@pnpm/lockfile.fs 1100.1.0 → 1100.1.2

package/lib/lockfileFormatConverters.js

@@ -1,5 +1,5 @@
 import { LOCKFILE_VERSION } from '@pnpm/constants';
-import { refToRelative, removeSuffix } from '@pnpm/deps.path';
+import { parse, refToRelative, removeSuffix } from '@pnpm/deps.path';
 import { DEPENDENCIES_FIELDS } from '@pnpm/types';
 import { isEmpty, map as _mapValues, omit, pick, pickBy } from 'ramda';
 // Minimal duplicate of `isGitHostedPkgUrl` from `@pnpm/fetching.pick-fetcher`,
@@ -120,12 +120,29 @@ function pruneTimeInLockfile(time, importers) {
     }
     return pickBy((_, depPath) => rootDepPaths.has(depPath), time);
 }
+// Mirrors `isFilename` in `resolving/local-resolver/src/parseBareSpecifier.ts`
+// so the directory-vs-tarball boundary applied at lockfile load time
+// matches the resolver's at resolve time.
+const LOCAL_TARBALL_RE = /\.(?:tgz|tar\.gz|tar)$/i;
 export function convertToLockfileObject(lockfile) {
     const { importers, ...rest } = lockfile;
     const packages = {};
     for (const [depPath, pkg] of Object.entries(lockfile.snapshots ?? {})) {
         const pkgId = removeSuffix(depPath);
-        packages[depPath] = Object.assign(pkg, lockfile.packages?.[pkgId]);
+        const snapshot = Object.assign(pkg, lockfile.packages?.[pkgId]);
+        // Defense-in-depth for pruned lockfiles (older `turbo prune --docker`,
+        // pre vercel/turborepo#12825): a peer-variant injected workspace
+        // snapshot whose base `packages:` entry was dropped now has a null
+        // `resolution`. Reconstruct it from the `file:` depPath — same value
+        // pnpm's writer emits — so every downstream reader sees a complete
+        // snapshot without per-reader guards.
+        if (snapshot.resolution == null) {
+            const ref = parse(depPath).nonSemverVersion;
+            if (ref != null && ref.startsWith('file:') && !LOCAL_TARBALL_RE.test(ref)) {
+                snapshot.resolution = { directory: ref.slice('file:'.length), type: 'directory' };
+            }
+        }
+        packages[depPath] = snapshot;
         enrichGitHostedFlag(packages[depPath]?.resolution);
     }
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.fs",
-  "version": "1100.1.0",
+  "version": "1100.1.2",
   "description": "Read/write pnpm-lock.yaml files",
   "keywords": [
     "pnpm",
@@ -31,21 +31,21 @@
     "js-yaml": "npm:@zkochan/js-yaml@0.0.11",
     "normalize-path": "^3.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "semver": "^7.7.2",
+    "semver": "^7.8.1",
     "strip-bom": "^5.0.0",
-    "write-file-atomic": "^7.0.0",
-    "@pnpm/deps.path": "1100.0.3",
+    "write-file-atomic": "^7.0.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/lockfile.merger": "1100.0.6",
-    "@pnpm/object.key-sorting": "1100.0.0",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/lockfile.types": "1100.0.8",
     "@pnpm/network.git-utils": "1100.0.1",
-    "@pnpm/lockfile.utils": "1100.0.8",
-    "@pnpm/types": "1101.1.0",
-    "@pnpm/lockfile.types": "1100.0.6",
-    "@pnpm/error": "1100.0.0"
+    "@pnpm/lockfile.merger": "1100.0.8",
+    "@pnpm/object.key-sorting": "1100.0.0",
+    "@pnpm/types": "1101.2.0",
+    "@pnpm/lockfile.utils": "1100.0.10",
+    "@pnpm/deps.path": "1100.0.5"
   },
   "peerDependencies": {
-    "@pnpm/logger": ">=1001.0.0 <1002.0.0"
+    "@pnpm/logger": "^1001.0.1"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -57,8 +57,8 @@
     "tempy": "3.0.0",
     "write-yaml-file": "^6.0.0",
     "yaml-tag": "1.1.0",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/lockfile.fs": "1100.1.0"
+    "@pnpm/lockfile.fs": "1100.1.2",
+    "@pnpm/logger": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"