@pnpm/lockfile.utils 1100.0.2 → 1100.0.4

package/lib/pkgSnapshotToResolution.js

@@ -1,4 +1,5 @@
 import url from 'node:url';
+import * as dp from '@pnpm/deps.path';
 import { isGitHostedPkgUrl } from '@pnpm/fetching.pick-fetcher';
 import getNpmTarballUrl from 'get-npm-tarball-url';
 import { nameVerFromPkgSnapshot } from './nameVerFromPkgSnapshot.js';
@@ -8,6 +9,16 @@ export function pkgSnapshotToResolution(depPath, pkgSnapshot, registries) {
         isGitHostedPkgUrl(pkgSnapshot.resolution.tarball ?? '')) {
         return pkgSnapshot.resolution;
     }
+    // Recover the tarball field for `file:` snapshots whose resolution lost
+    // its tarball (e.g. lockfiles written by an earlier pnpm 11 version that
+    // dropped the tarball under `lockfile-include-tarball-url=false`).
+    const nonSemverVersion = dp.parse(depPath).nonSemverVersion;
+    if (nonSemverVersion?.startsWith('file:')) {
+        return {
+            ...pkgSnapshot.resolution,
+            tarball: nonSemverVersion,
+        };
+    }
     const { name, version } = nameVerFromPkgSnapshot(depPath, pkgSnapshot);
     let registry = '';
     if (name != null) {

package/lib/toLockfileResolution.js

@@ -1,12 +1,24 @@
+import { isGitHostedPkgUrl } from '@pnpm/fetching.pick-fetcher';
 import getNpmTarballUrl from 'get-npm-tarball-url';
 export function toLockfileResolution(pkg, resolution, registry, lockfileIncludeTarballUrl) {
     if (resolution.type !== undefined || !resolution['integrity']) {
         return resolution;
     }
+    const tarball = resolution['tarball'];
     if (lockfileIncludeTarballUrl) {
         return {
             integrity: resolution['integrity'],
-            tarball: resolution['tarball'],
+            tarball,
+        };
+    }
+    // Tarball URLs that cannot be reconstructed from the package name, version,
+    // and registry must always stay in the lockfile, otherwise the package can
+    // no longer be re-fetched. This covers local `file:` tarballs and tarballs
+    // served by git providers (GitHub, GitLab, Bitbucket).
+    if (tarball != null && (tarball.startsWith('file:') || isGitHostedPkgUrl(tarball))) {
+        return {
+            integrity: resolution['integrity'],
+            tarball,
         };
     }
     if (lockfileIncludeTarballUrl === false) {
@@ -18,11 +30,11 @@ export function toLockfileResolution(pkg, resolution, registry, lockfileIncludeT
     // For instance, when they are hosted on npm Enterprise. See https://github.com/pnpm/pnpm/issues/867
     // Or in other weird cases, like https://github.com/pnpm/pnpm/issues/1072
     const expectedTarball = getNpmTarballUrl(pkg.name, pkg.version, { registry });
-    const actualTarball = resolution['tarball'].replaceAll('%2f', '/');
+    const actualTarball = tarball.replaceAll('%2f', '/');
     if (removeProtocol(expectedTarball) !== removeProtocol(actualTarball)) {
         return {
             integrity: resolution['integrity'],
-            tarball: resolution['tarball'],
+            tarball,
         };
     }
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.utils",
-  "version": "1100.0.2",
+  "version": "1100.0.4",
   "description": "Utils for dealing with pnpm-lock.yaml",
   "keywords": [
     "pnpm",
@@ -28,20 +28,21 @@
   "dependencies": {
     "get-npm-tarball-url": "^2.1.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "@pnpm/deps.path": "1100.0.1",
+    "@pnpm/deps.path": "1100.0.2",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/hooks.types": "1100.0.2",
-    "@pnpm/resolving.resolver-base": "1100.1.0",
-    "@pnpm/fetching.pick-fetcher": "1100.0.2",
-    "@pnpm/types": "1101.0.0",
-    "@pnpm/lockfile.types": "1100.0.2"
+    "@pnpm/fetching.pick-fetcher": "1100.0.4",
+    "@pnpm/lockfile.types": "1100.0.3",
+    "@pnpm/resolving.resolver-base": "1100.1.1",
+    "@pnpm/hooks.types": "1100.0.4",
+    "@pnpm/types": "1101.0.0"
   },
   "devDependencies": {
+    "@jest/globals": "30.3.0",
     "@types/ramda": "0.31.1",
     "tempy": "3.0.0",
     "write-yaml-file": "^6.0.0",
     "yaml-tag": "1.1.0",
-    "@pnpm/lockfile.utils": "1100.0.2"
+    "@pnpm/lockfile.utils": "1100.0.4"
   },
   "engines": {
     "node": ">=22.13"