             forceResolutionFromHook;
@@ -630,7 +631,7 @@ export async function mutateModules(projects, maybeOpts) {
                 !needsFullResolution &&
                     opts.preferFrozenLockfile &&
                     (!opts.pruneLockfileImporters || Object.keys(ctx.wantedLockfile.importers).length === Object.keys(ctx.projects).length) &&
-                    ctx.existsNonEmptyWantedLockfile &&
+                    !isEmptyLockfile(ctx.wantedLockfile) &&
                     ctx.wantedLockfile.lockfileVersion === LOCKFILE_VERSION &&
                     await allProjectsAreUpToDate(Object.values(ctx.projects), {
                         catalogs: opts.catalogs,
@@ -654,6 +655,16 @@ Note that in CI environments, this setting is enabled by default.`,
             });
         }
         if (!opts.ignorePackageManifest) {
+            // `--frozen-lockfile` (the CI default) means "fail if pnpm-lock.yaml is
+            // out of sync." Treat its absence as a sync failure even when the
+            // synthesized snapshot from node_modules/.pnpm/lock.yaml would satisfy
+            // the manifest — the developer needs to commit the regenerated file.
+            if (frozenLockfile && !ctx.existsWantedLockfile &&
+                Object.values(ctx.projects).some((project) => pkgHasDependencies(project.manifest))) {
+                throw new PnpmError('NO_LOCKFILE', `Cannot install with "frozen-lockfile" because ${WANTED_LOCKFILE} is absent`, {
+                    hint: 'Note that in CI environments this setting is true by default. If you still need to run install in such cases, use "pnpm install --no-frozen-lockfile"',
+                });
+            }
             const _satisfiesPackageManifest = satisfiesPackageManifest.bind(null, {
                 autoInstallPeers: opts.autoInstallPeers,
                 excludeLinksFromLockfile: opts.excludeLinksFromLockfile,
@@ -684,7 +695,7 @@ Note that in CI environments, this setting is enabled by default.`,
                 ignoredBuilds: undefined,
             };
         }
-        if (!ctx.existsNonEmptyWantedLockfile) {
+        if (isEmptyLockfile(ctx.wantedLockfile)) {
             if (Object.values(ctx.projects).some((project) => pkgHasDependencies(project.manifest))) {
                 throw new Error(`Headless installation requires a ${WANTED_LOCKFILE} file`);
             }
@@ -760,18 +771,13 @@ Note that in CI environments, this setting is enabled by default.`,
             };
         }
         catch (error) { // eslint-disable-line
+            const isIntegrityError = BROKEN_LOCKFILE_INTEGRITY_ERRORS.has(error.code);
             if (frozenLockfile ||
                 (error.code !== 'ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY' &&
-                    !BROKEN_LOCKFILE_INTEGRITY_ERRORS.has(error.code)) ||
-                (!ctx.existsNonEmptyWantedLockfile && !ctx.existsCurrentLockfile))
+                    !isIntegrityError) ||
+                (!ctx.existsNonEmptyWantedLockfile && !ctx.existsCurrentLockfile) ||
+                (isIntegrityError && !opts.updateChecksums))
                 throw error;
-            if (BROKEN_LOCKFILE_INTEGRITY_ERRORS.has(error.code)) {
-                needsFullResolution = true;
-                // Ideally, we would not update but currently there is no other way to redownload the integrity of the package
-                for (const project of projects) {
-                    project.update = true;
-                }
-            }
             // A broken lockfile may be caused by a badly resolved Git conflict
             logger.warn({
                 error,
@@ -1014,6 +1020,7 @@ const _installInContext = async (projects, ctx, opts) => {
         excludeLinksFromLockfile: opts.excludeLinksFromLockfile,
         force: opts.force,
         forceFullResolution,
+        updateChecksums: opts.updateChecksums,
         ignoreScripts: opts.ignoreScripts,
         hooks: {
             readPackage: opts.readPackageHook,
@@ -1529,19 +1536,16 @@ const installInContext = async (projects, ctx, opts) => {
     }
     catch (error) { // eslint-disable-line
         if (!BROKEN_LOCKFILE_INTEGRITY_ERRORS.has(error.code) ||
-            (!ctx.existsNonEmptyWantedLockfile && !ctx.existsCurrentLockfile))
+            (!ctx.existsNonEmptyWantedLockfile && !ctx.existsCurrentLockfile) ||
+            !opts.updateChecksums)
             throw error;
         opts.needsFullResolution = true;
-        // Ideally, we would not update but currently there is no other way to redownload the integrity of the package
-        for (const project of projects) {
-            project.update = true;
-        }
         logger.warn({
             error,
             message: error.message,
             prefix: ctx.lockfileDir,
         });
-        logger.error(new PnpmError(error.code, 'The lockfile is broken! A full installation will be performed in an attempt to fix it.'));
+        logger.error(new PnpmError(error.code, 'Refreshing the locked integrity from the registry as requested by --update-checksums. A full installation will be performed.'));
         return _installInContext(projects, ctx, opts);
     }
     finally {

package/lib/install/validateModules.js

@@ -1,10 +1,10 @@
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
+import { confirm } from '@inquirer/prompts';
 import { PnpmError } from '@pnpm/error';
 import { logger } from '@pnpm/logger';
 import { DEPENDENCIES_FIELDS, } from '@pnpm/types';
 import { rimraf } from '@zkochan/rimraf';
-import enquirer from 'enquirer';
 import { pathAbsolute } from 'path-absolute';
 import { equals } from 'ramda';
 import { checkCompatibility } from './checkCompatibility/index.js';
@@ -87,15 +87,22 @@ async function purgeModulesDirsOfImporters(opts, importers) {
                 hint: 'If you are running pnpm in CI, set the CI environment variable to "true", or set "confirmModulesPurge" to "false".',
             });
         }
-        const confirmed = await enquirer.prompt({
-            type: 'confirm',
-            name: 'question',
-            message: importers.length === 1
-                ? `The modules directory at "${importers[0].modulesDir}" will be removed and reinstalled from scratch. Proceed?`
-                : 'The modules directories will be removed and reinstalled from scratch. Proceed?',
-            initial: true,
-        });
-        if (!confirmed.question) {
+        let confirmed;
+        try {
+            confirmed = await confirm({
+                message: importers.length === 1
+                    ? `The modules directory at "${importers[0].modulesDir}" will be removed and reinstalled from scratch. Proceed?`
+                    : 'The modules directories will be removed and reinstalled from scratch. Proceed?',
+                default: true,
+            });
+        }
+        catch (err) {
+            if (err instanceof Error && err.name === 'ExitPromptError') {
+                throw new PnpmError('ABORTED_REMOVE_MODULES_DIR', 'Aborted removal of modules directory');
+            }
+            throw err;
+        }
+        if (!confirmed) {
             throw new PnpmError('ABORTED_REMOVE_MODULES_DIR', 'Aborted removal of modules directory');
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1101.4.0",
+  "version": "1101.6.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -47,86 +47,85 @@
     "test": "test"
   },
   "dependencies": {
+    "@inquirer/prompts": "^8.4.3",
     "@pnpm/npm-package-arg": "^2.0.0",
     "@pnpm/util.lex-comparator": "^3.0.2",
     "@zkochan/rimraf": "^4.0.0",
-    "enquirer": "^2.4.1",
     "is-inner-link": "^5.0.0",
     "is-subdir": "^2.0.0",
     "load-json-file": "^7.0.1",
     "normalize-path": "^3.0.0",
     "p-filter": "^4.1.0",
-    "p-limit": "^7.1.0",
+    "p-limit": "^7.3.0",
     "path-absolute": "^2.0.0",
     "path-exists": "^5.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
-    "semver": "^7.7.2",
-    "@pnpm/agent.client": "1.0.7",
-    "@pnpm/bins.linker": "1100.0.9",
-    "@pnpm/bins.remover": "1100.0.5",
-    "@pnpm/building.after-install": "1101.0.16",
-    "@pnpm/building.during-install": "1101.0.13",
-    "@pnpm/building.policy": "1100.0.6",
+    "semver": "^7.8.1",
+    "@pnpm/bins.linker": "1100.0.10",
+    "@pnpm/bins.remover": "1100.0.6",
+    "@pnpm/building.after-install": "1101.0.18",
+    "@pnpm/agent.client": "1.0.8",
     "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/building.policy": "1100.0.7",
     "@pnpm/catalogs.protocol-parser": "1100.0.0",
     "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/building.during-install": "1101.0.15",
+    "@pnpm/config.normalize-registries": "1100.0.5",
     "@pnpm/config.parse-overrides": "1100.0.1",
-    "@pnpm/core-loggers": "1100.1.1",
-    "@pnpm/constants": "1100.0.0",
+    "@pnpm/crypto.object-hasher": "1100.0.0",
+    "@pnpm/core-loggers": "1100.1.2",
+    "@pnpm/deps.graph-hasher": "1100.2.2",
     "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/config.normalize-registries": "1100.0.4",
-    "@pnpm/deps.graph-hasher": "1100.2.1",
+    "@pnpm/deps.path": "1100.0.5",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/exec.lifecycle": "1100.0.14",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.4",
+    "@pnpm/fs.symlink-dependency": "1100.0.6",
+    "@pnpm/installing.context": "1100.0.14",
+    "@pnpm/hooks.read-package-hook": "1100.0.5",
+    "@pnpm/installing.deps-resolver": "1100.1.5",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/exec.lifecycle": "1100.0.13",
+    "@pnpm/installing.deps-restorer": "1101.1.7",
+    "@pnpm/hooks.types": "1100.0.9",
+    "@pnpm/installing.linking.hoist": "1100.0.10",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.6",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.4",
+    "@pnpm/installing.modules-yaml": "1100.0.6",
+    "@pnpm/lockfile.filtering": "1100.1.3",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/fs.symlink-dependency": "1100.0.5",
-    "@pnpm/hooks.read-package-hook": "1100.0.4",
-    "@pnpm/hooks.types": "1100.0.8",
-    "@pnpm/installing.deps-resolver": "1100.1.3",
-    "@pnpm/installing.context": "1100.0.12",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.5",
-    "@pnpm/installing.deps-restorer": "1101.1.5",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.3",
-    "@pnpm/installing.linking.hoist": "1100.0.9",
-    "@pnpm/crypto.object-hasher": "1100.0.0",
-    "@pnpm/installing.modules-yaml": "1100.0.5",
-    "@pnpm/installing.package-requester": "1101.0.8",
-    "@pnpm/lockfile.fs": "1100.1.1",
-    "@pnpm/lockfile.filtering": "1100.1.2",
-    "@pnpm/lockfile.preferred-versions": "1100.0.11",
-    "@pnpm/lockfile.pruner": "1100.0.7",
-    "@pnpm/lockfile.to-pnp": "1100.0.10",
-    "@pnpm/lockfile.utils": "1100.0.9",
-    "@pnpm/lockfile.verification": "1100.0.12",
-    "@pnpm/lockfile.walker": "1100.0.7",
-    "@pnpm/patching.config": "1100.0.4",
-    "@pnpm/pkg-manifest.utils": "1100.2.0",
+    "@pnpm/lockfile.fs": "1100.1.2",
+    "@pnpm/lockfile.preferred-versions": "1100.0.12",
+    "@pnpm/lockfile.settings-checker": "1100.0.14",
+    "@pnpm/lockfile.to-pnp": "1100.0.11",
+    "@pnpm/lockfile.pruner": "1100.0.8",
+    "@pnpm/lockfile.utils": "1100.0.10",
+    "@pnpm/lockfile.walker": "1100.0.8",
+    "@pnpm/patching.config": "1100.0.5",
+    "@pnpm/pkg-manifest.utils": "1100.2.1",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/lockfile.settings-checker": "1100.0.12",
-    "@pnpm/resolving.resolver-base": "1100.3.0",
-    "@pnpm/store.controller-types": "1100.1.1",
+    "@pnpm/store.controller-types": "1100.1.2",
+    "@pnpm/types": "1101.2.0",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.9",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/types": "1101.1.1",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.8"
+    "@pnpm/installing.package-requester": "1101.0.10",
+    "@pnpm/resolving.resolver-base": "1100.3.1",
+    "@pnpm/lockfile.verification": "1100.0.14"
   },
   "peerDependencies": {
-    "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.7"
+    "@pnpm/logger": "^1001.0.1",
+    "@pnpm/worker": "^1100.1.8"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
-    "@pnpm/registry-mock": "6.0.0",
     "@types/fs-extra": "^11.0.4",
     "@types/is-windows": "^1.0.2",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@yarnpkg/core": "4.5.0",
-    "ci-info": "^4.3.0",
+    "ci-info": "^4.4.0",
     "deep-require-cwd": "1.0.0",
     "execa": "npm:safe-execa@0.3.0",
     "exists-link": "2.0.0",
@@ -138,21 +137,22 @@
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.10",
-    "@pnpm/assert-store": "1100.0.10",
-    "@pnpm/installing.deps-installer": "1101.4.0",
-    "@pnpm/lockfile.types": "1100.0.7",
-    "@pnpm/logger": "1100.0.0",
+    "@pnpm/assert-project": "1100.0.12",
+    "@pnpm/lockfile.types": "1100.0.8",
+    "@pnpm/installing.deps-installer": "1101.6.0",
+    "@pnpm/assert-store": "1100.0.12",
+    "@pnpm/prepare": "1100.0.12",
     "@pnpm/network.git-utils": "1100.0.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.4",
-    "@pnpm/prepare": "1100.0.10",
-    "@pnpm/resolving.registry.types": "1100.0.4",
-    "@pnpm/store.cafs": "1100.1.6",
-    "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/store.path": "1100.0.1",
+    "@pnpm/pkg-manifest.reader": "1100.0.5",
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/store.cafs": "1100.1.7",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.6",
-    "@pnpm/testing.temp-store": "1100.1.3"
+    "@pnpm/resolving.registry.types": "1100.1.0",
+    "@pnpm/testing.mock-agent": "1100.0.8",
+    "@pnpm/testing.temp-store": "1100.1.5",
+    "@pnpm/store.path": "1100.0.1",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/testing.registry-mock": "1100.0.2"
   },
   "engines": {
     "node": ">=22.13"