@pnpm/resolving.npm-resolver 1004.4.1 → 1100.0.0

package/lib/fetch.d.ts

@@ -4,6 +4,11 @@ import type { PackageMeta } from '@pnpm/resolving.registry.types';
 export interface FetchMetadataResult {
     meta: PackageMeta;
     jsonText: string;
+    etag?: string;
+    notModified?: false;
+}
+export interface FetchMetadataNotModifiedResult {
+    notModified: true;
 }
 export declare class RegistryResponseError extends FetchError {
     readonly pkgName: string;
@@ -19,5 +24,7 @@ export interface FetchMetadataOptions {
     registry: string;
     authHeaderValue?: string;
     fullMetadata?: boolean;
+    etag?: string;
+    modified?: string;
 }
-export declare function fetchMetadataFromFromRegistry(fetchOpts: FetchMetadataFromFromRegistryOptions, pkgName: string, { authHeaderValue, fullMetadata, registry }: FetchMetadataOptions): Promise<FetchMetadataResult>;
+export declare function fetchMetadataFromFromRegistry(fetchOpts: FetchMetadataFromFromRegistryOptions, pkgName: string, { authHeaderValue, etag: cachedEtag, fullMetadata, modified: cachedModified, registry }: FetchMetadataOptions): Promise<FetchMetadataResult | FetchMetadataNotModifiedResult>;

package/lib/fetch.js

@@ -21,7 +21,7 @@ export class RegistryResponseError extends FetchError {
         this.pkgName = pkgName;
     }
 }
-export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHeaderValue, fullMetadata, registry, }) {
+export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHeaderValue, etag: cachedEtag, fullMetadata, modified: cachedModified, registry, }) {
     const uri = toUri(pkgName, registry);
     const op = retry.operation(fetchOpts.retry);
     return new Promise((resolve, reject) => {
@@ -33,12 +33,18 @@ export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHe
                     authHeaderValue,
                     compress: true,
                     fullMetadata,
+                    ifNoneMatch: cachedEtag,
+                    ifModifiedSince: cachedModified ? new Date(cachedModified).toUTCString() : undefined,
                     retry: fetchOpts.retry,
                     timeout: fetchOpts.timeout,
                 });
             }
             catch (error) { // eslint-disable-line
-                reject(new PnpmError('META_FETCH_FAIL', `GET ${uri}: ${error.message}`, { attempts: attempt }));
+                reject(new PnpmError('META_FETCH_FAIL', `GET ${uri}: ${error.message}`, { attempts: attempt, cause: error }));
+                return;
+            }
+            if (response.status === 304) {
+                resolve({ notModified: true });
                 return;
             }
             if (response.status >= 400) {
@@ -59,7 +65,11 @@ export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHe
                 if (elapsedMs > fetchOpts.fetchWarnTimeoutMs) {
                     globalWarn(`Request took ${elapsedMs}ms: ${uri}`);
                 }
-                resolve({ meta, jsonText });
+                resolve({
+                    meta,
+                    jsonText,
+                    etag: response.headers.get('etag') ?? undefined,
+                });
             }
             catch (error) { // eslint-disable-line
                 const timeout = op.retry(new PnpmError('BROKEN_METADATA_JSON', error.message));
@@ -67,9 +77,17 @@ export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHe
                     reject(op.mainError());
                     return;
                 }
+                // Extract error properties into a plain object because Error properties
+                // are non-enumerable and don't serialize well through the logging system
+                const errorInfo = {
+                    name: error.name,
+                    message: error.message,
+                    code: error.code,
+                    errno: error.errno,
+                };
                 requestRetryLogger.debug({
                     attempt,
-                    error,
+                    error: errorInfo,
                     maxRetries: fetchOpts.retry.retries,
                     method: 'GET',
                     timeout,

package/lib/index.d.ts

@@ -3,9 +3,10 @@ import type { FetchFromRegistry, GetAuthHeader, RetryTimeoutOptions } from '@pnp
 import type { PackageMeta } from '@pnpm/resolving.registry.types';
 import type { DirectoryResolution, PkgResolutionId, PreferredVersions, ResolveResult, TarballResolution, WantedDependency, WorkspacePackages } from '@pnpm/resolving.resolver-base';
 import type { DependencyManifest, PackageVersionPolicy, PinnedVersion, Registries, TrustPolicy } from '@pnpm/types';
-import { RegistryResponseError } from './fetch.js';
+import { fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, RegistryResponseError } from './fetch.js';
 import { parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
 import { type PackageMetaCache, pickPackage, type PickPackageOptions } from './pickPackage.js';
+import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
 export interface NoMatchingVersionErrorOptions {
     wantedDependency: WantedDependency;
@@ -19,7 +20,7 @@ export declare class NoMatchingVersionError extends PnpmError {
     readonly immatureVersion?: string;
     constructor(opts: NoMatchingVersionErrorOptions);
 }
-export { type PackageMeta, type PackageMetaCache, parseBareSpecifier, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
+export { fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
 export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export interface ResolverFactoryOptions {
     cacheDir: string;

package/lib/index.js

@@ -6,7 +6,7 @@ import { readPkgFromCafs, } from '@pnpm/worker';
 import { resolveWorkspaceRange } from '@pnpm/workspace.range-resolver';
 import { LRUCache } from 'lru-cache';
 import normalize from 'normalize-path';
-import pMemoize from 'p-memoize';
+import pMemoize, { pMemoizeClear } from 'p-memoize';
 import { clone } from 'ramda';
 import semver from 'semver';
 import ssri from 'ssri';
@@ -15,7 +15,7 @@ import { fetchMetadataFromFromRegistry, RegistryResponseError } from './fetch.js
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
 import { parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
 import { pickPackage, } from './pickPackage.js';
-import { pickVersionByVersionRange } from './pickPackageFromMeta.js';
+import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
 import { whichVersionIsPinned } from './whichVersionIsPinned.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
@@ -59,7 +59,7 @@ function formatTimeAgo(date) {
     }
     return `${diffMinutes} minute${diffMinutes === 1 ? '' : 's'} ago`;
 }
-export { parseBareSpecifier, RegistryResponseError, workspacePrefToNpm, };
+export { fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
 export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     if (typeof opts.cacheDir !== 'string') {
@@ -124,6 +124,7 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
         resolveFromJsr: resolveJsr.bind(null, ctx),
         clearCache: () => {
             metaCache.clear();
+            pMemoizeClear(fetch);
         },
     };
 }

package/lib/pickPackage.d.ts

@@ -1,5 +1,5 @@
 import type { PackageInRegistry, PackageMeta } from '@pnpm/resolving.registry.types';
-import type { FetchMetadataResult } from './fetch.js';
+import type { FetchMetadataNotModifiedResult, FetchMetadataResult } from './fetch.js';
 import type { RegistryPackageSpec } from './parseBareSpecifier.js';
 import { type PickPackageFromMetaOptions } from './pickPackageFromMeta.js';
 export interface PackageMetaCache {
@@ -20,7 +20,9 @@ export declare function pickPackage(ctx: {
         registry: string;
         authHeaderValue?: string;
         fullMetadata?: boolean;
-    }) => Promise<FetchMetadataResult>;
+        etag?: string;
+        modified?: string;
+    }) => Promise<FetchMetadataResult | FetchMetadataNotModifiedResult>;
     fullMetadata?: boolean;
     metaCache: PackageMetaCache;
     cacheDir: string;

package/lib/pickPackage.js

@@ -91,7 +91,7 @@ export async function pickPackage(ctx, spec, opts) {
         };
     }
     const registryName = getRegistryName(opts.registry);
-    const pkgMirror = path.join(ctx.cacheDir, metaDir, registryName, `${encodePkgName(spec.name)}.json`);
+    const pkgMirror = path.join(ctx.cacheDir, metaDir, registryName, `${encodePkgName(spec.name)}.jsonl`);
     return runLimited(pkgMirror, async (limit) => {
         let metaCachedInStore;
         if (ctx.offline === true || ctx.preferOffline === true || opts.pickLowestVersion) {
@@ -136,51 +136,106 @@ export async function pickPackage(ctx, spec, opts) {
             }
         }
         if (opts.publishedBy) {
-            metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
-            if (metaCachedInStore?.cachedAt && new Date(metaCachedInStore.cachedAt) >= opts.publishedBy) {
-                try {
-                    const pickedPackage = _pickPackageFromMeta(metaCachedInStore);
-                    if (pickedPackage) {
-                        return {
-                            meta: metaCachedInStore,
-                            pickedPackage,
-                        };
+            const mtime = await limit(async () => getFileMtime(pkgMirror));
+            if (mtime != null && mtime >= opts.publishedBy) {
+                metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
+                if (metaCachedInStore != null) {
+                    try {
+                        const pickedPackage = _pickPackageFromMeta(metaCachedInStore);
+                        if (pickedPackage) {
+                            return {
+                                meta: metaCachedInStore,
+                                pickedPackage,
+                            };
+                        }
                     }
-                }
-                catch (err) {
-                    if (ctx.strictPublishedByCheck) {
-                        throw err;
+                    catch (err) {
+                        // Don't rethrow ERR_PNPM_MISSING_TIME from cached abbreviated metadata —
+                        // let the code fall through to the network fetch path which will get full metadata.
+                        if (ctx.strictPublishedByCheck &&
+                            !(isMissingTimeError(err))) {
+                            throw err;
+                        }
                     }
                 }
             }
         }
         try {
-            const fetchResult = await ctx.fetch(spec.name, {
+            // Load only the cache headers (etag, modified) for conditional request headers.
+            // This avoids reading and parsing the full metadata file (which can be megabytes)
+            // when the registry returns 200 and the old metadata would be discarded anyway.
+            const cacheHeaders = metaCachedInStore != null
+                ? { etag: metaCachedInStore.etag, modified: metaCachedInStore.modified ?? metaCachedInStore.time?.modified }
+                : await limit(async () => loadMetaHeaders(pkgMirror));
+            let fetchResult = await ctx.fetch(spec.name, {
                 authHeaderValue: opts.authHeaderValue,
                 fullMetadata,
+                etag: cacheHeaders?.etag,
+                modified: cacheHeaders?.modified,
                 registry: opts.registry,
             });
-            const cachedAt = Date.now();
+            // 304 Not Modified — registry confirmed local cache is still fresh.
+            // Now we need the full metadata, so load it from disk.
+            if (fetchResult.notModified) {
+                metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
+                if (metaCachedInStore != null) {
+                    ctx.metaCache.set(cacheKey, metaCachedInStore);
+                    return {
+                        meta: metaCachedInStore,
+                        pickedPackage: _pickPackageFromMeta(metaCachedInStore),
+                    };
+                }
+                throw new PnpmError('CACHE_MISSING_AFTER_304', `Metadata cache for ${spec.name} is unreadable after receiving 304 Not Modified`);
+            }
             let meta = fetchResult.meta;
-            let jsonToSave;
+            let resultToSave = fetchResult;
+            // When minimumReleaseAge is active and we fetched abbreviated metadata,
+            // check if the package was recently modified and needs full metadata
+            // for per-version time-based filtering.
+            //
+            // This two-step approach is intentional: abbreviated metadata is much smaller,
+            // and most packages won't have been modified recently enough to need the full
+            // document. We only upgrade to full metadata when the package's modification
+            // date is recent enough that some versions might not yet be "mature."
+            if (opts.publishedBy &&
+                !fullMetadata &&
+                meta.time == null &&
+                opts.publishedByExclude?.(spec.name) !== true) {
+                const modifiedDate = meta.modified ? new Date(meta.modified) : null;
+                const isModifiedValid = modifiedDate != null && !Number.isNaN(modifiedDate.getTime());
+                if (!isModifiedValid || modifiedDate >= opts.publishedBy) {
+                    // Save the abbreviated metadata to the abbreviated cache before re-fetching full.
+                    if (!opts.dryRun) {
+                        const abbreviatedJson = prepareJsonForDisk(fetchResult.meta, fetchResult.etag, fetchResult.jsonText);
+                        // Fire-and-forget save to the abbreviated cache path (pkgMirror).
+                        runLimited(pkgMirror, (limit) => limit(async () => {
+                            try {
+                                await saveMeta(pkgMirror, abbreviatedJson);
+                            }
+                            catch (err) { // eslint-disable-line
+                                // We don't care if this file was not written to the cache
+                            }
+                        }));
+                    }
+                    const fullFetchResult = await ctx.fetch(spec.name, {
+                        authHeaderValue: opts.authHeaderValue,
+                        fullMetadata: true,
+                        registry: opts.registry,
+                    });
+                    if (!fullFetchResult.notModified) {
+                        resultToSave = fullFetchResult;
+                        meta = fullFetchResult.meta;
+                    }
+                }
+            }
             if (ctx.filterMetadata) {
                 meta = clearMeta(meta);
             }
-            else if (typeof fetchResult.jsonText === 'string') {
-                // Reuse the raw JSON text from the registry response to avoid re-stringifying.
-                // Inject cachedAt at the start of the JSON object. To be robust against BOMs or
-                // leading whitespace/newlines, locate the first '{' and splice after it.
-                const jsonText = fetchResult.jsonText;
-                const firstBraceIndex = jsonText.indexOf('{');
-                if (firstBraceIndex !== -1) {
-                    jsonToSave = `{"cachedAt":${cachedAt},${jsonText.slice(firstBraceIndex + 1)}`;
-                }
-            }
-            meta.cachedAt = cachedAt;
-            // only save meta to cache, when it is fresh
-            ctx.metaCache.set(cacheKey, meta);
             if (!opts.dryRun) {
-                const jsonForDisk = jsonToSave ?? JSON.stringify(meta);
+                // Serialize before setting meta.etag so it only lives in the headers line, not the body.
+                const jsonForDisk = ctx.filterMetadata
+                    ? prepareJsonForDisk(meta, resultToSave.etag)
+                    : prepareJsonForDisk(resultToSave.meta, resultToSave.etag, resultToSave.jsonText);
                 runLimited(pkgMirror, (limit) => limit(async () => {
                     try {
                         await saveMeta(pkgMirror, jsonForDisk);
@@ -190,6 +245,9 @@ export async function pickPackage(ctx, spec, opts) {
                     }
                 }));
             }
+            meta.etag = resultToSave.etag;
+            // only save meta to cache, when it is fresh
+            ctx.metaCache.set(cacheKey, meta);
             return {
                 meta,
                 pickedPackage: _pickPackageFromMeta(meta),
@@ -241,7 +299,7 @@ function clearMeta(pkg) {
         'dist-tags': pkg['dist-tags'],
         versions,
         time: pkg.time,
-        cachedAt: pkg.cachedAt,
+        modified: pkg.modified,
     };
 }
 function encodePkgName(pkgName) {
@@ -250,10 +308,75 @@ function encodePkgName(pkgName) {
     }
     return pkgName;
 }
+/**
+ * Formats metadata for disk storage as two-line NDJSON:
+ *   Line 1: cache headers (etag, modified) — small, fast to read
+ *   Line 2: the full registry metadata JSON — unchanged from the registry response
+ */
+function prepareJsonForDisk(meta, etag, jsonText) {
+    const modified = meta.modified ?? meta.time?.modified;
+    const headers = JSON.stringify({ etag, modified });
+    const body = jsonText ?? JSON.stringify(meta);
+    return `${headers}\n${body}`;
+}
+function isMissingTimeError(err) {
+    return (err != null &&
+        typeof err === 'object' &&
+        'code' in err &&
+        err.code === 'ERR_PNPM_MISSING_TIME');
+}
+async function getFileMtime(filePath) {
+    try {
+        const stat = await fs.stat(filePath);
+        return stat.mtime;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Reads only the first line of the cached NDJSON metadata file to extract
+ * the cache headers (etag, modified). This avoids reading and
+ * parsing the full metadata (which can be megabytes for popular packages)
+ * when we only need conditional-request headers.
+ */
+async function loadMetaHeaders(pkgMirror) {
+    let fh;
+    try {
+        fh = await fs.open(pkgMirror, 'r');
+        // The first line (headers JSON) is typically ~100 bytes; 1 KB is plenty.
+        const buf = Buffer.alloc(1024);
+        const { bytesRead } = await fh.read(buf, 0, 1024, 0);
+        if (bytesRead === 0)
+            return null;
+        const chunk = buf.toString('utf8', 0, bytesRead);
+        const newlineIdx = chunk.indexOf('\n');
+        if (newlineIdx === -1)
+            return null;
+        return JSON.parse(chunk.slice(0, newlineIdx));
+    }
+    catch {
+        return null;
+    }
+    finally {
+        await fh?.close();
+    }
+}
+/**
+ * Reads the full metadata from the cached NDJSON file.
+ * Line 1: cache headers (etag, modified)
+ * Line 2: registry metadata JSON
+ */
 async function loadMeta(pkgMirror) {
     try {
         const data = await gfs.readFile(pkgMirror, 'utf8');
-        return JSON.parse(data);
+        const newlineIdx = data.indexOf('\n');
+        if (newlineIdx === -1)
+            return null;
+        const headers = JSON.parse(data.slice(0, newlineIdx));
+        const meta = JSON.parse(data.slice(newlineIdx + 1));
+        meta.etag = headers.etag;
+        return meta;
     }
     catch {
         return null;

package/lib/pickPackageFromMeta.js

@@ -6,9 +6,22 @@ export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVers
     if (publishedBy) {
         const excludeResult = publishedByExclude?.(meta.name) ?? false;
         if (excludeResult !== true) {
-            assertMetaHasTime(meta);
-            const trustedVersions = Array.isArray(excludeResult) ? excludeResult : undefined;
-            meta = filterPkgMetadataByPublishDate(meta, publishedBy, trustedVersions);
+            if (meta.time != null) {
+                // Full metadata with per-version timestamps: filter normally
+                assertMetaHasTime(meta);
+                const trustedVersions = Array.isArray(excludeResult) ? excludeResult : undefined;
+                meta = filterPkgMetadataByPublishDate(meta, publishedBy, trustedVersions);
+            }
+            else {
+                const modifiedDate = parseModifiedDate(meta.modified);
+                if (modifiedDate == null || modifiedDate >= publishedBy) {
+                    // Abbreviated metadata without per-version timestamps, and the package
+                    // was recently modified (or has no/invalid modified field). We cannot determine
+                    // which individual versions are mature enough — need full metadata.
+                    assertMetaHasTime(meta);
+                }
+                // else: meta.modified < publishedBy — all versions are old enough, no filtering needed
+            }
         }
     }
     if ((!meta.versions || Object.keys(meta.versions).length === 0) && !publishedBy) {
@@ -57,7 +70,7 @@ export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVers
             err.code.startsWith('ERR_PNPM_')) {
             throw err;
         }
-        throw new PnpmError('MALFORMED_METADATA', `Received malformed metadata for "${spec.name}"`, { hint: 'This might mean that the package was unpublished from the registry' });
+        throw new PnpmError('MALFORMED_METADATA', `Received malformed metadata for "${spec.name}"`, { hint: 'This might mean that the package was unpublished from the registry', cause: err });
     }
 }
 export function assertMetaHasTime(meta) {
@@ -65,6 +78,14 @@ export function assertMetaHasTime(meta) {
         throw new PnpmError('MISSING_TIME', `The metadata of ${meta.name} is missing the "time" field`);
     }
 }
+function parseModifiedDate(modified) {
+    if (!modified)
+        return null;
+    const date = new Date(modified);
+    if (Number.isNaN(date.getTime()))
+        return null;
+    return date;
+}
 const semverRangeCache = new Map();
 // This is a performance optimization; working with string-ish semver
 // causes lots of allocations and repeated work, but caching the Range

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1004.4.1",
+  "version": "1100.0.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -28,52 +28,52 @@
   "dependencies": {
     "@zkochan/retry": "^0.2.0",
     "encode-registry": "^3.0.1",
-    "lru-cache": "^11.1.0",
+    "lru-cache": "^11.2.7",
     "normalize-path": "^3.0.0",
     "p-limit": "^7.1.0",
     "p-memoize": "8.0.0",
     "parse-npm-tarball-url": "^4.0.0",
     "path-temp": "^3.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "rename-overwrite": "^7.0.0",
+    "rename-overwrite": "^7.0.1",
     "semver": "^7.7.2",
     "semver-utils": "^1.1.4",
-    "ssri": "13.0.0",
+    "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/config.pick-registry-for-package": "1000.0.11",
-    "@pnpm/core-loggers": "1001.0.4",
-    "@pnpm/constants": "1001.3.1",
-    "@pnpm/error": "1000.0.5",
-    "@pnpm/fs.graceful-fs": "1000.0.1",
-    "@pnpm/crypto.hash": "1000.2.1",
-    "@pnpm/resolving.jsr-specifier-parser": "1000.0.3",
-    "@pnpm/fetching.types": "1000.2.0",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1000.1.1",
-    "@pnpm/resolving.resolver-base": "1005.1.0",
-    "@pnpm/resolving.registry.types": "1000.0.1",
-    "@pnpm/store.cafs": "1000.0.19",
-    "@pnpm/store.index": "1000.0.0-0",
-    "@pnpm/types": "1000.9.0",
-    "@pnpm/workspace.spec-parser": "1000.0.0",
-    "@pnpm/workspace.range-resolver": "1000.0.0"
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/config.pick-registry-for-package": "1100.0.0",
+    "@pnpm/core-loggers": "1100.0.0",
+    "@pnpm/crypto.hash": "1100.0.0",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/fetching.types": "1100.0.0",
+    "@pnpm/fs.graceful-fs": "1100.0.0",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
+    "@pnpm/resolving.registry.types": "1100.0.0",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.0",
+    "@pnpm/resolving.resolver-base": "1100.0.0",
+    "@pnpm/types": "1100.0.0",
+    "@pnpm/store.index": "1100.0.0",
+    "@pnpm/store.cafs": "1100.0.0",
+    "@pnpm/workspace.spec-parser": "1100.0.0",
+    "@pnpm/workspace.range-resolver": "1100.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1000.3.0"
+    "@pnpm/worker": "^1100.0.0"
   },
   "devDependencies": {
     "@types/normalize-path": "^3.0.2",
-    "@types/ramda": "0.29.12",
+    "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/ssri": "^7.1.5",
     "load-json-file": "^7.0.1",
-    "nock": "13.3.4",
     "tempy": "3.0.0",
-    "@pnpm/config.version-policy": "1000.0.0",
-    "@pnpm/network.fetch": "1000.2.6",
-    "@pnpm/logger": "1001.0.1",
-    "@pnpm/resolving.npm-resolver": "1004.4.1",
-    "@pnpm/test-fixtures": "1000.0.0"
+    "@pnpm/config.version-policy": "1100.0.0",
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/network.fetch": "1100.0.0",
+    "@pnpm/testing.mock-agent": "1100.0.0",
+    "@pnpm/resolving.npm-resolver": "1100.0.0",
+    "@pnpm/test-fixtures": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"
@@ -83,8 +83,8 @@
   },
   "scripts": {
     "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
-    "_test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
-    "test": "pnpm run compile && pnpm run _test",
-    "compile": "tsgo --build && pnpm run lint --fix"
+    "test": "pn compile && pn .test",
+    "compile": "tsgo --build && pn lint --fix",
+    ".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
   }
 }