@pnpm/pnpr 0.1.0-alpha.7 → 0.1.0-alpha.9

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # @pnpm/pnpr
 
+## 0.1.0-alpha.9
+
+### Minor Changes
+
+- Made the signed shared-artifact cache horizontally scalable with S3-compatible storage and an independent top-level `artifacts` feature toggle.
+
+- Generalized the experimental shared-artifact protocol so candidates and signed payloads identify a discriminated subject. Dependency side effects use package and source-integrity subjects, while workspace tasks use project and task subjects.
+
+  This changes shared-artifact request bodies and signed payloads. A pnpr server and its clients have to be on matching versions.
+
+### Patch Changes
+
+- A published build artifact is now immutable: one input key and one set of compatibility constraints admit one artifact, so publishing a different one over it answers `409 Conflict`, the same as a re-published `name@version`. Republishing the identical artifact still succeeds. Artifacts already stored by an earlier version keep their slot, so upgrading a populated registry does not leave them replaceable.
+
+- A published build artifact is now immutable for every consumer it can reach, not only for the exact compatibility constraints it declares. Publishing an artifact that reaches a machine an existing one already reaches answers `409 Conflict`, so a later universal, broader, or higher-floor build can no longer take precedence over the artifact a consumer already receives. Publishing across a platform matrix is unaffected: artifacts for different operating systems, architectures, or Node majors reach no machine in common and coexist as before.
+
+- pnpr reclaims unreferenced shared artifact blobs after ambiguous object-storage write failures once active publications drain.
+
+- Recognize `pnpm install --fix-lockfile`, including filtered installs, and regenerate broken lockfile metadata while preserving compatible locked versions [pnpm/pnpm#14250](https://github.com/pnpm/pnpm/issues/14250).
+
+- pnpr retains shared artifact quota after object storage reports an ambiguous write failure.
+
+## 0.1.0-alpha.8
+
+### Minor Changes
+
+- Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines, by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally.
+
+  Configure it with the new `remoteSideEffectsCache` setting. A workspace names the eligible `organization` and `packages`; everything describing the act of signing — `publish`, `keyId`, `builderId`, `trustedKeys`, `privateKey` and the provenance fields — is refused in `pnpm-workspace.yaml` and read from the global config file or the environment instead.
+
+- Hosted pnpr registries now serve newly published original artifacts from registry-scoped SHA-512 digest URLs.
+
+- Allowed `pnpm update --patches` to refresh registry revisions through a configured pnpr server while retaining locked package versions.
+
+- Added explicit registry revision selection with `<version>+rN` and `pnpm update --patches` for refreshing revision artifacts without changing package versions. Registry-backed lockfile policy checks recognize historical revisions, and pnpr now preserves safe revision histories from upstream registries.
+
+- Added support for registry replacement tarballs using standard integrity values, explicit revision fields, registry routing from the `registries` setting, non-redirecting integrity-addressed URLs, canonical safe-integer revision numbers, and pnpr proxying for immutable upstream revision artifacts.
+
+### Patch Changes
+
+- Forward `patchedDependencies` hashes and `packageExtensions` to pnpr so server-side resolution preserves patches and package extensions in the lockfile and installed packages.
+
 ## 0.1.0-alpha.7
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/pnpr",
-  "version": "0.1.0-alpha.7",
+  "version": "0.1.0-alpha.9",
   "description": "pnpm-compatible npm registry server, written in Rust",
   "keywords": [
     "pnpm",
@@ -28,14 +28,14 @@
     "LICENSE.md"
   ],
   "optionalDependencies": {
-    "@pnpm/pnpr.win32-x64": "0.1.0-alpha.7",
-    "@pnpm/pnpr.win32-arm64": "0.1.0-alpha.7",
-    "@pnpm/pnpr.darwin-x64": "0.1.0-alpha.7",
-    "@pnpm/pnpr.darwin-arm64": "0.1.0-alpha.7",
-    "@pnpm/pnpr.linux-x64": "0.1.0-alpha.7",
-    "@pnpm/pnpr.linux-arm64": "0.1.0-alpha.7",
-    "@pnpm/pnpr.linux-x64-musl": "0.1.0-alpha.7",
-    "@pnpm/pnpr.linux-arm64-musl": "0.1.0-alpha.7"
+    "@pnpm/pnpr.win32-x64": "0.1.0-alpha.9",
+    "@pnpm/pnpr.win32-arm64": "0.1.0-alpha.9",
+    "@pnpm/pnpr.darwin-x64": "0.1.0-alpha.9",
+    "@pnpm/pnpr.darwin-arm64": "0.1.0-alpha.9",
+    "@pnpm/pnpr.linux-x64": "0.1.0-alpha.9",
+    "@pnpm/pnpr.linux-arm64": "0.1.0-alpha.9",
+    "@pnpm/pnpr.linux-x64-musl": "0.1.0-alpha.9",
+    "@pnpm/pnpr.linux-arm64-musl": "0.1.0-alpha.9"
   },
   "scripts": {
     "preinstall": "node install.js"