@pnpm/installing.deps-resolver 1100.2.4 → 1100.2.6

package/lib/getNonDevWantedDependencies.d.ts

@@ -6,6 +6,8 @@ export interface WantedDependency {
     optional: boolean;
     injected?: boolean;
     saveCatalogName?: string;
+    /** Whether this dependency's spec should be (re)written to the manifest. */
+    updateSpec?: boolean;
 }
 type GetNonDevWantedDependenciesManifest = Pick<DependencyManifest, 'bundleDependencies' | 'bundledDependencies' | 'optionalDependencies' | 'dependencies' | 'dependenciesMeta'> & {
     name?: string;

package/lib/index.js

@@ -221,6 +221,7 @@ export async function resolveDependencies(importers, opts) {
             }
         }
     }
+    await waitForResolutionFetches(resolvedPkgsById);
     const newLockfile = updateLockfile({
         dependenciesGraph,
         lockfile: opts.wantedLockfile,
@@ -334,6 +335,21 @@ function alignDependencyTypes(manifest, projectSnapshot) {
         }
     }
 }
+/**
+ * Waits for fetches that complete resolution data used by the lockfile snapshot and
+ * virtual-store paths. Other package fetches are awaited later by `waitTillAllFetchingsFinish`.
+ */
+async function waitForResolutionFetches(resolvedPkgsById) {
+    const fetches = [];
+    for (const pkg of Object.values(resolvedPkgsById)) {
+        if (pkg.resolutionNeedsFetch && pkg.fetching != null) {
+            fetches.push(pkg.fetching());
+        }
+    }
+    if (fetches.length > 0) {
+        await Promise.all(fetches);
+    }
+}
 function getAliasToDependencyTypeMap(manifest) {
     const depTypesOfAliases = {};
     for (const depType of DEPENDENCIES_FIELDS) {

package/lib/resolveDependencies.d.ts

@@ -45,6 +45,11 @@ export interface PkgAddressOrLinkBase {
     optional: boolean;
     pkg: PackageManifest;
     pkgId: PkgResolutionId;
+    /**
+     * The wanted dependency this direct dependency was resolved from, carried so
+     * consumers can recover the request directly. See `updateProjectManifest`.
+     */
+    wantedDependency?: WantedDependency;
 }
 export interface LinkedDependency extends PkgAddressOrLinkBase {
     isLinkedDependency: true;
@@ -201,6 +206,12 @@ export interface ResolvedPackage {
     dev: boolean;
     optional: boolean;
     fetching: () => Promise<PkgRequestFetchResult>;
+    /**
+     * The resolution can't be completed without awaiting `fetching` (e.g. a registry tarball
+     * whose integrity is computed from the downloaded bytes). The lockfile snapshot and the
+     * virtual-store paths derived from the integrity must await `fetching` for these first.
+     */
+    resolutionNeedsFetch?: boolean;
     filesIndexFile: string;
     name: string;
     version: string;
@@ -278,6 +289,15 @@ export declare function resolveDependencies(ctx: ResolutionContext, preferredVer
     updateDepth?: number;
 }>, options: ResolvedDependenciesOptions): Promise<ResolvedDependenciesResult>;
 export declare function createNodeIdForLinkedLocalPkg(lockfileDir: string, pkgDir: string): NodeId;
+export declare function claimChildrenResolution(ctx: ResolutionContext, opts: {
+    currentDepth: number;
+    parentIds: PkgResolutionId[];
+    pkgId: PkgResolutionId;
+}): {
+    id: number;
+    isOwner: boolean;
+    missingPeersOfChildren?: MissingPeersOfChildren;
+};
 export declare function buildTree(ctx: {
     childrenByParentId: ChildrenByParentId;
     dependenciesTree: DependenciesTree<ResolvedPackage>;

package/lib/resolveDependencies.js

@@ -8,6 +8,7 @@ import { nameVerFromPkgSnapshot, pkgSnapshotToResolution, } from '@pnpm/lockfile
 import { logger } from '@pnpm/logger';
 import { getPatchInfo } from '@pnpm/patching.config';
 import { convertEnginesRuntimeToDependencies } from '@pnpm/pkg-manifest.utils';
+import { parseBareSpecifier } from '@pnpm/resolving.npm-resolver';
 import { DIRECT_DEP_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
 import { lexCompare } from '@pnpm/util.lex-comparator';
 import normalizePath from 'normalize-path';
@@ -39,7 +40,8 @@ export async function resolveRootDependencies(ctx, importers) {
         ctx.allPreferredVersions = getPreferredVersionsFromLockfileAndManifests(ctx.wantedLockfile.packages, []);
     }
     else if (ctx.hoistPeers) {
-        ctx.allPreferredVersions = {};
+        // Null-prototype: keyed by package names from resolved manifests.
+        ctx.allPreferredVersions = Object.create(null);
     }
     const { pkgAddressesByImportersWithoutPeers, publishedBy, time } = await resolveDependenciesOfImporters(ctx, importers);
     if (!ctx.hoistPeers) {
@@ -434,8 +436,14 @@ async function resolveDependenciesOfDependency(ctx, preferredVersions, options,
     const updateShouldContinue = options.currentDepth <= updateDepth;
     const updateRequested = updateShouldContinue &&
         ((options.updateMatching == null) ||
-            (extendedWantedDep.infoFromLockfile?.name != null &&
-                options.updateMatching(extendedWantedDep.infoFromLockfile.name, extendedWantedDep.infoFromLockfile.version)));
+            (extendedWantedDep.infoFromLockfile?.name != null
+                ? options.updateMatching(extendedWantedDep.infoFromLockfile.name, extendedWantedDep.infoFromLockfile.version)
+                // A changed specifier forgets the edge's lockfile reference before
+                // resolution (e.g. `pnpm audit --fix` widening a vulnerable pin), so
+                // the target would otherwise lose its updateRequested status — and
+                // keep its seeded lockfile pins — at the very moment it is being
+                // updated. Fall back to matching by the wanted dependency itself.
+                : wantedDependencyMatchesUpdateTarget(ctx, options.updateMatching, extendedWantedDep.wantedDependency)));
     const update = updateRequested ||
         ((extendedWantedDep.infoFromLockfile?.dependencyLockfile) == null) || Boolean((ctx.workspacePackages != null) &&
         ctx.linkWorkspacePackagesDepth !== -1 &&
@@ -557,6 +565,21 @@ async function resolveDependenciesOfDependency(ctx, preferredVersions, options,
         },
     };
 }
+/**
+ * Whether a wanted dependency without a lockfile reference matches the
+ * update target by package name. The name is parsed from the bare
+ * specifier, so an `npm:` alias matches by the real package name it
+ * installs — `foo@npm:bar@^4` matches an update target of `bar`, not
+ * `foo`. Exotic specifiers the npm parser rejects fall back to the alias.
+ */
+function wantedDependencyMatchesUpdateTarget(ctx, updateMatching, wantedDependency) {
+    const { alias, bareSpecifier } = wantedDependency;
+    const spec = alias && bareSpecifier
+        ? parseBareSpecifier(bareSpecifier, alias, ctx.defaultTag ?? 'latest', ctx.registries.default)
+        : null;
+    const name = spec?.name ?? alias;
+    return name != null && updateMatching(name, undefined);
+}
 export function createNodeIdForLinkedLocalPkg(lockfileDir, pkgDir) {
     return `link:${normalizePath(path.relative(lockfileDir, pkgDir))}`;
 }
@@ -611,7 +634,7 @@ function hasActivePackageResolutionBeforeDepth(ctx, depth) {
     }
     return false;
 }
-function claimChildrenResolution(ctx, opts) {
+export function claimChildrenResolution(ctx, opts) {
     const owner = {
         depth: opts.currentDepth,
         importerOrder: ctx.importerResolutionOrder[opts.parentIds[0]] ?? Number.MAX_SAFE_INTEGER,
@@ -657,8 +680,13 @@ function claimChildrenResolution(ctx, opts) {
     if (ctx.hoistPeers &&
         !opts.parentIds.includes(opts.pkgId) &&
         existing.missingPeersOfChildren &&
-        (existing.owner.depth >= opts.currentDepth ||
-            existing.missingPeersOfChildren.resolved)) {
+        existing.owner.depth >= opts.currentDepth) {
+        // Gating reuse on the owner's depth keeps a transitive optional peer's
+        // presence in the resolved suffix a function of graph structure, not of
+        // which occurrence happened to finish resolving first. A strictly shallower
+        // owner is excluded because its promise may still be unsettled here, and
+        // awaiting it can deadlock under auto-install-peers
+        // (https://github.com/pnpm/pnpm/issues/5454).
         missingPeersOfChildren = existing.missingPeersOfChildren;
     }
     return {
@@ -1097,6 +1125,7 @@ async function resolveDependency(wantedDependency, ctx, options) {
                 trustPolicyExclude: ctx.trustPolicyExclude,
                 trustPolicyIgnoreAfter: ctx.trustPolicyIgnoreAfter,
                 update: options.update,
+                updateRequested: options.updateRequested,
                 updateChecksums: options.updateChecksums,
                 workspacePackages: ctx.workspacePackages,
                 supportedArchitectures: options.supportedArchitectures,
@@ -1158,7 +1187,8 @@ async function resolveDependency(wantedDependency, ctx, options) {
         }
         if (ctx.allPreferredVersions && pkgResponse.body.manifest?.version) {
             if (!ctx.allPreferredVersions[pkgResponse.body.manifest.name]) {
-                ctx.allPreferredVersions[pkgResponse.body.manifest.name] = {};
+                // Null-prototype: keyed by versions from the resolved manifest.
+                ctx.allPreferredVersions[pkgResponse.body.manifest.name] = Object.create(null);
             }
             ctx.allPreferredVersions[pkgResponse.body.manifest.name][pkgResponse.body.manifest.version] = 'version';
         }
@@ -1184,6 +1214,7 @@ async function resolveDependency(wantedDependency, ctx, options) {
                 version: pkgResponse.body.manifest.version,
                 normalizedBareSpecifier: pkgResponse.body.normalizedBareSpecifier,
                 pkg: pkgResponse.body.manifest,
+                wantedDependency,
             };
         }
         let prepare;
@@ -1364,6 +1395,7 @@ async function resolveDependency(wantedDependency, ctx, options) {
             resolvedVia: pkgResponse.body.resolvedVia,
             isNew,
             nodeId,
+            wantedDependency,
             normalizedBareSpecifier: pkgResponse.body.normalizedBareSpecifier,
             missingPeersOfChildren,
             childrenResolutionId: childrenResolution.id,
@@ -1433,6 +1465,7 @@ function getResolvedPackage(options) {
         pkgIdWithPatchHash: options.pkgIdWithPatchHash,
         dev: options.wantedDependency.dev,
         fetching: options.pkgResponse.fetching,
+        resolutionNeedsFetch: options.pkgResponse.resolutionNeedsFetch,
         filesIndexFile: options.pkgResponse.filesIndexFile,
         hasBin: options.hasBin,
         hasBundledDependencies: !((options.pkg.bundledDependencies ?? options.pkg.bundleDependencies) == null),

package/lib/resolveDependencyTree.d.ts

@@ -25,6 +25,11 @@ export interface ResolvedDirectDependency {
     name: string;
     catalogLookup?: CatalogLookupMetadata;
     normalizedBareSpecifier?: string;
+    /**
+     * The wanted dependency this was resolved from, carried so consumers can
+     * recover the request directly. See `updateProjectManifest`.
+     */
+    wantedDependency?: WantedDependency;
 }
 /**
  * Information related to the catalog entry for this dependency if it was

package/lib/resolveDependencyTree.js

@@ -164,6 +164,7 @@ export async function resolveDependencyTree(importers, opts) {
                     resolution: resolvedPackage.resolution,
                     version: resolvedPackage.version,
                     normalizedBareSpecifier: dep.normalizedBareSpecifier,
+                    wantedDependency: dep.wantedDependency,
                 };
             }),
             directNodeIdsByAlias: new Map(directNonLinkedDeps.map(({ alias, nodeId }) => [alias, nodeId])),

package/lib/updateProjectManifest.js

@@ -3,19 +3,24 @@ export async function updateProjectManifest(importer, opts) {
     if (!importer.manifest) {
         throw new Error('Cannot save because no package.json found');
     }
-    const specsToUpsert = opts.directDependencies
-        .filter((rdd, index) => importer.wantedDependencies[index]?.updateSpec)
-        .map((rdd, index) => {
-        const wantedDep = importer.wantedDependencies[index];
-        return {
+    const specsToUpsert = [];
+    for (const rdd of opts.directDependencies) {
+        const wantedDep = rdd.wantedDependency;
+        if (wantedDep?.updateSpec !== true)
+            continue;
+        specsToUpsert.push({
             alias: rdd.alias,
             peer: importer.peer,
             bareSpecifier: getBareSpecifierToSave(wantedDep, rdd, opts.preserveWorkspaceProtocol),
             resolvedVersion: rdd.version,
             pinnedVersion: importer.pinnedVersion,
             saveType: importer.targetDependenciesField,
-        };
-    });
+        });
+    }
+    // Re-save a dependency flagged for update that failed to resolve (e.g. a
+    // missing optional, hence absent from `directDependencies`) carrying no
+    // specifier, so it keeps its existing version under the importer's target
+    // field (which is unset for a plain install/update, making this a no-op).
     for (const pkgToInstall of importer.wantedDependencies) {
         if (pkgToInstall.updateSpec && pkgToInstall.alias && !specsToUpsert.some(({ alias }) => alias === pkgToInstall.alias)) {
             specsToUpsert.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.2.4",
+  "version": "1100.2.6",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -10,9 +10,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/installing/deps-resolver"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/installing/deps-resolver"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/installing/deps-resolver#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/installing/deps-resolver#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -43,30 +43,30 @@
     "semver-range-intersect": "^0.3.1",
     "validate-npm-package-name": "7.0.2",
     "version-selector-type": "^3.0.0",
+    "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/config.version-policy": "1100.1.6",
+    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/constants": "1100.0.0",
     "@pnpm/core-loggers": "1100.2.1",
-    "@pnpm/deps.graph-hasher": "1100.2.5",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/fetching.pick-fetcher": "1100.0.12",
+    "@pnpm/deps.graph-hasher": "1100.2.7",
     "@pnpm/deps.peer-range": "1100.0.2",
-    "@pnpm/hooks.types": "1100.0.12",
     "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/config.version-policy": "1100.1.5",
-    "@pnpm/lockfile.preferred-versions": "1100.0.16",
-    "@pnpm/lockfile.types": "1100.0.11",
-    "@pnpm/lockfile.utils": "1100.0.13",
-    "@pnpm/patching.config": "1100.0.8",
-    "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.8",
-    "@pnpm/pkg-manifest.utils": "1100.2.5",
-    "@pnpm/resolving.npm-resolver": "1102.0.1",
-    "@pnpm/resolving.resolver-base": "1100.4.2",
-    "@pnpm/store.controller-types": "1100.1.5",
-    "@pnpm/types": "1101.3.2",
-    "@pnpm/workspace.spec-parser": "1100.0.0",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/hooks.types": "1100.1.1",
+    "@pnpm/fetching.pick-fetcher": "1100.0.14",
+    "@pnpm/lockfile.preferred-versions": "1100.0.18",
+    "@pnpm/lockfile.pruner": "1100.0.13",
+    "@pnpm/lockfile.types": "1100.0.13",
+    "@pnpm/lockfile.utils": "1100.1.1",
+    "@pnpm/patching.config": "1100.0.9",
     "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/lockfile.pruner": "1100.0.11"
+    "@pnpm/resolving.npm-resolver": "1102.1.1",
+    "@pnpm/pkg-manifest.reader": "1100.0.9",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
+    "@pnpm/pkg-manifest.utils": "1100.2.6",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/store.controller-types": "1100.1.7",
+    "@pnpm/workspace.spec-parser": "1100.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
@@ -77,8 +77,8 @@
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/validate-npm-package-name": "^4.0.2",
-    "@pnpm/installing.deps-resolver": "1100.2.4",
-    "@pnpm/logger": "1100.0.0"
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/installing.deps-resolver": "1100.2.6"
   },
   "engines": {
     "node": ">=22.13"