@pnpm/releasing.exportable-manifest 1100.1.8 → 1100.1.10

package/CHANGELOG.md

@@ -0,0 +1,1055 @@
+# @pnpm/exportable-manifest
+
+## 1100.1.10
+
+### Patch Changes
+
+- `pnpm publish` again sends the package's README to the registry as metadata, so registries can render it on the package page. The readme is always included in the published metadata (matching the npm CLI), while the `embed-readme` setting continues to control only whether the readme is written into the `package.json` inside the tarball. This restores the behavior that was lost when publishing became fully native. Closes pnpm/pnpm#12966.
+
+- Updated dependencies:
+  - @pnpm/bins.resolver@1100.0.9
+  - @pnpm/types@1101.4.0
+  - @pnpm/workspace.project-manifest-reader@1100.0.15
+
+## 1100.1.9
+
+### Patch Changes
+
+- Updated dependencies [25c7388]
+  - @pnpm/resolving.jsr-specifier-parser@1100.0.2
+
+## 1100.1.8
+
+### Patch Changes
+
+- Updated dependencies [0ec878d]
+- Updated dependencies [852d537]
+  - @pnpm/workspace.project-manifest-reader@1100.0.14
+  - @pnpm/error@1100.0.1
+  - @pnpm/resolving.jsr-specifier-parser@1100.0.1
+
+## 1100.1.7
+
+### Patch Changes
+
+- e85aea2: Avoid reading `README.md` from disk when publishing if the publish manifest already provides a `readme` field. The README is now only read lazily, inside `createExportableManifest`, when it is actually needed.
+
+## 1100.1.6
+
+### Patch Changes
+
+- Updated dependencies [681b593]
+- Updated dependencies [a31faa7]
+  - @pnpm/types@1101.3.2
+  - @pnpm/workspace.project-manifest-reader@1100.0.13
+  - @pnpm/bins.resolver@1100.0.8
+
+## 1100.1.5
+
+### Patch Changes
+
+- @pnpm/workspace.project-manifest-reader@1100.0.12
+
+## 1100.1.4
+
+### Patch Changes
+
+- Updated dependencies [230df57]
+- Updated dependencies [bf1b731]
+  - @pnpm/bins.resolver@1100.0.7
+  - @pnpm/types@1101.3.1
+  - @pnpm/workspace.project-manifest-reader@1100.0.11
+
+## 1100.1.3
+
+### Patch Changes
+
+- Updated dependencies [a017bf3]
+  - @pnpm/types@1101.3.0
+  - @pnpm/bins.resolver@1100.0.6
+  - @pnpm/workspace.project-manifest-reader@1100.0.10
+
+## 1100.1.2
+
+### Patch Changes
+
+- 33921c8: Normalize a string `repository` field into the `{ type, url }` object form when creating the publish manifest, matching npm's behavior. Some registries (e.g. Gitea/Codeberg) reject a string `repository` with a 500 Internal Server Error during `pnpm publish` [#12099](https://github.com/pnpm/pnpm/issues/12099).
+
+## 1100.1.1
+
+### Patch Changes
+
+- Updated dependencies [a456dc7]
+- Updated dependencies [35d2355]
+  - @pnpm/workspace.project-manifest-reader@1100.0.9
+  - @pnpm/types@1101.2.0
+  - @pnpm/bins.resolver@1100.0.5
+
+## 1100.1.0
+
+### Minor Changes
+
+- 3b62f9d: Add a `skip-manifest-obfuscation` option for `pnpm pack` and `pnpm publish`. When enabled, the original `packageManager` field and publish lifecycle scripts are kept in the packed/published manifest instead of being stripped. The pnpm-specific `pnpm` field continues to be omitted.
+
+### Patch Changes
+
+- Updated dependencies [d7da112]
+  - @pnpm/workspace.project-manifest-reader@1100.0.8
+
+## 1100.0.7
+
+### Patch Changes
+
+- Updated dependencies [64afc92]
+  - @pnpm/types@1101.1.1
+  - @pnpm/workspace.project-manifest-reader@1100.0.7
+  - @pnpm/bins.resolver@1100.0.4
+
+## 1100.0.6
+
+### Patch Changes
+
+- @pnpm/workspace.project-manifest-reader@1100.0.6
+
+## 1100.0.5
+
+### Patch Changes
+
+- @pnpm/workspace.project-manifest-reader@1100.0.5
+
+## 1100.0.4
+
+### Patch Changes
+
+- Updated dependencies [b61e268]
+  - @pnpm/types@1101.1.0
+  - @pnpm/bins.resolver@1100.0.3
+  - @pnpm/workspace.project-manifest-reader@1100.0.4
+
+## 1100.0.3
+
+### Patch Changes
+
+- 184ce26: Fix the package name in README.md.
+- Updated dependencies [184ce26]
+  - @pnpm/workspace.project-manifest-reader@1100.0.3
+  - @pnpm/bins.resolver@1100.0.2
+
+## 1100.0.2
+
+### Patch Changes
+
+- @pnpm/workspace.project-manifest-reader@1100.0.2
+
+## 1100.0.1
+
+### Patch Changes
+
+- Updated dependencies [ff28085]
+  - @pnpm/types@1101.0.0
+  - @pnpm/bins.resolver@1100.0.1
+  - @pnpm/workspace.project-manifest-reader@1100.0.1
+
+## 1001.0.0
+
+### Major Changes
+
+- 491a84f: This package is now pure ESM.
+- 7d2fd48: Node.js v18, 19, 20, and 21 support discontinued.
+
+### Minor Changes
+
+- 29764fb: Add support for a hook called `beforePacking` that can be used to customize the `package.json` contents at publish time [#3816](https://github.com/pnpm/pnpm/issues/3816).
+- 0625e20: Support bare `workspace:` protocol without version specifier. It is now treated as `workspace:*` and resolves to the concrete version during publish [#10436](https://github.com/pnpm/pnpm/pull/10436).
+- cc7c0d2: `pnpm publish` now works without the `npm` CLI.
+
+  The One-time Password feature now reads from `PNPM_CONFIG_OTP` instead of `NPM_CONFIG_OTP`:
+
+  ```sh
+  export PNPM_CONFIG_OTP='<your OTP here>'
+  pnpm publish --no-git-checks
+  ```
+
+  If the registry requests OTP and the user has not provided it via the `PNPM_CONFIG_OTP` environment variable or the `--otp` flag, pnpm will prompt the user directly for an OTP code.
+
+  If the registry requests web-based authentication, pnpm will print a scannable QR code along with the URL.
+
+  Since the new `pnpm publish` no longer calls `npm publish`, some undocumented features may have been unknowingly dropped. If you rely on a feature that is now gone, please open an issue at <https://github.com/pnpm/pnpm/issues>. In the meantime, you can use `pnpm pack && npm publish *.tgz` as a workaround.
+
+- f03b9ec: Allow to override the `engines` field on publish by the `publishConfig.engines` field.
+
+### Patch Changes
+
+- Updated dependencies [449dacf]
+- Updated dependencies [76718b3]
+- Updated dependencies [a8f016c]
+- Updated dependencies [cc1b8e3]
+- Updated dependencies [491a84f]
+- Updated dependencies [13855ac]
+- Updated dependencies [d7b8be4]
+- Updated dependencies [98a5f1c]
+- Updated dependencies [7d2fd48]
+- Updated dependencies [efb48dc]
+- Updated dependencies [cb367b9]
+- Updated dependencies [7b1c189]
+- Updated dependencies [8ffb1a7]
+- Updated dependencies [05fb1ae]
+- Updated dependencies [71de2b3]
+- Updated dependencies [10bc391]
+- Updated dependencies [831f574]
+- Updated dependencies [2df8b71]
+- Updated dependencies [15549a9]
+- Updated dependencies [cc7c0d2]
+- Updated dependencies [efb48dc]
+  - @pnpm/bins.resolver@1001.0.0
+  - @pnpm/types@1001.0.0
+  - @pnpm/workspace.project-manifest-reader@1002.0.0
+  - @pnpm/resolving.jsr-specifier-parser@1001.0.0
+  - @pnpm/catalogs.resolver@1001.0.0
+  - @pnpm/error@1001.0.0
+
+## 1000.1.7
+
+### Patch Changes
+
+- Updated dependencies [7c1382f]
+- Updated dependencies [dee39ec]
+  - @pnpm/types@1000.9.0
+  - @pnpm/read-project-manifest@1001.1.4
+
+## 1000.1.6
+
+### Patch Changes
+
+- @pnpm/read-project-manifest@1001.1.3
+
+## 1000.1.5
+
+### Patch Changes
+
+- @pnpm/error@1000.0.5
+- @pnpm/read-project-manifest@1001.1.2
+- @pnpm/resolving.jsr-specifier-parser@1000.0.3
+
+## 1000.1.4
+
+### Patch Changes
+
+- Updated dependencies [e792927]
+  - @pnpm/types@1000.8.0
+  - @pnpm/read-project-manifest@1001.1.1
+
+## 1000.1.3
+
+### Patch Changes
+
+- Updated dependencies [d1edf73]
+- Updated dependencies [86b33e9]
+  - @pnpm/read-project-manifest@1001.1.0
+  - @pnpm/error@1000.0.4
+  - @pnpm/catalogs.resolver@1000.0.5
+  - @pnpm/resolving.jsr-specifier-parser@1000.0.2
+
+## 1000.1.2
+
+### Patch Changes
+
+- Updated dependencies [1a07b8f]
+- Updated dependencies [1a07b8f]
+- Updated dependencies [1a07b8f]
+  - @pnpm/types@1000.7.0
+  - @pnpm/read-project-manifest@1001.0.0
+  - @pnpm/error@1000.0.3
+  - @pnpm/catalogs.resolver@1000.0.4
+  - @pnpm/resolving.jsr-specifier-parser@1000.0.1
+
+## 1000.1.1
+
+### Patch Changes
+
+- Updated dependencies [5ec7255]
+  - @pnpm/types@1000.6.0
+  - @pnpm/read-project-manifest@1000.0.11
+
+## 1000.1.0
+
+### Minor Changes
+
+- 9c3dd03: **Added support for installing JSR packages.** You can now install JSR packages using the following syntax:
+
+  ```
+  pnpm add jsr:<pkg_name>
+  ```
+
+  or with a version range:
+
+  ```
+  pnpm add jsr:<pkg_name>@<range>
+  ```
+
+  For example, running:
+
+  ```
+  pnpm add jsr:@foo/bar
+  ```
+
+  will add the following entry to your `package.json`:
+
+  ```json
+  {
+    "dependencies": {
+      "@foo/bar": "jsr:^0.1.2"
+    }
+  }
+  ```
+
+  When publishing, this entry will be transformed into a format compatible with npm, older versions of Yarn, and previous pnpm versions:
+
+  ```json
+  {
+    "dependencies": {
+      "@foo/bar": "npm:@jsr/foo__bar@^0.1.2"
+    }
+  }
+  ```
+
+  Related issue: [#8941](https://github.com/pnpm/pnpm/issues/8941).
+
+  Note: The `@jsr` scope defaults to <https://npm.jsr.io/> if the `@jsr:registry` setting is not defined.
+
+### Patch Changes
+
+- Updated dependencies [9c3dd03]
+- Updated dependencies [5b73df1]
+  - @pnpm/resolving.jsr-specifier-parser@1000.0.0
+  - @pnpm/types@1000.5.0
+  - @pnpm/catalogs.resolver@1000.0.3
+  - @pnpm/read-project-manifest@1000.0.10
+
+## 1000.0.10
+
+### Patch Changes
+
+- Updated dependencies [750ae7d]
+  - @pnpm/types@1000.4.0
+  - @pnpm/read-project-manifest@1000.0.9
+
+## 1000.0.9
+
+### Patch Changes
+
+- Updated dependencies [5f7be64]
+- Updated dependencies [5f7be64]
+  - @pnpm/types@1000.3.0
+  - @pnpm/read-project-manifest@1000.0.8
+
+## 1000.0.8
+
+### Patch Changes
+
+- Updated dependencies [a5e4965]
+  - @pnpm/types@1000.2.1
+  - @pnpm/read-project-manifest@1000.0.7
+
+## 1000.0.7
+
+### Patch Changes
+
+- Updated dependencies [8fcc221]
+  - @pnpm/types@1000.2.0
+  - @pnpm/read-project-manifest@1000.0.6
+
+## 1000.0.6
+
+### Patch Changes
+
+- Updated dependencies [1e229d7]
+  - @pnpm/read-project-manifest@1000.0.5
+
+## 1000.0.5
+
+### Patch Changes
+
+- Updated dependencies [b562deb]
+  - @pnpm/types@1000.1.1
+  - @pnpm/error@1000.0.2
+  - @pnpm/read-project-manifest@1000.0.4
+  - @pnpm/catalogs.resolver@1000.0.2
+
+## 1000.0.4
+
+### Patch Changes
+
+- Updated dependencies [e050221]
+  - @pnpm/read-project-manifest@1000.0.3
+
+## 1000.0.3
+
+### Patch Changes
+
+- Updated dependencies [9591a18]
+  - @pnpm/types@1000.1.0
+  - @pnpm/read-project-manifest@1000.0.2
+
+## 1000.0.2
+
+### Patch Changes
+
+- 738d9e4: Fixed `publish`/`pack` error with workspace dependencies with relative paths [#8904](https://github.com/pnpm/pnpm/pull/8904). It was broken in `v9.4.0` ([398472c](https://github.com/pnpm/pnpm/commit/398472c)).
+
+## 1000.0.1
+
+### Patch Changes
+
+- @pnpm/error@1000.0.1
+- @pnpm/catalogs.resolver@1000.0.1
+- @pnpm/read-project-manifest@1000.0.1
+
+## 7.0.7
+
+### Patch Changes
+
+- @pnpm/error@6.0.3
+- @pnpm/catalogs.resolver@0.1.2
+- @pnpm/read-project-manifest@6.0.10
+
+## 7.0.6
+
+### Patch Changes
+
+- @pnpm/error@6.0.2
+- @pnpm/catalogs.resolver@0.1.1
+- @pnpm/read-project-manifest@6.0.9
+
+## 7.0.5
+
+### Patch Changes
+
+- Updated dependencies [d500d9f]
+  - @pnpm/types@12.2.0
+  - @pnpm/read-project-manifest@6.0.8
+
+## 7.0.4
+
+### Patch Changes
+
+- Updated dependencies [7ee59a1]
+  - @pnpm/types@12.1.0
+  - @pnpm/read-project-manifest@6.0.7
+
+## 7.0.3
+
+### Patch Changes
+
+- ecbe2ea: Replace semver in "peerDependency" with workspace protocol [#8355](https://github.com/pnpm/pnpm/issues/8355).
+
+## 7.0.2
+
+### Patch Changes
+
+- Updated dependencies [cb006df]
+  - @pnpm/types@12.0.0
+  - @pnpm/read-project-manifest@6.0.6
+
+## 7.0.1
+
+### Patch Changes
+
+- Updated dependencies [0ef168b]
+  - @pnpm/types@11.1.0
+  - @pnpm/read-project-manifest@6.0.5
+
+## 7.0.0
+
+### Major Changes
+
+- 9c63679: Creating an exportable manifest now requires a `Catalog` object to be passed to `createExportableManifest` in order to replace `catalog:` protocol specifiers.
+
+### Patch Changes
+
+- Updated dependencies [dd00eeb]
+- Updated dependencies
+  - @pnpm/types@11.0.0
+  - @pnpm/read-project-manifest@6.0.4
+
+## 6.1.0
+
+### Minor Changes
+
+- 398472c: Handle workspace protocol with any semver range specifier, when used in peer dependencies [#7578](https://github.com/pnpm/pnpm/issues/7578).
+
+### Patch Changes
+
+- Updated dependencies [13e55b2]
+  - @pnpm/types@10.1.1
+  - @pnpm/read-project-manifest@6.0.3
+
+## 6.0.2
+
+### Patch Changes
+
+- Updated dependencies [45f4262]
+  - @pnpm/types@10.1.0
+  - @pnpm/read-project-manifest@6.0.2
+
+## 6.0.1
+
+### Patch Changes
+
+- Updated dependencies [a7aef51]
+  - @pnpm/error@6.0.1
+  - @pnpm/read-project-manifest@6.0.1
+
+## 6.0.0
+
+### Major Changes
+
+- 43cdd87: Node.js v16 support dropped. Use at least Node.js v18.12.
+- 3477ee5: pnpm will now check the `package.json` file for a `packageManager` field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires.
+
+  To disable this behaviour, set the `package-manager-strict` setting to `false` or the `COREPACK_ENABLE_STRICT` env variable to `0`.
+
+### Patch Changes
+
+- Updated dependencies [7733f3a]
+- Updated dependencies [3ded840]
+- Updated dependencies [43cdd87]
+- Updated dependencies [730929e]
+  - @pnpm/types@10.0.0
+  - @pnpm/error@6.0.0
+  - @pnpm/read-project-manifest@6.0.0
+
+## 5.0.11
+
+### Patch Changes
+
+- Updated dependencies [4d34684f1]
+  - @pnpm/types@9.4.2
+  - @pnpm/read-project-manifest@5.0.10
+
+## 5.0.10
+
+### Patch Changes
+
+- Updated dependencies
+  - @pnpm/types@9.4.1
+  - @pnpm/read-project-manifest@5.0.9
+
+## 5.0.9
+
+### Patch Changes
+
+- Updated dependencies [43ce9e4a6]
+  - @pnpm/types@9.4.0
+  - @pnpm/read-project-manifest@5.0.8
+
+## 5.0.8
+
+### Patch Changes
+
+- Updated dependencies [d774a3196]
+  - @pnpm/types@9.3.0
+  - @pnpm/read-project-manifest@5.0.7
+
+## 5.0.7
+
+### Patch Changes
+
+- @pnpm/read-project-manifest@5.0.6
+
+## 5.0.6
+
+### Patch Changes
+
+- e9aa6f682: Apply fixes from @typescript-eslint v6 for nullish coalescing and optional chains. No behavior changes are expected with this change.
+  - @pnpm/read-project-manifest@5.0.5
+
+## 5.0.5
+
+### Patch Changes
+
+- Updated dependencies [aa2ae8fe2]
+  - @pnpm/types@9.2.0
+  - @pnpm/read-project-manifest@5.0.4
+
+## 5.0.4
+
+### Patch Changes
+
+- Updated dependencies [b4892acc5]
+  - @pnpm/read-project-manifest@5.0.3
+
+## 5.0.3
+
+### Patch Changes
+
+- @pnpm/error@5.0.2
+- @pnpm/read-project-manifest@5.0.2
+
+## 5.0.2
+
+### Patch Changes
+
+- 4b97f1f07: Don't use await in loops.
+
+## 5.0.1
+
+### Patch Changes
+
+- Updated dependencies [a9e0b7cbf]
+  - @pnpm/types@9.1.0
+  - @pnpm/read-project-manifest@5.0.1
+  - @pnpm/error@5.0.1
+
+## 5.0.0
+
+### Major Changes
+
+- eceaa8b8b: Node.js 14 support dropped.
+
+### Patch Changes
+
+- Updated dependencies [eceaa8b8b]
+  - @pnpm/read-project-manifest@5.0.0
+  - @pnpm/error@5.0.0
+  - @pnpm/types@9.0.0
+
+## 4.0.8
+
+### Patch Changes
+
+- @pnpm/read-project-manifest@4.1.4
+
+## 4.0.7
+
+### Patch Changes
+
+- b71c6ed74: Fix version number replacing for namespaced workspace packages. `workspace:@foo/bar@*` should be replaced with `npm:@foo/bar@<version>` on publish [#6052](https://github.com/pnpm/pnpm/pull/6052).
+
+## 4.0.6
+
+### Patch Changes
+
+- @pnpm/error@4.0.1
+- @pnpm/read-project-manifest@4.1.3
+
+## 4.0.5
+
+### Patch Changes
+
+- Updated dependencies [b77651d14]
+  - @pnpm/types@8.10.0
+  - @pnpm/read-project-manifest@4.1.2
+
+## 4.0.4
+
+### Patch Changes
+
+- @pnpm/read-project-manifest@4.1.1
+
+## 4.0.3
+
+### Patch Changes
+
+- Updated dependencies [fec9e3149]
+- Updated dependencies [0d12d38fd]
+  - @pnpm/read-project-manifest@4.1.0
+
+## 4.0.2
+
+### Patch Changes
+
+- Updated dependencies [702e847c1]
+  - @pnpm/types@8.9.0
+  - @pnpm/read-project-manifest@4.0.2
+
+## 4.0.1
+
+### Patch Changes
+
+- Updated dependencies [844e82f3a]
+  - @pnpm/types@8.8.0
+  - @pnpm/read-project-manifest@4.0.1
+
+## 4.0.0
+
+### Major Changes
+
+- 043d988fc: Breaking change to the API. Defaul export is not used.
+- f884689e0: Require `@pnpm/logger` v5.
+
+### Patch Changes
+
+- Updated dependencies [043d988fc]
+- Updated dependencies [f884689e0]
+  - @pnpm/error@4.0.0
+  - @pnpm/read-project-manifest@4.0.0
+
+## 3.1.6
+
+### Patch Changes
+
+- @pnpm/read-project-manifest@3.0.13
+
+## 3.1.5
+
+### Patch Changes
+
+- Updated dependencies [e8a631bf0]
+  - @pnpm/error@3.1.0
+  - @pnpm/read-project-manifest@3.0.12
+
+## 3.1.4
+
+### Patch Changes
+
+- Updated dependencies [d665f3ff7]
+  - @pnpm/types@8.7.0
+  - @pnpm/read-project-manifest@3.0.11
+
+## 3.1.3
+
+### Patch Changes
+
+- Updated dependencies [156cc1ef6]
+  - @pnpm/types@8.6.0
+  - @pnpm/read-project-manifest@3.0.10
+
+## 3.1.2
+
+### Patch Changes
+
+- 8103f92bd: Use a patched version of ramda to fix deprecation warnings on Node.js 16. Related issue: https://github.com/ramda/ramda/pull/3270
+- Updated dependencies [39c040127]
+  - @pnpm/read-project-manifest@3.0.9
+
+## 3.1.1
+
+### Patch Changes
+
+- Updated dependencies [c90798461]
+  - @pnpm/types@8.5.0
+  - @pnpm/read-project-manifest@3.0.8
+
+## 3.1.0
+
+### Minor Changes
+
+- eb2426cf8: Accept the module directory path where the dependency's manifest should be read.
+
+### Patch Changes
+
+- Updated dependencies [01c5834bf]
+  - @pnpm/read-project-manifest@3.0.7
+
+## 3.0.7
+
+### Patch Changes
+
+- 5f643f23b: Update ramda to v0.28.
+
+## 3.0.6
+
+### Patch Changes
+
+- Updated dependencies [8e5b77ef6]
+  - @pnpm/types@8.4.0
+  - @pnpm/read-project-manifest@3.0.6
+
+## 3.0.5
+
+### Patch Changes
+
+- Updated dependencies [2a34b21ce]
+  - @pnpm/types@8.3.0
+  - @pnpm/read-project-manifest@3.0.5
+
+## 3.0.4
+
+### Patch Changes
+
+- Updated dependencies [fb5bbfd7a]
+  - @pnpm/types@8.2.0
+  - @pnpm/read-project-manifest@3.0.4
+
+## 3.0.3
+
+### Patch Changes
+
+- Updated dependencies [4d39e4a0c]
+  - @pnpm/types@8.1.0
+  - @pnpm/read-project-manifest@3.0.3
+
+## 3.0.2
+
+### Patch Changes
+
+- 18ba5e2c0: Add typesVersions to PUBLISH_CONFIG_WHITELIST
+- Updated dependencies [18ba5e2c0]
+  - @pnpm/types@8.0.1
+  - @pnpm/read-project-manifest@3.0.2
+
+## 3.0.1
+
+### Patch Changes
+
+- @pnpm/error@3.0.1
+- @pnpm/read-project-manifest@3.0.1
+
+## 3.0.0
+
+### Major Changes
+
+- 542014839: Node.js 12 is not supported.
+
+### Patch Changes
+
+- Updated dependencies [d504dc380]
+- Updated dependencies [542014839]
+  - @pnpm/types@8.0.0
+  - @pnpm/error@3.0.0
+  - @pnpm/read-project-manifest@3.0.0
+
+## 2.3.2
+
+### Patch Changes
+
+- Updated dependencies [70ba51da9]
+  - @pnpm/error@2.1.0
+  - @pnpm/read-project-manifest@2.0.13
+
+## 2.3.1
+
+### Patch Changes
+
+- Updated dependencies [b138d048c]
+  - @pnpm/types@7.10.0
+  - @pnpm/read-project-manifest@2.0.12
+
+## 2.3.0
+
+### Minor Changes
+
+- e1b459008: Remove meaningless keys from `publishConfig` when the `pack` or `publish` commands are used [#4311](https://github.com/pnpm/pnpm/issues/4311)
+
+## 2.2.4
+
+### Patch Changes
+
+- Updated dependencies [26cd01b88]
+  - @pnpm/types@7.9.0
+  - @pnpm/read-project-manifest@2.0.11
+
+## 2.2.3
+
+### Patch Changes
+
+- Updated dependencies [b5734a4a7]
+  - @pnpm/types@7.8.0
+  - @pnpm/read-project-manifest@2.0.10
+
+## 2.2.2
+
+### Patch Changes
+
+- 6493e0c93: add readme file to published package.json file
+- Updated dependencies [6493e0c93]
+  - @pnpm/types@7.7.1
+  - @pnpm/read-project-manifest@2.0.9
+
+## 2.2.1
+
+### Patch Changes
+
+- Updated dependencies [ba9b2eba1]
+  - @pnpm/types@7.7.0
+  - @pnpm/read-project-manifest@2.0.8
+
+## 2.2.0
+
+### Minor Changes
+
+- 6428690e2: Allow to set `os` and `cpu` in `publishConfig`.
+
+## 2.1.8
+
+### Patch Changes
+
+- Updated dependencies [302ae4f6f]
+  - @pnpm/types@7.6.0
+  - @pnpm/read-project-manifest@2.0.7
+
+## 2.1.7
+
+### Patch Changes
+
+- Updated dependencies [4ab87844a]
+  - @pnpm/types@7.5.0
+  - @pnpm/read-project-manifest@2.0.6
+
+## 2.1.6
+
+### Patch Changes
+
+- Updated dependencies [b734b45ea]
+  - @pnpm/types@7.4.0
+  - @pnpm/read-project-manifest@2.0.5
+
+## 2.1.5
+
+### Patch Changes
+
+- Updated dependencies [8e76690f4]
+  - @pnpm/types@7.3.0
+  - @pnpm/read-project-manifest@2.0.4
+
+## 2.1.4
+
+### Patch Changes
+
+- Updated dependencies [724c5abd8]
+  - @pnpm/types@7.2.0
+  - @pnpm/read-project-manifest@2.0.3
+
+## 2.1.3
+
+### Patch Changes
+
+- a1a03d145: Import only the required functions from ramda.
+
+## 2.1.2
+
+### Patch Changes
+
+- 6a1468495: Adds support for `type` and `imports` in publishConfig
+
+## 2.1.1
+
+### Patch Changes
+
+- @pnpm/read-project-manifest@2.0.2
+
+## 2.1.0
+
+### Minor Changes
+
+- 85fb21a83: Add support for workspace:^ and workspace:~ aliases
+
+### Patch Changes
+
+- Updated dependencies [6e9c112af]
+- Updated dependencies [97c64bae4]
+  - @pnpm/read-project-manifest@2.0.1
+  - @pnpm/types@7.1.0
+
+## 2.0.1
+
+### Patch Changes
+
+- 561276d2c: Remove publish lifecycle events from manifest to avoid npm running them.
+
+## 2.0.0
+
+### Major Changes
+
+- 97b986fbc: Node.js 10 support is dropped. At least Node.js 12.17 is required for the package to work.
+
+### Patch Changes
+
+- Updated dependencies [97b986fbc]
+  - @pnpm/error@2.0.0
+  - @pnpm/read-project-manifest@2.0.0
+  - @pnpm/types@7.0.0
+
+## 1.2.2
+
+### Patch Changes
+
+- Updated dependencies [ad113645b]
+  - @pnpm/read-project-manifest@1.1.7
+
+## 1.2.1
+
+### Patch Changes
+
+- Updated dependencies [9ad8c27bf]
+  - @pnpm/types@6.4.0
+  - @pnpm/read-project-manifest@1.1.6
+
+## 1.2.0
+
+### Minor Changes
+
+- c854f8547: Remove the "pnpm" property that stores pnpm settings from the manifest.
+
+## 1.1.0
+
+### Minor Changes
+
+- 284e95c5e: Convert relative workspace paths to version specs.
+- 084614f55: Support aliases to workspace packages. For instance, `"foo": "workspace:bar@*"` will link bar from the repository but aliased to foo. Before publish, these specs are converted to regular aliased versions.
+
+## 1.0.8
+
+### Patch Changes
+
+- Updated dependencies [0c5f1bcc9]
+  - @pnpm/error@1.4.0
+  - @pnpm/read-project-manifest@1.1.5
+
+## 1.0.7
+
+### Patch Changes
+
+- @pnpm/read-project-manifest@1.1.4
+
+## 1.0.6
+
+### Patch Changes
+
+- @pnpm/read-project-manifest@1.1.3
+
+## 1.0.5
+
+### Patch Changes
+
+- Updated dependencies [b5d694e7f]
+  - @pnpm/types@6.3.1
+  - @pnpm/read-project-manifest@1.1.2
+
+## 1.0.4
+
+### Patch Changes
+
+- Updated dependencies [d54043ee4]
+  - @pnpm/types@6.3.0
+  - @pnpm/read-project-manifest@1.1.1
+
+## 1.0.3
+
+### Patch Changes
+
+- Updated dependencies [2762781cc]
+  - @pnpm/read-project-manifest@1.1.0
+
+## 1.0.2
+
+### Patch Changes
+
+- Updated dependencies [75a36deba]
+  - @pnpm/error@1.3.1
+  - @pnpm/read-project-manifest@1.0.13
+
+## 1.0.1
+
+### Patch Changes
+
+- Updated dependencies [6d480dd7a]
+  - @pnpm/error@1.3.0
+  - @pnpm/read-project-manifest@1.0.12
+
+## 1.0.0
+
+### Major Changes
+
+- edf1f412e: Package created.

package/lib/index.d.ts

@@ -11,6 +11,7 @@ export interface MakePublishManifestOptions {
     embedReadme?: boolean;
 }
 export declare function createExportableManifest(dir: string, originalManifest: ProjectManifest, opts: MakePublishManifestOptions): Promise<ExportedManifest>;
+export declare function readReadmeFile(projectDir: string): Promise<string | undefined>;
 export type PublishDependencyConverter = (depName: string, depSpec: string, dir: string, modulesDir?: string) => Promise<string> | string;
 export interface MakePublishDependenciesOpts {
     readonly modulesDir?: string;

package/lib/index.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import util from 'node:util';
 import { resolveFromCatalog } from '@pnpm/catalogs.resolver';
 import { PnpmError } from '@pnpm/error';
 import { parseJsrSpecifier } from '@pnpm/resolving.jsr-specifier-parser';
@@ -17,15 +18,6 @@ const PREPUBLISH_SCRIPTS = [
     'publish',
     'postpublish',
 ];
-async function readReadmeFile(projectDir) {
-    const entries = await fs.promises.readdir(projectDir, { withFileTypes: true });
-    // Only embed a regular README.md file. A symlink could point outside the
-    // project and leak its target's contents into the published manifest.
-    const readmeEntry = entries.find((entry) => entry.isFile() && /^readme\.md$/i.test(entry.name));
-    if (readmeEntry == null)
-        return undefined;
-    return fs.promises.readFile(path.join(projectDir, readmeEntry.name), 'utf8');
-}
 export async function createExportableManifest(dir, originalManifest, opts) {
     let publishManifest;
     if (opts.skipManifestObfuscation) {
@@ -70,6 +62,33 @@ export async function createExportableManifest(dir, originalManifest, opts) {
     }
     return transform(publishManifest);
 }
+// `O_NOFOLLOW` makes the open itself refuse a symlink at the final path component, closing the
+// TOCTOU window between the `readdir` type check and the read: a symlink swapped in for README.md
+// after the check can't redirect the read outside the project and leak its target into the
+// published manifest. Windows lacks the flag (and requires privileges to create symlinks), so it
+// falls back to a plain read.
+const README_READ_FLAGS = fs.constants.O_RDONLY | (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW);
+export async function readReadmeFile(projectDir) {
+    const entries = await fs.promises.readdir(projectDir, { withFileTypes: true });
+    // Only embed a regular README.md file — a symlink is skipped (see README_READ_FLAGS).
+    const readmeEntry = entries.find((entry) => entry.isFile() && /^readme\.md$/i.test(entry.name));
+    if (readmeEntry == null)
+        return undefined;
+    let handle;
+    try {
+        handle = await fs.promises.open(path.join(projectDir, readmeEntry.name), README_READ_FLAGS);
+        return await handle.readFile('utf8');
+    }
+    catch (err) {
+        // ELOOP: the entry is a symlink after all (a concurrent swap) — skip it, as the isFile() check intended.
+        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ELOOP')
+            return undefined;
+        throw err;
+    }
+    finally {
+        await handle?.close();
+    }
+}
 function combineConverters(...converters) {
     return async (depName, depSpec, dir, modulesDir) => {
         let bareSpecifier = depSpec;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/releasing.exportable-manifest",
-  "version": "1100.1.8",
+  "version": "1100.1.10",
   "description": "Creates an exportable manifest",
   "keywords": [
     "pnpm",
@@ -28,26 +28,26 @@
   ],
   "dependencies": {
     "@npm/types": "^2.1.0",
-    "p-map-values": "^0.1.0",
-    "ramda": "npm:@pnpm/ramda@0.28.1",
-    "@pnpm/bins.resolver": "1100.0.8",
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.1",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.14",
+    "@pnpm/bins.resolver": "1100.0.9",
     "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/types": "1101.3.2"
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.2",
+    "@pnpm/types": "1101.4.0",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.15",
+    "p-map-values": "^0.1.0",
+    "ramda": "npm:@pnpm/ramda@0.28.1"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
+    "@pnpm/catalogs.config": "1100.0.2",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/hooks.pnpmfile": "1100.0.19",
+    "@pnpm/prepare": "1100.0.19",
+    "@pnpm/releasing.exportable-manifest": "1100.1.10",
     "@types/cross-spawn": "^6.0.6",
     "@types/ramda": "0.31.1",
     "cross-spawn": "^7.0.6",
-    "write-yaml-file": "^6.0.0",
-    "@pnpm/catalogs.config": "1100.0.2",
-    "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/hooks.pnpmfile": "1100.0.16",
-    "@pnpm/releasing.exportable-manifest": "1100.1.8",
-    "@pnpm/prepare": "1100.0.17"
+    "write-yaml-file": "^6.0.0"
   },
   "engines": {
     "node": ">=22.13"