@pnpm/installing.deps-installer 1101.8.0 → 1101.9.0

package/lib/install/verifyLockfileResolutions.js

@@ -8,10 +8,10 @@ import { recordVerification, tryLockfileVerificationCache, } from './verifyLockf
 // (e.g. a poisoned lockfile) doesn't flood the terminal / CI log; the full
 // count is in the header and the remainder is summarized at the end.
 const MAX_VIOLATIONS_TO_PRINT = 20;
-// 16 mirrors the floor of pnpm's package-requester network-concurrency
-// (Math.min(64, Math.max(workers*3, 16))); keep them aligned so the
+// 64 mirrors the floor of pnpm's package-requester network-concurrency
+// (Math.min(96, Math.max(workers*3, 64))); keep them aligned so the
 // verification pass doesn't push past what the rest of the install respects.
-const DEFAULT_CONCURRENCY = 16;
+const DEFAULT_CONCURRENCY = 64;
 export const RESOLUTION_SHAPE_MISMATCH_VIOLATION_CODE = 'RESOLUTION_SHAPE_MISMATCH';
 const RESOLUTION_SHAPE_CACHE_IDENTITY = {
     policy: { resolutionShapeCheck: true },
@@ -80,14 +80,27 @@ export async function verifyLockfileResolutions(lockfile, verifiers, options) {
             verifiers: cacheVerifiers,
             hashLockfile,
         });
-        if (result.hit)
+        if (result.hit) {
+            // A silent short-circuit looks like the policy gate never ran
+            // (pnpm/pnpm#12324), so surface the reused verdict — but only
+            // when policy verifiers are active; the shape-only run that
+            // every install performs stays quiet.
+            if (verifiers.length > 0) {
+                lockfileVerificationLogger.debug({
+                    status: 'cached',
+                    verifiedAt: result.verifiedAt,
+                    lockfilePath: options?.lockfilePath,
+                });
+            }
             return;
+        }
         cachePrecomputed = result.precomputed;
     }
     // Emit started/done around the actual verification pass — the
     // round-trip can be slow on a cold registry cache, and the cached
-    // short-circuit above doesn't reach this branch, so a user only
-    // sees these messages on installs that are doing real work.
+    // short-circuit above announces itself with its own `cached` event,
+    // so a user only sees these messages on installs that are doing
+    // real work.
     // A degenerate lockfile where every snapshot fails the
     // name/version extraction (so candidates is empty) skips emission
     // entirely — no work, no noise.

package/lib/install/verifyLockfileResolutionsCache.d.ts

@@ -9,6 +9,13 @@ import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 export type VerifierCacheIdentity = Pick<ResolutionVerifier, 'policy' | 'canTrustPastCheck'>;
 export interface CacheLookupResult {
     hit: boolean;
+    /**
+     * ISO-8601 timestamp of the verification run the hit is reusing.
+     * Set only on a hit, and only when the record carries a usable
+     * timestamp (records written before the field existed normalize to
+     * an empty string and surface as `undefined` here).
+     */
+    verifiedAt?: string;
     /**
      * stat + hash already computed during the lookup. When the caller
      * follows up with {@link recordVerification} after running the gate,

package/lib/install/verifyLockfileResolutionsCache.js

@@ -159,8 +159,10 @@ export function tryLockfileVerificationCache(cacheDir, key) {
     // hash without reading the file. Microseconds.
     const byPathRecord = indexes.byPath.get(key.lockfilePath);
     if (byPathRecord && statMatches(stat, byPathRecord.lockfile)) {
+        const hit = everyVerifierTrustsCachedRun(byPathRecord, key.verifiers);
         return {
-            hit: everyVerifierTrustsCachedRun(byPathRecord, key.verifiers),
+            hit,
+            verifiedAt: hit ? byPathRecord.verifiedAt || undefined : undefined,
             // The stat-match implies the file content is unchanged since the
             // cached record was written, so its hash is still correct. Pass
             // it through to skip hashing on the miss-then-record path.
@@ -190,7 +192,7 @@ export function tryLockfileVerificationCache(cacheDir, key) {
         ...byHashRecord,
         lockfile: { ...byHashRecord.lockfile, path: key.lockfilePath, size: stat.size, mtimeNs: stat.mtimeNs, inode: stat.inode },
     });
-    return { hit: true, precomputed: { stat, hash } };
+    return { hit: true, verifiedAt: byHashRecord.verifiedAt || undefined, precomputed: { stat, hash } };
 }
 function everyVerifierTrustsCachedRun(record, verifiers) {
     for (const verifier of verifiers) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1101.8.0",
+  "version": "1101.9.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -65,61 +65,61 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
     "semver": "^7.8.1",
-    "@pnpm/bins.linker": "1100.0.12",
-    "@pnpm/building.after-install": "1101.0.20",
-    "@pnpm/catalogs.protocol-parser": "1100.0.0",
-    "@pnpm/building.during-install": "1101.0.17",
+    "@pnpm/bins.linker": "1100.0.13",
+    "@pnpm/building.after-install": "1101.0.21",
+    "@pnpm/building.during-install": "1101.0.18",
     "@pnpm/building.policy": "1100.0.9",
-    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/config.normalize-registries": "1100.0.7",
-    "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/core-loggers": "1100.1.4",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/catalogs.protocol-parser": "1100.0.0",
+    "@pnpm/config.parse-overrides": "1100.0.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/config.normalize-registries": "1100.0.7",
+    "@pnpm/core-loggers": "1100.2.0",
     "@pnpm/deps.graph-hasher": "1100.2.4",
-    "@pnpm/crypto.object-hasher": "1100.0.0",
+    "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
-    "@pnpm/config.parse-overrides": "1100.0.1",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/exec.lifecycle": "1100.0.16",
-    "@pnpm/fs.symlink-dependency": "1100.0.8",
+    "@pnpm/deps.path": "1100.0.7",
+    "@pnpm/exec.lifecycle": "1100.0.17",
+    "@pnpm/fs.symlink-dependency": "1100.0.9",
+    "@pnpm/crypto.object-hasher": "1100.0.0",
     "@pnpm/hooks.read-package-hook": "1100.0.7",
-    "@pnpm/installing.deps-restorer": "1101.1.10",
     "@pnpm/hooks.types": "1100.0.11",
-    "@pnpm/installing.context": "1100.0.16",
-    "@pnpm/installing.deps-resolver": "1100.2.1",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.8",
-    "@pnpm/deps.path": "1100.0.7",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.6",
-    "@pnpm/installing.linking.hoist": "1100.0.12",
-    "@pnpm/bins.remover": "1100.0.8",
+    "@pnpm/installing.deps-resolver": "1100.2.2",
+    "@pnpm/bins.remover": "1100.0.9",
+    "@pnpm/installing.context": "1100.0.17",
+    "@pnpm/installing.linking.hoist": "1100.0.13",
+    "@pnpm/installing.deps-restorer": "1101.1.11",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.7",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.9",
     "@pnpm/installing.modules-yaml": "1100.0.8",
+    "@pnpm/lockfile.filtering": "1100.1.6",
     "@pnpm/lockfile.fs": "1100.1.4",
-    "@pnpm/installing.package-requester": "1101.0.12",
-    "@pnpm/lockfile.pruner": "1100.0.10",
-    "@pnpm/lockfile.settings-checker": "1100.0.16",
-    "@pnpm/lockfile.preferred-versions": "1100.0.14",
-    "@pnpm/lockfile.filtering": "1100.1.5",
+    "@pnpm/installing.package-requester": "1101.1.0",
+    "@pnpm/lockfile.preferred-versions": "1100.0.15",
+    "@pnpm/fs.read-modules-dir": "1100.0.1",
+    "@pnpm/lockfile.settings-checker": "1100.0.17",
     "@pnpm/lockfile.to-pnp": "1100.0.13",
-    "@pnpm/lockfile.verification": "1100.0.16",
+    "@pnpm/lockfile.pruner": "1100.0.10",
     "@pnpm/lockfile.utils": "1100.0.12",
     "@pnpm/lockfile.walker": "1100.0.10",
     "@pnpm/network.auth-header": "1101.1.1",
-    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/pkg-manifest.utils": "1100.2.3",
+    "@pnpm/lockfile.verification": "1100.0.17",
     "@pnpm/patching.config": "1100.0.7",
     "@pnpm/pnpr.client": "1.2.0",
-    "@pnpm/resolving.resolver-base": "1100.4.1",
+    "@pnpm/pkg-manifest.utils": "1100.2.4",
     "@pnpm/store.controller-types": "1100.1.4",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.11",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/types": "1101.3.1"
+    "@pnpm/resolving.resolver-base": "1100.4.1",
+    "@pnpm/types": "1101.3.1",
+    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.12"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1001.0.1",
-    "@pnpm/worker": "^1100.1.10"
+    "@pnpm/worker": "^1100.1.11"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -141,22 +141,22 @@
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.14",
-    "@pnpm/lockfile.types": "1100.0.10",
-    "@pnpm/installing.deps-installer": "1101.8.0",
-    "@pnpm/assert-store": "1100.0.14",
-    "@pnpm/network.git-utils": "1100.0.1",
+    "@pnpm/assert-project": "1100.0.15",
+    "@pnpm/assert-store": "1100.0.15",
+    "@pnpm/installing.deps-installer": "1101.9.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.7",
+    "@pnpm/network.git-utils": "1100.0.1",
+    "@pnpm/lockfile.types": "1100.0.10",
     "@pnpm/resolving.registry.types": "1100.1.2",
-    "@pnpm/prepare": "1100.0.14",
-    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.7",
     "@pnpm/store.cafs": "1100.1.9",
-    "@pnpm/testing.mock-agent": "1101.0.1",
-    "@pnpm/test-ipc-server": "1100.0.0",
     "@pnpm/store.path": "1100.0.1",
-    "@pnpm/testing.temp-store": "1100.1.7",
-    "@pnpm/testing.registry-mock": "1100.0.4"
+    "@pnpm/prepare": "1100.0.15",
+    "@pnpm/test-ipc-server": "1100.0.0",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/testing.mock-agent": "1101.0.2",
+    "@pnpm/testing.temp-store": "1100.1.8",
+    "@pnpm/testing.registry-mock": "1100.0.5"
   },
   "engines": {
     "node": ">=22.13"