@pnpm/installing.deps-installer 1102.1.1 → 1102.2.1

package/lib/install/index.js

@@ -19,7 +19,7 @@ import { extendProjectsWithTargetDirs, headlessInstall } from '@pnpm/installing.
 import { readModulesManifest, writeModulesManifest } from '@pnpm/installing.modules-yaml';
 import { cleanGitBranchLockfiles, getWantedLockfileName, isEmptyLockfile, readEnvLockfile, readWantedLockfile, readWantedLockfileFile, writeCurrentLockfile, writeEnvLockfile, writeLockfiles, writeWantedLockfile, } from '@pnpm/lockfile.fs';
 import { getPreferredVersionsFromLockfileAndManifests } from '@pnpm/lockfile.preferred-versions';
-import { calcPatchHashes, createOverridesMapFromParsed, getOutdatedLockfileSetting, } from '@pnpm/lockfile.settings-checker';
+import { calcPatchHashes, createOverridesMapFromParsed, getOutdatedLockfileSetting, resolvePatchedDependencies, } from '@pnpm/lockfile.settings-checker';
 import { PACKAGE_MAP_FILENAME, writePackageMap, writePnpFile } from '@pnpm/lockfile.to-pnp';
 import { allProjectsAreUpToDate, satisfiesPackageManifest } from '@pnpm/lockfile.verification';
 import { globalInfo, logger, streamParser } from '@pnpm/logger';
@@ -399,20 +399,17 @@ export async function mutateModules(projects, maybeOpts) {
         }
         const packageExtensionsChecksum = hashObjectNullableWithPrefix(opts.packageExtensions);
         const pnpmfileChecksum = await opts.hooks.calculatePnpmfileChecksum?.();
+        const resolvedPatchedDeps = resolvePatchedDependencies(opts.patchedDependencies, opts.lockfileDir);
         const patchedDependencies = opts.ignorePackageManifest
             ? ctx.wantedLockfile.patchedDependencies
-            : (opts.patchedDependencies ? await calcPatchHashes(opts.patchedDependencies) : {});
-        const patchGroupInput = opts.patchedDependencies
+            : (resolvedPatchedDeps ? await calcPatchHashes(resolvedPatchedDeps) : {});
+        const patchGroupInput = resolvedPatchedDeps
             ? Object.fromEntries(Object.entries(patchedDependencies ?? {}).map(([key, hash]) => {
-                let patchFilePath = opts.patchedDependencies[key]
-                    ? path.resolve(opts.lockfileDir, opts.patchedDependencies[key])
-                    : undefined;
+                let patchFilePath = resolvedPatchedDeps[key];
                 if (!patchFilePath) {
                     const lastAt = key.lastIndexOf('@');
                     const pkgName = lastAt > 0 ? key.slice(0, lastAt) : key;
-                    if (opts.patchedDependencies[pkgName]) {
-                        patchFilePath = path.resolve(opts.lockfileDir, opts.patchedDependencies[pkgName]);
-                    }
+                    patchFilePath = resolvedPatchedDeps[pkgName];
                 }
                 return [key, { hash, patchFilePath }];
             }))
@@ -1069,10 +1066,23 @@ const _installInContext = async (projects, ctx, opts) => {
         prefix: ctx.lockfileDir,
         stage: 'resolution_started',
     });
-    const update = projects.some((project) => project.update);
-    const preferredVersions = opts.preferredVersions ?? (!update
-        ? getPreferredVersionsFromLockfileAndManifests(ctx.wantedLockfile.packages, Object.values(ctx.projects).map(({ manifest }) => manifest))
-        : undefined);
+    // Always seed preferred versions from the lockfile, even for update
+    // mutations. Gating this on `update` (the previous behavior) nullified
+    // the seed globally during `pnpm up -r <pkg>`, so unrelated packages
+    // with open ranges lost their pins and re-resolved to newest-in-range
+    // (pnpm/pnpm#10662). The targeted package still bumps: `updateRequested`
+    // at the npm picker subtracts the lockfile-derived weight from its pins,
+    // so the target re-resolves exactly as a fresh install would after its
+    // lockfile entries were deleted.
+    // Caller-supplied preferred versions (audit-fix vulnerability penalties)
+    // layer on top of the seed per package name — replacing the seed with
+    // them would unpin every unrelated package.
+    // Null-prototype merge target so a crafted package name (e.g. `__proto__`)
+    // lands as a plain own key instead of invoking the prototype setter.
+    const preferredVersions = Object.assign(Object.create(null), getPreferredVersionsFromLockfileAndManifests(ctx.wantedLockfile.packages, Object.values(ctx.projects).map(({ manifest }) => manifest)));
+    for (const [pkgName, selectors] of Object.entries(opts.preferredVersions ?? {})) {
+        preferredVersions[pkgName] = { ...preferredVersions[pkgName], ...selectors };
+    }
     const forceFullResolution = ctx.wantedLockfile.lockfileVersion !== LOCKFILE_VERSION ||
         !opts.currentLockfileIsUpToDate ||
         opts.force ||
@@ -2043,12 +2053,11 @@ async function installViaPnprServer(manifest, rootDir, opts, allInstallProjects)
         throw new PnpmError('TRUST_POLICY_INCOMPATIBLE_WITH_PNPR', 'The pnpr server does not yet enforce `trustPolicy: no-downgrade`, so running an install through it under this policy would produce a lockfile that the local verifier rejects.', { hint: 'Unset `trustPolicy` for this install, or disable the pnpr server (unset `--pnpr-server` / `pnprServer` in pnpm-workspace.yaml) so resolution runs locally and the trust check applies.' });
     }
     const { resolveViaPnprServer } = await import('@pnpm/pnpr.client');
-    const { createGetAuthHeaderByURI, getAuthHeadersByScope, getAuthHeadersFromCreds } = await import('@pnpm/network.auth-header');
-    // Forward the whole credential map (the registries a graph touches
-    // aren't known up front), so the server attaches the right token per
-    // URL. `authorization` also identifies the caller to pnpr's gate.
+    const { createGetAuthHeaderByURI } = await import('@pnpm/network.auth-header');
+    // Identify the caller to pnpr's gate. The client does not forward its
+    // upstream registry credentials: pnpr selects upstream credentials from
+    // its own route policy, so they never travel in the request body.
     const configByUri = opts.configByUri ?? {};
-    const forwardedAuthHeaders = getAuthHeadersFromCreds(configByUri);
     const pnprAuthorization = createGetAuthHeaderByURI(configByUri)(opts.pnprServer);
     try {
         const lockfileDir = opts.lockfileDir ?? rootDir;
@@ -2079,7 +2088,6 @@ async function installViaPnprServer(manifest, rootDir, opts, allInstallProjects)
             projects: projectsList,
             registry: opts.registries?.default,
             namedRegistries: opts.namedRegistries,
-            authHeaders: getAuthHeadersByScope(forwardedAuthHeaders),
             authorization: pnprAuthorization,
             overrides: opts.overrides,
             minimumReleaseAge: opts.minimumReleaseAge,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1102.1.1",
+  "version": "1102.2.1",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -65,62 +65,62 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
     "semver": "^7.8.4",
-    "@pnpm/bins.remover": "1100.0.11",
-    "@pnpm/building.during-install": "1102.0.2",
+    "@pnpm/bins.remover": "1100.0.12",
     "@pnpm/bins.linker": "1100.0.16",
+    "@pnpm/building.during-install": "1102.0.4",
+    "@pnpm/building.after-install": "1102.0.4",
+    "@pnpm/building.policy": "1100.0.12",
     "@pnpm/catalogs.config": "1100.0.2",
-    "@pnpm/building.policy": "1100.0.11",
-    "@pnpm/building.after-install": "1102.0.2",
-    "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/catalogs.resolver": "1100.0.0",
     "@pnpm/catalogs.protocol-parser": "1100.0.0",
-    "@pnpm/config.parse-overrides": "1100.0.2",
-    "@pnpm/config.normalize-registries": "1100.0.8",
+    "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/config.normalize-registries": "1100.0.8",
     "@pnpm/core-loggers": "1100.2.1",
     "@pnpm/constants": "1100.0.0",
+    "@pnpm/deps.graph-hasher": "1100.2.8",
+    "@pnpm/crypto.object-hasher": "1100.0.0",
+    "@pnpm/deps.path": "1100.0.8",
     "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/deps.graph-hasher": "1100.2.6",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
-    "@pnpm/crypto.object-hasher": "1100.0.0",
     "@pnpm/error": "1100.0.1",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/exec.lifecycle": "1100.1.1",
+    "@pnpm/hooks.types": "1100.1.1",
     "@pnpm/fs.symlink-dependency": "1100.0.10",
-    "@pnpm/hooks.types": "1100.1.0",
-    "@pnpm/installing.context": "1100.0.20",
-    "@pnpm/installing.deps-resolver": "1100.2.5",
-    "@pnpm/installing.deps-restorer": "1102.1.1",
+    "@pnpm/installing.context": "1100.0.22",
+    "@pnpm/exec.lifecycle": "1100.1.2",
+    "@pnpm/installing.deps-resolver": "1100.2.7",
+    "@pnpm/config.parse-overrides": "1100.0.2",
     "@pnpm/hooks.read-package-hook": "1100.0.9",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.10",
     "@pnpm/installing.linking.hoist": "1100.0.16",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.10",
+    "@pnpm/installing.deps-restorer": "1102.1.3",
     "@pnpm/installing.modules-yaml": "1100.0.9",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.9",
-    "@pnpm/installing.package-requester": "1102.1.0",
-    "@pnpm/lockfile.fs": "1100.1.7",
-    "@pnpm/lockfile.preferred-versions": "1100.0.17",
-    "@pnpm/lockfile.filtering": "1100.1.8",
-    "@pnpm/lockfile.pruner": "1100.0.12",
-    "@pnpm/lockfile.settings-checker": "1100.0.20",
-    "@pnpm/lockfile.verification": "1100.0.20",
-    "@pnpm/lockfile.to-pnp": "1100.1.1",
-    "@pnpm/patching.config": "1100.0.9",
-    "@pnpm/lockfile.utils": "1100.1.0",
-    "@pnpm/lockfile.walker": "1100.0.12",
+    "@pnpm/lockfile.filtering": "1100.1.9",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.10",
+    "@pnpm/lockfile.preferred-versions": "1100.0.18",
+    "@pnpm/lockfile.pruner": "1100.0.13",
+    "@pnpm/lockfile.fs": "1100.1.9",
+    "@pnpm/lockfile.to-pnp": "1100.1.3",
+    "@pnpm/lockfile.verification": "1100.0.22",
+    "@pnpm/lockfile.utils": "1100.1.1",
+    "@pnpm/lockfile.settings-checker": "1100.1.1",
+    "@pnpm/lockfile.walker": "1100.0.13",
     "@pnpm/network.auth-header": "1101.1.3",
+    "@pnpm/patching.config": "1100.0.9",
     "@pnpm/pkg-manifest.utils": "1100.2.6",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/pnpr.client": "1.2.3",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
+    "@pnpm/store.controller-types": "1100.1.7",
+    "@pnpm/installing.package-requester": "1102.1.1",
     "@pnpm/store.index": "1100.2.1",
-    "@pnpm/resolving.resolver-base": "1100.5.0",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.14",
-    "@pnpm/store.controller-types": "1100.1.6",
-    "@pnpm/types": "1101.3.2"
+    "@pnpm/pnpr.client": "1.3.1",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.14"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.2"
+    "@pnpm/worker": "^1100.2.3"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
@@ -141,22 +141,22 @@
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.17",
-    "@pnpm/assert-store": "1100.0.17",
-    "@pnpm/installing.deps-installer": "1102.1.1",
-    "@pnpm/lockfile.types": "1100.0.12",
+    "@pnpm/assert-store": "1100.0.18",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.17",
-    "@pnpm/resolving.registry.types": "1100.1.3",
-    "@pnpm/store.cafs": "1100.1.11",
+    "@pnpm/installing.deps-installer": "1102.2.1",
+    "@pnpm/network.git-utils": "1100.0.2",
+    "@pnpm/lockfile.types": "1100.0.13",
+    "@pnpm/prepare": "1100.0.18",
     "@pnpm/pkg-manifest.reader": "1100.0.9",
+    "@pnpm/resolving.registry.types": "1100.1.3",
+    "@pnpm/assert-project": "1100.0.18",
+    "@pnpm/store.cafs": "1100.1.12",
     "@pnpm/store.path": "1100.0.2",
     "@pnpm/test-fixtures": "1100.0.0",
     "@pnpm/test-ipc-server": "1100.0.0",
+    "@pnpm/testing.registry-mock": "1100.0.8",
     "@pnpm/testing.mock-agent": "1101.0.4",
-    "@pnpm/testing.temp-store": "1100.1.11",
-    "@pnpm/network.git-utils": "1100.0.2",
-    "@pnpm/testing.registry-mock": "1100.0.7"
+    "@pnpm/testing.temp-store": "1100.1.13"
   },
   "engines": {
     "node": ">=22.13"