@pnpm/lockfile.utils 1100.0.11 → 1100.0.13

package/lib/index.d.ts

@@ -4,6 +4,6 @@ export { packageIdFromSnapshot } from './packageIdFromSnapshot.js';
 export { packageIsIndependent } from './packageIsIndependent.js';
 export { pkgSnapshotToResolution } from './pkgSnapshotToResolution.js';
 export { refIsLocalDirectory, refIsLocalTarball } from './refIsLocalTarball.js';
-export { toLockfileResolution } from './toLockfileResolution.js';
+export { isGitHostedTarballUrl, toLockfileResolution } from './toLockfileResolution.js';
 export * from '@pnpm/lockfile.types';
 export declare const getPkgShortId: typeof refToRelative;

package/lib/index.js

@@ -4,7 +4,7 @@ export { packageIdFromSnapshot } from './packageIdFromSnapshot.js';
 export { packageIsIndependent } from './packageIsIndependent.js';
 export { pkgSnapshotToResolution } from './pkgSnapshotToResolution.js';
 export { refIsLocalDirectory, refIsLocalTarball } from './refIsLocalTarball.js';
-export { toLockfileResolution } from './toLockfileResolution.js';
+export { isGitHostedTarballUrl, toLockfileResolution } from './toLockfileResolution.js';
 export * from '@pnpm/lockfile.types';
 // for backward compatibility
 export const getPkgShortId = refToRelative;

package/lib/toLockfileResolution.js

@@ -15,53 +15,52 @@ export function toLockfileResolution(pkg, resolution, registry, lockfileIncludeT
     // legacy lockfiles read by callers that don't enrich the field).
     const gitHosted = resolution.gitHosted === true ||
         isGitHostedTarballUrl(tarball);
-    if (lockfileIncludeTarballUrl) {
-        return preservingGitHosted({
-            integrity: resolution['integrity'],
-            tarball,
-        }, gitHosted);
-    }
-    // Tarball URLs that cannot be reconstructed from the package name, version,
-    // and registry must always stay in the lockfile, otherwise the package can
-    // no longer be re-fetched. This covers local `file:` tarballs and tarballs
-    // served by git providers (GitHub, GitLab, Bitbucket).
-    if (tarball.startsWith('file:') || gitHosted) {
-        return preservingGitHosted({
-            integrity: resolution['integrity'],
-            tarball,
-        }, gitHosted);
-    }
-    // Sometimes packages are hosted under non-standard tarball URLs.
-    // For instance, when they are hosted on npm Enterprise. See https://github.com/pnpm/pnpm/issues/867
-    // Or in other weird cases, like https://github.com/pnpm/pnpm/issues/1072.
-    // Even when the user explicitly sets `lockfileIncludeTarballUrl: false`, we
-    // must preserve such URLs — otherwise the package cannot be re-fetched on a
-    // frozen-lockfile install (e.g. GitHub Packages tarballs at
-    // `https://npm.pkg.github.com/download/<scope>/<name>/<version>/<hash>`).
-    // `lockfileIncludeTarballUrl` only controls whether URLs that *can* be
-    // derived from name+version+registry are written.
-    const expectedTarball = getNpmTarballUrl(pkg.name, pkg.version, { registry });
-    const actualTarball = tarball.replaceAll('%2f', '/');
-    if (removeProtocol(expectedTarball) !== removeProtocol(actualTarball)) {
-        return preservingGitHosted({
-            integrity: resolution['integrity'],
-            tarball,
-        }, gitHosted);
+    // A standard registry tarball whose URL can be rebuilt from the package name,
+    // version, and registry is written as just `{ integrity }` — pnpm derives the
+    // URL on demand. Every other tarball must keep its URL or it can no longer be
+    // re-fetched on a frozen-lockfile install: `file:` tarballs, git-provider
+    // tarballs (GitHub/GitLab/Bitbucket), and non-standard registry URLs such as
+    // npm Enterprise (https://github.com/pnpm/pnpm/issues/867) or GitHub Packages
+    // `/download/` URLs. `lockfileIncludeTarballUrl` forces the URL to be kept.
+    if (!lockfileIncludeTarballUrl &&
+        !gitHosted &&
+        !tarball.startsWith('file:') &&
+        isCanonicalRegistryTarballUrl(tarball, pkg, registry)) {
+        return { integrity: resolution['integrity'] };
     }
+    // The kept-URL form carries the `gitHosted` marker and the subdirectory `path`
+    // (`repo#commit&path:/sub/dir`, only ever set on git-hosted tarballs) so a
+    // git-hosted monorepo tarball still unpacks the right subfolder.
+    // See https://github.com/pnpm/pnpm/issues/12304.
+    const { path } = resolution;
     return {
         integrity: resolution['integrity'],
+        tarball,
+        ...(gitHosted ? { gitHosted: true } : {}),
+        ...(path == null ? {} : { path }),
     };
 }
-function preservingGitHosted(resolution, gitHosted) {
-    return gitHosted ? { ...resolution, gitHosted: true } : resolution;
+// Whether `tarball` is the canonical npm registry URL derived from the package
+// name, version, and registry — i.e. it can be dropped from the lockfile and
+// rebuilt on demand. The `%2f` unescape matches the URLs npm produces for
+// scoped packages.
+function isCanonicalRegistryTarballUrl(tarball, pkg, registry) {
+    const expectedTarball = getNpmTarballUrl(pkg.name, pkg.version, { registry });
+    const actualTarball = tarball.replaceAll('%2f', '/');
+    return removeProtocol(expectedTarball) === removeProtocol(actualTarball);
 }
 // Inlined to avoid pulling @pnpm/fetching.pick-fetcher into the lockfile-utils
 // dep graph. Used as a fallback when callers haven't pre-set the
 // `gitHosted` field on TarballResolution.
 export function isGitHostedTarballUrl(url) {
-    return (url.startsWith('https://codeload.github.com/') ||
-        url.startsWith('https://bitbucket.org/') ||
-        url.startsWith('https://gitlab.com/')) && url.includes('tar.gz');
+    // Schemes and hostnames are case-insensitive, so match against a lowercased
+    // copy: a tampered `https://CODELOAD.GITHUB.COM/...` must not slip past as a
+    // non-git-hosted (and therefore registry-trusted) tarball. Only the
+    // lowercased copy is inspected; the original URL is never rewritten.
+    const lowerUrl = url.toLowerCase();
+    return (lowerUrl.startsWith('https://codeload.github.com/') ||
+        lowerUrl.startsWith('https://bitbucket.org/') ||
+        lowerUrl.startsWith('https://gitlab.com/')) && lowerUrl.includes('tar.gz');
 }
 function removeProtocol(url) {
     return url.split('://')[1];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.utils",
-  "version": "1100.0.11",
+  "version": "1100.0.13",
   "description": "Utils for dealing with pnpm-lock.yaml",
   "keywords": [
     "pnpm",
@@ -31,20 +31,20 @@
   "dependencies": {
     "get-npm-tarball-url": "^2.1.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "@pnpm/deps.path": "1100.0.6",
-    "@pnpm/hooks.types": "1100.0.10",
-    "@pnpm/resolving.resolver-base": "1100.4.0",
-    "@pnpm/lockfile.types": "1100.0.9",
+    "@pnpm/lockfile.types": "1100.0.11",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/resolving.resolver-base": "1100.4.2",
+    "@pnpm/hooks.types": "1100.0.12",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/types": "1101.3.0"
+    "@pnpm/deps.path": "1100.0.8"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
     "@types/ramda": "0.31.1",
     "tempy": "3.0.0",
     "write-yaml-file": "^6.0.0",
     "yaml-tag": "1.1.0",
-    "@pnpm/lockfile.utils": "1100.0.11"
+    "@pnpm/lockfile.utils": "1100.0.13"
   },
   "engines": {
     "node": ">=22.13"