@pnpm/installing.deps-restorer 1101.1.10 → 1102.0.0

package/lib/index.d.ts

@@ -96,6 +96,13 @@ export interface HeadlessOptions {
     supportedArchitectures?: SupportedArchitectures;
     hoistWorkspacePackages?: boolean;
     modulesFile?: Modules | null;
+    /**
+     * Awaited right before dependency lifecycle scripts run. Lets the caller
+     * overlap lockfile verification with fetching and linking while still
+     * guaranteeing no dependency script executes on an unverified lockfile:
+     * the returned promise rejects when verification failed.
+     */
+    verifyLockfile?: () => Promise<void>;
 }
 export interface InstallationResultStats {
     added: number;

package/lib/index.js

@@ -361,6 +361,8 @@ export async function headlessInstall(opts) {
                 ...makeNodeRequireOption(path.join(opts.lockfileDir, '.pnp.cjs')),
             };
         }
+        // Dependency lifecycle scripts must not run on an unverified lockfile.
+        await opts.verifyLockfile?.();
         ignoredBuilds = (await buildModules(graph, Array.from(directNodes), {
             allowBuild,
             childConcurrency: opts.childConcurrency,
@@ -485,6 +487,10 @@ export async function headlessInstall(opts) {
     }));
     summaryLogger.debug({ prefix: lockfileDir });
     if (!opts.ignoreScripts && !opts.ignorePackageManifest && !skipPostImportLinking) {
+        // The projects' own lifecycle scripts import dependency code linked from
+        // the lockfile, so they are held to the same gate as dependency builds —
+        // also on the `enableModulesDir: false` path that skips buildModules.
+        await opts.verifyLockfile?.();
         await runLifecycleHooksConcurrently(['preinstall', 'install', 'postinstall', 'preprepare', 'prepare', 'postprepare'], projectsToBeBuilt, opts.childConcurrency ?? 5, scriptsOpts);
     }
     if ((reporter != null) && typeof reporter === 'function') {

package/lib/lockfileToHoistedDepGraph.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { packageIsInstallable } from '@pnpm/config.package-is-installable';
 import * as dp from '@pnpm/deps.path';
+import { safeJoinModulesDir } from '@pnpm/fs.symlink-dependency';
 import { hoist } from '@pnpm/installing.linking.real-hoist';
 import { nameVerFromPkgSnapshot, packageIdFromSnapshot, pkgSnapshotToResolution, } from '@pnpm/lockfile.utils';
 import { logger } from '@pnpm/logger';
@@ -134,7 +135,7 @@ async function fetchDeps(opts, modules, deps) {
             });
             return;
         }
-        const dir = path.join(modules, dep.name);
+        const dir = safeJoinModulesDir(modules, dep.name);
         const depLocation = path.relative(opts.lockfileDir, dir);
         const resolution = pkgSnapshotToResolution(depPath, pkgSnapshot, opts.registries);
         let fetchResponse;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-restorer",
-  "version": "1101.1.10",
+  "version": "1102.0.0",
   "description": "Fast installation using only pnpm-lock.yaml",
   "keywords": [
     "pnpm",
@@ -38,60 +38,60 @@
     "path-exists": "^5.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "realpath-missing": "^2.0.0",
-    "@pnpm/building.during-install": "1101.0.17",
-    "@pnpm/building.policy": "1100.0.9",
-    "@pnpm/bins.linker": "1100.0.12",
-    "@pnpm/config.package-is-installable": "1100.0.9",
-    "@pnpm/core-loggers": "1100.1.4",
+    "@pnpm/building.during-install": "1102.0.0",
+    "@pnpm/building.policy": "1100.0.10",
+    "@pnpm/config.package-is-installable": "1100.0.11",
+    "@pnpm/core-loggers": "1100.2.1",
+    "@pnpm/deps.graph-hasher": "1100.2.5",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.graph-builder": "1100.0.14",
-    "@pnpm/deps.graph-hasher": "1100.2.4",
-    "@pnpm/deps.path": "1100.0.7",
-    "@pnpm/exec.lifecycle": "1100.0.16",
+    "@pnpm/deps.graph-builder": "1100.0.16",
+    "@pnpm/bins.linker": "1100.0.14",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/fs.symlink-dependency": "1100.0.8",
-    "@pnpm/installing.linking.hoist": "1100.0.12",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.8",
-    "@pnpm/installing.linking.real-hoist": "1100.1.2",
-    "@pnpm/installing.modules-yaml": "1100.0.8",
-    "@pnpm/installing.package-requester": "1101.0.12",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.6",
-    "@pnpm/lockfile.filtering": "1100.1.5",
-    "@pnpm/lockfile.fs": "1100.1.4",
-    "@pnpm/lockfile.to-pnp": "1100.0.13",
-    "@pnpm/lockfile.utils": "1100.0.12",
-    "@pnpm/pkg-manifest.reader": "1100.0.7",
-    "@pnpm/patching.config": "1100.0.7",
-    "@pnpm/store.controller-types": "1100.1.4",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.11",
-    "@pnpm/types": "1101.3.1"
+    "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/exec.lifecycle": "1100.0.18",
+    "@pnpm/fs.symlink-dependency": "1100.0.10",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.10",
+    "@pnpm/installing.linking.hoist": "1100.0.14",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.8",
+    "@pnpm/installing.linking.real-hoist": "1100.1.3",
+    "@pnpm/installing.modules-yaml": "1100.0.9",
+    "@pnpm/installing.package-requester": "1102.0.0",
+    "@pnpm/lockfile.to-pnp": "1100.0.14",
+    "@pnpm/lockfile.fs": "1100.1.5",
+    "@pnpm/lockfile.utils": "1100.0.13",
+    "@pnpm/patching.config": "1100.0.8",
+    "@pnpm/pkg-manifest.reader": "1100.0.8",
+    "@pnpm/store.controller-types": "1100.1.5",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
+    "@pnpm/lockfile.filtering": "1100.1.7"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1",
-    "@pnpm/worker": "^1100.1.10"
+    "@pnpm/logger": "^1100.0.0",
+    "@pnpm/worker": "^1100.2.0"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
     "@types/fs-extra": "^11.0.4",
     "@types/ramda": "0.31.1",
-    "concurrently": "9.2.1",
+    "concurrently": "10.0.3",
     "isexe": "4.0.0",
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
     "write-json-file": "^7.0.0",
-    "@pnpm/assert-project": "1100.0.14",
+    "@pnpm/installing.deps-restorer": "1102.0.0",
+    "@pnpm/assert-project": "1100.0.16",
     "@pnpm/crypto.object-hasher": "1100.0.0",
-    "@pnpm/installing.read-projects-context": "1100.0.14",
-    "@pnpm/installing.deps-restorer": "1101.1.10",
+    "@pnpm/installing.read-projects-context": "1100.0.15",
+    "@pnpm/prepare": "1100.0.16",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.9",
+    "@pnpm/store.cafs": "1100.1.10",
+    "@pnpm/store.index": "1100.2.0",
     "@pnpm/store.path": "1100.0.1",
-    "@pnpm/prepare": "1100.0.14",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/store.index": "1100.1.0",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.registry-mock": "1100.0.4",
-    "@pnpm/testing.temp-store": "1100.1.7"
+    "@pnpm/testing.temp-store": "1100.1.9",
+    "@pnpm/testing.registry-mock": "1100.0.6"
   },
   "engines": {
     "node": ">=22.13"