@pnpm/installing.deps-installer 1101.9.0 → 1102.1.0

package/lib/install/link.js

@@ -2,13 +2,16 @@ import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { progressLogger, stageLogger, statsLogger, } from '@pnpm/core-loggers';
 import { calcDepState, findRuntimeNodeVersion } from '@pnpm/deps.graph-hasher';
+import { readModulesDir } from '@pnpm/fs.read-modules-dir';
 import { symlinkDependency } from '@pnpm/fs.symlink-dependency';
+import { isValidDependencyAlias, } from '@pnpm/installing.deps-resolver';
 import { linkDirectDeps } from '@pnpm/installing.linking.direct-dep-linker';
 import { hoist } from '@pnpm/installing.linking.hoist';
 import { prune } from '@pnpm/installing.linking.modules-cleaner';
 import { filterLockfileByImporters, } from '@pnpm/lockfile.filtering';
 import { logger } from '@pnpm/logger';
 import { symlinkAllModules } from '@pnpm/worker';
+import { rimraf } from '@zkochan/rimraf';
 import pLimit from 'p-limit';
 import { pathExists } from 'path-exists';
 import { difference, equals, isEmpty, pick, pickBy, props } from 'ramda';
@@ -250,20 +253,47 @@ async function linkNewPackages(currentLockfile, wantedLockfile, depGraph, opts)
     });
     const existingWithUpdatedDeps = [];
     if (!opts.force && (currentLockfile.packages != null) && (wantedLockfile.packages != null)) {
+        const currentPackages = currentLockfile.packages;
+        const wantedPackages = wantedLockfile.packages;
         // add subdependencies that have been updated
-        // TODO: no need to relink everything. Can be relinked only what was changed
-        for (const depPath of wantedRelDepPaths) {
-            if (currentLockfile.packages[depPath] &&
-                (!equals(currentLockfile.packages[depPath].dependencies, wantedLockfile.packages[depPath].dependencies) ||
-                    !isEmpty(currentLockfile.packages[depPath].optionalDependencies ?? {}) ||
-                    !isEmpty(wantedLockfile.packages[depPath].optionalDependencies ?? {}))) {
+        await Promise.all(wantedRelDepPaths.map((depPath) => limitModulesDirReads(async () => {
+            if (currentPackages[depPath] &&
+                (!equals(currentPackages[depPath].dependencies, wantedPackages[depPath].dependencies) ||
+                    !isEmpty(currentPackages[depPath].optionalDependencies ?? {}) ||
+                    !isEmpty(wantedPackages[depPath].optionalDependencies ?? {}))) {
                 // TODO: come up with a test that triggers the usecase of depGraph[depPath] undefined
                 // see related issue: https://github.com/pnpm/pnpm/issues/870
                 if (depGraph[depPath] && !newDepPathsSet.has(depPath)) {
-                    existingWithUpdatedDeps.push(depGraph[depPath]);
+                    const { actualChildrenChanged, removedAliases: actualRemovedAliases } = await getActualChildrenDiff(depGraph[depPath], depGraph, opts.lockfileDir, opts.optional);
+                    if (actualChildrenChanged) {
+                        existingWithUpdatedDeps.push({
+                            children: depGraph[depPath].children,
+                            modules: depGraph[depPath].modules,
+                            name: depGraph[depPath].name,
+                            optionalDependencies: depGraph[depPath].optionalDependencies,
+                            removedAliases: actualRemovedAliases,
+                        });
+                        return;
+                    }
+                    const { changedChildren, removedAliases } = getChangedChildren({
+                        currentDependencies: currentPackages[depPath].dependencies,
+                        currentOptionalDependencies: currentPackages[depPath].optionalDependencies,
+                        wantedDependencies: wantedPackages[depPath].dependencies,
+                        wantedOptionalDependencies: wantedPackages[depPath].optionalDependencies,
+                        allChildren: depGraph[depPath].children,
+                    });
+                    if (!isEmpty(changedChildren) || removedAliases.length > 0) {
+                        existingWithUpdatedDeps.push({
+                            children: changedChildren,
+                            modules: depGraph[depPath].modules,
+                            name: depGraph[depPath].name,
+                            optionalDependencies: depGraph[depPath].optionalDependencies,
+                            removedAliases,
+                        });
+                    }
                 }
             }
-        }
+        })));
     }
     if (!newDepPathsSet.size && (existingWithUpdatedDeps.length === 0))
         return { newDepPaths: [], added };
@@ -317,6 +347,7 @@ async function selectNewFromWantedDeps(wantedRelDepPaths, currentLockfile, depGr
     return newDeps;
 }
 const limitLinking = pLimit(16);
+const limitModulesDirReads = pLimit(16);
 async function linkAllPkgs(storeController, depNodes, opts) {
     // Resolved `engines.runtime` Node version (when present) so the
     // side-effects-cache key prefix tracks the script-runner Node
@@ -365,29 +396,83 @@ async function linkAllPkgs(storeController, depNodes, opts) {
     }));
 }
 async function linkAllModules(depNodes, depGraph, opts) {
+    await Promise.all(depNodes.flatMap((depNode) => (depNode.removedAliases ?? []).map(async (alias) => limitModulesDirReads(async () => removeObsoleteChild(depNode.modules, alias)))));
     await symlinkAllModules({
         deps: depNodes.map((depNode) => {
-            const children = opts.optional
-                ? depNode.children
-                : pickBy((_, childAlias) => !depNode.optionalDependencies.has(childAlias), depNode.children);
-            const childrenPaths = {};
-            for (const [alias, childDepPath] of Object.entries(children ?? {})) {
-                if (childDepPath.startsWith('link:')) {
-                    childrenPaths[alias] = path.resolve(opts.lockfileDir, childDepPath.slice(5));
-                }
-                else {
-                    const pkg = depGraph[childDepPath];
-                    if (!pkg || !pkg.installable && pkg.optional || alias === depNode.name)
-                        continue;
-                    childrenPaths[alias] = pkg.dir;
-                }
-            }
             return {
-                children: childrenPaths,
+                children: getChildrenPaths(depNode, depGraph, opts.lockfileDir, opts.optional),
                 modules: depNode.modules,
                 name: depNode.name,
             };
         }),
     });
 }
+function getChangedChildren(opts) {
+    const { currentOptionalDependencies, wantedOptionalDependencies, allChildren } = opts;
+    // Use null-prototype maps so a child literally named `constructor`,
+    // `toString`, `__proto__`, etc. is treated as a normal alias instead
+    // of colliding with an inherited `Object.prototype` key during the
+    // `in`/index lookups below.
+    const currentChildren = Object.assign(Object.create(null), opts.currentDependencies, currentOptionalDependencies);
+    const wantedChildren = Object.assign(Object.create(null), opts.wantedDependencies, wantedOptionalDependencies);
+    const changedChildren = {};
+    const removedAliases = [];
+    for (const [alias, wantedChildDepPath] of Object.entries(wantedChildren)) {
+        const optionalityChanged = hasOwn(wantedOptionalDependencies, alias) !== hasOwn(currentOptionalDependencies, alias);
+        if (currentChildren[alias] !== wantedChildDepPath || optionalityChanged) {
+            const resolvedChildDepPath = hasOwn(allChildren, alias) ? allChildren[alias] : undefined;
+            if (resolvedChildDepPath != null) {
+                changedChildren[alias] = resolvedChildDepPath;
+            }
+        }
+    }
+    for (const alias of Object.keys(currentChildren)) {
+        if (!hasOwn(wantedChildren, alias)) {
+            removedAliases.push(alias);
+        }
+    }
+    return { changedChildren, removedAliases };
+}
+function hasOwn(obj, key) {
+    return obj != null && Object.hasOwn(obj, key);
+}
+async function getActualChildrenDiff(depNode, depGraph, lockfileDir, optional) {
+    if (depNode.optionalDependencies.size === 0) {
+        return { actualChildrenChanged: false, removedAliases: [] };
+    }
+    const currentAliases = new Set((await readModulesDir(depNode.modules) ?? []).filter((alias) => alias !== depNode.name));
+    const nextAliases = new Set(Object.keys(getChildrenPaths(depNode, depGraph, lockfileDir, optional)));
+    const removedAliases = Array.from(currentAliases).filter((alias) => !nextAliases.has(alias));
+    const actualChildrenChanged = removedAliases.length > 0 ||
+        Array.from(nextAliases).some((alias) => !currentAliases.has(alias));
+    return { actualChildrenChanged, removedAliases };
+}
+async function removeObsoleteChild(modulesDir, alias) {
+    // Guard against an alias that would escape the modules directory (e.g. `../../x`).
+    if (!isValidDependencyAlias(alias))
+        return;
+    await rimraf(path.join(modulesDir, alias));
+    if (alias[0] === '@') {
+        await fs.rmdir(path.join(modulesDir, alias.split('/')[0])).catch(() => { });
+    }
+}
+function getChildrenPaths(depNode, depGraph, lockfileDir, optional) {
+    const children = optional
+        ? depNode.children
+        : pickBy((_, childAlias) => !depNode.optionalDependencies.has(childAlias), depNode.children);
+    const childrenPaths = {};
+    for (const [alias, childDepPath] of Object.entries(children ?? {})) {
+        if (alias === depNode.name)
+            continue;
+        if (childDepPath.startsWith('link:')) {
+            childrenPaths[alias] = path.resolve(lockfileDir, childDepPath.slice(5));
+            continue;
+        }
+        const pkg = depGraph[childDepPath];
+        if (!pkg || !pkg.installable && pkg.optional)
+            continue;
+        childrenPaths[alias] = pkg.dir;
+    }
+    return childrenPaths;
+}
 //# sourceMappingURL=link.js.map

package/lib/install/recordLockfileVerified.js

@@ -1,5 +1,5 @@
 import { hashObject } from '@pnpm/crypto.object-hasher';
-import { withResolutionShapeCacheIdentity } from './verifyLockfileResolutions.js';
+import { withOfflineCheckCacheIdentities } from './verifyLockfileResolutions.js';
 import { recordVerification } from './verifyLockfileResolutionsCache.js';
 /**
  * Records the post-resolution lockfile as verified so the next install
@@ -18,7 +18,7 @@ export function recordLockfileVerified(opts) {
         return;
     recordVerification(opts.cacheDir, {
         lockfilePath: opts.lockfilePath,
-        verifiers: withResolutionShapeCacheIdentity(opts.resolutionVerifiers),
+        verifiers: withOfflineCheckCacheIdentities(opts.resolutionVerifiers),
         hashLockfile: () => hashObject(opts.lockfile),
     });
 }

package/lib/install/verifyLockfileResolutions.d.ts

@@ -3,15 +3,19 @@ import type { ResolutionPolicyViolation, ResolutionVerifier } from '@pnpm/resolv
 import { type VerifierCacheIdentity } from './verifyLockfileResolutionsCache.js';
 export type { ResolutionPolicyViolation };
 export declare const RESOLUTION_SHAPE_MISMATCH_VIOLATION_CODE = "RESOLUTION_SHAPE_MISMATCH";
+export declare const INVALID_DEPENDENCY_ALIAS_CODE = "INVALID_DEPENDENCY_NAME";
 /**
  * Every verifier list that flows into the verification cache must carry
- * the resolution-shape identity, so records written before the shape rule
- * existed cannot stat-fast-path around it. Used by the gate itself and by
- * {@link recordLockfileVerified}, whose freshly-resolved lockfile satisfies
- * the shape invariant by construction (the writer derives every key from
- * the resolution it just produced).
+ * the always-on offline structural checks' identities, so a record
+ * written before one of those rules existed cannot stat-fast-path around
+ * it — its missing flag fails `canTrustPastCheck`, forcing a
+ * re-verification that runs the new check. Used by the gate itself and by
+ * {@link recordLockfileVerified}, whose freshly-resolved lockfile
+ * satisfies these invariants by construction (the resolver validates
+ * aliases at manifest-read time and derives every resolution key from the
+ * resolution it just produced).
  */
-export declare function withResolutionShapeCacheIdentity(verifiers: readonly VerifierCacheIdentity[]): VerifierCacheIdentity[];
+export declare function withOfflineCheckCacheIdentities(verifiers: readonly VerifierCacheIdentity[]): VerifierCacheIdentity[];
 export interface VerifyLockfileResolutionsOptions {
     concurrency?: number;
     /**

package/lib/install/verifyLockfileResolutions.js

@@ -1,6 +1,7 @@
 import { lockfileVerificationLogger } from '@pnpm/core-loggers';
 import { hashObject } from '@pnpm/crypto.object-hasher';
 import { PnpmError } from '@pnpm/error';
+import { isValidDependencyAlias } from '@pnpm/installing.deps-resolver';
 import { isGitHostedTarballUrl, nameVerFromPkgSnapshot } from '@pnpm/lockfile.utils';
 import pLimit from 'p-limit';
 import { recordVerification, tryLockfileVerificationCache, } from './verifyLockfileResolutionsCache.js';
@@ -13,20 +14,29 @@ const MAX_VIOLATIONS_TO_PRINT = 20;
 // verification pass doesn't push past what the rest of the install respects.
 const DEFAULT_CONCURRENCY = 64;
 export const RESOLUTION_SHAPE_MISMATCH_VIOLATION_CODE = 'RESOLUTION_SHAPE_MISMATCH';
+// Same code the sink-level guards (`safeJoinModulesDir`) throw.
+export const INVALID_DEPENDENCY_ALIAS_CODE = 'INVALID_DEPENDENCY_NAME';
 const RESOLUTION_SHAPE_CACHE_IDENTITY = {
     policy: { resolutionShapeCheck: true },
     canTrustPastCheck: (cached) => cached.resolutionShapeCheck === true,
 };
+const DEPENDENCY_ALIAS_CACHE_IDENTITY = {
+    policy: { dependencyAliasCheck: true },
+    canTrustPastCheck: (cached) => cached.dependencyAliasCheck === true,
+};
 /**
  * Every verifier list that flows into the verification cache must carry
- * the resolution-shape identity, so records written before the shape rule
- * existed cannot stat-fast-path around it. Used by the gate itself and by
- * {@link recordLockfileVerified}, whose freshly-resolved lockfile satisfies
- * the shape invariant by construction (the writer derives every key from
- * the resolution it just produced).
+ * the always-on offline structural checks' identities, so a record
+ * written before one of those rules existed cannot stat-fast-path around
+ * it — its missing flag fails `canTrustPastCheck`, forcing a
+ * re-verification that runs the new check. Used by the gate itself and by
+ * {@link recordLockfileVerified}, whose freshly-resolved lockfile
+ * satisfies these invariants by construction (the resolver validates
+ * aliases at manifest-read time and derives every resolution key from the
+ * resolution it just produced).
  */
-export function withResolutionShapeCacheIdentity(verifiers) {
-    return [...verifiers, RESOLUTION_SHAPE_CACHE_IDENTITY];
+export function withOfflineCheckCacheIdentities(verifiers) {
+    return [...verifiers, RESOLUTION_SHAPE_CACHE_IDENTITY, DEPENDENCY_ALIAS_CACHE_IDENTITY];
 }
 /**
  * Policy-neutral pass that asks every resolver-supplied
@@ -65,7 +75,7 @@ export async function verifyLockfileResolutions(lockfile, verifiers, options) {
     const cache = options?.cacheDir && options?.lockfilePath
         ? { cacheDir: options.cacheDir, lockfilePath: options.lockfilePath }
         : undefined;
-    const cacheVerifiers = withResolutionShapeCacheIdentity(verifiers);
+    const cacheVerifiers = withOfflineCheckCacheIdentities(verifiers);
     let cachePrecomputed;
     // hashObject streams and is key-order-stable, unlike JSON.stringify.
     let cachedHash;
@@ -104,7 +114,10 @@ export async function verifyLockfileResolutions(lockfile, verifiers, options) {
     // A degenerate lockfile where every snapshot fails the
     // name/version extraction (so candidates is empty) skips emission
     // entirely — no work, no noise.
-    const { candidates, shapeViolations } = collectCandidates(lockfile);
+    const { candidates, shapeViolations, invalidAliases } = collectCandidates(lockfile);
+    if (invalidAliases.length > 0) {
+        throw buildInvalidAliasError(invalidAliases);
+    }
     if (shapeViolations.length > 0) {
         throw buildVerificationError(shapeViolations);
     }
@@ -158,6 +171,19 @@ export async function verifyLockfileResolutions(lockfile, verifiers, options) {
         });
     }
 }
+function buildInvalidAliasError(aliases) {
+    const sorted = [...aliases].sort();
+    const visible = sorted.slice(0, MAX_VIOLATIONS_TO_PRINT);
+    const omitted = sorted.length - visible.length;
+    const breakdown = visible.map((alias) => `  ${JSON.stringify(alias)}`).join('\n');
+    const details = omitted > 0 ? `${breakdown}\n  …and ${omitted} more` : breakdown;
+    const plural = aliases.length === 1 ? 'alias' : 'aliases';
+    return new PnpmError(INVALID_DEPENDENCY_ALIAS_CODE, `The lockfile contains ${aliases.length} dependency ${plural} that are not valid package names:\n${details}`, {
+        hint: 'A dependency alias becomes a directory under node_modules, so it must be a valid npm package name — a single `name` or `@scope/name` with no leading `.` or `_`, and not a reserved name such as `node_modules`. ' +
+            'An alias containing path-traversal segments or a reserved name such as `.bin` or `.pnpm` could make an install write outside the intended directory or overwrite pnpm-owned layout. ' +
+            'This usually means the lockfile was tampered with — inspect recent changes to pnpm-lock.yaml before trusting it.',
+    });
+}
 function buildVerificationError(violations) {
     // Stable order so the error output is deterministic.
     violations.sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
@@ -266,7 +292,17 @@ function isRegistryShapedResolution(resolution) {
 function collectCandidates(lockfile) {
     const candidates = new Map();
     const shapeViolations = [];
+    // The importer alias maps are the one source not reached by the
+    // package loop below, so they're scanned here.
+    const invalidAliases = new Set();
+    for (const importer of Object.values(lockfile.importers ?? {})) {
+        pushInvalidAliases(importer.dependencies, invalidAliases);
+        pushInvalidAliases(importer.devDependencies, invalidAliases);
+        pushInvalidAliases(importer.optionalDependencies, invalidAliases);
+    }
     for (const [depPath, snapshot] of Object.entries(lockfile.packages ?? {})) {
+        pushInvalidAliases(snapshot.dependencies, invalidAliases);
+        pushInvalidAliases(snapshot.optionalDependencies, invalidAliases);
         const { name, version, nonSemverVersion } = nameVerFromPkgSnapshot(depPath, snapshot);
         if (!name || !version)
             continue;
@@ -292,7 +328,21 @@ function collectCandidates(lockfile) {
             resolution: snapshot.resolution,
         });
     }
-    return { candidates, shapeViolations };
+    return { candidates, shapeViolations, invalidAliases: Array.from(invalidAliases) };
+}
+/**
+ * Add every key of `deps` that is not a valid {@link isValidDependencyAlias}
+ * to `invalid`. Only pass maps whose keys become `node_modules/<alias>`
+ * directories — not `overrides` (`foo>bar` selectors) or
+ * `patchedDependencies` (`name@version` keys).
+ */
+function pushInvalidAliases(deps, invalid) {
+    if (deps == null)
+        return;
+    for (const alias of Object.keys(deps)) {
+        if (!isValidDependencyAlias(alias))
+            invalid.add(alias);
+    }
 }
 async function iterateLockfileViolations(candidates, verifiers, concurrency) {
     const violations = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1101.9.0",
+  "version": "1102.1.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -52,7 +52,7 @@
   "dependencies": {
     "@inquirer/prompts": "^8.4.3",
     "@pnpm/npm-package-arg": "^2.0.0",
-    "@pnpm/util.lex-comparator": "^3.0.2",
+    "@pnpm/util.lex-comparator": "^4.0.1",
     "@zkochan/rimraf": "^4.0.0",
     "is-inner-link": "^5.0.0",
     "is-subdir": "^2.0.0",
@@ -64,104 +64,105 @@
     "path-exists": "^5.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
-    "semver": "^7.8.1",
-    "@pnpm/bins.linker": "1100.0.13",
-    "@pnpm/building.after-install": "1101.0.21",
-    "@pnpm/building.during-install": "1101.0.18",
-    "@pnpm/building.policy": "1100.0.9",
-    "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/catalogs.types": "1100.0.0",
+    "semver": "^7.8.4",
+    "@pnpm/bins.linker": "1100.0.15",
+    "@pnpm/building.after-install": "1102.0.1",
+    "@pnpm/building.during-install": "1102.0.1",
+    "@pnpm/building.policy": "1100.0.10",
+    "@pnpm/catalogs.config": "1100.0.1",
     "@pnpm/catalogs.protocol-parser": "1100.0.0",
+    "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/config.normalize-registries": "1100.0.8",
     "@pnpm/config.parse-overrides": "1100.0.1",
+    "@pnpm/core-loggers": "1100.2.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/config.normalize-registries": "1100.0.7",
-    "@pnpm/core-loggers": "1100.2.0",
-    "@pnpm/deps.graph-hasher": "1100.2.4",
-    "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/bins.remover": "1100.0.10",
+    "@pnpm/deps.graph-hasher": "1100.2.5",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/crypto.object-hasher": "1100.0.0",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
+    "@pnpm/deps.path": "1100.0.8",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.7",
-    "@pnpm/exec.lifecycle": "1100.0.17",
-    "@pnpm/fs.symlink-dependency": "1100.0.9",
-    "@pnpm/crypto.object-hasher": "1100.0.0",
-    "@pnpm/hooks.read-package-hook": "1100.0.7",
-    "@pnpm/hooks.types": "1100.0.11",
-    "@pnpm/installing.deps-resolver": "1100.2.2",
-    "@pnpm/bins.remover": "1100.0.9",
-    "@pnpm/installing.context": "1100.0.17",
-    "@pnpm/installing.linking.hoist": "1100.0.13",
-    "@pnpm/installing.deps-restorer": "1101.1.11",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.7",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.9",
-    "@pnpm/installing.modules-yaml": "1100.0.8",
-    "@pnpm/lockfile.filtering": "1100.1.6",
-    "@pnpm/lockfile.fs": "1100.1.4",
-    "@pnpm/installing.package-requester": "1101.1.0",
-    "@pnpm/lockfile.preferred-versions": "1100.0.15",
+    "@pnpm/exec.lifecycle": "1100.1.0",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/lockfile.settings-checker": "1100.0.17",
-    "@pnpm/lockfile.to-pnp": "1100.0.13",
-    "@pnpm/lockfile.pruner": "1100.0.10",
-    "@pnpm/lockfile.utils": "1100.0.12",
-    "@pnpm/lockfile.walker": "1100.0.10",
-    "@pnpm/network.auth-header": "1101.1.1",
-    "@pnpm/lockfile.verification": "1100.0.17",
-    "@pnpm/patching.config": "1100.0.7",
-    "@pnpm/pnpr.client": "1.2.0",
-    "@pnpm/pkg-manifest.utils": "1100.2.4",
-    "@pnpm/store.controller-types": "1100.1.4",
-    "@pnpm/store.index": "1100.1.0",
-    "@pnpm/resolving.resolver-base": "1100.4.1",
-    "@pnpm/types": "1101.3.1",
+    "@pnpm/fs.symlink-dependency": "1100.0.10",
+    "@pnpm/hooks.types": "1100.0.12",
+    "@pnpm/installing.context": "1100.0.19",
+    "@pnpm/installing.deps-resolver": "1100.2.4",
+    "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/installing.deps-restorer": "1102.1.0",
+    "@pnpm/installing.linking.hoist": "1100.0.15",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.8",
+    "@pnpm/installing.package-requester": "1102.0.0",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.10",
+    "@pnpm/installing.modules-yaml": "1100.0.9",
+    "@pnpm/lockfile.filtering": "1100.1.7",
+    "@pnpm/lockfile.preferred-versions": "1100.0.16",
+    "@pnpm/lockfile.fs": "1100.1.6",
+    "@pnpm/lockfile.pruner": "1100.0.11",
+    "@pnpm/lockfile.to-pnp": "1100.1.0",
+    "@pnpm/lockfile.verification": "1100.0.19",
+    "@pnpm/lockfile.settings-checker": "1100.0.19",
+    "@pnpm/lockfile.utils": "1100.0.13",
+    "@pnpm/network.auth-header": "1101.1.2",
+    "@pnpm/patching.config": "1100.0.8",
+    "@pnpm/pkg-manifest.utils": "1100.2.5",
+    "@pnpm/pnpr.client": "1.2.2",
+    "@pnpm/resolving.resolver-base": "1100.4.2",
+    "@pnpm/store.controller-types": "1100.1.5",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.12"
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
+    "@pnpm/hooks.read-package-hook": "1100.0.8",
+    "@pnpm/lockfile.walker": "1100.0.11",
+    "@pnpm/store.index": "1100.2.0"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1",
-    "@pnpm/worker": "^1100.1.11"
+    "@pnpm/logger": "^1100.0.0",
+    "@pnpm/worker": "^1100.2.1"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
     "@types/fs-extra": "^11.0.4",
     "@types/is-windows": "^1.0.2",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
-    "@yarnpkg/core": "4.5.0",
+    "@yarnpkg/core": "4.8.0",
     "ci-info": "^4.4.0",
     "deep-require-cwd": "1.0.0",
     "execa": "npm:safe-execa@0.3.0",
     "exists-link": "2.0.0",
     "is-windows": "^1.0.2",
-    "nock": "13.3.4",
     "path-name": "^1.0.0",
     "read-yaml-file": "^3.0.0",
     "resolve-link-target": "^3.0.0",
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.15",
-    "@pnpm/assert-store": "1100.0.15",
-    "@pnpm/installing.deps-installer": "1101.9.0",
+    "@pnpm/assert-project": "1100.0.16",
+    "@pnpm/installing.deps-installer": "1102.1.0",
+    "@pnpm/assert-store": "1100.0.16",
+    "@pnpm/lockfile.types": "1100.0.11",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.git-utils": "1100.0.1",
-    "@pnpm/lockfile.types": "1100.0.10",
-    "@pnpm/resolving.registry.types": "1100.1.2",
-    "@pnpm/pkg-manifest.reader": "1100.0.7",
-    "@pnpm/store.cafs": "1100.1.9",
+    "@pnpm/prepare": "1100.0.16",
+    "@pnpm/store.cafs": "1100.1.10",
+    "@pnpm/pkg-manifest.reader": "1100.0.8",
     "@pnpm/store.path": "1100.0.1",
-    "@pnpm/prepare": "1100.0.15",
     "@pnpm/test-ipc-server": "1100.0.0",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1101.0.2",
-    "@pnpm/testing.temp-store": "1100.1.8",
-    "@pnpm/testing.registry-mock": "1100.0.5"
+    "@pnpm/network.git-utils": "1100.0.2",
+    "@pnpm/testing.mock-agent": "1101.0.3",
+    "@pnpm/resolving.registry.types": "1100.1.3",
+    "@pnpm/testing.temp-store": "1100.1.10",
+    "@pnpm/testing.registry-mock": "1100.0.6"
   },
   "engines": {
     "node": ">=22.13"
   },
   "jest": {
+    "collectCoverage": false,
     "preset": "@pnpm/jest-config/with-registry"
   },
   "scripts": {
@@ -170,6 +171,8 @@
     "test-with-preview": "preview && pnpm run test:e2e",
     "test": "pn compile && pn .test",
     "compile": "tsgo --build && pn lint --fix",
-    ".test": "cross-env PNPM_REGISTRY_MOCK_PORT=7769 NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
+    ".test": "pn .test:heavy && pn .test:rest",
+    ".test:heavy": "cross-env PNPM_REGISTRY_MOCK_PORT=7769 NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest test/install/deepRecursive.ts",
+    ".test:rest": "cross-env PNPM_REGISTRY_MOCK_PORT=7769 NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest \"^(?!.*deepRecursive)\""
   }
 }