@pnpm/releasing.commands 1100.5.4 → 1100.6.0

package/lib/publish/extractManifestFromPacked.js

@@ -6,6 +6,30 @@ import tar from 'tar-stream';
 const TARBALL_SUFFIXES = ['.tar.gz', '.tgz'];
 export const isTarballPath = (path) => TARBALL_SUFFIXES.some(suffix => path.endsWith(suffix));
 export async function extractManifestFromPacked(tarballPath) {
+    const { manifest } = await extractEntriesFromPacked(tarballPath, false);
+    return JSON.parse(manifest);
+}
+/**
+ * Read the publish manifest from a pre-built tarball, filling in its `readme` from the tarball's
+ * root README file when the manifest doesn't already declare one. This mirrors the npm CLI, which
+ * reads the readme out of the tarball (via pacote's `fullReadJson`) so the registry gets it as
+ * metadata even though it isn't stored in the packed `package.json`.
+ */
+export async function extractPublishManifestFromPacked(tarballPath) {
+    const { manifest, readme } = await extractEntriesFromPacked(tarballPath, true);
+    const parsed = JSON.parse(manifest);
+    if (parsed.readme == null && readme != null) {
+        parsed.readme = readme;
+    }
+    return parsed;
+}
+/**
+ * Scan the tarball for `package/package.json` and, when `wantReadme` is set, the root
+ * `README.md`. The manifest-only path (`wantReadme` false) resolves as soon as the manifest
+ * entry is read and stops decompressing the rest of the archive; the publish path scans on
+ * because a README can appear after the manifest.
+ */
+async function extractEntriesFromPacked(tarballPath, wantReadme) {
     const extract = tar.extract();
     const gunzip = createGunzip();
     const tarballStream = fs.createReadStream(tarballPath);
@@ -19,47 +43,62 @@ export async function extractManifestFromPacked(tarballPath) {
         tarballStream.destroy();
     }
     const promise = new Promise((resolve, reject) => {
+        let settled = false;
+        let manifest;
+        let readme;
         function handleError(error) {
             cleanup();
             reject(error);
         }
+        function settle() {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            if (manifest == null) {
+                reject(new PublishArchiveMissingManifestError(tarballPath));
+                return;
+            }
+            resolve({ manifest, readme });
+        }
         tarballStream.once('error', handleError);
         gunzip.once('error', handleError);
-        let manifestFound = false;
         extract.on('entry', (header, stream, next) => {
             const normalizedPath = path.normalize(header.name).replaceAll('\\', '/');
-            if (normalizedPath !== 'package/package.json') {
+            const isManifest = normalizedPath === 'package/package.json';
+            const isReadme = wantReadme && /^package\/readme\.md$/i.test(normalizedPath);
+            if (!isManifest && !isReadme) {
                 stream.once('end', next);
                 stream.resume();
                 return;
             }
-            manifestFound = true;
             const chunks = [];
             stream.on('data', (chunk) => {
                 chunks.push(chunk);
             });
             stream.once('end', () => {
-                try {
-                    const text = Buffer.concat(chunks).toString();
-                    cleanup();
-                    resolve(text);
+                const text = Buffer.concat(chunks).toString();
+                if (isManifest) {
+                    manifest = text;
                 }
-                catch (error) {
-                    handleError(error);
+                else {
+                    readme = text;
                 }
+                // Stop early once every wanted entry has been captured, so the manifest-only
+                // path doesn't stream and decompress the remainder of the tarball.
+                if (manifest != null && (!wantReadme || readme != null)) {
+                    settle();
+                    return;
+                }
+                next();
             });
             stream.once('error', handleError);
         });
-        extract.once('finish', () => {
-            cleanup();
-            if (!manifestFound) {
-                reject(new PublishArchiveMissingManifestError(tarballPath));
-            }
-        });
+        extract.once('finish', settle);
         extract.once('error', handleError);
     });
     tarballStream.pipe(gunzip).pipe(extract);
-    return JSON.parse(await promise);
+    return promise;
 }
 export class PublishArchiveMissingManifestError extends PnpmError {
     tarballPath;

package/lib/publish/otp.js

@@ -28,11 +28,14 @@ export async function publishWithOtpHandling({ context = SHARED_CONTEXT, manifes
     return withOtpHandling({
         context,
         fetchOptions,
-        // When otp is undefined (first attempt), { ...publishOptions, otp } adds
-        // otp: undefined to the options. This is safe because libnpmpublish treats
-        // undefined the same as absent (unlike HTTP headers, where undefined gets
-        // coerced to the string "undefined").
-        operation: otp => publish(manifest, tarballData, { ...publishOptions, otp }),
+        // withOtpHandling first calls this with no otp, then retries with the otp
+        // it obtained from an OTP challenge. On the first attempt we fall back to
+        // the configured --otp (publishOptions.otp) so it is actually sent; a retry
+        // otp takes precedence over it. When both are undefined, passing
+        // otp: undefined is safe because libnpmpublish treats undefined the same as
+        // absent (unlike HTTP headers, where undefined gets coerced to the string
+        // "undefined").
+        operation: otp => publish(manifest, tarballData, { ...publishOptions, otp: otp ?? publishOptions.otp }),
     });
 }
 //# sourceMappingURL=otp.js.map

package/lib/publish/pack.d.ts

@@ -4,7 +4,7 @@ export declare function rcOptionsTypes(): Record<string, unknown>;
 export declare function cliOptionsTypes(): Record<string, unknown>;
 export declare const commandNames: string[];
 export declare function help(): string;
-export type PackOptions = Pick<UniversalOptions, 'dir'> & Pick<Config, 'catalogs' | 'ignoreScripts' | 'embedReadme' | 'packGzipLevel' | 'nodeLinker' | 'skipManifestObfuscation' | 'userAgent'> & Partial<Pick<Config, 'extraBinPaths' | 'extraEnv' | 'recursive' | 'workspaceConcurrency' | 'workspaceDir'>> & Partial<Pick<ConfigContext, 'hooks' | 'selectedProjectsGraph' | 'allProjectsGraph' | 'prodAllProjectsGraph' | 'prodOnlySelectedProjectDirs'>> & {
+export type PackOptions = Pick<UniversalOptions, 'dir'> & Pick<Config, 'catalogs' | 'ignoreScripts' | 'embedReadme' | 'packGzipLevel' | 'nodeLinker' | 'skipManifestObfuscation' | 'userAgent'> & Partial<Pick<Config, 'extraBinPaths' | 'extraEnv' | 'recursive' | 'workspaceConcurrency' | 'workspaceDir' | 'versioning' | 'registries' | 'configByUri' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout' | 'ca' | 'cert' | 'key' | 'strictSsl' | 'httpProxy' | 'httpsProxy' | 'noProxy' | 'localAddress'>> & Partial<Pick<ConfigContext, 'hooks' | 'selectedProjectsGraph' | 'allProjectsGraph' | 'prodAllProjectsGraph' | 'prodOnlySelectedProjectDirs'>> & {
     argv: {
         original: string[];
     };

package/lib/publish/pack.js

@@ -8,7 +8,8 @@ import { getDefaultWorkspaceConcurrency, getWorkspaceConcurrency, types as allTy
 import { PnpmError } from '@pnpm/error';
 import { packlist } from '@pnpm/fs.packlist';
 import { logger } from '@pnpm/logger';
-import { createExportableManifest } from '@pnpm/releasing.exportable-manifest';
+import { createExportableManifest, readReadmeFile } from '@pnpm/releasing.exportable-manifest';
+import { changelogStorage, readPendingChangelog, renderChangelog } from '@pnpm/releasing.versioning';
 import { sortFilteredProjects } from '@pnpm/workspace.projects-sorter';
 import chalk from 'chalk';
 import pLimit from 'p-limit';
@@ -18,6 +19,7 @@ import { renderHelp } from 'render-help';
 import tar from 'tar-stream';
 import { glob } from 'tinyglobby';
 import validateNpmPackageName from 'validate-npm-package-name';
+import { fetchPreviousChangelog } from './previousChangelog.js';
 import { runScriptsIfPresent } from './publish.js';
 const LICENSE_GLOB = 'LICEN{S,C}E{,.*}'; // cspell:disable-line
 export function rcOptionsTypes() {
@@ -216,6 +218,7 @@ export async function api(opts) {
     }
     const files = await packlist(dir, {
         manifest: publishManifest,
+        workspaceDir: opts.workspaceDir,
     });
     const filesMap = Object.fromEntries(files.map((file) => [`package/${file}`, path.join(dir, file)]));
     // cspell:disable-next-line
@@ -233,6 +236,16 @@ export async function api(opts) {
             }
         }));
     }
+    // In `registry` changelog storage the package carries no committed
+    // CHANGELOG.md; its section was parked at `pnpm version -r` time and is
+    // composed here on top of the previously published version's changelog and
+    // packed in. A composed entry supersedes any stale committed CHANGELOG.md.
+    const injectedEntries = {};
+    const composedChangelog = await composeRegistryChangelog(opts, manifest.name, manifest.version);
+    if (composedChangelog != null) {
+        delete filesMap['package/CHANGELOG.md'];
+        injectedEntries['package/CHANGELOG.md'] = composedChangelog;
+    }
     const destDir = packDestination
         ? (path.isAbsolute(packDestination) ? packDestination : path.join(dir, packDestination ?? '.'))
         : dir;
@@ -253,14 +266,19 @@ export async function api(opts) {
         const stat = await fs.promises.stat(source);
         return stat.size;
     }));
-    const unpackedSize = sizes.reduce((acc, size) => acc + size, 0);
-    const packedContents = Array.from(new Set(Object.keys(filesMap).map((name) => isManifestEntry(name)
-        ? 'package.json'
-        : name.replace(/^package\//, '')))).sort((a, b) => a.localeCompare(b, 'en'));
+    const injectedSize = Object.values(injectedEntries).reduce((acc, content) => acc + Buffer.byteLength(content), 0);
+    const unpackedSize = sizes.reduce((acc, size) => acc + size, 0) + injectedSize;
+    const packedContents = Array.from(new Set([
+        ...Object.keys(filesMap).map((name) => isManifestEntry(name)
+            ? 'package.json'
+            : name.replace(/^package\//, '')),
+        ...Object.keys(injectedEntries).map((name) => name.replace(/^package\//, '')),
+    ])).sort((a, b) => a.localeCompare(b, 'en'));
     if (!opts.dryRun) {
         await packPkg({
             destFile: path.join(destDir, tarballName),
             filesMap,
+            injectedEntries,
             modulesDir: path.join(opts.dir, 'node_modules'),
             packGzipLevel: opts.packGzipLevel,
             manifest: publishManifest,
@@ -282,18 +300,51 @@ export async function api(opts) {
         packedTarballPath = path.relative(opts.dir, path.join(dir, tarballName));
     }
     return {
-        publishedManifest: publishManifest,
+        publishedManifest: await withRegistryReadme(publishManifest, dir),
         contents: packedContents,
         tarballPath: packedTarballPath,
         unpackedSize,
     };
 }
+/**
+ * The readme is always sent to the registry as package metadata, matching the npm CLI, so that
+ * registries can render it on the package page. The `embed-readme` setting only controls whether
+ * the readme is additionally written into the `package.json` inside the tarball (via
+ * `createExportableManifest`), which is why it is added to the returned manifest here rather than
+ * to the packed one.
+ */
+async function withRegistryReadme(manifest, projectDir) {
+    if (manifest.readme != null)
+        return manifest;
+    const readme = await readReadmeFile(projectDir);
+    if (readme == null)
+        return manifest;
+    return { ...manifest, readme };
+}
 // True when a `package/<path>` tar key names the package manifest, which is
 // packed as a single serialized `package/package.json` entry and reported as
 // `package.json` in the contents listing regardless of the source file name.
 function isManifestEntry(name) {
     return name === 'package/package.json' || name === 'package/package.json5' || name === 'package/package.yaml';
 }
+/**
+ * The CHANGELOG.md to pack for a `registry`-storage release: its parked
+ * section (written at `pnpm version -r` time) rendered on top of the
+ * previously published version's changelog. `undefined` when storage is
+ * `repository`, there is no workspace, or the release has no parked section
+ * (an ordinary `pnpm pack` of a package that is not mid-release).
+ */
+async function composeRegistryChangelog(opts, pkgName, version) {
+    if (changelogStorage(opts.versioning) !== 'registry' || opts.workspaceDir == null)
+        return undefined;
+    const section = await readPendingChangelog(opts.workspaceDir, pkgName, version);
+    if (section == null)
+        return undefined;
+    const previous = opts.registries != null
+        ? await fetchPreviousChangelog(opts, pkgName, version)
+        : undefined;
+    return renderChangelog(previous ?? null, pkgName, section);
+}
 function stripBuildMetadata(version) {
     const plusIndex = version.indexOf('+');
     return plusIndex === -1 ? version : version.slice(0, plusIndex);
@@ -311,7 +362,7 @@ function preventBundledDependenciesWithoutHoistedNodeLinker(nodeLinker, manifest
     }
 }
 async function packPkg(opts) {
-    const { destFile, filesMap, bins, manifest, } = opts;
+    const { destFile, filesMap, injectedEntries, bins, manifest, } = opts;
     const mtime = new Date('1985-10-26T08:15:00.000Z');
     const pack = tar.pack();
     await Promise.all(Object.entries(filesMap).map(async ([name, source]) => {
@@ -323,6 +374,9 @@ async function packPkg(opts) {
         }
         pack.entry({ mode, mtime, name }, fs.readFileSync(source));
     }));
+    for (const [name, content] of Object.entries(injectedEntries ?? {})) {
+        pack.entry({ mode: 0o644, mtime, name }, content);
+    }
     const tarball = fs.createWriteStream(destFile);
     pack.pipe(createGzip({ level: opts.packGzipLevel })).pipe(tarball);
     pack.finalize();

package/lib/publish/previousChangelog.d.ts

@@ -0,0 +1,19 @@
+import type { Config } from '@pnpm/config.reader';
+import { type CreateFetchFromRegistryOptions } from '@pnpm/network.fetch';
+export type PreviousChangelogOptions = CreateFetchFromRegistryOptions & Pick<Config, 'registries' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout'>;
+/**
+ * The `CHANGELOG.md` packed into the highest published version of `pkgName`
+ * that is semver-lower than `version` — the changelog the section for
+ * `version` is prepended onto in `registry` storage. `undefined` when the
+ * package is new, has no earlier published version, or that version's tarball
+ * carried no changelog.
+ */
+export declare function fetchPreviousChangelog(opts: PreviousChangelogOptions, pkgName: string, version: string): Promise<string | undefined>;
+/**
+ * The `CHANGELOG.md` packed into the published `pkgName@version` exactly, or
+ * `undefined` when that version is not published (or carried no changelog).
+ * Used to confirm a release actually carries its composed section before the
+ * intents behind it are garbage-collected.
+ */
+export declare function fetchPublishedChangelog(opts: PreviousChangelogOptions, pkgName: string, version: string): Promise<string | undefined>;
+export declare function changelogHasSection(changelog: string, section: string): boolean;

package/lib/publish/previousChangelog.js

@@ -0,0 +1,182 @@
+import { gunzipSync } from 'node:zlib';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { PnpmError } from '@pnpm/error';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import { fetchMetadataFromFromRegistry } from '@pnpm/resolving.npm-resolver';
+import { lt, rsort, valid } from 'semver';
+import tar from 'tar-stream';
+const CHANGELOG_ENTRY = 'package/CHANGELOG.md';
+/**
+ * Caps the previous tarball we buffer and decompress to compose the changelog.
+ * The bytes come from a registry/proxy, so an unbounded read or a highly
+ * compressible ("gzip bomb") tarball could OOM release automation. A composed
+ * changelog is best-effort — exceeding the cap just skips the history prepend —
+ * so this bound can be generous while still defeating the amplification attack.
+ */
+const MAX_TARBALL_BYTES = 256 * 1024 * 1024;
+function createRegistryClient(opts) {
+    return {
+        fetch: createFetchFromRegistry(opts),
+        getAuthHeader: createGetAuthHeaderByURI(opts.configByUri ?? {}),
+    };
+}
+/**
+ * The `CHANGELOG.md` packed into the highest published version of `pkgName`
+ * that is semver-lower than `version` — the changelog the section for
+ * `version` is prepended onto in `registry` storage. `undefined` when the
+ * package is new, has no earlier published version, or that version's tarball
+ * carried no changelog.
+ */
+export async function fetchPreviousChangelog(opts, pkgName, version) {
+    const client = createRegistryClient(opts);
+    const meta = await fetchPackument(client, opts, pkgName);
+    if (meta == null)
+        return undefined;
+    const previousVersion = pickPreviousVersion(meta, version);
+    if (previousVersion == null)
+        return undefined;
+    return downloadTarballChangelog(client, pkgName, meta, previousVersion);
+}
+/**
+ * The `CHANGELOG.md` packed into the published `pkgName@version` exactly, or
+ * `undefined` when that version is not published (or carried no changelog).
+ * Used to confirm a release actually carries its composed section before the
+ * intents behind it are garbage-collected.
+ */
+export async function fetchPublishedChangelog(opts, pkgName, version) {
+    const client = createRegistryClient(opts);
+    const meta = await fetchPackument(client, opts, pkgName);
+    if (meta?.versions[version] == null)
+        return undefined;
+    return downloadTarballChangelog(client, pkgName, meta, version);
+}
+export function changelogHasSection(changelog, section) {
+    return changelog.includes(section.trim());
+}
+async function fetchPackument(client, opts, pkgName) {
+    const registry = pickRegistryForPackage(opts.registries, pkgName);
+    let fetchResult;
+    try {
+        fetchResult = await fetchMetadataFromFromRegistry({
+            fetch: client.fetch,
+            retry: {
+                factor: opts.fetchRetryFactor,
+                maxTimeout: opts.fetchRetryMaxtimeout,
+                minTimeout: opts.fetchRetryMintimeout,
+                retries: opts.fetchRetries,
+            },
+            timeout: opts.fetchTimeout ?? 60000,
+            fetchWarnTimeoutMs: 10000,
+        }, pkgName, {
+            registry,
+            authHeaderValue: client.getAuthHeader(registry, { pkgName }),
+            fullMetadata: false,
+        });
+    }
+    catch (err) {
+        // A package with no published version yet has no changelog to build on.
+        if (err != null && typeof err === 'object' && 'code' in err && err.code === 'ERR_PNPM_FETCH_404') {
+            return undefined;
+        }
+        throw err;
+    }
+    return fetchResult.notModified ? undefined : fetchResult.meta;
+}
+/** Highest published version of the package that is semver-lower than `version`. */
+function pickPreviousVersion(meta, version) {
+    const candidates = Object.keys(meta.versions).filter((candidate) => valid(candidate) != null && lt(candidate, version));
+    return candidates.length > 0 ? rsort(candidates)[0] : undefined;
+}
+async function downloadTarballChangelog(client, pkgName, meta, version) {
+    const tarballUrl = meta.versions[version]?.dist?.tarball;
+    if (tarballUrl == null)
+        return undefined;
+    const response = await client.fetch(tarballUrl, { authHeaderValue: client.getAuthHeader(tarballUrl, { pkgName }) });
+    if (!response.ok) {
+        throw new PnpmError('CHANGELOG_TARBALL_FETCH_FAILED', `Failed to download ${pkgName}@${version} tarball (${response.status}) to compose the changelog: ${tarballUrl}`);
+    }
+    const tarballData = await readCapped(response, MAX_TARBALL_BYTES);
+    if (tarballData == null)
+        return undefined;
+    return extractTarballEntry(tarballData, CHANGELOG_ENTRY);
+}
+/**
+ * Reads a response body into a buffer, stopping (and returning `undefined`) as
+ * soon as it exceeds `maxBytes` — bounding the actual download rather than
+ * trusting a `content-length` header, which may be absent or lie.
+ */
+async function readCapped(response, maxBytes) {
+    const reader = response.body?.getReader();
+    if (reader == null) {
+        const buffer = Buffer.from(await response.arrayBuffer());
+        return buffer.byteLength > maxBytes ? undefined : buffer;
+    }
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        // Streaming a body is inherently sequential — each read must await the
+        // previous chunk — so the successive awaits here are intentional.
+        // eslint-disable-next-line no-await-in-loop
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            // Best-effort cleanup: a cancel failure must not turn the over-cap path
+            // into a hard error — the caller just gets no changelog either way.
+            // eslint-disable-next-line no-await-in-loop
+            await reader.cancel().catch(() => { });
+            return undefined;
+        }
+        chunks.push(Buffer.from(value));
+    }
+    return Buffer.concat(chunks);
+}
+/**
+ * Reads one entry's contents out of a (optionally gzipped) tarball buffer.
+ * Composing the changelog is best-effort, so any decode/parse failure —
+ * including a gzip bomb tripping the inflate cap — resolves to `undefined`
+ * (no history prepend) rather than throwing.
+ */
+async function extractTarballEntry(tarballData, entryName) {
+    const tarData = gunzipCapped(tarballData);
+    if (tarData == null)
+        return undefined;
+    const extract = tar.extract();
+    return new Promise((resolve) => {
+        let contents;
+        extract.on('entry', (header, stream, next) => {
+            if (header.name !== entryName) {
+                stream.resume();
+                stream.on('end', next);
+                stream.on('error', () => resolve(undefined));
+                return;
+            }
+            const chunks = [];
+            stream.on('data', (chunk) => chunks.push(Buffer.from(chunk)));
+            stream.on('error', () => resolve(undefined));
+            stream.on('end', () => {
+                contents = Buffer.concat(chunks).toString('utf8');
+                next();
+            });
+        });
+        extract.on('error', () => resolve(undefined));
+        extract.on('finish', () => resolve(contents));
+        extract.end(tarData);
+    });
+}
+/**
+ * Inflates a published `.tgz`, capped at `MAX_TARBALL_BYTES` of output so a
+ * gzip bomb throws rather than ballooning memory. Returns `undefined` on that
+ * cap or any other decode failure — the caller treats it as no changelog.
+ */
+function gunzipCapped(tarballData) {
+    try {
+        return gunzipSync(tarballData, { maxOutputLength: MAX_TARBALL_BYTES });
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=previousChangelog.js.map

package/lib/publish/publish.d.ts

@@ -16,7 +16,7 @@ export declare function handler(opts: Omit<PublishRecursiveOpts, 'workspaceDir'>
     json?: boolean;
     recursive?: boolean;
     workspaceDir?: string;
-} & Pick<Config, 'bin' | 'gitChecks' | 'ignoreScripts' | 'pnpmHomeDir' | 'publishBranch' | 'embedReadme' | 'skipManifestObfuscation'> & Pick<ConfigContext, 'allProjects'>, params: string[]): Promise<{
+} & Pick<Config, 'bin' | 'gitChecks' | 'ignoreScripts' | 'pnpmHomeDir' | 'publishBranch' | 'embedReadme' | 'skipManifestObfuscation' | 'versioning'> & Pick<ConfigContext, 'allProjects'>, params: string[]): Promise<{
     exitCode?: number;
     output?: string;
 } | undefined>;
@@ -36,5 +36,5 @@ export declare function publish(opts: Omit<PublishRecursiveOpts, 'workspaceDir'>
     engineStrict?: boolean;
     recursive?: boolean;
     workspaceDir?: string;
-} & Pick<Config, 'bin' | 'gitChecks' | 'ignoreScripts' | 'pnpmHomeDir' | 'publishBranch' | 'embedReadme' | 'packGzipLevel' | 'skipManifestObfuscation'> & Pick<ConfigContext, 'allProjects'>, params: string[]): Promise<PublishResult>;
+} & Pick<Config, 'bin' | 'gitChecks' | 'ignoreScripts' | 'pnpmHomeDir' | 'publishBranch' | 'embedReadme' | 'packGzipLevel' | 'skipManifestObfuscation' | 'versioning'> & Pick<ConfigContext, 'allProjects'>, params: string[]): Promise<PublishResult>;
 export declare function runScriptsIfPresent(opts: RunLifecycleHookOptions, scriptNames: string[], manifest: ProjectManifest): Promise<void>;

package/lib/publish/publish.js

@@ -11,7 +11,7 @@ import { pick } from 'ramda';
 import { realpathMissing } from 'realpath-missing';
 import { renderHelp } from 'render-help';
 import { temporaryDirectory } from 'tempy';
-import { extractManifestFromPacked, isTarballPath } from './extractManifestFromPacked.js';
+import { extractPublishManifestFromPacked, isTarballPath } from './extractManifestFromPacked.js';
 import { optionsWithOtpEnv } from './otpEnv.js';
 import * as pack from './pack.js';
 import { publishPackedPkg } from './publishPackedPkg.js';
@@ -188,7 +188,7 @@ export async function publish(opts, params) {
     const dirInParams = (params.length > 0) ? params[0] : undefined;
     if (dirInParams != null && isTarballPath(dirInParams)) {
         const tarballPath = dirInParams;
-        const publishedManifest = await extractManifestFromPacked(tarballPath);
+        const publishedManifest = await extractPublishManifestFromPacked(tarballPath);
         // Publishing a pre-built tarball bypasses `pack.api()`, so we don't have the file listing
         // or unpacked size — those summary fields are reported as empty/zero.
         const publishSummary = await publishPackedPkg({

package/lib/publish/recursivePublish.d.ts

@@ -1,6 +1,6 @@
 import type { Config, ConfigContext } from '@pnpm/config.reader';
 import type { PublishPackedPkgOptions, PublishSummary } from './publishPackedPkg.js';
-export type PublishRecursiveOpts = Required<Pick<Config, 'bin' | 'cacheDir' | 'dir' | 'pnpmHomeDir' | 'configByUri' | 'registries' | 'workspaceDir'>> & Required<Pick<ConfigContext, 'cliOptions'>> & Partial<Pick<Config, 'tag' | 'ca' | 'catalogs' | 'cert' | 'fetchTimeout' | 'force' | 'dryRun' | 'extraBinPaths' | 'extraEnv' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'key' | 'httpProxy' | 'httpsProxy' | 'localAddress' | 'lockfileDir' | 'noProxy' | 'npmPath' | 'offline' | 'strictSsl' | 'unsafePerm' | 'userAgent' | 'verifyStoreIntegrity'>> & Partial<Pick<ConfigContext, 'selectedProjectsGraph' | 'allProjectsGraph' | 'prodAllProjectsGraph' | 'prodOnlySelectedProjectDirs'>> & {
+export type PublishRecursiveOpts = Required<Pick<Config, 'bin' | 'cacheDir' | 'dir' | 'pnpmHomeDir' | 'configByUri' | 'registries' | 'workspaceDir'>> & Required<Pick<ConfigContext, 'cliOptions'>> & Partial<Pick<Config, 'tag' | 'ca' | 'catalogs' | 'cert' | 'fetchTimeout' | 'force' | 'dryRun' | 'extraBinPaths' | 'extraEnv' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'key' | 'httpProxy' | 'httpsProxy' | 'localAddress' | 'lockfileDir' | 'noProxy' | 'npmPath' | 'offline' | 'strictSsl' | 'unsafePerm' | 'userAgent' | 'verifyStoreIntegrity' | 'versioning'>> & Partial<Pick<ConfigContext, 'selectedProjectsGraph' | 'allProjectsGraph' | 'prodAllProjectsGraph' | 'prodOnlySelectedProjectDirs'>> & {
     access?: 'public' | 'restricted';
     argv: {
         original: string[];

package/lib/stage/list.js

@@ -4,6 +4,9 @@ import { parseStagePackageSpec } from './parsing.js';
 import { renderStageItem } from './rendering.js';
 import { stageJsonRequest } from './request.js';
 const PER_PAGE = 100;
+// Fail-safe bound on the pagination loop, so a registry that keeps answering
+// full pages with an inflated `total` cannot drive it forever.
+const MAX_PAGES = 1000;
 export async function stageList(opts, params) {
     const packageFilter = parsePackageFilter(params[0]);
     const context = createStageContext(opts, packageFilter);
@@ -22,6 +25,8 @@ export async function stageList(opts, params) {
         if (items.length >= res.total || res.items.length < PER_PAGE)
             break;
         page++;
+        if (page >= MAX_PAGES)
+            break;
     }
     if (opts.json)
         return JSON.stringify(items, null, 2);

package/lib/version/index.d.ts

@@ -1,12 +1,14 @@
 import { type Config } from '@pnpm/config.reader';
-import type { ProjectsGraph } from '@pnpm/types';
+import type { Project, ProjectsGraph } from '@pnpm/types';
 export declare function rcOptionsTypes(): Record<string, unknown>;
 export declare function cliOptionsTypes(): Record<string, unknown>;
 export declare const commandNames: string[];
 export declare function help(): string;
 interface VersionHandlerOptions extends Config {
+    allProjects?: Project[];
     allowSameVersion?: boolean;
     commitHooks?: boolean;
+    dryRun?: boolean;
     gitChecks?: boolean;
     gitTagVersion?: boolean;
     json?: boolean;