@pnpm/lockfile.utils 1100.0.4 → 1100.0.6

package/lib/pkgSnapshotToResolution.js

@@ -1,12 +1,11 @@
 import url from 'node:url';
 import * as dp from '@pnpm/deps.path';
-import { isGitHostedPkgUrl } from '@pnpm/fetching.pick-fetcher';
 import getNpmTarballUrl from 'get-npm-tarball-url';
 import { nameVerFromPkgSnapshot } from './nameVerFromPkgSnapshot.js';
 export function pkgSnapshotToResolution(depPath, pkgSnapshot, registries) {
     if (Boolean(pkgSnapshot.resolution.type) ||
         pkgSnapshot.resolution.tarball?.startsWith('file:') ||
-        isGitHostedPkgUrl(pkgSnapshot.resolution.tarball ?? '')) {
+        pkgSnapshot.resolution.gitHosted === true) {
         return pkgSnapshot.resolution;
     }
     // Recover the tarball field for `file:` snapshots whose resolution lost

package/lib/toLockfileResolution.js

@@ -1,46 +1,68 @@
-import { isGitHostedPkgUrl } from '@pnpm/fetching.pick-fetcher';
 import getNpmTarballUrl from 'get-npm-tarball-url';
 export function toLockfileResolution(pkg, resolution, registry, lockfileIncludeTarballUrl) {
     if (resolution.type !== undefined || !resolution['integrity']) {
         return resolution;
     }
+    // Tarball-typed resolutions are guaranteed to carry a tarball URL by the
+    // resolver, but guard for unexpected inputs (e.g. resolutions deserialized
+    // from external state) so we don't blow up on a missing field.
     const tarball = resolution['tarball'];
+    if (tarball == null) {
+        return { integrity: resolution['integrity'] };
+    }
+    // Honor the resolver-supplied flag, with a URL fallback for resolutions
+    // that didn't go through the git resolver (e.g. config-dep migrations or
+    // legacy lockfiles read by callers that don't enrich the field).
+    const gitHosted = resolution.gitHosted === true ||
+        isGitHostedTarballUrl(tarball);
     if (lockfileIncludeTarballUrl) {
-        return {
+        return preservingGitHosted({
             integrity: resolution['integrity'],
             tarball,
-        };
+        }, gitHosted);
     }
     // Tarball URLs that cannot be reconstructed from the package name, version,
     // and registry must always stay in the lockfile, otherwise the package can
     // no longer be re-fetched. This covers local `file:` tarballs and tarballs
     // served by git providers (GitHub, GitLab, Bitbucket).
-    if (tarball != null && (tarball.startsWith('file:') || isGitHostedPkgUrl(tarball))) {
-        return {
+    if (tarball.startsWith('file:') || gitHosted) {
+        return preservingGitHosted({
             integrity: resolution['integrity'],
             tarball,
-        };
-    }
-    if (lockfileIncludeTarballUrl === false) {
-        return {
-            integrity: resolution['integrity'],
-        };
+        }, gitHosted);
     }
     // Sometimes packages are hosted under non-standard tarball URLs.
     // For instance, when they are hosted on npm Enterprise. See https://github.com/pnpm/pnpm/issues/867
-    // Or in other weird cases, like https://github.com/pnpm/pnpm/issues/1072
+    // Or in other weird cases, like https://github.com/pnpm/pnpm/issues/1072.
+    // Even when the user explicitly sets `lockfileIncludeTarballUrl: false`, we
+    // must preserve such URLs — otherwise the package cannot be re-fetched on a
+    // frozen-lockfile install (e.g. GitHub Packages tarballs at
+    // `https://npm.pkg.github.com/download/<scope>/<name>/<version>/<hash>`).
+    // `lockfileIncludeTarballUrl` only controls whether URLs that *can* be
+    // derived from name+version+registry are written.
     const expectedTarball = getNpmTarballUrl(pkg.name, pkg.version, { registry });
     const actualTarball = tarball.replaceAll('%2f', '/');
     if (removeProtocol(expectedTarball) !== removeProtocol(actualTarball)) {
-        return {
+        return preservingGitHosted({
             integrity: resolution['integrity'],
             tarball,
-        };
+        }, gitHosted);
     }
     return {
         integrity: resolution['integrity'],
     };
 }
+function preservingGitHosted(resolution, gitHosted) {
+    return gitHosted ? { ...resolution, gitHosted: true } : resolution;
+}
+// Inlined to avoid pulling @pnpm/fetching.pick-fetcher into the lockfile-utils
+// dep graph. Used as a fallback when callers haven't pre-set the
+// `gitHosted` field on TarballResolution.
+function isGitHostedTarballUrl(url) {
+    return (url.startsWith('https://codeload.github.com/') ||
+        url.startsWith('https://bitbucket.org/') ||
+        url.startsWith('https://gitlab.com/')) && url.includes('tar.gz');
+}
 function removeProtocol(url) {
     return url.split('://')[1];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.utils",
-  "version": "1100.0.4",
+  "version": "1100.0.6",
   "description": "Utils for dealing with pnpm-lock.yaml",
   "keywords": [
     "pnpm",
@@ -29,12 +29,11 @@
     "get-npm-tarball-url": "^2.1.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "@pnpm/deps.path": "1100.0.2",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/fetching.pick-fetcher": "1100.0.4",
-    "@pnpm/lockfile.types": "1100.0.3",
-    "@pnpm/resolving.resolver-base": "1100.1.1",
-    "@pnpm/hooks.types": "1100.0.4",
-    "@pnpm/types": "1101.0.0"
+    "@pnpm/lockfile.types": "1100.0.4",
+    "@pnpm/hooks.types": "1100.0.5",
+    "@pnpm/resolving.resolver-base": "1100.1.2",
+    "@pnpm/types": "1101.0.0",
+    "@pnpm/error": "1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -42,7 +41,7 @@
     "tempy": "3.0.0",
     "write-yaml-file": "^6.0.0",
     "yaml-tag": "1.1.0",
-    "@pnpm/lockfile.utils": "1100.0.4"
+    "@pnpm/lockfile.utils": "1100.0.6"
   },
   "engines": {
     "node": ">=22.13"