@pnpm/lockfile.fs 1100.2.4 → 1100.2.6

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @pnpm/lockfile-file
 
+## 1100.2.6
+
+### Patch Changes
+
+- Fixed `pnpm install` failing with `ERR_PNPM_LOCKFILE_IS_SYMLINK` in a project with config dependencies when `pnpm-lock.yaml` is a symlink, as build sandboxes such as Bazel and Nix stage it. pnpm no longer rewrites the lockfile when the recorded config dependencies are unchanged. Writing changed config dependencies through a symlinked lockfile is still refused. A lockfile that starts with a byte order mark now keeps its main document when its config dependencies are updated [#14372](https://github.com/pnpm/pnpm/issues/14372).
+
+- `pnpm install` no longer lets a symlink swapped into the path of `pnpm-lock.yaml` during a config dependency update redirect the lockfile write to the symlink target [pnpm/pnpm#14322](https://github.com/pnpm/pnpm/issues/14322).
+
+- `pnpm install` now relinks workspace packages when `publishConfig.linkDirectory` changes. Frozen installs report an outdated lockfile until it is regenerated [pnpm/pnpm#14488](https://github.com/pnpm/pnpm/issues/14488).
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.4
+  - @pnpm/lockfile.merger@1100.0.22
+  - @pnpm/lockfile.types@1100.1.1
+  - @pnpm/lockfile.utils@1102.1.1
+
+## 1100.2.5
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/deps.path@1101.0.1
+  - @pnpm/lockfile.merger@1100.0.21
+  - @pnpm/lockfile.types@1100.1.0
+  - @pnpm/lockfile.utils@1102.1.0
+  - @pnpm/types@1102.1.0
+
 ## 1100.2.4
 
 ### Patch Changes

package/lib/envLockfile.d.ts

@@ -1,4 +1,8 @@
 import type { EnvLockfile } from '@pnpm/lockfile.types';
 export declare function createEnvLockfile(): EnvLockfile;
 export declare function readEnvLockfile(rootDir: string): Promise<EnvLockfile | null>;
+/**
+ * Replaces the env document that leads `pnpm-lock.yaml`, preserving the main
+ * document after it. An unchanged document is not rewritten.
+ */
 export declare function writeEnvLockfile(rootDir: string, lockfile: EnvLockfile): Promise<void>;

package/lib/envLockfile.js

@@ -1,10 +1,9 @@
 import path from 'node:path';
 import { LOCKFILE_VERSION, WANTED_LOCKFILE } from '@pnpm/constants';
 import yaml from 'js-yaml';
-import writeFileAtomic from 'write-file-atomic';
 import { sortLockfileKeys } from './sortLockfileKeys.js';
-import { lockfileYamlDump } from './write.js';
-import { extractMainDocument, readLockfileToStringNoFollow, streamReadFirstYamlDocument } from './yamlDocuments.js';
+import { lockfileYamlDump, writeWantedLockfileAtomic } from './write.js';
+import { extractMainDocument, readLockfileToString, streamReadFirstYamlDocument, YAML_DOCUMENT_SEPARATOR, YAML_DOCUMENT_START, } from './yamlDocuments.js';
 export function createEnvLockfile() {
     return {
         lockfileVersion: LOCKFILE_VERSION,
@@ -49,13 +48,19 @@ export async function readEnvLockfile(rootDir) {
     }
     return envLockfile;
 }
+/**
+ * Replaces the env document that leads `pnpm-lock.yaml`, preserving the main
+ * document after it. An unchanged document is not rewritten.
+ */
 export async function writeEnvLockfile(rootDir, lockfile) {
     const lockfilePath = path.join(rootDir, WANTED_LOCKFILE);
     const sorted = sortLockfileKeys(lockfile);
     const envYaml = lockfileYamlDump(sorted);
-    const existing = await readLockfileToStringNoFollow(lockfilePath);
+    const existing = await readLockfileToString(lockfilePath);
     const mainDoc = existing == null ? '' : extractMainDocument(existing);
-    const combined = `---\n${envYaml}\n---\n${mainDoc}`;
-    return writeFileAtomic(lockfilePath, combined);
+    const combined = `${YAML_DOCUMENT_START}${envYaml}${YAML_DOCUMENT_SEPARATOR}${mainDoc}`;
+    if (existing === combined)
+        return;
+    await writeWantedLockfileAtomic(lockfilePath, combined);
 }
 //# sourceMappingURL=envLockfile.js.map

package/lib/lockfileFormatConverters.js

@@ -63,6 +63,9 @@ function normalizeLockfile(lockfile) {
             if (importer.publishDirectory) {
                 normalizedImporter.publishDirectory = importer.publishDirectory;
             }
+            if (importer.linkDirectory === false) {
+                normalizedImporter.linkDirectory = false;
+            }
             return normalizedImporter;
         }, lockfile.importers ?? {}),
     };

package/lib/write.d.ts

@@ -13,6 +13,12 @@ export declare function writeWantedLockfile(pkgPath: string, wantedLockfile: Loc
     lockfileName?: string;
 }): Promise<LockfileObject>;
 export declare function writeCurrentLockfile(virtualStoreDir: string, currentLockfile: LockfileObject): Promise<LockfileObject | undefined>;
+/**
+ * Publishes with `rename`, not the `write-file-atomic` used elsewhere here:
+ * `rename` never resolves the final path component, so a symlink swapped in
+ * after {@link ensureLockfileIsNotSymlink} cannot redirect the write.
+ */
+export declare function writeWantedLockfileAtomic(lockfilePath: string, content: string): Promise<void>;
 export declare function writeLockfileFile(lockfilePath: string, wantedLockfile: LockfileFile): Promise<void>;
 export declare function isEmptyLockfile(lockfile: LockfileObject): boolean;
 export interface WriteLockfilesResult {

package/lib/write.js

@@ -76,7 +76,7 @@ async function writeLockfileDoc(lockfilePath, lockfileName, mainDoc) {
  * `rename` never resolves the final path component, so a symlink swapped in
  * after {@link ensureLockfileIsNotSymlink} cannot redirect the write.
  */
-async function writeWantedLockfileAtomic(lockfilePath, content) {
+export async function writeWantedLockfileAtomic(lockfilePath, content) {
     await ensureLockfileIsNotSymlink(lockfilePath);
     const targetStat = await fs.lstat(lockfilePath).catch((error) => {
         if (error.code === 'ENOENT')

package/lib/yamlDocuments.d.ts

@@ -8,7 +8,6 @@ export declare const YAML_DOCUMENT_START = "---\n";
  */
 export declare function streamReadFirstYamlDocument(filePath: string, readBufferSize?: number): Promise<string | null>;
 export declare function readLockfileToString(filePath: string): Promise<string | null>;
-export declare function readLockfileToStringNoFollow(filePath: string): Promise<string | null>;
 /**
  * Refuses a symlinked lockfile before a write, which would land on the link's
  * target — any file the user can write. Reads may follow it: sandboxes stage

package/lib/yamlDocuments.js

@@ -7,7 +7,6 @@ import stripBom from 'strip-bom';
 export const YAML_DOCUMENT_SEPARATOR = '\n---\n';
 export const YAML_DOCUMENT_START = '---\n';
 const READ_BUFFER_SIZE = 64 * 1024;
-const LOCKFILE_READ_FLAGS = constants.O_RDONLY | (process.platform === 'win32' ? 0 : constants.O_NOFOLLOW);
 /**
  * Reads the first YAML document from a multi-document YAML file using streaming.
  * The file must start with "---\n" to indicate it contains an env lockfile document.
@@ -74,34 +73,6 @@ export async function readLockfileToString(filePath) {
         throw err;
     }
 }
-export async function readLockfileToStringNoFollow(filePath) {
-    let fileHandle;
-    try {
-        fileHandle = await openLockfileNoFollow(filePath);
-        return await fileHandle.readFile('utf8');
-    }
-    catch (err) {
-        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ENOENT') {
-            return null;
-        }
-        throw err;
-    }
-    finally {
-        await fileHandle?.close().catch(() => { });
-    }
-}
-async function openLockfileNoFollow(filePath) {
-    await ensureLockfileIsNotSymlink(filePath);
-    try {
-        return await open(filePath, LOCKFILE_READ_FLAGS);
-    }
-    catch (err) {
-        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ELOOP') {
-            throw symlinkedLockfileError(filePath);
-        }
-        throw err;
-    }
-}
 /**
  * Refuses a symlinked lockfile before a write, which would land on the link's
  * target — any file the user can write. Reads may follow it: sandboxes stage

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.fs",
-  "version": "1100.2.4",
+  "version": "1100.2.6",
   "description": "Read/write pnpm-lock.yaml files",
   "keywords": [
     "pnpm",
@@ -30,14 +30,14 @@
   ],
   "dependencies": {
     "@pnpm/constants": "1102.0.0",
-    "@pnpm/deps.path": "1101.0.0",
-    "@pnpm/error": "1100.1.3",
-    "@pnpm/lockfile.merger": "1100.0.20",
-    "@pnpm/lockfile.types": "1100.0.20",
-    "@pnpm/lockfile.utils": "1102.0.0",
+    "@pnpm/deps.path": "1101.0.1",
+    "@pnpm/error": "1100.1.4",
+    "@pnpm/lockfile.merger": "1100.0.22",
+    "@pnpm/lockfile.types": "1100.1.1",
+    "@pnpm/lockfile.utils": "1102.1.1",
     "@pnpm/network.git-utils": "1100.0.3",
     "@pnpm/object.key-sorting": "1100.0.2",
-    "@pnpm/types": "1102.0.0",
+    "@pnpm/types": "1102.1.0",
     "@zkochan/rimraf": "^4.0.0",
     "comver-to-semver": "^2.0.0",
     "js-yaml": "npm:@zkochan/js-yaml@0.0.11",
@@ -52,7 +52,7 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/lockfile.fs": "1100.2.4",
+    "@pnpm/lockfile.fs": "1100.2.6",
     "@pnpm/logger": "1100.0.0",
     "@types/js-yaml": "^4.0.9",
     "@types/normalize-path": "^3.0.2",