@pnpm/installing.deps-installer 1102.2.1 → 1102.3.0

package/lib/install/extendInstallOptions.d.ts

@@ -259,5 +259,11 @@ export type InstallOptions = Partial<StrictInstallOptions> & Pick<StrictInstallO
 export interface ProcessedInstallOptions extends StrictInstallOptions {
     readPackageHook?: ReadPackageHook;
     parsedOverrides: VersionOverride[];
+    /**
+     * Present when the overrides contain convergence entries (`"pkg@"`). The
+     * versions overrider fills it with every declared semver range it sees for
+     * those packages; the staleness check reads it after a full resolution.
+     */
+    convergeDeclaredRanges?: Map<string, Set<string>>;
 }
 export declare function extendOptions(opts: InstallOptions): ProcessedInstallOptions;

package/lib/install/extendInstallOptions.js

@@ -124,10 +124,14 @@ export function extendOptions(opts) {
         storeDir: defaultOpts.storeDir,
         parsedOverrides: parseOverrides(opts.overrides ?? {}, opts.catalogs ?? {}),
     };
+    if (extendedOpts.parsedOverrides.some(({ converge }) => converge)) {
+        extendedOpts.convergeDeclaredRanges = new Map();
+    }
     extendedOpts.readPackageHook = createReadPackageHook({
         ignoreCompatibilityDb: extendedOpts.ignoreCompatibilityDb,
         readPackageHook: extendedOpts.hooks?.readPackage,
         overrides: extendedOpts.parsedOverrides,
+        convergeDeclaredRanges: extendedOpts.convergeDeclaredRanges,
         lockfileDir: extendedOpts.lockfileDir,
         packageExtensions: extendedOpts.packageExtensions,
         ignoredOptionalDependencies: extendedOpts.ignoredOptionalDependencies,

package/lib/install/index.js

@@ -41,6 +41,7 @@ import { linkPackages } from './link.js';
 import { reportPeerDependencyIssues } from './reportPeerDependencyIssues.js';
 import { validateModules } from './validateModules.js';
 import { verifyLockfileResolutions } from './verifyLockfileResolutions.js';
+import { warnOnStaleConvergenceOverrides } from './warnOnStaleConvergenceOverrides.js';
 import { writeLockfilesAndRecordVerified } from './writeLockfilesAndRecordVerified.js';
 import { writeWantedLockfileAndRecordVerified } from './writeWantedLockfileAndRecordVerified.js';
 class LockfileConfigMismatchError extends PnpmError {
@@ -1167,6 +1168,20 @@ const _installInContext = async (projects, ctx, opts) => {
         allProjectIds: Object.values(ctx.projects).map((p) => p.id),
         handleResolutionPolicyViolations: opts.handleResolutionPolicyViolations,
     });
+    // Only a full resolution walks every manifest through the versions
+    // overrider, making the collected declared ranges complete enough for the
+    // staleness verdict; partial resolutions must stay silent to avoid false
+    // positives from unseen ranges.
+    if (opts.convergeDeclaredRanges != null && (forceFullResolution || opts.dedupe)) {
+        await warnOnStaleConvergenceOverrides({
+            convergeDeclaredRanges: opts.convergeDeclaredRanges,
+            parsedOverrides: opts.parsedOverrides,
+            requestPackage: opts.storeController.requestPackage,
+            lockfileDir: opts.lockfileDir,
+            minimumReleaseAge: opts.minimumReleaseAge,
+            minimumReleaseAgeExclude: opts.minimumReleaseAgeExclude,
+        });
+    }
     if (!opts.include.optionalDependencies || !opts.include.devDependencies || !opts.include.dependencies) {
         linkedDependenciesByProjectId = mapValues((linkedDeps) => linkedDeps.filter((linkedDep) => !(linkedDep.dev && !opts.include.devDependencies ||
             linkedDep.optional && !opts.include.optionalDependencies ||

package/lib/install/warnOnStaleConvergenceOverrides.d.ts

@@ -0,0 +1,31 @@
+import type { VersionOverride } from '@pnpm/config.parse-overrides';
+import type { RequestPackageFunction } from '@pnpm/store.controller-types';
+export interface WarnOnStaleConvergenceOverridesOptions {
+    convergeDeclaredRanges: Map<string, Set<string>>;
+    parsedOverrides: VersionOverride[];
+    requestPackage: RequestPackageFunction;
+    lockfileDir: string;
+    minimumReleaseAge?: number;
+    minimumReleaseAgeExclude?: string[];
+}
+/**
+ * A convergence override's value is derived state — the best version that
+ * converges the currently declared ranges. It goes stale when dependents
+ * start declaring ranges that admit newer versions: the override then keeps
+ * the edges it governs on the old version while newer edges resolve past it,
+ * producing the duplication the entry was written to prevent.
+ *
+ * Must only run after a full resolution: only then has every manifest
+ * streamed through the versions overrider, so `convergeDeclaredRanges` holds
+ * the complete set of declared ranges. For each convergence override this
+ * resolves every declared range to the best version it admits (metadata is
+ * already cached from the resolution that just ran, and the release-age
+ * policy applies, so the recommendation is a version the resolver would
+ * actually pick) and warns when a version newer than the override's value
+ * satisfies every declared range — a strictly better convergence.
+ *
+ * A range that fails to resolve contributes no candidate but still
+ * participates in the satisfies-every-range check, so failures can only
+ * suppress the warning, never fabricate one.
+ */
+export declare function warnOnStaleConvergenceOverrides(opts: WarnOnStaleConvergenceOverridesOptions): Promise<void>;

package/lib/install/warnOnStaleConvergenceOverrides.js

@@ -0,0 +1,62 @@
+import { getPublishedByPolicy } from '@pnpm/config.version-policy';
+import { globalWarn } from '@pnpm/logger';
+import semver from 'semver';
+/**
+ * A convergence override's value is derived state — the best version that
+ * converges the currently declared ranges. It goes stale when dependents
+ * start declaring ranges that admit newer versions: the override then keeps
+ * the edges it governs on the old version while newer edges resolve past it,
+ * producing the duplication the entry was written to prevent.
+ *
+ * Must only run after a full resolution: only then has every manifest
+ * streamed through the versions overrider, so `convergeDeclaredRanges` holds
+ * the complete set of declared ranges. For each convergence override this
+ * resolves every declared range to the best version it admits (metadata is
+ * already cached from the resolution that just ran, and the release-age
+ * policy applies, so the recommendation is a version the resolver would
+ * actually pick) and warns when a version newer than the override's value
+ * satisfies every declared range — a strictly better convergence.
+ *
+ * A range that fails to resolve contributes no candidate but still
+ * participates in the satisfies-every-range check, so failures can only
+ * suppress the warning, never fabricate one.
+ */
+export async function warnOnStaleConvergenceOverrides(opts) {
+    const convergeOverrides = opts.parsedOverrides.filter(({ converge }) => converge);
+    if (convergeOverrides.length === 0)
+        return;
+    const { publishedBy, publishedByExclude } = getPublishedByPolicy(opts);
+    await Promise.all(convergeOverrides.map(async (override) => {
+        const name = override.targetPkg.name;
+        const ranges = opts.convergeDeclaredRanges.get(name);
+        if (ranges == null || ranges.size === 0)
+            return;
+        const candidates = await Promise.all([...ranges].map(async (range) => {
+            try {
+                const response = await opts.requestPackage({ alias: name, bareSpecifier: range }, {
+                    downloadPriority: 0,
+                    lockfileDir: opts.lockfileDir,
+                    projectDir: opts.lockfileDir,
+                    preferredVersions: {},
+                    skipFetch: true,
+                    publishedBy,
+                    publishedByExclude,
+                });
+                if (response.body.policyViolation != null)
+                    return undefined;
+                return response.body.manifest?.version;
+            }
+            catch {
+                return undefined;
+            }
+        }));
+        const best = candidates
+            .filter((version) => version != null && semver.gt(version, override.newBareSpecifier))
+            .sort(semver.rcompare)
+            .find((version) => [...ranges].every((range) => semver.satisfies(version, range, true)));
+        if (best == null)
+            return;
+        globalWarn(`The convergence override "${name}@": "${override.newBareSpecifier}" is stale: every declared range of ${name} also admits ${best}. Change the override's value to ${best} in pnpm-workspace.yaml, or remove the override and run "pnpm dedupe".`);
+    }));
+}
+//# sourceMappingURL=warnOnStaleConvergenceOverrides.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1102.2.1",
+  "version": "1102.3.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -51,8 +51,61 @@
   },
   "dependencies": {
     "@inquirer/prompts": "^8.4.3",
+    "@pnpm/bins.linker": "1100.0.17",
+    "@pnpm/bins.remover": "1100.0.13",
+    "@pnpm/building.after-install": "1102.0.6",
+    "@pnpm/building.during-install": "1102.0.6",
+    "@pnpm/building.policy": "1100.0.13",
+    "@pnpm/catalogs.config": "1100.0.2",
+    "@pnpm/catalogs.protocol-parser": "1100.0.0",
+    "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/config.normalize-registries": "1100.0.9",
+    "@pnpm/config.parse-overrides": "1100.1.0",
+    "@pnpm/config.version-policy": "1100.1.7",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/core-loggers": "1100.2.2",
+    "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/crypto.object-hasher": "1100.0.0",
+    "@pnpm/deps.graph-hasher": "1100.2.10",
+    "@pnpm/deps.graph-sequencer": "1100.0.0",
+    "@pnpm/deps.path": "1100.0.9",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/exec.lifecycle": "1100.1.3",
+    "@pnpm/fs.read-modules-dir": "1100.0.1",
+    "@pnpm/fs.symlink-dependency": "1100.0.11",
+    "@pnpm/hooks.read-package-hook": "1100.1.0",
+    "@pnpm/hooks.types": "1100.2.1",
+    "@pnpm/installing.context": "1100.0.24",
+    "@pnpm/installing.deps-resolver": "1100.2.9",
+    "@pnpm/installing.deps-restorer": "1102.1.5",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.11",
+    "@pnpm/installing.linking.hoist": "1100.0.17",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.12",
+    "@pnpm/installing.modules-yaml": "1100.0.10",
+    "@pnpm/installing.package-requester": "1102.1.3",
+    "@pnpm/lockfile.filtering": "1100.1.11",
+    "@pnpm/lockfile.fs": "1100.1.11",
+    "@pnpm/lockfile.preferred-versions": "1100.0.20",
+    "@pnpm/lockfile.pruner": "1100.0.14",
+    "@pnpm/lockfile.settings-checker": "1100.1.3",
+    "@pnpm/lockfile.to-pnp": "1100.1.5",
+    "@pnpm/lockfile.utils": "1100.1.3",
+    "@pnpm/lockfile.verification": "1100.0.24",
+    "@pnpm/lockfile.walker": "1100.0.14",
+    "@pnpm/network.auth-header": "1101.1.4",
     "@pnpm/npm-package-arg": "^2.0.0",
+    "@pnpm/patching.config": "1100.0.10",
+    "@pnpm/pkg-manifest.utils": "1100.2.7",
+    "@pnpm/pnpr.client": "1.3.3",
+    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
+    "@pnpm/resolving.resolver-base": "1100.5.2",
+    "@pnpm/store.controller-types": "1100.1.8",
+    "@pnpm/store.index": "1100.2.1",
+    "@pnpm/types": "1101.4.0",
     "@pnpm/util.lex-comparator": "^4.0.1",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.15",
     "@zkochan/rimraf": "^4.0.0",
     "is-inner-link": "^5.0.0",
     "is-subdir": "^2.0.0",
@@ -64,66 +117,30 @@
     "path-exists": "^5.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
-    "semver": "^7.8.4",
-    "@pnpm/bins.remover": "1100.0.12",
-    "@pnpm/bins.linker": "1100.0.16",
-    "@pnpm/building.during-install": "1102.0.4",
-    "@pnpm/building.after-install": "1102.0.4",
-    "@pnpm/building.policy": "1100.0.12",
-    "@pnpm/catalogs.config": "1100.0.2",
-    "@pnpm/catalogs.protocol-parser": "1100.0.0",
-    "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/config.normalize-registries": "1100.0.8",
-    "@pnpm/core-loggers": "1100.2.1",
-    "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.2.8",
-    "@pnpm/crypto.object-hasher": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/deps.graph-sequencer": "1100.0.0",
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/hooks.types": "1100.1.1",
-    "@pnpm/fs.symlink-dependency": "1100.0.10",
-    "@pnpm/installing.context": "1100.0.22",
-    "@pnpm/exec.lifecycle": "1100.1.2",
-    "@pnpm/installing.deps-resolver": "1100.2.7",
-    "@pnpm/config.parse-overrides": "1100.0.2",
-    "@pnpm/hooks.read-package-hook": "1100.0.9",
-    "@pnpm/installing.linking.hoist": "1100.0.16",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.10",
-    "@pnpm/installing.deps-restorer": "1102.1.3",
-    "@pnpm/installing.modules-yaml": "1100.0.9",
-    "@pnpm/lockfile.filtering": "1100.1.9",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.10",
-    "@pnpm/lockfile.preferred-versions": "1100.0.18",
-    "@pnpm/lockfile.pruner": "1100.0.13",
-    "@pnpm/lockfile.fs": "1100.1.9",
-    "@pnpm/lockfile.to-pnp": "1100.1.3",
-    "@pnpm/lockfile.verification": "1100.0.22",
-    "@pnpm/lockfile.utils": "1100.1.1",
-    "@pnpm/lockfile.settings-checker": "1100.1.1",
-    "@pnpm/lockfile.walker": "1100.0.13",
-    "@pnpm/network.auth-header": "1101.1.3",
-    "@pnpm/patching.config": "1100.0.9",
-    "@pnpm/pkg-manifest.utils": "1100.2.6",
-    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/resolving.resolver-base": "1100.5.1",
-    "@pnpm/store.controller-types": "1100.1.7",
-    "@pnpm/installing.package-requester": "1102.1.1",
-    "@pnpm/store.index": "1100.2.1",
-    "@pnpm/pnpr.client": "1.3.1",
-    "@pnpm/types": "1101.3.2",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.14"
+    "semver": "^7.8.4"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.3"
+    "@pnpm/worker": "^1100.2.4"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
+    "@pnpm/assert-project": "1100.0.19",
+    "@pnpm/assert-store": "1100.0.19",
+    "@pnpm/installing.deps-installer": "1102.3.0",
+    "@pnpm/lockfile.types": "1100.0.14",
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/network.git-utils": "1100.0.2",
+    "@pnpm/pkg-manifest.reader": "1100.0.10",
+    "@pnpm/prepare": "1100.0.19",
+    "@pnpm/resolving.registry.types": "1100.1.4",
+    "@pnpm/store.cafs": "1100.1.13",
+    "@pnpm/store.path": "1100.0.2",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/test-ipc-server": "1100.0.0",
+    "@pnpm/testing.mock-agent": "1101.0.5",
+    "@pnpm/testing.registry-mock": "1100.0.9",
+    "@pnpm/testing.temp-store": "1100.1.15",
     "@types/fs-extra": "^11.0.4",
     "@types/is-windows": "^1.0.2",
     "@types/normalize-path": "^3.0.2",
@@ -140,23 +157,7 @@
     "resolve-link-target": "^3.0.0",
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
-    "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-store": "1100.0.18",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/installing.deps-installer": "1102.2.1",
-    "@pnpm/network.git-utils": "1100.0.2",
-    "@pnpm/lockfile.types": "1100.0.13",
-    "@pnpm/prepare": "1100.0.18",
-    "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/resolving.registry.types": "1100.1.3",
-    "@pnpm/assert-project": "1100.0.18",
-    "@pnpm/store.cafs": "1100.1.12",
-    "@pnpm/store.path": "1100.0.2",
-    "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.registry-mock": "1100.0.8",
-    "@pnpm/testing.mock-agent": "1101.0.4",
-    "@pnpm/testing.temp-store": "1100.1.13"
+    "write-yaml-file": "^6.0.0"
   },
   "engines": {
     "node": ">=22.13"