@pnpm/installing.deps-resolver 1100.2.2 → 1100.2.4

package/lib/resolveDependencyTree.d.ts

@@ -5,7 +5,7 @@ import type { PreferredVersions, Resolution, ResolutionPolicyViolation, Workspac
 import type { StoreController } from '@pnpm/store.controller-types';
 import type { AllowBuild, AllowedDeprecatedVersions, PinnedVersion, PkgResolutionId, ProjectId, ProjectManifest, ProjectRootDir, ReadPackageHook, Registries, SupportedArchitectures, TrustPolicy } from '@pnpm/types';
 import type { WantedDependency } from './getNonDevWantedDependencies.js';
-import { type NodeId } from './nextNodeId.js';
+import type { NodeId } from './nextNodeId.js';
 import { type DependenciesTree, type LinkedDependency, type ResolvedPackage, type ResolvedPkgsById } from './resolveDependencies.js';
 export type { DependenciesTree, DependenciesTreeNode, LinkedDependency, ResolvedPackage } from './resolveDependencies.js';
 export interface ResolvedImporters {

package/lib/resolveDependencyTree.js

@@ -3,9 +3,7 @@ import { createPackageVersionPolicyOrThrow, getPublishedByPolicy } from '@pnpm/c
 import { globalWarn } from '@pnpm/logger';
 import { BUILTIN_NAMED_REGISTRIES } from '@pnpm/resolving.npm-resolver';
 import { partition } from 'ramda';
-import { nextNodeId } from './nextNodeId.js';
-import { parentIdsContainSequence } from './parentIdsContainSequence.js';
-import { resolveRootDependencies, } from './resolveDependencies.js';
+import { buildTree, resolveRootDependencies, } from './resolveDependencies.js';
 export async function resolveDependencyTree(importers, opts) {
     const wantedToBeSkippedPackageIds = new Set();
     const autoInstallPeers = opts.autoInstallPeers === true;
@@ -57,6 +55,14 @@ export async function resolveDependencyTree(importers, opts) {
         allPeerDepNames: new Set(),
         maximumPublishedBy: publishedBy,
         publishedByExclude,
+        packageResolutionBarrier: {
+            activeByDepth: new Map(),
+            waiters: [],
+        },
+        childrenResolutionByPkgId: {},
+        childrenResolutionId: 0,
+        importerResolutionOrder: Object.fromEntries(importers.map(({ id }, index) => [id, index])),
+        nodeResolutionContextByNodeId: new Map(),
         trustPolicy: opts.trustPolicy,
         trustPolicyExclude: opts.trustPolicyExclude ? createPackageVersionPolicyOrThrow(opts.trustPolicyExclude, 'trustPolicyExclude') : undefined,
         trustPolicyIgnoreAfter: opts.trustPolicyIgnoreAfter,
@@ -176,32 +182,6 @@ export async function resolveDependencyTree(importers, opts) {
         resolutionPolicyViolations: ctx.resolutionPolicyViolations,
     };
 }
-function buildTree(ctx, parentId, parentIds, children, depth, installable) {
-    const childrenNodeIds = {};
-    for (const child of children) {
-        if (child.id.startsWith('link:')) {
-            childrenNodeIds[child.alias] = child.id;
-            continue;
-        }
-        if (parentIdsContainSequence(parentIds, parentId, child.id) || parentId === child.id) {
-            continue;
-        }
-        if (ctx.resolvedPkgsById[child.id].isLeaf) {
-            childrenNodeIds[child.alias] = child.id;
-            continue;
-        }
-        const childNodeId = nextNodeId();
-        childrenNodeIds[child.alias] = childNodeId;
-        installable = installable || !ctx.skipped.has(child.id);
-        ctx.dependenciesTree.set(childNodeId, {
-            children: () => buildTree(ctx, child.id, [...parentIds, child.id], ctx.childrenByParentId[child.id], depth + 1, installable),
-            depth,
-            installable,
-            resolvedPackage: ctx.resolvedPkgsById[child.id],
-        });
-    }
-    return childrenNodeIds;
-}
 /**
   * There may be cases where multiple dependencies have the same alias in the directDeps array.
   * E.g., when there is "is-negative: github:kevva/is-negative#1.0.0" in the package.json dependencies,

package/lib/resolvePeers.js

@@ -259,10 +259,11 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
         parentPkgs = { ...parentParentPkgs };
         const parentPkgNodes = [];
         for (const [alias, nodeId] of Object.entries(children)) {
-            if (ctx.allPeerDepNames.has(alias)) {
+            const childNode = ctx.dependenciesTree.get(nodeId);
+            if (ctx.allPeerDepNames.has(alias) || (alias !== childNode.resolvedPackage.name && ctx.allPeerDepNames.has(childNode.resolvedPackage.name))) {
                 parentPkgNodes.push({
                     alias,
-                    node: ctx.dependenciesTree.get(nodeId),
+                    node: childNode,
                     nodeId,
                     parentNodeIds,
                 });
@@ -320,6 +321,15 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
             ctx.pathsByNodeIdPromises.set(peerNodeId, peerPathPromise);
             ctx.pathsByNodeId.set(peerNodeId, previousPeerDepPath);
             peerPathPromise.resolve(previousPeerDepPath);
+            // Pinning writes into parentPkgs, and a childless node shares the object
+            // with its parent, so siblings processed later would see the pinned
+            // provider too. Copy before the first write to keep the pin scoped to
+            // this node — sibling order follows resolution order, so a leak makes the
+            // lockfile depend on network timing. Done here, not before the loop, so a
+            // pass whose guards skip every entry never allocates.
+            if (parentPkgs === parentParentPkgs) {
+                parentPkgs = { ...parentParentPkgs };
+            }
             parentPkgs[peerName] = lockedPeer;
         }
     }
@@ -382,7 +392,18 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
     }
     let cache;
     const isPure = allResolvedPeers.size === 0 && allMissingPeers.size === 0;
-    if (isPure) {
+    // A cycle re-entry resolves against truncated children (the cycle is broken by
+    // dropping the repeated package's subtree), so its empty/partial peer sets are
+    // not authoritative for the package as a whole. Recording that verdict — as
+    // pure or in peersCache — lets it short-circuit other occurrences that *can*
+    // see the full subtree, dropping their transitivePeerDependencies depending on
+    // traversal order and churning the lockfile (https://github.com/pnpm/pnpm/issues/5108).
+    const resolvedThroughCycle = ctx.parentDepPathsChain.includes(resolvedPackage.pkgIdWithPatchHash);
+    if (resolvedThroughCycle) {
+        // Leave both caches untouched so later occurrences re-resolve (or hit the
+        // authoritative entry of the same package) instead of reusing this partial one.
+    }
+    else if (isPure) {
         ctx.purePkgs.add(resolvedPackage.pkgIdWithPatchHash);
     }
     else {

package/lib/toResolveImporter.js

@@ -48,7 +48,7 @@ export async function toResolveImporter(opts, project) {
             ...project.wantedDependencies.map(defaultUpdateDepth < 0
                 ? updateLocalTarballs
                 : (dep) => ({ ...dep, updateDepth: defaultUpdateDepth })),
-            ...existingDeps.map(opts.noDependencySelectors && project.updateMatching != null
+            ...existingDeps.map(project.updateMatching != null
                 ? updateLocalTarballs
                 : (dep) => ({ ...dep, updateDepth: -1 })),
         ];

package/lib/updateProjectManifest.js

@@ -10,7 +10,7 @@ export async function updateProjectManifest(importer, opts) {
         return {
             alias: rdd.alias,
             peer: importer.peer,
-            bareSpecifier: rdd.catalogLookup?.userSpecifiedBareSpecifier ?? rdd.normalizedBareSpecifier ?? wantedDep.bareSpecifier,
+            bareSpecifier: getBareSpecifierToSave(wantedDep, rdd, opts.preserveWorkspaceProtocol),
             resolvedVersion: rdd.version,
             pinnedVersion: importer.pinnedVersion,
             saveType: importer.targetDependenciesField,
@@ -31,4 +31,19 @@ export async function updateProjectManifest(importer, opts) {
         : undefined;
     return [hookedManifest, originalManifest];
 }
+function getBareSpecifierToSave(wantedDep, resolvedDep, preserveWorkspaceProtocol) {
+    if (resolvedDep.catalogLookup != null) {
+        return resolvedDep.catalogLookup.userSpecifiedBareSpecifier;
+    }
+    if (preserveWorkspaceProtocol && isWorkspaceLocalPathSpecifier(wantedDep.bareSpecifier)) {
+        return wantedDep.bareSpecifier;
+    }
+    return resolvedDep.normalizedBareSpecifier ?? wantedDep.bareSpecifier;
+}
+function isWorkspaceLocalPathSpecifier(bareSpecifier) {
+    if (!bareSpecifier.startsWith('workspace:'))
+        return false;
+    const pref = bareSpecifier.slice('workspace:'.length);
+    return pref.startsWith('.') || pref.startsWith('/') || pref.startsWith('~/') || /^[A-Z]:/i.test(pref);
+}
 //# sourceMappingURL=updateProjectManifest.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.2.2",
+  "version": "1100.2.4",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -27,8 +27,8 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/util.lex-comparator": "^3.0.2",
-    "@yarnpkg/core": "4.5.0",
+    "@pnpm/util.lex-comparator": "^4.0.1",
+    "@yarnpkg/core": "4.8.0",
     "graph-cycles": "3.0.0",
     "is-inner-link": "^5.0.0",
     "is-subdir": "^2.0.0",
@@ -39,46 +39,46 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^7.0.1",
     "safe-promise-defer": "^2.0.0",
-    "semver": "^7.8.1",
+    "semver": "^7.8.4",
     "semver-range-intersect": "^0.3.1",
     "validate-npm-package-name": "7.0.2",
     "version-selector-type": "^3.0.0",
-    "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.1.4",
-    "@pnpm/core-loggers": "1100.2.0",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.2.4",
-    "@pnpm/deps.path": "1100.0.7",
-    "@pnpm/deps.peer-range": "1100.0.1",
+    "@pnpm/core-loggers": "1100.2.1",
+    "@pnpm/deps.graph-hasher": "1100.2.5",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/fetching.pick-fetcher": "1100.0.11",
-    "@pnpm/hooks.types": "1100.0.11",
-    "@pnpm/lockfile.preferred-versions": "1100.0.15",
-    "@pnpm/lockfile.pruner": "1100.0.10",
-    "@pnpm/lockfile.utils": "1100.0.12",
-    "@pnpm/lockfile.types": "1100.0.10",
-    "@pnpm/patching.config": "1100.0.7",
+    "@pnpm/fetching.pick-fetcher": "1100.0.12",
+    "@pnpm/deps.peer-range": "1100.0.2",
+    "@pnpm/hooks.types": "1100.0.12",
+    "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/config.version-policy": "1100.1.5",
+    "@pnpm/lockfile.preferred-versions": "1100.0.16",
+    "@pnpm/lockfile.types": "1100.0.11",
+    "@pnpm/lockfile.utils": "1100.0.13",
+    "@pnpm/patching.config": "1100.0.8",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.8",
+    "@pnpm/pkg-manifest.utils": "1100.2.5",
+    "@pnpm/resolving.npm-resolver": "1102.0.1",
+    "@pnpm/resolving.resolver-base": "1100.4.2",
+    "@pnpm/store.controller-types": "1100.1.5",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/workspace.spec-parser": "1100.0.0",
     "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.7",
-    "@pnpm/pkg-manifest.utils": "1100.2.4",
-    "@pnpm/resolving.npm-resolver": "1101.5.2",
-    "@pnpm/store.controller-types": "1100.1.4",
-    "@pnpm/resolving.resolver-base": "1100.4.1",
-    "@pnpm/types": "1101.3.1",
-    "@pnpm/workspace.spec-parser": "1100.0.0"
+    "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/lockfile.pruner": "1100.0.11"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1"
+    "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/validate-npm-package-name": "^4.0.2",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/installing.deps-resolver": "1100.2.2"
+    "@pnpm/installing.deps-resolver": "1100.2.4",
+    "@pnpm/logger": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"