@pnpm/installing.deps-resolver 1100.1.3 → 1100.1.5

package/lib/getNonDevWantedDependencies.d.ts

@@ -7,6 +7,9 @@ export interface WantedDependency {
     injected?: boolean;
     saveCatalogName?: string;
 }
-type GetNonDevWantedDependenciesManifest = Pick<DependencyManifest, 'bundleDependencies' | 'bundledDependencies' | 'optionalDependencies' | 'dependencies' | 'dependenciesMeta'>;
+type GetNonDevWantedDependenciesManifest = Pick<DependencyManifest, 'bundleDependencies' | 'bundledDependencies' | 'optionalDependencies' | 'dependencies' | 'dependenciesMeta'> & {
+    name?: string;
+    version?: string;
+};
 export declare function getNonDevWantedDependencies(pkg: GetNonDevWantedDependenciesManifest): WantedDependency[];
 export {};

package/lib/getNonDevWantedDependencies.js

@@ -1,5 +1,11 @@
 import { pickBy } from 'ramda';
+import { assertValidDependencyAliases } from './validateDependencyAlias.js';
 export function getNonDevWantedDependencies(pkg) {
+    const pkgDescription = pkg.name != null
+        ? `Package "${pkg.name}${pkg.version != null ? `@${pkg.version}` : ''}"`
+        : 'Package';
+    assertValidDependencyAliases(pkg.dependencies, pkgDescription);
+    assertValidDependencyAliases(pkg.optionalDependencies, pkgDescription);
     let bd = pkg.bundledDependencies ?? pkg.bundleDependencies;
     if (bd === true) {
         bd = pkg.dependencies != null ? Object.keys(pkg.dependencies) : [];

package/lib/getWantedDependencies.js

@@ -1,5 +1,10 @@
 import { filterDependenciesByType } from '@pnpm/pkg-manifest.utils';
+import { assertValidDependencyAliases } from './validateDependencyAlias.js';
 export function getWantedDependencies(pkg, opts) {
+    assertValidDependencyAliases(pkg.dependencies, 'The current package');
+    assertValidDependencyAliases(pkg.devDependencies, 'The current package');
+    assertValidDependencyAliases(pkg.optionalDependencies, 'The current package');
+    assertValidDependencyAliases(pkg.peerDependencies, 'The current package');
     let depsToInstall = filterDependenciesByType(pkg, opts?.includeDirect ?? {
         dependencies: true,
         devDependencies: true,

package/lib/resolveDependencies.d.ts

@@ -77,6 +77,7 @@ export interface ResolutionContext {
     defaultTag: string;
     dryRun: boolean;
     forceFullResolution: boolean;
+    updateChecksums?: boolean;
     ignoreScripts?: boolean;
     resolvedPkgsById: ResolvedPkgsById;
     resolvePeersFromWorkspaceRoot?: boolean;

package/lib/resolveDependencies.js

@@ -450,6 +450,7 @@ async function resolveDependenciesOfDependency(ctx, preferredVersions, options,
         proceed: extendedWantedDep.proceed || updateShouldContinue || ctx.updatedSet.size > 0,
         publishedBy: options.publishedBy,
         update: update ? options.updateToLatest ? 'latest' : 'compatible' : false,
+        updateChecksums: ctx.updateChecksums,
         updateDepth,
         updateRequested,
         supportedArchitectures: options.supportedArchitectures,
@@ -785,6 +786,7 @@ async function resolveDependency(wantedDependency, ctx, options) {
             trustPolicyExclude: ctx.trustPolicyExclude,
             trustPolicyIgnoreAfter: ctx.trustPolicyIgnoreAfter,
             update: options.update,
+            updateChecksums: options.updateChecksums,
             workspacePackages: ctx.workspacePackages,
             supportedArchitectures: options.supportedArchitectures,
             onFetchError: (err) => {

package/lib/resolveDependencyTree.d.ts

@@ -76,6 +76,7 @@ export interface ResolveDependenciesOptions {
     engineStrict: boolean;
     force: boolean;
     forceFullResolution: boolean;
+    updateChecksums?: boolean;
     ignoreScripts?: boolean;
     hooks: {
         readPackage?: ReadPackageHook;

package/lib/resolveDependencyTree.js

@@ -24,6 +24,7 @@ export async function resolveDependencyTree(importers, opts) {
         engineStrict: opts.engineStrict,
         force: opts.force,
         forceFullResolution: opts.forceFullResolution,
+        updateChecksums: opts.updateChecksums,
         ignoreScripts: opts.ignoreScripts,
         injectWorkspacePackages: opts.injectWorkspacePackages,
         linkWorkspacePackagesDepth: opts.linkWorkspacePackagesDepth ?? -1,

package/lib/resolvePeers.js

@@ -361,8 +361,15 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
     };
     async function calculateDepPath(peerIds, pendingPeerNodes, cycles) {
         const cyclicPeerAliases = new Set();
+        const pendingPeerAliases = new Set(pendingPeerNodes.map(({ alias }) => alias));
         for (const cycle of cycles) {
-            if (cycle.includes(currentAlias)) {
+            // A cycle has to be short-circuited at this level whenever any of
+            // its members is involved in the current resolution — either as
+            // currentAlias or among the pending peers we are about to await.
+            // When a cycle member hits the `findHit` cache instead of running
+            // its own calculateDepPath, only the awaiting siblings at this
+            // level can release the cached promise. See pnpm/pnpm#11999.
+            if (cycle.includes(currentAlias) || cycle.some((alias) => pendingPeerAliases.has(alias))) {
                 for (const peerAlias of cycle) {
                     cyclicPeerAliases.add(peerAlias);
                 }

package/lib/validateDependencyAlias.d.ts

@@ -0,0 +1,2 @@
+export declare function isValidDependencyAlias(alias: string): boolean;
+export declare function assertValidDependencyAliases(deps: Record<string, unknown> | undefined, parentPkgDescription: string): void;

package/lib/validateDependencyAlias.js

@@ -0,0 +1,24 @@
+import { PnpmError } from '@pnpm/error';
+import validateNpmPackageName from 'validate-npm-package-name';
+// An alias is the directory name pnpm creates inside `node_modules`, so
+// it must be a valid npm package name. Anything else (path-traversal
+// shapes such as `@x/../../../../../.git/hooks`, control characters,
+// names that collide with pnpm's own `node_modules` layout such as
+// `.bin` / `.pnpm` / `node_modules`) is rejected. Matches the
+// `validForOldPackages` check `parseWantedDependency` applies to
+// CLI-given names.
+export function isValidDependencyAlias(alias) {
+    return typeof alias === 'string' && validateNpmPackageName(alias).validForOldPackages;
+}
+export function assertValidDependencyAliases(deps, parentPkgDescription) {
+    if (deps == null)
+        return;
+    for (const alias of Object.keys(deps)) {
+        if (!isValidDependencyAlias(alias)) {
+            throw new PnpmError('INVALID_DEPENDENCY_NAME', `${parentPkgDescription} contains a dependency with an invalid name: ${JSON.stringify(alias)}`, {
+                hint: 'A dependency name must be a valid npm package name — a single `name` or `@scope/name` consisting of URL-friendly characters, with no leading `.` or `_`, and not equal to reserved names such as `node_modules`.',
+            });
+        }
+    }
+}
+//# sourceMappingURL=validateDependencyAlias.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.1.3",
+  "version": "1100.1.5",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -36,44 +36,46 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^7.0.1",
     "safe-promise-defer": "^2.0.0",
-    "semver": "^7.7.2",
+    "semver": "^7.8.1",
     "semver-range-intersect": "^0.3.1",
+    "validate-npm-package-name": "7.0.2",
     "version-selector-type": "^3.0.0",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/config.version-policy": "1100.1.2",
     "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.1.1",
-    "@pnpm/core-loggers": "1100.1.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.4",
-    "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.2.1",
+    "@pnpm/deps.graph-hasher": "1100.2.2",
+    "@pnpm/deps.path": "1100.0.5",
+    "@pnpm/core-loggers": "1100.1.2",
     "@pnpm/deps.peer-range": "1100.0.1",
+    "@pnpm/fetching.pick-fetcher": "1100.0.9",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/lockfile.preferred-versions": "1100.0.11",
-    "@pnpm/hooks.types": "1100.0.8",
-    "@pnpm/fetching.pick-fetcher": "1100.0.8",
-    "@pnpm/lockfile.pruner": "1100.0.7",
-    "@pnpm/lockfile.types": "1100.0.7",
-    "@pnpm/patching.config": "1100.0.4",
-    "@pnpm/lockfile.utils": "1100.0.9",
+    "@pnpm/hooks.types": "1100.0.9",
+    "@pnpm/lockfile.pruner": "1100.0.8",
+    "@pnpm/lockfile.preferred-versions": "1100.0.12",
+    "@pnpm/lockfile.types": "1100.0.8",
+    "@pnpm/patching.config": "1100.0.5",
     "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.4",
-    "@pnpm/pkg-manifest.utils": "1100.2.0",
-    "@pnpm/resolving.npm-resolver": "1101.3.2",
-    "@pnpm/resolving.resolver-base": "1100.3.0",
-    "@pnpm/store.controller-types": "1100.1.1",
-    "@pnpm/types": "1101.1.1",
-    "@pnpm/workspace.spec-parser": "1100.0.0"
+    "@pnpm/lockfile.utils": "1100.0.10",
+    "@pnpm/pkg-manifest.reader": "1100.0.5",
+    "@pnpm/resolving.npm-resolver": "1101.4.0",
+    "@pnpm/pkg-manifest.utils": "1100.2.1",
+    "@pnpm/resolving.resolver-base": "1100.3.1",
+    "@pnpm/types": "1101.2.0",
+    "@pnpm/workspace.spec-parser": "1100.0.0",
+    "@pnpm/store.controller-types": "1100.1.2"
   },
   "peerDependencies": {
-    "@pnpm/logger": ">=1001.0.0 <1002.0.0"
+    "@pnpm/logger": "^1001.0.1"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/installing.deps-resolver": "1100.1.3"
+    "@types/validate-npm-package-name": "^4.0.2",
+    "@pnpm/installing.deps-resolver": "1100.1.5",
+    "@pnpm/logger": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"