@pnpm/installing.deps-installer 1102.0.0 → 1102.1.1

package/lib/install/extendInstallOptions.d.ts

@@ -46,6 +46,13 @@ export interface StrictInstallOptions {
     preferFrozenLockfile: boolean;
     saveWorkspaceProtocol: boolean | 'rolling';
     lockfileCheck?: (prev: LockfileObject, next: LockfileObject) => void;
+    /**
+     * When true, resolve fully but write nothing to disk (no lockfile, no
+     * `node_modules`). The before/after wanted lockfiles are returned in the
+     * install result's `dryRunResult` so the caller can report what an install
+     * would change. Powers `pnpm install --dry-run`.
+     */
+    dryRun?: boolean;
     lockfileIncludeTarballUrl?: boolean;
     preferWorkspacePackages: boolean;
     preserveWorkspaceProtocol: boolean;
@@ -65,6 +72,8 @@ export interface StrictInstallOptions {
     engineStrict: boolean;
     allowBuilds?: Record<string, boolean | string>;
     nodeLinker: 'isolated' | 'hoisted' | 'pnp';
+    nodeExperimentalPackageMap: boolean;
+    nodePackageMapType: 'standard' | 'loose';
     nodeVersion?: string;
     packageExtensions: Record<string, PackageExtension>;
     ignoredOptionalDependencies: string[];

package/lib/install/extendInstallOptions.js

@@ -48,6 +48,8 @@ const defaults = (opts) => {
         updateChecksums: false,
         nodeVersion: opts.nodeVersion,
         nodeLinker: 'isolated',
+        nodeExperimentalPackageMap: false,
+        nodePackageMapType: 'standard',
         overrides: {},
         ownLifecycleHooksStdio: 'inherit',
         ignoreCompatibilityDb: false,

package/lib/install/index.d.ts

@@ -2,6 +2,7 @@ import type { Catalogs } from '@pnpm/catalogs.types';
 import { PnpmError } from '@pnpm/error';
 import { type PinnedVersion, type UpdateMatchingFunction, type WantedDependency } from '@pnpm/installing.deps-resolver';
 import { type InstallationResultStats } from '@pnpm/installing.deps-restorer';
+import { type LockfileObject } from '@pnpm/lockfile.fs';
 import type { PreferredVersions, ResolutionPolicyViolation } from '@pnpm/resolving.resolver-base';
 import type { DependenciesField, DepPath, IgnoredBuilds, PeerDependencyIssues, ProjectId, ProjectManifest, ProjectRootDir, ReadPackageHook } from '@pnpm/types';
 import { type InstallOptions } from './extendInstallOptions.js';
@@ -47,6 +48,8 @@ export interface InstallResult {
     ignoredBuilds: IgnoredBuilds | undefined;
     /** Forwarded from {@link MutateModulesResult.resolutionPolicyViolations}. */
     resolutionPolicyViolations: ResolutionPolicyViolation[];
+    /** Forwarded from {@link MutateModulesResult.dryRunResult}. */
+    dryRunResult?: DryRunInstallResult;
 }
 export declare function install(manifest: ProjectManifest, opts: Opts): Promise<InstallResult>;
 export type MutatedProject = DependenciesMutation & {
@@ -64,6 +67,8 @@ export interface MutateModulesInSingleProjectResult {
     ignoredBuilds: IgnoredBuilds | undefined;
     /** Forwarded from {@link MutateModulesResult.resolutionPolicyViolations}. */
     resolutionPolicyViolations: ResolutionPolicyViolation[];
+    /** Forwarded from {@link MutateModulesResult.dryRunResult}. */
+    dryRunResult?: DryRunInstallResult;
 }
 export declare function mutateModulesInSingleProject(project: MutatedProject & {
     binsDir?: string;
@@ -86,6 +91,11 @@ export interface MutateModulesResult {
      * verifier reported a violation or no policy was active.
      */
     resolutionPolicyViolations: ResolutionPolicyViolation[];
+    /**
+     * Present only for a `dryRun` install: the before/after wanted lockfiles
+     * the resolve produced without writing, for the caller to diff.
+     */
+    dryRunResult?: DryRunInstallResult;
 }
 export declare function mutateModules(projects: MutatedProject[], maybeOpts: MutateModulesOptions): Promise<MutateModulesResult>;
 export declare function addDependenciesToPackage(manifest: ProjectManifest, dependencySelectors: string[], opts: Omit<InstallOptions, 'allProjects'> & {
@@ -117,6 +127,14 @@ export interface UpdatedProject {
     peerDependencyIssues?: PeerDependencyIssues;
     rootDir: ProjectRootDir;
 }
+/**
+ * The before/after wanted lockfiles a `dryRun` install resolved without
+ * writing. The caller diffs them to report what a real install would change.
+ */
+export interface DryRunInstallResult {
+    originalLockfile: LockfileObject;
+    wantedLockfile: LockfileObject;
+}
 export declare class IgnoredBuildsError extends PnpmError {
     constructor(ignoredBuilds: IgnoredBuilds);
 }

package/lib/install/index.js

@@ -3,22 +3,24 @@ import { linkBins, linkBinsOfPackages } from '@pnpm/bins.linker';
 import { buildSelectedPkgs } from '@pnpm/building.after-install';
 import { buildModules, linkBinsOfDependencies } from '@pnpm/building.during-install';
 import { createAllowBuildFunction, isBuildExplicitlyDisallowed } from '@pnpm/building.policy';
+import { mergeCatalogs } from '@pnpm/catalogs.config';
 import { parseCatalogProtocol } from '@pnpm/catalogs.protocol-parser';
 import { matchCatalogResolveResult, resolveFromCatalog } from '@pnpm/catalogs.resolver';
+import { parseOverrides } from '@pnpm/config.parse-overrides';
 import { LAYOUT_VERSION, LOCKFILE_MAJOR_VERSION, LOCKFILE_VERSION, WANTED_LOCKFILE, } from '@pnpm/constants';
 import { ignoredScriptsLogger, stageLogger, summaryLogger, } from '@pnpm/core-loggers';
 import { hashObjectNullableWithPrefix } from '@pnpm/crypto.object-hasher';
 import * as dp from '@pnpm/deps.path';
 import { PnpmError } from '@pnpm/error';
-import { makeNodeRequireOption, runLifecycleHook, runLifecycleHooksConcurrently, } from '@pnpm/exec.lifecycle';
+import { makeNodePackageMapOption, makeNodeRequireOption, runLifecycleHook, runLifecycleHooksConcurrently, } from '@pnpm/exec.lifecycle';
 import { getContext } from '@pnpm/installing.context';
 import { getWantedDependencies, resolveDependencies, } from '@pnpm/installing.deps-resolver';
 import { extendProjectsWithTargetDirs, headlessInstall } from '@pnpm/installing.deps-restorer';
-import { writeModulesManifest } from '@pnpm/installing.modules-yaml';
+import { readModulesManifest, writeModulesManifest } from '@pnpm/installing.modules-yaml';
 import { cleanGitBranchLockfiles, getWantedLockfileName, isEmptyLockfile, readEnvLockfile, readWantedLockfile, readWantedLockfileFile, writeCurrentLockfile, writeEnvLockfile, writeLockfiles, writeWantedLockfile, } from '@pnpm/lockfile.fs';
 import { getPreferredVersionsFromLockfileAndManifests } from '@pnpm/lockfile.preferred-versions';
 import { calcPatchHashes, createOverridesMapFromParsed, getOutdatedLockfileSetting, } from '@pnpm/lockfile.settings-checker';
-import { writePnpFile } from '@pnpm/lockfile.to-pnp';
+import { PACKAGE_MAP_FILENAME, writePackageMap, writePnpFile } from '@pnpm/lockfile.to-pnp';
 import { allProjectsAreUpToDate, satisfiesPackageManifest } from '@pnpm/lockfile.verification';
 import { globalInfo, logger, streamParser } from '@pnpm/logger';
 import { groupPatchedDependencies } from '@pnpm/patching.config';
@@ -60,7 +62,7 @@ export async function install(manifest, opts) {
     if (opts.pnprServer) {
         return installViaPnprServer(manifest, rootDir, opts);
     }
-    const { updatedCatalogs, updatedProjects: projects, ignoredBuilds, resolutionPolicyViolations } = await mutateModules([
+    const { updatedCatalogs, updatedProjects: projects, ignoredBuilds, resolutionPolicyViolations, dryRunResult } = await mutateModules([
         {
             mutation: 'install',
             pruneDirectDependencies: opts.pruneDirectDependencies,
@@ -79,7 +81,7 @@ export async function install(manifest, opts) {
                 binsDir: opts.binsDir,
             }],
     });
-    return { updatedCatalogs, updatedManifest: projects[0].manifest, ignoredBuilds, resolutionPolicyViolations };
+    return { updatedCatalogs, updatedManifest: projects[0].manifest, ignoredBuilds, resolutionPolicyViolations, dryRunResult };
 }
 export async function mutateModulesInSingleProject(project, maybeOpts) {
     const result = await mutateModules([
@@ -102,6 +104,7 @@ export async function mutateModulesInSingleProject(project, maybeOpts) {
         updatedProject: result.updatedProjects[0],
         ignoredBuilds: result.ignoredBuilds,
         resolutionPolicyViolations: result.resolutionPolicyViolations,
+        dryRunResult: result.dryRunResult,
     };
 }
 const pickCatalogSpecifier = {
@@ -198,7 +201,7 @@ export async function mutateModules(projects, maybeOpts) {
         opts.useLockfile &&
         !opts.useGitBranchLockfile &&
         !opts.mergeGitBranchLockfiles &&
-        opts.lockfileCheck == null &&
+        !isCheckOnlyInstall(opts) &&
         opts.enableModulesDir &&
         installsOnly &&
         !opts.lockfileOnly &&
@@ -288,6 +291,7 @@ export async function mutateModules(projects, maybeOpts) {
     if (!opts.ignoreScripts && ignoredBuilds?.size) {
         ignoredBuilds = await runUnignoredDependencyBuilds(opts, ignoredBuilds, ctx.wantedLockfile, allowBuild);
     }
+    let revokedBuilds = false;
     // Detect packages whose build approval was revoked between the previous
     // and current install. A package is considered revoked when it was
     // previously allowed (true) but is now undecided (undefined). Packages
@@ -310,10 +314,28 @@ export async function mutateModules(projects, maybeOpts) {
                 if (allowBuild?.(depPath) === undefined) {
                     ignoredBuilds ??= new Set();
                     ignoredBuilds.add(depPath);
+                    revokedBuilds = true;
                 }
             }
         }
     }
+    if (revokedBuilds && !opts.lockfileOnly && opts.enableModulesDir) {
+        // The install path already wrote .modules.yaml with the current
+        // install's state, but it captured ignoredBuilds before the revocation
+        // scan above added to it. Re-read the manifest from disk so we only
+        // update ignoredBuilds and don't clobber fields (hoistedDependencies,
+        // pendingBuilds, etc.) the install just wrote. The current computed
+        // set is authoritative — runUnignoredDependencyBuilds may have removed
+        // entries (for packages it successfully rebuilt) that the on-disk
+        // manifest still records, and those must not be re-introduced.
+        const writtenManifest = await readModulesManifest(ctx.rootModulesDir);
+        if (writtenManifest) {
+            // writeModulesManifest converts ignoredBuilds to an array before
+            // serializing, so a Set is fine here.
+            writtenManifest.ignoredBuilds = ignoredBuilds;
+            await writeModulesManifest(ctx.rootModulesDir, writtenManifest);
+        }
+    }
     ignoredScriptsLogger.debug({
         packageNames: ignoredBuilds ? dedupePackageNamesFromIgnoredBuilds(ignoredBuilds) : [],
     });
@@ -325,6 +347,7 @@ export async function mutateModules(projects, maybeOpts) {
         depsRequiringBuild: result.depsRequiringBuild,
         ignoredBuilds,
         resolutionPolicyViolations: result.resolutionPolicyViolations ?? [],
+        dryRunResult: result.dryRunResult,
     };
     // Reconcile the install with the lockfile verification that runs alongside
     // it. The verification verdict is awaited first so it takes precedence and
@@ -647,6 +670,7 @@ export async function mutateModules(projects, maybeOpts) {
             depsRequiringBuild: result.depsRequiringBuild,
             ignoredBuilds: result.ignoredBuilds,
             resolutionPolicyViolations: result.resolutionPolicyViolations,
+            dryRunResult: result.dryRunResult,
         };
     }
     /**
@@ -680,6 +704,11 @@ export async function mutateModules(projects, maybeOpts) {
         !ctx.lockfileHadConflicts &&
             !opts.fixLockfile &&
             !opts.dedupe &&
+            // A check-only install (`lockfileCheck`, used by `--dry-run` and
+            // `dedupe --check`) must always run a full resolution so the wanted
+            // lockfile can be compared, and must never materialize anything. The
+            // frozen path would skip resolution and/or perform a real install.
+            !isCheckOnlyInstall(opts) &&
             installsOnly &&
             (
             // If the user explicitly requested a frozen lockfile install, attempt
@@ -767,7 +796,7 @@ Note that in CI environments, this setting is enabled by default.`,
         else {
             logger.info({ message: 'Lockfile is up to date, resolution step is skipped', prefix: opts.lockfileDir });
         }
-        if (opts.runPacquet != null && opts.useLockfile && !opts.useGitBranchLockfile && !opts.mergeGitBranchLockfiles && opts.lockfileCheck == null && opts.enableModulesDir) {
+        if (opts.runPacquet != null && opts.useLockfile && !opts.useGitBranchLockfile && !opts.mergeGitBranchLockfiles && !isCheckOnlyInstall(opts) && opts.enableModulesDir) {
             try {
                 await opts.runPacquet.run();
             }
@@ -989,18 +1018,29 @@ export async function addDependenciesToPackage(manifest, dependencySelectors, op
     });
     return { updatedCatalogs, updatedManifest: projects[0].manifest, ignoredBuilds, resolutionPolicyViolations };
 }
+/**
+ * A "check-only" install resolves fully but writes nothing: `dryRun`
+ * (`pnpm install --dry-run`) and `lockfileCheck` (`pnpm dedupe --check`)
+ * both take this path. The shared flag suppresses every write and forces a
+ * full resolution (the frozen/headless fast paths are skipped) so the wanted
+ * lockfile can always be compared.
+ */
+function isCheckOnlyInstall(opts) {
+    return opts.lockfileCheck != null || opts.dryRun === true;
+}
 const _installInContext = async (projects, ctx, opts) => {
+    // Aliasing for clarity in boolean expressions below. True for both
+    // `--dry-run` and `dedupe --check`: resolve fully, write nothing.
+    const isInstallationOnlyForLockfileCheck = isCheckOnlyInstall(opts);
     // The wanted lockfile is mutated during installation. To compare changes, a
     // deep copy before installation is needed. This copy should represent the
     // original wanted lockfile on disk as close as possible.
     //
     // This object can be quite large. Intentionally avoiding an expensive copy
-    // if no lockfileCheck option was passed in.
-    const originalLockfileForCheck = opts.lockfileCheck != null
+    // unless this is a check-only install that needs the comparison.
+    const originalLockfileForCheck = isInstallationOnlyForLockfileCheck
         ? clone(ctx.wantedLockfile)
         : null;
-    // Aliasing for clarity in boolean expressions below.
-    const isInstallationOnlyForLockfileCheck = opts.lockfileCheck != null;
     ctx.wantedLockfile.importers = ctx.wantedLockfile.importers || {};
     for (const { id } of projects) {
         if (!ctx.wantedLockfile.importers[id]) {
@@ -1159,6 +1199,17 @@ const _installInContext = async (projects, ctx, opts) => {
         prefix: ctx.lockfileDir,
         stage: 'resolution_done',
     });
+    // `pnpm update` may bump catalog entries during resolution. Overrides that
+    // reference a catalog (e.g. `overrides: { foo: 'catalog:' }`) were resolved
+    // against the pre-update catalog when the install options were extended, so
+    // re-resolve them against the updated catalog. Done before `afterAllResolved`
+    // so that hook still sees (and can amend) the final overrides. Otherwise
+    // lockfile `overrides` keeps pointing at the old version while `catalogs`
+    // advances, and a later `--frozen-lockfile` install fails with
+    // ERR_PNPM_LOCKFILE_CONFIG_MISMATCH.
+    if (updatedCatalogs != null && opts.overrides != null && Object.keys(opts.overrides).length > 0) {
+        newLockfile.overrides = createOverridesMapFromParsed(parseOverrides(opts.overrides, mergeCatalogs(opts.catalogs, updatedCatalogs)));
+    }
     newLockfile = ((opts.hooks?.afterAllResolved) != null)
         ? await pipeWith(async (f, res) => f(await res), opts.hooks.afterAllResolved)(newLockfile) // eslint-disable-line
         : newLockfile;
@@ -1172,6 +1223,7 @@ const _installInContext = async (projects, ctx, opts) => {
     };
     let stats;
     let ignoredBuilds;
+    const shouldWritePackageMap = opts.enableModulesDir !== false && opts.nodeLinker === 'isolated' && !opts.virtualStoreOnly;
     if (!opts.lockfileOnly && !isInstallationOnlyForLockfileCheck && opts.enableModulesDir) {
         const result = await linkPackages(projects, dependenciesGraph, {
             allowBuild: opts.allowBuild,
@@ -1211,6 +1263,20 @@ const _installInContext = async (projects, ctx, opts) => {
             supportedArchitectures: opts.supportedArchitectures,
         });
         stats = result.stats;
+        if (shouldWritePackageMap) {
+            // Omit the importer self-mapping when a project has no name (see the
+            // deps-restorer write): a non-package-name key like `.` would be invalid.
+            const importerNames = Object.fromEntries(projects.map(({ manifest, id }) => [id, manifest.name]));
+            await writePackageMap(result.currentLockfile, {
+                importerNames,
+                lockfileDir: ctx.lockfileDir,
+                locationByDepPath: Object.fromEntries(Object.values(dependenciesGraph).map((node) => [node.depPath, node.dir])),
+                packageMapType: opts.nodePackageMapType,
+                rootModulesDir: ctx.rootModulesDir,
+                virtualStoreDir: ctx.virtualStoreDir,
+                virtualStoreDirMaxLength: ctx.virtualStoreDirMaxLength,
+            });
+        }
         if (opts.enablePnp) {
             const importerNames = Object.fromEntries(projects.map(({ manifest, id }) => [id, manifest.name ?? id]));
             await writePnpFile(result.currentLockfile, {
@@ -1237,7 +1303,13 @@ const _installInContext = async (projects, ctx, opts) => {
                 if (opts.enablePnp) {
                     extraEnv = {
                         ...extraEnv,
-                        ...makeNodeRequireOption(path.join(opts.lockfileDir, '.pnp.cjs')),
+                        ...makeNodeRequireOption(path.join(opts.lockfileDir, '.pnp.cjs'), extraEnv),
+                    };
+                }
+                if (opts.nodeExperimentalPackageMap && shouldWritePackageMap) {
+                    extraEnv = {
+                        ...extraEnv,
+                        ...makeNodePackageMapOption(path.join(ctx.rootModulesDir, PACKAGE_MAP_FILENAME), extraEnv),
                     };
                 }
                 // Dependency lifecycle scripts must not run on an unverified lockfile.
@@ -1382,7 +1454,13 @@ const _installInContext = async (projects, ctx, opts) => {
             if (opts.enablePnp) {
                 opts.scriptsOpts.extraEnv = {
                     ...opts.scriptsOpts.extraEnv,
-                    ...makeNodeRequireOption(path.join(opts.lockfileDir, '.pnp.cjs')),
+                    ...makeNodeRequireOption(path.join(opts.lockfileDir, '.pnp.cjs'), opts.scriptsOpts.extraEnv),
+                };
+            }
+            if (opts.nodeExperimentalPackageMap && shouldWritePackageMap) {
+                opts.scriptsOpts.extraEnv = {
+                    ...opts.scriptsOpts.extraEnv,
+                    ...makeNodePackageMapOption(path.join(ctx.rootModulesDir, PACKAGE_MAP_FILENAME), opts.scriptsOpts.extraEnv),
                 };
             }
             const projectsToBeBuilt = projectsWithTargetDirs.filter(({ mutation }) => mutation === 'install');
@@ -1466,6 +1544,9 @@ const _installInContext = async (projects, ctx, opts) => {
         depsRequiringBuild,
         ignoredBuilds,
         resolutionPolicyViolations,
+        dryRunResult: (opts.dryRun && originalLockfileForCheck != null)
+            ? { originalLockfile: originalLockfileForCheck, wantedLockfile: newLockfile }
+            : undefined,
     };
 };
 function allMutationsAreInstalls(projects) {
@@ -1530,7 +1611,7 @@ const installInContext = async (projects, ctx, opts) => {
         if (!opts.frozenLockfile && opts.useLockfile) {
             const allProjectsLocatedInsideWorkspace = Object.values(ctx.projects)
                 .filter((project) => isPathInsideWorkspace(project.rootDirRealPath ?? project.rootDir));
-            if (allProjectsLocatedInsideWorkspace.length > projects.length && opts.lockfileCheck == null && opts.enableModulesDir) {
+            if (allProjectsLocatedInsideWorkspace.length > projects.length && !isCheckOnlyInstall(opts) && opts.enableModulesDir) {
                 const newProjects = [...projects];
                 const getWantedDepsOpts = {
                     autoInstallPeers: opts.autoInstallPeers,
@@ -1582,7 +1663,7 @@ const installInContext = async (projects, ctx, opts) => {
                 };
             }
         }
-        if (opts.nodeLinker === 'hoisted' && !opts.lockfileOnly && opts.lockfileCheck == null && opts.enableModulesDir) {
+        if (opts.nodeLinker === 'hoisted' && !opts.lockfileOnly && !isCheckOnlyInstall(opts) && opts.enableModulesDir) {
             const result = await _installInContext(projects, ctx, {
                 ...opts,
                 lockfileOnly: true,
@@ -1611,7 +1692,7 @@ const installInContext = async (projects, ctx, opts) => {
         // Isolated `nodeLinker` (the default) with a non-frozen install.
         // The frozen branch is handled earlier in `tryFrozenInstall`; the
         // hoisted branch above runs a resolve-then-materialize sequence.
-        if (opts.runPacquet != null && opts.useLockfile && opts.saveLockfile && !opts.useGitBranchLockfile && !opts.mergeGitBranchLockfiles && !opts.lockfileOnly && opts.lockfileCheck == null && opts.enableModulesDir) {
+        if (opts.runPacquet != null && opts.useLockfile && opts.saveLockfile && !opts.useGitBranchLockfile && !opts.mergeGitBranchLockfiles && !opts.lockfileOnly && !isCheckOnlyInstall(opts) && opts.enableModulesDir) {
             // pacquet >= 0.11.7 resolves itself: hand it the whole install
             // (resolve + fetch + import + link + build, writing the lockfile)
             // in a single non-frozen pass. Only for plain installs — `add` /

package/lib/install/link.d.ts

@@ -1,5 +1,5 @@
 import { type DepsStateCache } from '@pnpm/deps.graph-hasher';
-import type { DependenciesGraph, LinkedDependency } from '@pnpm/installing.deps-resolver';
+import { type DependenciesGraph, type LinkedDependency } from '@pnpm/installing.deps-resolver';
 import type { InstallationResultStats } from '@pnpm/installing.deps-restorer';
 import type { IncludedDependencies } from '@pnpm/installing.modules-yaml';
 import type { LockfileObject } from '@pnpm/lockfile.fs';

package/lib/install/link.js

@@ -2,13 +2,16 @@ import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { progressLogger, stageLogger, statsLogger, } from '@pnpm/core-loggers';
 import { calcDepState, findRuntimeNodeVersion } from '@pnpm/deps.graph-hasher';
+import { readModulesDir } from '@pnpm/fs.read-modules-dir';
 import { symlinkDependency } from '@pnpm/fs.symlink-dependency';
+import { isValidDependencyAlias, } from '@pnpm/installing.deps-resolver';
 import { linkDirectDeps } from '@pnpm/installing.linking.direct-dep-linker';
 import { hoist } from '@pnpm/installing.linking.hoist';
 import { prune } from '@pnpm/installing.linking.modules-cleaner';
 import { filterLockfileByImporters, } from '@pnpm/lockfile.filtering';
 import { logger } from '@pnpm/logger';
 import { symlinkAllModules } from '@pnpm/worker';
+import { rimraf } from '@zkochan/rimraf';
 import pLimit from 'p-limit';
 import { pathExists } from 'path-exists';
 import { difference, equals, isEmpty, pick, pickBy, props } from 'ramda';
@@ -250,20 +253,47 @@ async function linkNewPackages(currentLockfile, wantedLockfile, depGraph, opts)
     });
     const existingWithUpdatedDeps = [];
     if (!opts.force && (currentLockfile.packages != null) && (wantedLockfile.packages != null)) {
+        const currentPackages = currentLockfile.packages;
+        const wantedPackages = wantedLockfile.packages;
         // add subdependencies that have been updated
-        // TODO: no need to relink everything. Can be relinked only what was changed
-        for (const depPath of wantedRelDepPaths) {
-            if (currentLockfile.packages[depPath] &&
-                (!equals(currentLockfile.packages[depPath].dependencies, wantedLockfile.packages[depPath].dependencies) ||
-                    !isEmpty(currentLockfile.packages[depPath].optionalDependencies ?? {}) ||
-                    !isEmpty(wantedLockfile.packages[depPath].optionalDependencies ?? {}))) {
+        await Promise.all(wantedRelDepPaths.map((depPath) => limitModulesDirReads(async () => {
+            if (currentPackages[depPath] &&
+                (!equals(currentPackages[depPath].dependencies, wantedPackages[depPath].dependencies) ||
+                    !isEmpty(currentPackages[depPath].optionalDependencies ?? {}) ||
+                    !isEmpty(wantedPackages[depPath].optionalDependencies ?? {}))) {
                 // TODO: come up with a test that triggers the usecase of depGraph[depPath] undefined
                 // see related issue: https://github.com/pnpm/pnpm/issues/870
                 if (depGraph[depPath] && !newDepPathsSet.has(depPath)) {
-                    existingWithUpdatedDeps.push(depGraph[depPath]);
+                    const { actualChildrenChanged, removedAliases: actualRemovedAliases } = await getActualChildrenDiff(depGraph[depPath], depGraph, opts.lockfileDir, opts.optional);
+                    if (actualChildrenChanged) {
+                        existingWithUpdatedDeps.push({
+                            children: depGraph[depPath].children,
+                            modules: depGraph[depPath].modules,
+                            name: depGraph[depPath].name,
+                            optionalDependencies: depGraph[depPath].optionalDependencies,
+                            removedAliases: actualRemovedAliases,
+                        });
+                        return;
+                    }
+                    const { changedChildren, removedAliases } = getChangedChildren({
+                        currentDependencies: currentPackages[depPath].dependencies,
+                        currentOptionalDependencies: currentPackages[depPath].optionalDependencies,
+                        wantedDependencies: wantedPackages[depPath].dependencies,
+                        wantedOptionalDependencies: wantedPackages[depPath].optionalDependencies,
+                        allChildren: depGraph[depPath].children,
+                    });
+                    if (!isEmpty(changedChildren) || removedAliases.length > 0) {
+                        existingWithUpdatedDeps.push({
+                            children: changedChildren,
+                            modules: depGraph[depPath].modules,
+                            name: depGraph[depPath].name,
+                            optionalDependencies: depGraph[depPath].optionalDependencies,
+                            removedAliases,
+                        });
+                    }
                 }
             }
-        }
+        })));
     }
     if (!newDepPathsSet.size && (existingWithUpdatedDeps.length === 0))
         return { newDepPaths: [], added };
@@ -317,6 +347,7 @@ async function selectNewFromWantedDeps(wantedRelDepPaths, currentLockfile, depGr
     return newDeps;
 }
 const limitLinking = pLimit(16);
+const limitModulesDirReads = pLimit(16);
 async function linkAllPkgs(storeController, depNodes, opts) {
     // Resolved `engines.runtime` Node version (when present) so the
     // side-effects-cache key prefix tracks the script-runner Node
@@ -365,29 +396,83 @@ async function linkAllPkgs(storeController, depNodes, opts) {
     }));
 }
 async function linkAllModules(depNodes, depGraph, opts) {
+    await Promise.all(depNodes.flatMap((depNode) => (depNode.removedAliases ?? []).map(async (alias) => limitModulesDirReads(async () => removeObsoleteChild(depNode.modules, alias)))));
     await symlinkAllModules({
         deps: depNodes.map((depNode) => {
-            const children = opts.optional
-                ? depNode.children
-                : pickBy((_, childAlias) => !depNode.optionalDependencies.has(childAlias), depNode.children);
-            const childrenPaths = {};
-            for (const [alias, childDepPath] of Object.entries(children ?? {})) {
-                if (childDepPath.startsWith('link:')) {
-                    childrenPaths[alias] = path.resolve(opts.lockfileDir, childDepPath.slice(5));
-                }
-                else {
-                    const pkg = depGraph[childDepPath];
-                    if (!pkg || !pkg.installable && pkg.optional || alias === depNode.name)
-                        continue;
-                    childrenPaths[alias] = pkg.dir;
-                }
-            }
             return {
-                children: childrenPaths,
+                children: getChildrenPaths(depNode, depGraph, opts.lockfileDir, opts.optional),
                 modules: depNode.modules,
                 name: depNode.name,
             };
         }),
     });
 }
+function getChangedChildren(opts) {
+    const { currentOptionalDependencies, wantedOptionalDependencies, allChildren } = opts;
+    // Use null-prototype maps so a child literally named `constructor`,
+    // `toString`, `__proto__`, etc. is treated as a normal alias instead
+    // of colliding with an inherited `Object.prototype` key during the
+    // `in`/index lookups below.
+    const currentChildren = Object.assign(Object.create(null), opts.currentDependencies, currentOptionalDependencies);
+    const wantedChildren = Object.assign(Object.create(null), opts.wantedDependencies, wantedOptionalDependencies);
+    const changedChildren = {};
+    const removedAliases = [];
+    for (const [alias, wantedChildDepPath] of Object.entries(wantedChildren)) {
+        const optionalityChanged = hasOwn(wantedOptionalDependencies, alias) !== hasOwn(currentOptionalDependencies, alias);
+        if (currentChildren[alias] !== wantedChildDepPath || optionalityChanged) {
+            const resolvedChildDepPath = hasOwn(allChildren, alias) ? allChildren[alias] : undefined;
+            if (resolvedChildDepPath != null) {
+                changedChildren[alias] = resolvedChildDepPath;
+            }
+        }
+    }
+    for (const alias of Object.keys(currentChildren)) {
+        if (!hasOwn(wantedChildren, alias)) {
+            removedAliases.push(alias);
+        }
+    }
+    return { changedChildren, removedAliases };
+}
+function hasOwn(obj, key) {
+    return obj != null && Object.hasOwn(obj, key);
+}
+async function getActualChildrenDiff(depNode, depGraph, lockfileDir, optional) {
+    if (depNode.optionalDependencies.size === 0) {
+        return { actualChildrenChanged: false, removedAliases: [] };
+    }
+    const currentAliases = new Set((await readModulesDir(depNode.modules) ?? []).filter((alias) => alias !== depNode.name));
+    const nextAliases = new Set(Object.keys(getChildrenPaths(depNode, depGraph, lockfileDir, optional)));
+    const removedAliases = Array.from(currentAliases).filter((alias) => !nextAliases.has(alias));
+    const actualChildrenChanged = removedAliases.length > 0 ||
+        Array.from(nextAliases).some((alias) => !currentAliases.has(alias));
+    return { actualChildrenChanged, removedAliases };
+}
+async function removeObsoleteChild(modulesDir, alias) {
+    // Guard against an alias that would escape the modules directory (e.g. `../../x`).
+    if (!isValidDependencyAlias(alias))
+        return;
+    await rimraf(path.join(modulesDir, alias));
+    if (alias[0] === '@') {
+        await fs.rmdir(path.join(modulesDir, alias.split('/')[0])).catch(() => { });
+    }
+}
+function getChildrenPaths(depNode, depGraph, lockfileDir, optional) {
+    const children = optional
+        ? depNode.children
+        : pickBy((_, childAlias) => !depNode.optionalDependencies.has(childAlias), depNode.children);
+    const childrenPaths = {};
+    for (const [alias, childDepPath] of Object.entries(children ?? {})) {
+        if (alias === depNode.name)
+            continue;
+        if (childDepPath.startsWith('link:')) {
+            childrenPaths[alias] = path.resolve(lockfileDir, childDepPath.slice(5));
+            continue;
+        }
+        const pkg = depGraph[childDepPath];
+        if (!pkg || !pkg.installable && pkg.optional)
+            continue;
+        childrenPaths[alias] = pkg.dir;
+    }
+    return childrenPaths;
+}
 //# sourceMappingURL=link.js.map

package/lib/install/verifyLockfileResolutions.js

@@ -205,6 +205,10 @@ function buildVerificationError(violations) {
     const details = omitted > 0
         ? `${breakdown}\n  …and ${omitted} more`
         : breakdown;
+    // Registry fetch failures (auth/network/5xx) don't reach this batch — the
+    // verifier throws the registry's own error and the gate aborts with it. So
+    // every violation here is a genuine policy rejection, and the hint points at
+    // the lockfile rather than at connectivity.
     return new PnpmError(errorCode, `${violations.length} lockfile entries failed verification:\n${details}`, {
         hint: 'The lockfile contains entries that the active policies reject. ' +
             'This can mean the lockfile is stale, or that someone committed a ' +
@@ -346,22 +350,41 @@ function pushInvalidAliases(deps, invalid) {
 }
 async function iterateLockfileViolations(candidates, verifiers, concurrency) {
     const violations = [];
+    // A verifier may throw rather than return a violation when it can't reach the
+    // registry to verify an entry (auth/network/5xx) — that's not a per-entry
+    // policy pick, it's an incomplete verification, so the registry's own error
+    // should abort the install. Capture the first such error and rethrow it after
+    // the fan-out settles: rethrowing straight into Promise.all would leave the
+    // sibling tasks (all failing against the same dead registry) as unhandled
+    // rejections once Promise.all rejects on the first.
+    let fetchError;
     const limit = pLimit(concurrency ?? DEFAULT_CONCURRENCY);
     await Promise.all(Array.from(candidates.values(), ({ name, version, nonSemverVersion, resolution }) => limit(async () => {
-        // Fan out across every active verifier; each handles its own
-        // protocol short-circuit (e.g. the npm verifier returns ok:true for
-        // git resolutions). We stop at the first failure per entry so a
-        // multi-verifier setup doesn't produce duplicate violations for the
-        // same (name, version).
-        for (const verifier of verifiers) {
-            // eslint-disable-next-line no-await-in-loop
-            const result = await verifier.verify(resolution, { name, version, nonSemverVersion });
-            if (!result.ok) {
-                violations.push({ name, version, resolution, code: result.code, reason: result.reason });
-                break;
+        try {
+            // Fan out across every active verifier; each handles its own
+            // protocol short-circuit (e.g. the npm verifier returns ok:true for
+            // git resolutions). We stop at the first failure per entry so a
+            // multi-verifier setup doesn't produce duplicate violations for the
+            // same (name, version).
+            for (const verifier of verifiers) {
+                // eslint-disable-next-line no-await-in-loop
+                const result = await verifier.verify(resolution, { name, version, nonSemverVersion });
+                if (!result.ok) {
+                    violations.push({ name, version, resolution, code: result.code, reason: result.reason });
+                    break;
+                }
             }
         }
+        catch (err) {
+            fetchError ??= err;
+        }
     })));
+    // A registry that couldn't be reached takes precedence over collected
+    // violations: the run never finished verifying, so the batch is incomplete
+    // and the actionable failure is the transport error. Once it's resolved the
+    // re-run surfaces any remaining violations.
+    if (fetchError != null)
+        throw fetchError;
     return violations;
 }
 //# sourceMappingURL=verifyLockfileResolutions.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1102.0.0",
+  "version": "1102.1.1",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -30,9 +30,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/installing/deps-installer"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/installing/deps-installer"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/installing/deps-installer#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/installing/deps-installer#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -65,61 +65,62 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
     "semver": "^7.8.4",
-    "@pnpm/building.after-install": "1102.0.0",
-    "@pnpm/building.during-install": "1102.0.0",
-    "@pnpm/catalogs.protocol-parser": "1100.0.0",
-    "@pnpm/bins.remover": "1100.0.10",
+    "@pnpm/bins.remover": "1100.0.11",
+    "@pnpm/building.during-install": "1102.0.2",
+    "@pnpm/bins.linker": "1100.0.16",
+    "@pnpm/catalogs.config": "1100.0.2",
+    "@pnpm/building.policy": "1100.0.11",
+    "@pnpm/building.after-install": "1102.0.2",
+    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/catalogs.protocol-parser": "1100.0.0",
+    "@pnpm/config.parse-overrides": "1100.0.2",
     "@pnpm/config.normalize-registries": "1100.0.8",
-    "@pnpm/config.parse-overrides": "1100.0.1",
-    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/config.matcher": "1100.0.1",
     "@pnpm/core-loggers": "1100.2.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/deps.graph-hasher": "1100.2.5",
-    "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/deps.graph-hasher": "1100.2.6",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
-    "@pnpm/building.policy": "1100.0.10",
-    "@pnpm/bins.linker": "1100.0.14",
     "@pnpm/crypto.object-hasher": "1100.0.0",
-    "@pnpm/exec.lifecycle": "1100.0.18",
-    "@pnpm/hooks.read-package-hook": "1100.0.8",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/fs.read-modules-dir": "1100.0.1",
+    "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/exec.lifecycle": "1100.1.1",
     "@pnpm/fs.symlink-dependency": "1100.0.10",
-    "@pnpm/hooks.types": "1100.0.12",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/installing.context": "1100.0.18",
+    "@pnpm/hooks.types": "1100.1.0",
+    "@pnpm/installing.context": "1100.0.20",
+    "@pnpm/installing.deps-resolver": "1100.2.5",
+    "@pnpm/installing.deps-restorer": "1102.1.1",
+    "@pnpm/hooks.read-package-hook": "1100.0.9",
     "@pnpm/installing.linking.direct-dep-linker": "1100.0.10",
-    "@pnpm/installing.deps-resolver": "1100.2.3",
-    "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/installing.linking.hoist": "1100.0.14",
-    "@pnpm/installing.package-requester": "1102.0.0",
-    "@pnpm/installing.deps-restorer": "1102.0.0",
-    "@pnpm/lockfile.fs": "1100.1.5",
-    "@pnpm/lockfile.pruner": "1100.0.11",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.8",
-    "@pnpm/lockfile.preferred-versions": "1100.0.16",
+    "@pnpm/installing.linking.hoist": "1100.0.16",
     "@pnpm/installing.modules-yaml": "1100.0.9",
-    "@pnpm/lockfile.settings-checker": "1100.0.18",
-    "@pnpm/lockfile.utils": "1100.0.13",
-    "@pnpm/lockfile.to-pnp": "1100.0.14",
-    "@pnpm/network.auth-header": "1101.1.2",
-    "@pnpm/lockfile.walker": "1100.0.11",
-    "@pnpm/pnpr.client": "1.2.1",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.9",
+    "@pnpm/installing.package-requester": "1102.1.0",
+    "@pnpm/lockfile.fs": "1100.1.7",
+    "@pnpm/lockfile.preferred-versions": "1100.0.17",
+    "@pnpm/lockfile.filtering": "1100.1.8",
+    "@pnpm/lockfile.pruner": "1100.0.12",
+    "@pnpm/lockfile.settings-checker": "1100.0.20",
+    "@pnpm/lockfile.verification": "1100.0.20",
+    "@pnpm/lockfile.to-pnp": "1100.1.1",
+    "@pnpm/patching.config": "1100.0.9",
+    "@pnpm/lockfile.utils": "1100.1.0",
+    "@pnpm/lockfile.walker": "1100.0.12",
+    "@pnpm/network.auth-header": "1101.1.3",
+    "@pnpm/pkg-manifest.utils": "1100.2.6",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/pkg-manifest.utils": "1100.2.5",
-    "@pnpm/resolving.resolver-base": "1100.4.2",
-    "@pnpm/lockfile.filtering": "1100.1.7",
-    "@pnpm/types": "1101.3.2",
-    "@pnpm/patching.config": "1100.0.8",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
-    "@pnpm/store.controller-types": "1100.1.5",
-    "@pnpm/lockfile.verification": "1100.0.18",
-    "@pnpm/store.index": "1100.2.0"
+    "@pnpm/pnpr.client": "1.2.3",
+    "@pnpm/store.index": "1100.2.1",
+    "@pnpm/resolving.resolver-base": "1100.5.0",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.14",
+    "@pnpm/store.controller-types": "1100.1.6",
+    "@pnpm/types": "1101.3.2"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.0"
+    "@pnpm/worker": "^1100.2.2"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
@@ -140,22 +141,22 @@
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.16",
-    "@pnpm/installing.deps-installer": "1102.0.0",
-    "@pnpm/assert-store": "1100.0.16",
+    "@pnpm/assert-project": "1100.0.17",
+    "@pnpm/assert-store": "1100.0.17",
+    "@pnpm/installing.deps-installer": "1102.1.1",
+    "@pnpm/lockfile.types": "1100.0.12",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.git-utils": "1100.0.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.8",
-    "@pnpm/store.cafs": "1100.1.10",
-    "@pnpm/prepare": "1100.0.16",
-    "@pnpm/store.path": "1100.0.1",
-    "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.registry-mock": "1100.0.6",
-    "@pnpm/testing.mock-agent": "1101.0.3",
-    "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.temp-store": "1100.1.9",
+    "@pnpm/prepare": "1100.0.17",
     "@pnpm/resolving.registry.types": "1100.1.3",
-    "@pnpm/lockfile.types": "1100.0.11"
+    "@pnpm/store.cafs": "1100.1.11",
+    "@pnpm/pkg-manifest.reader": "1100.0.9",
+    "@pnpm/store.path": "1100.0.2",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/test-ipc-server": "1100.0.0",
+    "@pnpm/testing.mock-agent": "1101.0.4",
+    "@pnpm/testing.temp-store": "1100.1.11",
+    "@pnpm/network.git-utils": "1100.0.2",
+    "@pnpm/testing.registry-mock": "1100.0.7"
   },
   "engines": {
     "node": ">=22.13"