@pnpm/installing.deps-installer 1102.1.0 → 1102.2.0

package/lib/install/index.js

@@ -19,7 +19,7 @@ import { extendProjectsWithTargetDirs, headlessInstall } from '@pnpm/installing.
 import { readModulesManifest, writeModulesManifest } from '@pnpm/installing.modules-yaml';
 import { cleanGitBranchLockfiles, getWantedLockfileName, isEmptyLockfile, readEnvLockfile, readWantedLockfile, readWantedLockfileFile, writeCurrentLockfile, writeEnvLockfile, writeLockfiles, writeWantedLockfile, } from '@pnpm/lockfile.fs';
 import { getPreferredVersionsFromLockfileAndManifests } from '@pnpm/lockfile.preferred-versions';
-import { calcPatchHashes, createOverridesMapFromParsed, getOutdatedLockfileSetting, } from '@pnpm/lockfile.settings-checker';
+import { calcPatchHashes, createOverridesMapFromParsed, getOutdatedLockfileSetting, resolvePatchedDependencies, } from '@pnpm/lockfile.settings-checker';
 import { PACKAGE_MAP_FILENAME, writePackageMap, writePnpFile } from '@pnpm/lockfile.to-pnp';
 import { allProjectsAreUpToDate, satisfiesPackageManifest } from '@pnpm/lockfile.verification';
 import { globalInfo, logger, streamParser } from '@pnpm/logger';
@@ -399,20 +399,17 @@ export async function mutateModules(projects, maybeOpts) {
         }
         const packageExtensionsChecksum = hashObjectNullableWithPrefix(opts.packageExtensions);
         const pnpmfileChecksum = await opts.hooks.calculatePnpmfileChecksum?.();
+        const resolvedPatchedDeps = resolvePatchedDependencies(opts.patchedDependencies, opts.lockfileDir);
         const patchedDependencies = opts.ignorePackageManifest
             ? ctx.wantedLockfile.patchedDependencies
-            : (opts.patchedDependencies ? await calcPatchHashes(opts.patchedDependencies) : {});
-        const patchGroupInput = opts.patchedDependencies
+            : (resolvedPatchedDeps ? await calcPatchHashes(resolvedPatchedDeps) : {});
+        const patchGroupInput = resolvedPatchedDeps
             ? Object.fromEntries(Object.entries(patchedDependencies ?? {}).map(([key, hash]) => {
-                let patchFilePath = opts.patchedDependencies[key]
-                    ? path.resolve(opts.lockfileDir, opts.patchedDependencies[key])
-                    : undefined;
+                let patchFilePath = resolvedPatchedDeps[key];
                 if (!patchFilePath) {
                     const lastAt = key.lastIndexOf('@');
                     const pkgName = lastAt > 0 ? key.slice(0, lastAt) : key;
-                    if (opts.patchedDependencies[pkgName]) {
-                        patchFilePath = path.resolve(opts.lockfileDir, opts.patchedDependencies[pkgName]);
-                    }
+                    patchFilePath = resolvedPatchedDeps[pkgName];
                 }
                 return [key, { hash, patchFilePath }];
             }))
@@ -1069,10 +1066,23 @@ const _installInContext = async (projects, ctx, opts) => {
         prefix: ctx.lockfileDir,
         stage: 'resolution_started',
     });
-    const update = projects.some((project) => project.update);
-    const preferredVersions = opts.preferredVersions ?? (!update
-        ? getPreferredVersionsFromLockfileAndManifests(ctx.wantedLockfile.packages, Object.values(ctx.projects).map(({ manifest }) => manifest))
-        : undefined);
+    // Always seed preferred versions from the lockfile, even for update
+    // mutations. Gating this on `update` (the previous behavior) nullified
+    // the seed globally during `pnpm up -r <pkg>`, so unrelated packages
+    // with open ranges lost their pins and re-resolved to newest-in-range
+    // (pnpm/pnpm#10662). The targeted package still bumps: `updateRequested`
+    // at the npm picker subtracts the lockfile-derived weight from its pins,
+    // so the target re-resolves exactly as a fresh install would after its
+    // lockfile entries were deleted.
+    // Caller-supplied preferred versions (audit-fix vulnerability penalties)
+    // layer on top of the seed per package name — replacing the seed with
+    // them would unpin every unrelated package.
+    // Null-prototype merge target so a crafted package name (e.g. `__proto__`)
+    // lands as a plain own key instead of invoking the prototype setter.
+    const preferredVersions = Object.assign(Object.create(null), getPreferredVersionsFromLockfileAndManifests(ctx.wantedLockfile.packages, Object.values(ctx.projects).map(({ manifest }) => manifest)));
+    for (const [pkgName, selectors] of Object.entries(opts.preferredVersions ?? {})) {
+        preferredVersions[pkgName] = { ...preferredVersions[pkgName], ...selectors };
+    }
     const forceFullResolution = ctx.wantedLockfile.lockfileVersion !== LOCKFILE_VERSION ||
         !opts.currentLockfileIsUpToDate ||
         opts.force ||
@@ -2043,12 +2053,11 @@ async function installViaPnprServer(manifest, rootDir, opts, allInstallProjects)
         throw new PnpmError('TRUST_POLICY_INCOMPATIBLE_WITH_PNPR', 'The pnpr server does not yet enforce `trustPolicy: no-downgrade`, so running an install through it under this policy would produce a lockfile that the local verifier rejects.', { hint: 'Unset `trustPolicy` for this install, or disable the pnpr server (unset `--pnpr-server` / `pnprServer` in pnpm-workspace.yaml) so resolution runs locally and the trust check applies.' });
     }
     const { resolveViaPnprServer } = await import('@pnpm/pnpr.client');
-    const { createGetAuthHeaderByURI, getAuthHeadersByScope, getAuthHeadersFromCreds } = await import('@pnpm/network.auth-header');
-    // Forward the whole credential map (the registries a graph touches
-    // aren't known up front), so the server attaches the right token per
-    // URL. `authorization` also identifies the caller to pnpr's gate.
+    const { createGetAuthHeaderByURI } = await import('@pnpm/network.auth-header');
+    // Identify the caller to pnpr's gate. The client does not forward its
+    // upstream registry credentials: pnpr selects upstream credentials from
+    // its own route policy, so they never travel in the request body.
     const configByUri = opts.configByUri ?? {};
-    const forwardedAuthHeaders = getAuthHeadersFromCreds(configByUri);
     const pnprAuthorization = createGetAuthHeaderByURI(configByUri)(opts.pnprServer);
     try {
         const lockfileDir = opts.lockfileDir ?? rootDir;
@@ -2079,7 +2088,6 @@ async function installViaPnprServer(manifest, rootDir, opts, allInstallProjects)
             projects: projectsList,
             registry: opts.registries?.default,
             namedRegistries: opts.namedRegistries,
-            authHeaders: getAuthHeadersByScope(forwardedAuthHeaders),
             authorization: pnprAuthorization,
             overrides: opts.overrides,
             minimumReleaseAge: opts.minimumReleaseAge,

package/lib/install/verifyLockfileResolutions.js

@@ -205,6 +205,10 @@ function buildVerificationError(violations) {
     const details = omitted > 0
         ? `${breakdown}\n  …and ${omitted} more`
         : breakdown;
+    // Registry fetch failures (auth/network/5xx) don't reach this batch — the
+    // verifier throws the registry's own error and the gate aborts with it. So
+    // every violation here is a genuine policy rejection, and the hint points at
+    // the lockfile rather than at connectivity.
     return new PnpmError(errorCode, `${violations.length} lockfile entries failed verification:\n${details}`, {
         hint: 'The lockfile contains entries that the active policies reject. ' +
             'This can mean the lockfile is stale, or that someone committed a ' +
@@ -346,22 +350,41 @@ function pushInvalidAliases(deps, invalid) {
 }
 async function iterateLockfileViolations(candidates, verifiers, concurrency) {
     const violations = [];
+    // A verifier may throw rather than return a violation when it can't reach the
+    // registry to verify an entry (auth/network/5xx) — that's not a per-entry
+    // policy pick, it's an incomplete verification, so the registry's own error
+    // should abort the install. Capture the first such error and rethrow it after
+    // the fan-out settles: rethrowing straight into Promise.all would leave the
+    // sibling tasks (all failing against the same dead registry) as unhandled
+    // rejections once Promise.all rejects on the first.
+    let fetchError;
     const limit = pLimit(concurrency ?? DEFAULT_CONCURRENCY);
     await Promise.all(Array.from(candidates.values(), ({ name, version, nonSemverVersion, resolution }) => limit(async () => {
-        // Fan out across every active verifier; each handles its own
-        // protocol short-circuit (e.g. the npm verifier returns ok:true for
-        // git resolutions). We stop at the first failure per entry so a
-        // multi-verifier setup doesn't produce duplicate violations for the
-        // same (name, version).
-        for (const verifier of verifiers) {
-            // eslint-disable-next-line no-await-in-loop
-            const result = await verifier.verify(resolution, { name, version, nonSemverVersion });
-            if (!result.ok) {
-                violations.push({ name, version, resolution, code: result.code, reason: result.reason });
-                break;
+        try {
+            // Fan out across every active verifier; each handles its own
+            // protocol short-circuit (e.g. the npm verifier returns ok:true for
+            // git resolutions). We stop at the first failure per entry so a
+            // multi-verifier setup doesn't produce duplicate violations for the
+            // same (name, version).
+            for (const verifier of verifiers) {
+                // eslint-disable-next-line no-await-in-loop
+                const result = await verifier.verify(resolution, { name, version, nonSemverVersion });
+                if (!result.ok) {
+                    violations.push({ name, version, resolution, code: result.code, reason: result.reason });
+                    break;
+                }
             }
         }
+        catch (err) {
+            fetchError ??= err;
+        }
     })));
+    // A registry that couldn't be reached takes precedence over collected
+    // violations: the run never finished verifying, so the batch is incomplete
+    // and the actionable failure is the transport error. Once it's resolved the
+    // re-run surfaces any remaining violations.
+    if (fetchError != null)
+        throw fetchError;
     return violations;
 }
 //# sourceMappingURL=verifyLockfileResolutions.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1102.1.0",
+  "version": "1102.2.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -30,9 +30,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/installing/deps-installer"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/installing/deps-installer"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/installing/deps-installer#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/installing/deps-installer#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -65,62 +65,62 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
     "semver": "^7.8.4",
-    "@pnpm/bins.linker": "1100.0.15",
-    "@pnpm/building.after-install": "1102.0.1",
-    "@pnpm/building.during-install": "1102.0.1",
-    "@pnpm/building.policy": "1100.0.10",
-    "@pnpm/catalogs.config": "1100.0.1",
+    "@pnpm/bins.remover": "1100.0.12",
+    "@pnpm/building.during-install": "1102.0.3",
+    "@pnpm/bins.linker": "1100.0.16",
+    "@pnpm/building.policy": "1100.0.11",
     "@pnpm/catalogs.protocol-parser": "1100.0.0",
-    "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/catalogs.config": "1100.0.2",
+    "@pnpm/building.after-install": "1102.0.3",
     "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/config.normalize-registries": "1100.0.8",
-    "@pnpm/config.parse-overrides": "1100.0.1",
-    "@pnpm/core-loggers": "1100.2.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/bins.remover": "1100.0.10",
-    "@pnpm/deps.graph-hasher": "1100.2.5",
-    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/config.parse-overrides": "1100.0.2",
+    "@pnpm/core-loggers": "1100.2.1",
+    "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/crypto.object-hasher": "1100.0.0",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
     "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/exec.lifecycle": "1100.1.0",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/exec.lifecycle": "1100.1.2",
+    "@pnpm/hooks.read-package-hook": "1100.0.9",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/fs.symlink-dependency": "1100.0.10",
-    "@pnpm/hooks.types": "1100.0.12",
-    "@pnpm/installing.context": "1100.0.19",
-    "@pnpm/installing.deps-resolver": "1100.2.4",
-    "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/installing.deps-restorer": "1102.1.0",
-    "@pnpm/installing.linking.hoist": "1100.0.15",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.8",
-    "@pnpm/installing.package-requester": "1102.0.0",
+    "@pnpm/installing.context": "1100.0.21",
+    "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/deps.graph-hasher": "1100.2.7",
+    "@pnpm/installing.deps-resolver": "1100.2.6",
+    "@pnpm/installing.deps-restorer": "1102.1.2",
     "@pnpm/installing.linking.direct-dep-linker": "1100.0.10",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.10",
+    "@pnpm/hooks.types": "1100.1.1",
+    "@pnpm/installing.package-requester": "1102.1.1",
     "@pnpm/installing.modules-yaml": "1100.0.9",
-    "@pnpm/lockfile.filtering": "1100.1.7",
-    "@pnpm/lockfile.preferred-versions": "1100.0.16",
-    "@pnpm/lockfile.fs": "1100.1.6",
-    "@pnpm/lockfile.pruner": "1100.0.11",
-    "@pnpm/lockfile.to-pnp": "1100.1.0",
-    "@pnpm/lockfile.verification": "1100.0.19",
-    "@pnpm/lockfile.settings-checker": "1100.0.19",
-    "@pnpm/lockfile.utils": "1100.0.13",
-    "@pnpm/network.auth-header": "1101.1.2",
-    "@pnpm/patching.config": "1100.0.8",
-    "@pnpm/pkg-manifest.utils": "1100.2.5",
-    "@pnpm/pnpr.client": "1.2.2",
-    "@pnpm/resolving.resolver-base": "1100.4.2",
-    "@pnpm/store.controller-types": "1100.1.5",
+    "@pnpm/lockfile.filtering": "1100.1.9",
+    "@pnpm/lockfile.preferred-versions": "1100.0.18",
+    "@pnpm/lockfile.pruner": "1100.0.13",
+    "@pnpm/lockfile.settings-checker": "1100.1.0",
+    "@pnpm/installing.linking.hoist": "1100.0.16",
+    "@pnpm/lockfile.utils": "1100.1.1",
+    "@pnpm/lockfile.verification": "1100.0.21",
+    "@pnpm/network.auth-header": "1101.1.3",
+    "@pnpm/lockfile.walker": "1100.0.13",
+    "@pnpm/patching.config": "1100.0.9",
+    "@pnpm/lockfile.fs": "1100.1.8",
+    "@pnpm/fs.symlink-dependency": "1100.0.10",
+    "@pnpm/pkg-manifest.utils": "1100.2.6",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
+    "@pnpm/store.controller-types": "1100.1.7",
     "@pnpm/types": "1101.3.2",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
-    "@pnpm/hooks.read-package-hook": "1100.0.8",
-    "@pnpm/lockfile.walker": "1100.0.11",
-    "@pnpm/store.index": "1100.2.0"
+    "@pnpm/pnpr.client": "1.3.0",
+    "@pnpm/store.index": "1100.2.1",
+    "@pnpm/lockfile.to-pnp": "1100.1.2",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.14"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.1"
+    "@pnpm/worker": "^1100.2.3"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
@@ -141,22 +141,22 @@
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.16",
-    "@pnpm/installing.deps-installer": "1102.1.0",
-    "@pnpm/assert-store": "1100.0.16",
-    "@pnpm/lockfile.types": "1100.0.11",
+    "@pnpm/assert-project": "1100.0.18",
+    "@pnpm/assert-store": "1100.0.18",
+    "@pnpm/lockfile.types": "1100.0.13",
+    "@pnpm/installing.deps-installer": "1102.2.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.16",
-    "@pnpm/store.cafs": "1100.1.10",
-    "@pnpm/pkg-manifest.reader": "1100.0.8",
-    "@pnpm/store.path": "1100.0.1",
-    "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.9",
     "@pnpm/network.git-utils": "1100.0.2",
-    "@pnpm/testing.mock-agent": "1101.0.3",
+    "@pnpm/prepare": "1100.0.18",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/store.path": "1100.0.2",
+    "@pnpm/store.cafs": "1100.1.12",
+    "@pnpm/test-ipc-server": "1100.0.0",
+    "@pnpm/testing.temp-store": "1100.1.12",
     "@pnpm/resolving.registry.types": "1100.1.3",
-    "@pnpm/testing.temp-store": "1100.1.10",
-    "@pnpm/testing.registry-mock": "1100.0.6"
+    "@pnpm/testing.mock-agent": "1101.0.4",
+    "@pnpm/testing.registry-mock": "1100.0.8"
   },
   "engines": {
     "node": ">=22.13"