@pnpm/installing.deps-installer 1102.2.2 → 1102.3.0

package/CHANGELOG.md

@@ -1,5 +1,62 @@
 # @pnpm/core
 
+## 1102.3.0
+
+### Minor Changes
+
+- Added a new override selector form with an empty range — `"pkg@": "<version>"` — called a convergence override. It rewrites a dependency edge only when its exact version satisfies the edge's declared range, so compatible consumers converge on one version while incompatible consumers keep their own resolution — now and for any dependent added in the future [#12794](https://github.com/pnpm/pnpm/issues/12794).
+
+  ```yaml
+  overrides:
+    "form-data@": 4.0.6
+  ```
+
+  The value must be an exact version. When a full resolution detects that every declared range also admits a newer version, pnpm warns that the override is stale and names the version to converge on. Previously an empty range in an override selector was undocumented and behaved like a bare (unscoped) override.
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/bins.linker@1100.0.17
+  - @pnpm/bins.remover@1100.0.13
+  - @pnpm/building.after-install@1102.0.6
+  - @pnpm/building.during-install@1102.0.6
+  - @pnpm/building.policy@1100.0.13
+  - @pnpm/config.normalize-registries@1100.0.9
+  - @pnpm/config.parse-overrides@1100.1.0
+  - @pnpm/config.version-policy@1100.1.7
+  - @pnpm/core-loggers@1100.2.2
+  - @pnpm/deps.graph-hasher@1100.2.10
+  - @pnpm/deps.path@1100.0.9
+  - @pnpm/exec.lifecycle@1100.1.3
+  - @pnpm/fs.symlink-dependency@1100.0.11
+  - @pnpm/hooks.read-package-hook@1100.1.0
+  - @pnpm/hooks.types@1100.2.1
+  - @pnpm/installing.context@1100.0.24
+  - @pnpm/installing.deps-resolver@1100.2.9
+  - @pnpm/installing.deps-restorer@1102.1.5
+  - @pnpm/installing.linking.direct-dep-linker@1100.0.11
+  - @pnpm/installing.linking.hoist@1100.0.17
+  - @pnpm/installing.linking.modules-cleaner@1100.1.12
+  - @pnpm/installing.modules-yaml@1100.0.10
+  - @pnpm/installing.package-requester@1102.1.3
+  - @pnpm/lockfile.filtering@1100.1.11
+  - @pnpm/lockfile.fs@1100.1.11
+  - @pnpm/lockfile.preferred-versions@1100.0.20
+  - @pnpm/lockfile.pruner@1100.0.14
+  - @pnpm/lockfile.settings-checker@1100.1.3
+  - @pnpm/lockfile.to-pnp@1100.1.5
+  - @pnpm/lockfile.utils@1100.1.3
+  - @pnpm/lockfile.verification@1100.0.24
+  - @pnpm/lockfile.walker@1100.0.14
+  - @pnpm/network.auth-header@1101.1.4
+  - @pnpm/patching.config@1100.0.10
+  - @pnpm/pkg-manifest.utils@1100.2.7
+  - @pnpm/pnpr.client@1.3.3
+  - @pnpm/resolving.resolver-base@1100.5.2
+  - @pnpm/store.controller-types@1100.1.8
+  - @pnpm/types@1101.4.0
+  - @pnpm/workspace.project-manifest-reader@1100.0.15
+
 ## 1102.2.2
 
 ### Patch Changes

package/lib/install/extendInstallOptions.d.ts

@@ -259,5 +259,11 @@ export type InstallOptions = Partial<StrictInstallOptions> & Pick<StrictInstallO
 export interface ProcessedInstallOptions extends StrictInstallOptions {
     readPackageHook?: ReadPackageHook;
     parsedOverrides: VersionOverride[];
+    /**
+     * Present when the overrides contain convergence entries (`"pkg@"`). The
+     * versions overrider fills it with every declared semver range it sees for
+     * those packages; the staleness check reads it after a full resolution.
+     */
+    convergeDeclaredRanges?: Map<string, Set<string>>;
 }
 export declare function extendOptions(opts: InstallOptions): ProcessedInstallOptions;

package/lib/install/extendInstallOptions.js

@@ -124,10 +124,14 @@ export function extendOptions(opts) {
         storeDir: defaultOpts.storeDir,
         parsedOverrides: parseOverrides(opts.overrides ?? {}, opts.catalogs ?? {}),
     };
+    if (extendedOpts.parsedOverrides.some(({ converge }) => converge)) {
+        extendedOpts.convergeDeclaredRanges = new Map();
+    }
     extendedOpts.readPackageHook = createReadPackageHook({
         ignoreCompatibilityDb: extendedOpts.ignoreCompatibilityDb,
         readPackageHook: extendedOpts.hooks?.readPackage,
         overrides: extendedOpts.parsedOverrides,
+        convergeDeclaredRanges: extendedOpts.convergeDeclaredRanges,
         lockfileDir: extendedOpts.lockfileDir,
         packageExtensions: extendedOpts.packageExtensions,
         ignoredOptionalDependencies: extendedOpts.ignoredOptionalDependencies,

package/lib/install/index.js

@@ -41,6 +41,7 @@ import { linkPackages } from './link.js';
 import { reportPeerDependencyIssues } from './reportPeerDependencyIssues.js';
 import { validateModules } from './validateModules.js';
 import { verifyLockfileResolutions } from './verifyLockfileResolutions.js';
+import { warnOnStaleConvergenceOverrides } from './warnOnStaleConvergenceOverrides.js';
 import { writeLockfilesAndRecordVerified } from './writeLockfilesAndRecordVerified.js';
 import { writeWantedLockfileAndRecordVerified } from './writeWantedLockfileAndRecordVerified.js';
 class LockfileConfigMismatchError extends PnpmError {
@@ -1167,6 +1168,20 @@ const _installInContext = async (projects, ctx, opts) => {
         allProjectIds: Object.values(ctx.projects).map((p) => p.id),
         handleResolutionPolicyViolations: opts.handleResolutionPolicyViolations,
     });
+    // Only a full resolution walks every manifest through the versions
+    // overrider, making the collected declared ranges complete enough for the
+    // staleness verdict; partial resolutions must stay silent to avoid false
+    // positives from unseen ranges.
+    if (opts.convergeDeclaredRanges != null && (forceFullResolution || opts.dedupe)) {
+        await warnOnStaleConvergenceOverrides({
+            convergeDeclaredRanges: opts.convergeDeclaredRanges,
+            parsedOverrides: opts.parsedOverrides,
+            requestPackage: opts.storeController.requestPackage,
+            lockfileDir: opts.lockfileDir,
+            minimumReleaseAge: opts.minimumReleaseAge,
+            minimumReleaseAgeExclude: opts.minimumReleaseAgeExclude,
+        });
+    }
     if (!opts.include.optionalDependencies || !opts.include.devDependencies || !opts.include.dependencies) {
         linkedDependenciesByProjectId = mapValues((linkedDeps) => linkedDeps.filter((linkedDep) => !(linkedDep.dev && !opts.include.devDependencies ||
             linkedDep.optional && !opts.include.optionalDependencies ||

package/lib/install/warnOnStaleConvergenceOverrides.d.ts

@@ -0,0 +1,31 @@
+import type { VersionOverride } from '@pnpm/config.parse-overrides';
+import type { RequestPackageFunction } from '@pnpm/store.controller-types';
+export interface WarnOnStaleConvergenceOverridesOptions {
+    convergeDeclaredRanges: Map<string, Set<string>>;
+    parsedOverrides: VersionOverride[];
+    requestPackage: RequestPackageFunction;
+    lockfileDir: string;
+    minimumReleaseAge?: number;
+    minimumReleaseAgeExclude?: string[];
+}
+/**
+ * A convergence override's value is derived state — the best version that
+ * converges the currently declared ranges. It goes stale when dependents
+ * start declaring ranges that admit newer versions: the override then keeps
+ * the edges it governs on the old version while newer edges resolve past it,
+ * producing the duplication the entry was written to prevent.
+ *
+ * Must only run after a full resolution: only then has every manifest
+ * streamed through the versions overrider, so `convergeDeclaredRanges` holds
+ * the complete set of declared ranges. For each convergence override this
+ * resolves every declared range to the best version it admits (metadata is
+ * already cached from the resolution that just ran, and the release-age
+ * policy applies, so the recommendation is a version the resolver would
+ * actually pick) and warns when a version newer than the override's value
+ * satisfies every declared range — a strictly better convergence.
+ *
+ * A range that fails to resolve contributes no candidate but still
+ * participates in the satisfies-every-range check, so failures can only
+ * suppress the warning, never fabricate one.
+ */
+export declare function warnOnStaleConvergenceOverrides(opts: WarnOnStaleConvergenceOverridesOptions): Promise<void>;

package/lib/install/warnOnStaleConvergenceOverrides.js

@@ -0,0 +1,62 @@
+import { getPublishedByPolicy } from '@pnpm/config.version-policy';
+import { globalWarn } from '@pnpm/logger';
+import semver from 'semver';
+/**
+ * A convergence override's value is derived state — the best version that
+ * converges the currently declared ranges. It goes stale when dependents
+ * start declaring ranges that admit newer versions: the override then keeps
+ * the edges it governs on the old version while newer edges resolve past it,
+ * producing the duplication the entry was written to prevent.
+ *
+ * Must only run after a full resolution: only then has every manifest
+ * streamed through the versions overrider, so `convergeDeclaredRanges` holds
+ * the complete set of declared ranges. For each convergence override this
+ * resolves every declared range to the best version it admits (metadata is
+ * already cached from the resolution that just ran, and the release-age
+ * policy applies, so the recommendation is a version the resolver would
+ * actually pick) and warns when a version newer than the override's value
+ * satisfies every declared range — a strictly better convergence.
+ *
+ * A range that fails to resolve contributes no candidate but still
+ * participates in the satisfies-every-range check, so failures can only
+ * suppress the warning, never fabricate one.
+ */
+export async function warnOnStaleConvergenceOverrides(opts) {
+    const convergeOverrides = opts.parsedOverrides.filter(({ converge }) => converge);
+    if (convergeOverrides.length === 0)
+        return;
+    const { publishedBy, publishedByExclude } = getPublishedByPolicy(opts);
+    await Promise.all(convergeOverrides.map(async (override) => {
+        const name = override.targetPkg.name;
+        const ranges = opts.convergeDeclaredRanges.get(name);
+        if (ranges == null || ranges.size === 0)
+            return;
+        const candidates = await Promise.all([...ranges].map(async (range) => {
+            try {
+                const response = await opts.requestPackage({ alias: name, bareSpecifier: range }, {
+                    downloadPriority: 0,
+                    lockfileDir: opts.lockfileDir,
+                    projectDir: opts.lockfileDir,
+                    preferredVersions: {},
+                    skipFetch: true,
+                    publishedBy,
+                    publishedByExclude,
+                });
+                if (response.body.policyViolation != null)
+                    return undefined;
+                return response.body.manifest?.version;
+            }
+            catch {
+                return undefined;
+            }
+        }));
+        const best = candidates
+            .filter((version) => version != null && semver.gt(version, override.newBareSpecifier))
+            .sort(semver.rcompare)
+            .find((version) => [...ranges].every((range) => semver.satisfies(version, range, true)));
+        if (best == null)
+            return;
+        globalWarn(`The convergence override "${name}@": "${override.newBareSpecifier}" is stale: every declared range of ${name} also admits ${best}. Change the override's value to ${best} in pnpm-workspace.yaml, or remove the override and run "pnpm dedupe".`);
+    }));
+}
+//# sourceMappingURL=warnOnStaleConvergenceOverrides.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1102.2.2",
+  "version": "1102.3.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -51,60 +51,61 @@
   },
   "dependencies": {
     "@inquirer/prompts": "^8.4.3",
-    "@pnpm/bins.linker": "1100.0.16",
-    "@pnpm/bins.remover": "1100.0.12",
-    "@pnpm/building.after-install": "1102.0.5",
-    "@pnpm/building.during-install": "1102.0.5",
-    "@pnpm/building.policy": "1100.0.12",
+    "@pnpm/bins.linker": "1100.0.17",
+    "@pnpm/bins.remover": "1100.0.13",
+    "@pnpm/building.after-install": "1102.0.6",
+    "@pnpm/building.during-install": "1102.0.6",
+    "@pnpm/building.policy": "1100.0.13",
     "@pnpm/catalogs.config": "1100.0.2",
     "@pnpm/catalogs.protocol-parser": "1100.0.0",
     "@pnpm/catalogs.resolver": "1100.0.0",
     "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/config.normalize-registries": "1100.0.8",
-    "@pnpm/config.parse-overrides": "1100.0.2",
+    "@pnpm/config.normalize-registries": "1100.0.9",
+    "@pnpm/config.parse-overrides": "1100.1.0",
+    "@pnpm/config.version-policy": "1100.1.7",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.2.1",
+    "@pnpm/core-loggers": "1100.2.2",
     "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/crypto.object-hasher": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.2.9",
+    "@pnpm/deps.graph-hasher": "1100.2.10",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/deps.path": "1100.0.9",
     "@pnpm/error": "1100.0.1",
-    "@pnpm/exec.lifecycle": "1100.1.2",
+    "@pnpm/exec.lifecycle": "1100.1.3",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/fs.symlink-dependency": "1100.0.10",
-    "@pnpm/hooks.read-package-hook": "1100.0.9",
-    "@pnpm/hooks.types": "1100.2.0",
-    "@pnpm/installing.context": "1100.0.23",
-    "@pnpm/installing.deps-resolver": "1100.2.8",
-    "@pnpm/installing.deps-restorer": "1102.1.4",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.10",
-    "@pnpm/installing.linking.hoist": "1100.0.16",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.11",
-    "@pnpm/installing.modules-yaml": "1100.0.9",
-    "@pnpm/installing.package-requester": "1102.1.2",
-    "@pnpm/lockfile.filtering": "1100.1.10",
-    "@pnpm/lockfile.fs": "1100.1.10",
-    "@pnpm/lockfile.preferred-versions": "1100.0.19",
-    "@pnpm/lockfile.pruner": "1100.0.13",
-    "@pnpm/lockfile.settings-checker": "1100.1.2",
-    "@pnpm/lockfile.to-pnp": "1100.1.4",
-    "@pnpm/lockfile.utils": "1100.1.2",
-    "@pnpm/lockfile.verification": "1100.0.23",
-    "@pnpm/lockfile.walker": "1100.0.13",
-    "@pnpm/network.auth-header": "1101.1.3",
+    "@pnpm/fs.symlink-dependency": "1100.0.11",
+    "@pnpm/hooks.read-package-hook": "1100.1.0",
+    "@pnpm/hooks.types": "1100.2.1",
+    "@pnpm/installing.context": "1100.0.24",
+    "@pnpm/installing.deps-resolver": "1100.2.9",
+    "@pnpm/installing.deps-restorer": "1102.1.5",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.11",
+    "@pnpm/installing.linking.hoist": "1100.0.17",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.12",
+    "@pnpm/installing.modules-yaml": "1100.0.10",
+    "@pnpm/installing.package-requester": "1102.1.3",
+    "@pnpm/lockfile.filtering": "1100.1.11",
+    "@pnpm/lockfile.fs": "1100.1.11",
+    "@pnpm/lockfile.preferred-versions": "1100.0.20",
+    "@pnpm/lockfile.pruner": "1100.0.14",
+    "@pnpm/lockfile.settings-checker": "1100.1.3",
+    "@pnpm/lockfile.to-pnp": "1100.1.5",
+    "@pnpm/lockfile.utils": "1100.1.3",
+    "@pnpm/lockfile.verification": "1100.0.24",
+    "@pnpm/lockfile.walker": "1100.0.14",
+    "@pnpm/network.auth-header": "1101.1.4",
     "@pnpm/npm-package-arg": "^2.0.0",
-    "@pnpm/patching.config": "1100.0.9",
-    "@pnpm/pkg-manifest.utils": "1100.2.6",
-    "@pnpm/pnpr.client": "1.3.2",
+    "@pnpm/patching.config": "1100.0.10",
+    "@pnpm/pkg-manifest.utils": "1100.2.7",
+    "@pnpm/pnpr.client": "1.3.3",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/resolving.resolver-base": "1100.5.1",
-    "@pnpm/store.controller-types": "1100.1.7",
+    "@pnpm/resolving.resolver-base": "1100.5.2",
+    "@pnpm/store.controller-types": "1100.1.8",
     "@pnpm/store.index": "1100.2.1",
-    "@pnpm/types": "1101.3.2",
+    "@pnpm/types": "1101.4.0",
     "@pnpm/util.lex-comparator": "^4.0.1",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.14",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.15",
     "@zkochan/rimraf": "^4.0.0",
     "is-inner-link": "^5.0.0",
     "is-subdir": "^2.0.0",
@@ -120,26 +121,26 @@
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.3"
+    "@pnpm/worker": "^1100.2.4"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/assert-project": "1100.0.18",
-    "@pnpm/assert-store": "1100.0.18",
-    "@pnpm/installing.deps-installer": "1102.2.2",
-    "@pnpm/lockfile.types": "1100.0.13",
+    "@pnpm/assert-project": "1100.0.19",
+    "@pnpm/assert-store": "1100.0.19",
+    "@pnpm/installing.deps-installer": "1102.3.0",
+    "@pnpm/lockfile.types": "1100.0.14",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/network.git-utils": "1100.0.2",
-    "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/prepare": "1100.0.18",
-    "@pnpm/resolving.registry.types": "1100.1.3",
-    "@pnpm/store.cafs": "1100.1.12",
+    "@pnpm/pkg-manifest.reader": "1100.0.10",
+    "@pnpm/prepare": "1100.0.19",
+    "@pnpm/resolving.registry.types": "1100.1.4",
+    "@pnpm/store.cafs": "1100.1.13",
     "@pnpm/store.path": "1100.0.2",
     "@pnpm/test-fixtures": "1100.0.0",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1101.0.4",
-    "@pnpm/testing.registry-mock": "1100.0.8",
-    "@pnpm/testing.temp-store": "1100.1.14",
+    "@pnpm/testing.mock-agent": "1101.0.5",
+    "@pnpm/testing.registry-mock": "1100.0.9",
+    "@pnpm/testing.temp-store": "1100.1.15",
     "@types/fs-extra": "^11.0.4",
     "@types/is-windows": "^1.0.2",
     "@types/normalize-path": "^3.0.2",