@pnpm/lockfile.utils 1100.0.13 → 1100.1.0

package/lib/index.d.ts

@@ -4,6 +4,7 @@ export { packageIdFromSnapshot } from './packageIdFromSnapshot.js';
 export { packageIsIndependent } from './packageIsIndependent.js';
 export { pkgSnapshotToResolution } from './pkgSnapshotToResolution.js';
 export { refIsLocalDirectory, refIsLocalTarball } from './refIsLocalTarball.js';
-export { isGitHostedTarballUrl, toLockfileResolution } from './toLockfileResolution.js';
+export { toLockfileResolution } from './toLockfileResolution.js';
 export * from '@pnpm/lockfile.types';
+export { isGitHostedTarballUrl } from '@pnpm/resolving.resolver-base';
 export declare const getPkgShortId: typeof refToRelative;

package/lib/index.js

@@ -4,8 +4,9 @@ export { packageIdFromSnapshot } from './packageIdFromSnapshot.js';
 export { packageIsIndependent } from './packageIsIndependent.js';
 export { pkgSnapshotToResolution } from './pkgSnapshotToResolution.js';
 export { refIsLocalDirectory, refIsLocalTarball } from './refIsLocalTarball.js';
-export { isGitHostedTarballUrl, toLockfileResolution } from './toLockfileResolution.js';
+export { toLockfileResolution } from './toLockfileResolution.js';
 export * from '@pnpm/lockfile.types';
+export { isGitHostedTarballUrl } from '@pnpm/resolving.resolver-base';
 // for backward compatibility
 export const getPkgShortId = refToRelative;
 //# sourceMappingURL=index.js.map

package/lib/pkgSnapshotToResolution.js

@@ -1,38 +1,21 @@
 import url from 'node:url';
 import * as dp from '@pnpm/deps.path';
 import { PnpmError } from '@pnpm/error';
-import getNpmTarballUrl from 'get-npm-tarball-url';
+import { getNpmTarballUrl } from '@pnpm/resolving.tarball-url';
 import { nameVerFromPkgSnapshot } from './nameVerFromPkgSnapshot.js';
-import { isGitHostedTarballUrl } from './toLockfileResolution.js';
 export function pkgSnapshotToResolution(depPath, pkgSnapshot, registries) {
     const resolution = pkgSnapshot.resolution;
-    // Tarball-shaped resolutions (no `type` field) must carry `integrity`,
-    // except where the URL itself anchors the bytes:
-    //   - `file:` tarballs (local file on the user's machine; integrity
-    //     adds nothing the user doesn't already control).
-    //   - Git-hosted tarballs (URL contains the commit SHA; git's content-
-    //     addressed model binds the bytes to the commit). The `gitHosted`
-    //     flag may be absent on legacy lockfiles, so fall back to a URL
-    //     match — same logic as `toLockfileResolution`.
-    // For any other tarball entry a missing integrity is what a tampered
-    // lockfile looks like: the worker would mint a fresh integrity from
-    // whatever bytes the URL returned, so we fail closed here. Pacquet
-    // enforces the same invariant via
-    // `pacquet_package_manager::missing_tarball_integrity`.
-    if (resolution.type == null &&
-        resolution.integrity == null &&
-        !resolution.tarball?.startsWith('file:') &&
-        !(resolution.gitHosted === true || (resolution.tarball != null && isGitHostedTarballUrl(resolution.tarball)))) {
-        throw new PnpmError('MISSING_TARBALL_INTEGRITY', `Cannot install package "${depPath}": its lockfile entry has no "integrity" field, so pnpm cannot verify the downloaded tarball.`, { hint: 'The lockfile may be corrupted or have been tampered with. Restore it from a trusted source, or delete it and re-run installation without --frozen-lockfile to regenerate.' });
+    if (resolution.tarball != null && typeof resolution.tarball !== 'string') {
+        // Avoid URL string-coercion from malformed YAML lockfile values.
+        throw new PnpmError('INVALID_TARBALL_RESOLUTION', `Cannot install package "${depPath}": its lockfile entry has a non-string "tarball" field.`);
     }
     if (Boolean(resolution.type) ||
         resolution.tarball?.startsWith('file:') ||
         resolution.gitHosted === true) {
         return pkgSnapshot.resolution;
     }
-    // Recover the tarball field for `file:` snapshots whose resolution lost
-    // its tarball (e.g. lockfiles written by an earlier pnpm 11 version that
-    // dropped the tarball under `lockfile-include-tarball-url=false`).
+    // Recover the tarball field for `file:` snapshots whose depPath is the only
+    // source of the local tarball reference.
     const nonSemverVersion = dp.parse(depPath).nonSemverVersion;
     if (nonSemverVersion?.startsWith('file:')) {
         return {
@@ -51,11 +34,11 @@ export function pkgSnapshotToResolution(depPath, pkgSnapshot, registries) {
         registry = registries.default;
     }
     let tarball;
-    if (!pkgSnapshot.resolution.tarball) {
+    if (!resolution.tarball) {
         tarball = getTarball(registry);
     }
     else {
-        tarball = new url.URL(pkgSnapshot.resolution.tarball, registry.endsWith('/') ? registry : `${registry}/`).toString();
+        tarball = new url.URL(resolution.tarball, registry.endsWith('/') ? registry : `${registry}/`).toString();
     }
     return {
         ...pkgSnapshot.resolution,

package/lib/toLockfileResolution.d.ts

@@ -1,7 +1,6 @@
 import type { LockfileResolution } from '@pnpm/lockfile.types';
-import type { Resolution } from '@pnpm/resolving.resolver-base';
+import { type Resolution } from '@pnpm/resolving.resolver-base';
 export declare function toLockfileResolution(pkg: {
     name: string;
     version: string;
 }, resolution: Resolution, registry: string, lockfileIncludeTarballUrl?: boolean): LockfileResolution;
-export declare function isGitHostedTarballUrl(url: string): boolean;

package/lib/toLockfileResolution.js

@@ -1,4 +1,5 @@
-import getNpmTarballUrl from 'get-npm-tarball-url';
+import { isGitHostedTarballUrl } from '@pnpm/resolving.resolver-base';
+import { isCanonicalRegistryTarballUrl } from '@pnpm/resolving.tarball-url';
 export function toLockfileResolution(pkg, resolution, registry, lockfileIncludeTarballUrl) {
     if (resolution.type !== undefined || !resolution['integrity']) {
         return resolution;
@@ -40,29 +41,4 @@ export function toLockfileResolution(pkg, resolution, registry, lockfileIncludeT
         ...(path == null ? {} : { path }),
     };
 }
-// Whether `tarball` is the canonical npm registry URL derived from the package
-// name, version, and registry — i.e. it can be dropped from the lockfile and
-// rebuilt on demand. The `%2f` unescape matches the URLs npm produces for
-// scoped packages.
-function isCanonicalRegistryTarballUrl(tarball, pkg, registry) {
-    const expectedTarball = getNpmTarballUrl(pkg.name, pkg.version, { registry });
-    const actualTarball = tarball.replaceAll('%2f', '/');
-    return removeProtocol(expectedTarball) === removeProtocol(actualTarball);
-}
-// Inlined to avoid pulling @pnpm/fetching.pick-fetcher into the lockfile-utils
-// dep graph. Used as a fallback when callers haven't pre-set the
-// `gitHosted` field on TarballResolution.
-export function isGitHostedTarballUrl(url) {
-    // Schemes and hostnames are case-insensitive, so match against a lowercased
-    // copy: a tampered `https://CODELOAD.GITHUB.COM/...` must not slip past as a
-    // non-git-hosted (and therefore registry-trusted) tarball. Only the
-    // lowercased copy is inspected; the original URL is never rewritten.
-    const lowerUrl = url.toLowerCase();
-    return (lowerUrl.startsWith('https://codeload.github.com/') ||
-        lowerUrl.startsWith('https://bitbucket.org/') ||
-        lowerUrl.startsWith('https://gitlab.com/')) && lowerUrl.includes('tar.gz');
-}
-function removeProtocol(url) {
-    return url.split('://')[1];
-}
 //# sourceMappingURL=toLockfileResolution.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.utils",
-  "version": "1100.0.13",
+  "version": "1100.1.0",
   "description": "Utils for dealing with pnpm-lock.yaml",
   "keywords": [
     "pnpm",
@@ -12,9 +12,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/lockfile/utils"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/lockfile/utils"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/lockfile/utils#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/lockfile/utils#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -29,14 +29,14 @@
     "!*.map"
   ],
   "dependencies": {
-    "get-npm-tarball-url": "^2.1.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "@pnpm/lockfile.types": "1100.0.11",
-    "@pnpm/types": "1101.3.2",
-    "@pnpm/resolving.resolver-base": "1100.4.2",
-    "@pnpm/hooks.types": "1100.0.12",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.8"
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/hooks.types": "1100.1.0",
+    "@pnpm/resolving.resolver-base": "1100.5.0",
+    "@pnpm/lockfile.types": "1100.0.12",
+    "@pnpm/resolving.tarball-url": "1100.0.0",
+    "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/types": "1101.3.2"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
@@ -44,7 +44,7 @@
     "tempy": "3.0.0",
     "write-yaml-file": "^6.0.0",
     "yaml-tag": "1.1.0",
-    "@pnpm/lockfile.utils": "1100.0.13"
+    "@pnpm/lockfile.utils": "1100.1.0"
   },
   "engines": {
     "node": ">=22.13"