@pnpm/installing.deps-resolver 1100.2.5 → 1100.2.7

package/lib/index.js

@@ -3,6 +3,7 @@ import { packageManifestLogger, } from '@pnpm/core-loggers';
 import { findRuntimeNodeVersion, iterateHashedGraphNodes } from '@pnpm/deps.graph-hasher';
 import { isRuntimeDepPath } from '@pnpm/deps.path';
 import { PnpmError } from '@pnpm/error';
+import { safeJoinModulesDir } from '@pnpm/fs.symlink-dependency';
 import { verifyPatches } from '@pnpm/patching.config';
 import { safeReadPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
 import { getAllDependenciesFromManifest, getSpecFromPackageManifest, } from '@pnpm/pkg-manifest.utils';
@@ -90,6 +91,7 @@ export async function resolveDependencies(importers, opts) {
                 ...project.wantedDependencies.flatMap(({ alias, isNew }) => isNew && alias != null ? [alias] : []),
             ]),
             directNodeIdsByAlias: resolvedImporter.directNodeIdsByAlias,
+            hoistedPeerProviderNodeIds: resolvedImporter.hoistedPeerProviderNodeIds,
             explicitlyRequestedDirectDependencies: new Set(project.wantedDependencies.flatMap(({ alias, bareSpecifier, isNew, prevSpecifier, updateSpec }) => alias != null && (isNew === true || updateSpec === true || (prevSpecifier != null && bareSpecifier !== prevSpecifier))
                 ? [alias]
                 : [])),
@@ -403,7 +405,7 @@ function extendGraph(graph, opts) {
         const node = graph[depPath];
         Object.assign(node, {
             modules,
-            dir: path.join(modules, node.name),
+            dir: safeJoinModulesDir(modules, node.name),
         });
     }
     return graph;

package/lib/resolveDependencies.d.ts

@@ -191,6 +191,13 @@ export interface PkgAddress extends PkgAddressOrLinkBase {
     saveCatalogName?: string;
     lockedPeerContext?: LockedPeerContext;
     previousDepPath?: DepPath;
+    /**
+     * A peer dependency provider attached to the root importer so that other
+     * subtrees can reuse it. Its `nodeId` keeps pointing at the provider's
+     * original position inside the dependency tree, so the node must be
+     * peer-resolved there — not in the root context.
+     */
+    hoistedPeerProvider?: boolean;
 }
 export type PkgAddressOrLink = PkgAddress | LinkedDependency;
 export interface PeerDependency {

package/lib/resolveDependencies.js

@@ -8,6 +8,7 @@ import { nameVerFromPkgSnapshot, pkgSnapshotToResolution, } from '@pnpm/lockfile
 import { logger } from '@pnpm/logger';
 import { getPatchInfo } from '@pnpm/patching.config';
 import { convertEnginesRuntimeToDependencies } from '@pnpm/pkg-manifest.utils';
+import { parseBareSpecifier } from '@pnpm/resolving.npm-resolver';
 import { DIRECT_DEP_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
 import { lexCompare } from '@pnpm/util.lex-comparator';
 import normalizePath from 'normalize-path';
@@ -23,6 +24,7 @@ import { safeIntersect } from './mergePeers.js';
 import { nextNodeId } from './nextNodeId.js';
 import { parentIdsContainSequence } from './parentIdsContainSequence.js';
 import { replaceVersionInBareSpecifier } from './replaceVersionInBareSpecifier.js';
+import { unwrapPackageName } from './unwrapPackageName.js';
 import { wantedDepIsLocallyAvailable } from './wantedDepIsLocallyAvailable.js';
 const dependencyResolvedLogger = logger('_dependency_resolved');
 const omitDepsFields = omit(['dependencies', 'optionalDependencies', 'peerDependencies', 'peerDependenciesMeta']);
@@ -39,7 +41,8 @@ export async function resolveRootDependencies(ctx, importers) {
         ctx.allPreferredVersions = getPreferredVersionsFromLockfileAndManifests(ctx.wantedLockfile.packages, []);
     }
     else if (ctx.hoistPeers) {
-        ctx.allPreferredVersions = {};
+        // Null-prototype: keyed by package names from resolved manifests.
+        ctx.allPreferredVersions = Object.create(null);
     }
     const { pkgAddressesByImportersWithoutPeers, publishedBy, time } = await resolveDependenciesOfImporters(ctx, importers);
     if (!ctx.hoistPeers) {
@@ -87,7 +90,10 @@ export async function resolveRootDependencies(ctx, importers) {
                     // even those peers should be hoisted that are not autoinstalled
                     for (const [resolvedPeerName, resolvedPeerAddress] of Object.entries(importerResolutionResult.resolvedPeers ?? {})) {
                         if (!parentPkgAliases[resolvedPeerName]) {
-                            importerResolutionResult.pkgAddresses.push(resolvedPeerAddress);
+                            importerResolutionResult.pkgAddresses.push({
+                                ...resolvedPeerAddress,
+                                hoistedPeerProvider: true,
+                            });
                         }
                     }
                 }
@@ -434,8 +440,14 @@ async function resolveDependenciesOfDependency(ctx, preferredVersions, options,
     const updateShouldContinue = options.currentDepth <= updateDepth;
     const updateRequested = updateShouldContinue &&
         ((options.updateMatching == null) ||
-            (extendedWantedDep.infoFromLockfile?.name != null &&
-                options.updateMatching(extendedWantedDep.infoFromLockfile.name, extendedWantedDep.infoFromLockfile.version)));
+            (extendedWantedDep.infoFromLockfile?.name != null
+                ? options.updateMatching(extendedWantedDep.infoFromLockfile.name, extendedWantedDep.infoFromLockfile.version)
+                // A changed specifier forgets the edge's lockfile reference before
+                // resolution (e.g. `pnpm audit --fix` widening a vulnerable pin), so
+                // the target would otherwise lose its updateRequested status — and
+                // keep its seeded lockfile pins — at the very moment it is being
+                // updated. Fall back to matching by the wanted dependency itself.
+                : wantedDependencyMatchesUpdateTarget(ctx, options.updateMatching, extendedWantedDep.wantedDependency)));
     const update = updateRequested ||
         ((extendedWantedDep.infoFromLockfile?.dependencyLockfile) == null) || Boolean((ctx.workspacePackages != null) &&
         ctx.linkWorkspacePackagesDepth !== -1 &&
@@ -557,6 +569,21 @@ async function resolveDependenciesOfDependency(ctx, preferredVersions, options,
         },
     };
 }
+/**
+ * Whether a wanted dependency without a lockfile reference matches the
+ * update target by package name. The name is parsed from the bare
+ * specifier, so an `npm:` alias matches by the real package name it
+ * installs — `foo@npm:bar@^4` matches an update target of `bar`, not
+ * `foo`. Exotic specifiers the npm parser rejects fall back to the alias.
+ */
+function wantedDependencyMatchesUpdateTarget(ctx, updateMatching, wantedDependency) {
+    const { alias, bareSpecifier } = wantedDependency;
+    const spec = alias && bareSpecifier
+        ? parseBareSpecifier(bareSpecifier, alias, ctx.defaultTag ?? 'latest', ctx.registries.default)
+        : null;
+    const name = spec?.name ?? alias;
+    return name != null && updateMatching(name, undefined);
+}
 export function createNodeIdForLinkedLocalPkg(lockfileDir, pkgDir) {
     return `link:${normalizePath(path.relative(lockfileDir, pkgDir))}`;
 }
@@ -1102,6 +1129,7 @@ async function resolveDependency(wantedDependency, ctx, options) {
                 trustPolicyExclude: ctx.trustPolicyExclude,
                 trustPolicyIgnoreAfter: ctx.trustPolicyIgnoreAfter,
                 update: options.update,
+                updateRequested: options.updateRequested,
                 updateChecksums: options.updateChecksums,
                 workspacePackages: ctx.workspacePackages,
                 supportedArchitectures: options.supportedArchitectures,
@@ -1122,14 +1150,21 @@ async function resolveDependency(wantedDependency, ctx, options) {
                 version: wantedDependency.alias ? wantedDependency.bareSpecifier : undefined,
             };
             if (wantedDependency.optional && err.code !== 'ERR_PNPM_TRUST_DOWNGRADE') {
-                skippedOptionalDependencyLogger.debug({
-                    details: err.toString(),
-                    package: wantedDependencyDetails,
-                    parents: getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById),
-                    prefix: options.prefix,
-                    reason: 'resolution_failure',
-                });
-                return null;
+                if (!wantedLockfileContainsSatisfyingEntry(ctx.wantedLockfile, wantedDependency)) {
+                    skippedOptionalDependencyLogger.debug({
+                        details: err.toString(),
+                        package: wantedDependencyDetails,
+                        parents: getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById),
+                        prefix: options.prefix,
+                        reason: 'resolution_failure',
+                    });
+                    return null;
+                }
+                if (err.hint == null) {
+                    err.hint = 'This optional dependency is not skipped, because the lockfile contains a resolution for it. ' +
+                        'Skipping it would remove the locked entries, making the lockfile differ depending on which machine ran the install. ' +
+                        'If the version was intentionally removed from the registry, update the dependent package or remove the entries from the lockfile.';
+                }
             }
             err.package = wantedDependencyDetails;
             err.prefix = options.prefix;
@@ -1163,7 +1198,8 @@ async function resolveDependency(wantedDependency, ctx, options) {
         }
         if (ctx.allPreferredVersions && pkgResponse.body.manifest?.version) {
             if (!ctx.allPreferredVersions[pkgResponse.body.manifest.name]) {
-                ctx.allPreferredVersions[pkgResponse.body.manifest.name] = {};
+                // Null-prototype: keyed by versions from the resolved manifest.
+                ctx.allPreferredVersions[pkgResponse.body.manifest.name] = Object.create(null);
             }
             ctx.allPreferredVersions[pkgResponse.body.manifest.name][pkgResponse.body.manifest.version] = 'version';
         }
@@ -1392,6 +1428,39 @@ async function resolveDependency(wantedDependency, ctx, options) {
         finishPackageResolution();
     }
 }
+/**
+ * Whether the wanted lockfile already holds a package entry that satisfies the
+ * wanted dependency. An optional dependency that fails to resolve is normally
+ * skipped, but when a locked resolution exists the failure is environmental
+ * (e.g. a registry mirror that hasn't synced the release yet) rather than a
+ * genuinely uninstallable package. Silently skipping in that case would erase
+ * the locked entries, making the lockfile differ across machines from
+ * identical inputs and leaving frozen installs on other hosts with nothing to
+ * link (https://github.com/pnpm/pnpm/issues/12853).
+ *
+ * Only plain semver specifiers are checked; exotic specifiers (git, catalogs,
+ * tags, URLs) keep the skip-on-failure behavior.
+ *
+ * The check is deliberately by package name and range rather than by the
+ * current edge's locked dep path. `pnpm dedupe` — the flow where the erasure
+ * bites — clears every per-snapshot dependency map before resolving
+ * (`forgetResolutionsOfAllPrevWantedDeps`), so on this code path no edge-level
+ * lockfile linkage exists to key on; only the package entries survive. A
+ * satisfying entry locked via any edge also means the registry served this
+ * package in-range before, so failing loudly instead of skipping is the right
+ * outcome even when the failing edge itself was never locked.
+ */
+function wantedLockfileContainsSatisfyingEntry(lockfile, wantedDependency) {
+    if (!wantedDependency.alias)
+        return false;
+    const { pkgName, bareSpecifier } = unwrapPackageName(wantedDependency.alias, wantedDependency.bareSpecifier);
+    if (semver.validRange(bareSpecifier) == null)
+        return false;
+    return Object.keys(lockfile.packages ?? {}).some((depPath) => {
+        const parsed = dp.parse(depPath);
+        return parsed.name === pkgName && parsed.version != null && semver.satisfies(parsed.version, bareSpecifier);
+    });
+}
 export function getManifestFromResponse(pkgResponse, wantedDependency, currentPkg) {
     if (pkgResponse.body.manifest)
         return pkgResponse.body.manifest;

package/lib/resolveDependencyTree.d.ts

@@ -12,6 +12,7 @@ export interface ResolvedImporters {
     [id: string]: {
         directDependencies: ResolvedDirectDependency[];
         directNodeIdsByAlias: Map<string, NodeId>;
+        hoistedPeerProviderNodeIds: Set<NodeId>;
         linkedDependencies: LinkedDependency[];
     };
 }

package/lib/resolveDependencyTree.js

@@ -168,6 +168,7 @@ export async function resolveDependencyTree(importers, opts) {
                 };
             }),
             directNodeIdsByAlias: new Map(directNonLinkedDeps.map(({ alias, nodeId }) => [alias, nodeId])),
+            hoistedPeerProviderNodeIds: new Set(directNonLinkedDeps.filter((dep) => dep.hoistedPeerProvider).map(({ nodeId }) => nodeId)),
             linkedDependencies,
         };
     }

package/lib/resolvePeers.d.ts

@@ -30,6 +30,7 @@ export interface GenericDependenciesGraphWithResolvedChildren<T extends PartialR
 }
 export interface ProjectToResolve {
     directNodeIdsByAlias: Map<string, NodeId>;
+    hoistedPeerProviderNodeIds?: Set<NodeId>;
     declaredDirectDependencies?: Set<string>;
     explicitlyRequestedDirectDependencies?: Set<string>;
     topParents: Array<{

package/lib/resolvePeers.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { createPeerDepGraphHash, depPathToFilename, parseDepPath } from '@pnpm/deps.path';
+import { safeJoinModulesDir } from '@pnpm/fs.symlink-dependency';
 import * as semverUtils from '@yarnpkg/core/semverUtils';
 import { analyzeGraph } from 'graph-cycles';
 import pDefer, {} from 'p-defer';
@@ -25,7 +26,7 @@ export async function resolvePeers(opts) {
     const finishingList = [];
     const peersCache = new Map();
     const purePkgs = new Set();
-    for (const { directNodeIdsByAlias, declaredDirectDependencies, explicitlyRequestedDirectDependencies, topParents, rootDir, id } of opts.projects) {
+    for (const { directNodeIdsByAlias, hoistedPeerProviderNodeIds, declaredDirectDependencies, explicitlyRequestedDirectDependencies, topParents, rootDir, id } of opts.projects) {
         const currentProviderSources = [{
                 directNodeIdsByAlias,
                 declaredDirectDependencies: declaredDirectDependencies ?? new Set(),
@@ -48,10 +49,26 @@ export async function resolvePeers(opts) {
                 pathsByNodeIdPromises.set(nodeId, pDefer());
             }
         }
-        // eslint-disable-next-line no-await-in-loop
-        const { finishing } = await resolvePeersOfChildren(Object.fromEntries(directNodeIdsByAlias.entries()), pkgsByName, {
+        // Hoisted peer providers stay visible as providers (via pkgsByName) but are
+        // not traversed as direct children: their nodeIds point into subtrees, and
+        // resolving them a second time in the project's root context would bind
+        // their peers to the project's own dependencies instead of the providers
+        // next to them in the tree, racing with the in-place resolution on
+        // pathsByNodeId and producing peer graphs that mix both contexts.
+        const ownDirectChildren = {};
+        const hoistedProviderChildren = {};
+        for (const [alias, nodeId] of directNodeIdsByAlias.entries()) {
+            if (hoistedPeerProviderNodeIds?.has(nodeId)) {
+                hoistedProviderChildren[alias] = nodeId;
+            }
+            else {
+                ownDirectChildren[alias] = nodeId;
+            }
+        }
+        const parentPkgsOfNode = new Map();
+        const projectPeersContext = {
             allPeerDepNames: opts.allPeerDepNames,
-            parentPkgsOfNode: new Map(),
+            parentPkgsOfNode,
             dependenciesTree: opts.dependenciesTree,
             depGraph,
             lockfileDir: opts.lockfileDir,
@@ -71,10 +88,33 @@ export async function resolvePeers(opts) {
             rootDir,
             virtualStoreDir: opts.virtualStoreDir,
             virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
-        });
+        };
+        // eslint-disable-next-line no-await-in-loop
+        const { finishing } = await resolvePeersOfChildren(ownDirectChildren, pkgsByName, projectPeersContext);
         if (finishing) {
             finishingList.push(finishing);
         }
+        // A provider whose tree position was pruned from the traversal (its parent
+        // hit peersCache, so its children were never visited) still has consumers
+        // awaiting its dep path, so resolve it here as a last resort. Providers
+        // visited by the traversal above are recorded in parentPkgsOfNode.
+        // All pruned providers go into a single resolvePeersOfChildren call:
+        // its cycle analysis only sees the children of one call, and providers
+        // frequently peer-depend on each other, so resolving them one by one
+        // would leave their dep path calculations awaiting each other forever.
+        const prunedProviderChildren = {};
+        for (const [alias, nodeId] of Object.entries(hoistedProviderChildren)) {
+            if (parentPkgsOfNode.has(nodeId))
+                continue;
+            prunedProviderChildren[alias] = nodeId;
+        }
+        if (Object.keys(prunedProviderChildren).length > 0) {
+            // eslint-disable-next-line no-await-in-loop
+            const { finishing } = await resolvePeersOfChildren(prunedProviderChildren, pkgsByName, projectPeersContext);
+            if (finishing) {
+                finishingList.push(finishing);
+            }
+        }
         if (Object.keys(peerDependencyIssues.bad).length > 0 || Object.keys(peerDependencyIssues.missing).length > 0) {
             peerDependencyIssuesByProjects[id] = {
                 ...peerDependencyIssues,
@@ -501,7 +541,7 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
         const peerDependencies = { ...resolvedPackage.peerDependencies };
         if (!ctx.depGraph[depPath] || ctx.depGraph[depPath].depth > node.depth) {
             const modules = path.join(ctx.virtualStoreDir, depPathToFilename(depPath, ctx.virtualStoreDirMaxLength), 'node_modules');
-            const dir = path.join(modules, resolvedPackage.name);
+            const dir = safeJoinModulesDir(modules, resolvedPackage.name);
             const transitivePeerDependencies = new Set();
             for (const unknownPeer of allResolvedPeers.keys()) {
                 if (!peerDependencies[unknownPeer]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.2.5",
+  "version": "1100.2.7",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -44,28 +44,29 @@
     "validate-npm-package-name": "7.0.2",
     "version-selector-type": "^3.0.0",
     "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/config.version-policy": "1100.1.6",
+    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/constants": "1100.0.0",
+    "@pnpm/deps.graph-hasher": "1100.2.8",
     "@pnpm/core-loggers": "1100.2.1",
-    "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/deps.graph-hasher": "1100.2.6",
     "@pnpm/deps.peer-range": "1100.0.2",
+    "@pnpm/deps.path": "1100.0.8",
     "@pnpm/error": "1100.0.1",
-    "@pnpm/fetching.pick-fetcher": "1100.0.13",
-    "@pnpm/hooks.types": "1100.1.0",
-    "@pnpm/lockfile.preferred-versions": "1100.0.17",
-    "@pnpm/lockfile.pruner": "1100.0.12",
-    "@pnpm/lockfile.types": "1100.0.12",
-    "@pnpm/lockfile.utils": "1100.1.0",
-    "@pnpm/patching.config": "1100.0.9",
+    "@pnpm/fetching.pick-fetcher": "1100.0.14",
+    "@pnpm/hooks.types": "1100.1.1",
+    "@pnpm/lockfile.preferred-versions": "1100.0.18",
+    "@pnpm/lockfile.pruner": "1100.0.13",
+    "@pnpm/fs.symlink-dependency": "1100.0.10",
+    "@pnpm/lockfile.types": "1100.0.13",
+    "@pnpm/lockfile.utils": "1100.1.1",
     "@pnpm/patching.types": "1100.0.0",
     "@pnpm/pkg-manifest.reader": "1100.0.9",
     "@pnpm/pkg-manifest.utils": "1100.2.6",
-    "@pnpm/resolving.resolver-base": "1100.5.0",
-    "@pnpm/store.controller-types": "1100.1.6",
-    "@pnpm/resolving.npm-resolver": "1102.1.0",
+    "@pnpm/resolving.npm-resolver": "1102.1.2",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
+    "@pnpm/store.controller-types": "1100.1.7",
     "@pnpm/types": "1101.3.2",
+    "@pnpm/patching.config": "1100.0.9",
     "@pnpm/workspace.spec-parser": "1100.0.0"
   },
   "peerDependencies": {
@@ -77,7 +78,7 @@
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/validate-npm-package-name": "^4.0.2",
-    "@pnpm/installing.deps-resolver": "1100.2.5",
+    "@pnpm/installing.deps-resolver": "1100.2.7",
     "@pnpm/logger": "1100.0.0"
   },
   "engines": {