@pnpm/lockfile.fs 1100.0.4 → 1100.0.5

package/lib/lockfileFormatConverters.js

@@ -2,6 +2,16 @@ import { LOCKFILE_VERSION } from '@pnpm/constants';
 import { refToRelative, removeSuffix } from '@pnpm/deps.path';
 import { DEPENDENCIES_FIELDS } from '@pnpm/types';
 import { isEmpty, map as _mapValues, omit, pick, pickBy } from 'ramda';
+// Minimal duplicate of `isGitHostedPkgUrl` from `@pnpm/fetching.pick-fetcher`,
+// inlined to avoid pulling the fetcher dep into the lockfile I/O layer. Used
+// to enrich entries written by older pnpm versions (which didn't record the
+// `gitHosted` field on TarballResolution) so every downstream reader can rely
+// on the field directly.
+function isGitHostedTarballUrl(url) {
+    return (url.startsWith('https://codeload.github.com/') ||
+        url.startsWith('https://bitbucket.org/') ||
+        url.startsWith('https://gitlab.com/')) && url.includes('tar.gz');
+}
 export function convertToLockfileFile(lockfile) {
     const packages = {};
     const snapshots = {};
@@ -116,6 +126,7 @@ export function convertToLockfileObject(lockfile) {
     for (const [depPath, pkg] of Object.entries(lockfile.snapshots ?? {})) {
         const pkgId = removeSuffix(depPath);
         packages[depPath] = Object.assign(pkg, lockfile.packages?.[pkgId]);
+        enrichGitHostedFlag(packages[depPath]?.resolution);
     }
     return {
         ...omit(['snapshots'], rest),
@@ -124,6 +135,20 @@ export function convertToLockfileObject(lockfile) {
         importers: mapValues(importers ?? {}, revertProjectSnapshot),
     };
 }
+// Backfill the `gitHosted` flag for tarball resolutions written by older
+// pnpm versions. Doing it once at load time lets every downstream reader
+// rely on the typed field instead of repeating URL prefix matches.
+function enrichGitHostedFlag(resolution) {
+    if (resolution == null)
+        return;
+    if (resolution.type !== undefined)
+        return;
+    if (resolution.gitHosted != null)
+        return;
+    if (resolution.tarball != null && isGitHostedTarballUrl(resolution.tarball)) {
+        resolution.gitHosted = true;
+    }
+}
 function migratePatchedDependencies(patchedDependencies) {
     if (!patchedDependencies)
         return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.fs",
-  "version": "1100.0.4",
+  "version": "1100.0.5",
   "description": "Read/write pnpm-lock.yaml files",
   "keywords": [
     "pnpm",
@@ -31,21 +31,21 @@
     "js-yaml": "npm:@zkochan/js-yaml@0.0.11",
     "normalize-path": "^3.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "semver": "^7.7.2",
+    "semver": "^7.7.4",
     "strip-bom": "^5.0.0",
-    "write-file-atomic": "^7.0.0",
+    "write-file-atomic": "^7.0.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.2",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/lockfile.merger": "1100.0.3",
-    "@pnpm/lockfile.types": "1100.0.3",
-    "@pnpm/network.git-utils": "1100.0.1",
+    "@pnpm/lockfile.types": "1100.0.4",
+    "@pnpm/deps.path": "1100.0.2",
+    "@pnpm/lockfile.merger": "1100.0.4",
+    "@pnpm/lockfile.utils": "1100.0.5",
     "@pnpm/object.key-sorting": "1100.0.0",
-    "@pnpm/types": "1101.0.0",
-    "@pnpm/lockfile.utils": "1100.0.4"
+    "@pnpm/network.git-utils": "1100.0.1",
+    "@pnpm/types": "1101.0.0"
   },
   "peerDependencies": {
-    "@pnpm/logger": ">=1001.0.0 <1002.0.0"
+    "@pnpm/logger": "^1001.0.1"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -57,8 +57,8 @@
     "tempy": "3.0.0",
     "write-yaml-file": "^6.0.0",
     "yaml-tag": "1.1.0",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/lockfile.fs": "1100.0.4"
+    "@pnpm/lockfile.fs": "1100.0.5",
+    "@pnpm/logger": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"