@pnpm/resolving.npm-resolver 1100.0.1 → 1101.0.0

package/lib/index.d.ts

@@ -35,7 +35,12 @@ export interface ResolverFactoryOptions {
     saveWorkspaceProtocol?: boolean | 'rolling';
     preserveAbsolutePaths?: boolean;
     strictPublishedByCheck?: boolean;
+    ignoreMissingTimeField?: boolean;
     fetchWarnTimeoutMs?: number;
+    /** Pre-populated metadata cache. When provided, the resolver uses this
+     *  instead of creating a new LRU cache. Useful for servers that keep
+     *  metadata in SQLite or persist it across requests. */
+    metaCache?: PackageMetaCache;
 }
 export interface NpmResolveResult extends ResolveResult {
     latest?: string;

package/lib/index.js

@@ -74,7 +74,7 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     const fetch = pMemoize(fetchMetadataFromFromRegistry.bind(null, fetchOpts), {
         cacheKey: (...args) => JSON.stringify(args),
     });
-    const metaCache = new LRUCache({
+    const metaCache = opts.metaCache ?? new LRUCache({
         max: 10000,
         ttl: 120 * 1000, // 2 minutes
     });
@@ -114,6 +114,7 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             preferOffline: opts.preferOffline,
             cacheDir: opts.cacheDir,
             strictPublishedByCheck: opts.strictPublishedByCheck,
+            ignoreMissingTimeField: opts.ignoreMissingTimeField,
         }),
         registries: opts.registries,
         saveWorkspaceProtocol: opts.saveWorkspaceProtocol,
@@ -123,7 +124,9 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
         resolveFromNpm: resolveNpm.bind(null, ctx),
         resolveFromJsr: resolveJsr.bind(null, ctx),
         clearCache: () => {
-            metaCache.clear();
+            if ('clear' in metaCache && typeof metaCache.clear === 'function') {
+                metaCache.clear();
+            }
             pMemoizeClear(fetch);
         },
     };
@@ -198,7 +201,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             dryRun: opts.dryRun === true,
             preferredVersionSelectors: opts.preferredVersions?.[spec.name],
             registry,
-            updateToLatest: opts.update === 'latest',
+            includeLatestTag: opts.update === 'latest',
             optional: wantedDependency.optional,
         });
     }
@@ -336,7 +339,7 @@ async function resolveJsr(ctx, wantedDependency, opts) {
         dryRun: opts.dryRun === true,
         preferredVersionSelectors: opts.preferredVersions?.[spec.name],
         registry,
-        updateToLatest: opts.update === 'latest',
+        includeLatestTag: opts.update === 'latest',
     });
     if (pickedPackage == null) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });

package/lib/pickPackage.d.ts

@@ -12,7 +12,7 @@ export interface PickPackageOptions extends PickPackageFromMetaOptions {
     pickLowestVersion?: boolean;
     registry: string;
     dryRun: boolean;
-    updateToLatest?: boolean;
+    includeLatestTag?: boolean;
     optional?: boolean;
 }
 export declare function pickPackage(ctx: {
@@ -30,6 +30,7 @@ export declare function pickPackage(ctx: {
     preferOffline?: boolean;
     filterMetadata?: boolean;
     strictPublishedByCheck?: boolean;
+    ignoreMissingTimeField?: boolean;
 }, spec: RegistryPackageSpec, opts: PickPackageOptions): Promise<{
     meta: PackageMeta;
     pickedPackage: PackageInRegistry | null;

package/lib/pickPackage.js

@@ -4,7 +4,7 @@ import { ABBREVIATED_META_DIR, FULL_FILTERED_META_DIR, FULL_META_DIR } from '@pn
 import { createHexHash } from '@pnpm/crypto.hash';
 import { PnpmError } from '@pnpm/error';
 import gfs from '@pnpm/fs.graceful-fs';
-import { logger } from '@pnpm/logger';
+import { globalWarn, logger } from '@pnpm/logger';
 import getRegistryName from 'encode-registry';
 import pLimit, {} from 'p-limit';
 import { fastPathTemp as pathTemp } from 'path-temp';
@@ -38,42 +38,82 @@ async function runLimited(pkgMirror, fn) {
         }
     }
 }
-const pickPackageFromMetaUsingTimeStrict = pickPackageFromMeta.bind(null, pickVersionByVersionRange);
-function pickPackageFromMetaUsingTime(opts, spec, meta) {
-    const pickedPackage = pickPackageFromMeta(pickVersionByVersionRange, opts, spec, meta);
-    if (pickedPackage)
-        return pickedPackage;
-    return pickPackageFromMeta(pickLowestVersionByVersionRange, {
-        preferredVersionSelectors: opts.preferredVersionSelectors,
-    }, spec, meta);
+// When includeLatestTag is set, the "latest" dist-tag is added as a candidate
+// alongside the requested spec, and the higher-versioned pick wins.
+function runPicker(pickerOpts, spec, pickOne) {
+    const currentPkg = pickOne(spec);
+    if (!pickerOpts.includeLatestTag)
+        return currentPkg;
+    const latestPkg = pickOne({ ...spec, type: 'tag', fetchSpec: 'latest' });
+    return pickMax(latestPkg, currentPkg);
+}
+// Returns whichever pick has the higher version, treating null as "no match".
+function pickMax(a, b) {
+    if (!a)
+        return b;
+    if (!b)
+        return a;
+    return semver.lt(a.version, b.version) ? b : a;
+}
+const pickHighest = pickPackageFromMeta.bind(null, pickVersionByVersionRange);
+const pickLowest = pickPackageFromMeta.bind(null, pickLowestVersionByVersionRange);
+// When minimumReleaseAge is active: try the highest mature version; if none
+// and strictPublishedByCheck is off, fall back to the lowest version in range
+// without applying the maturity filter.
+function pickRespectingMinReleaseAge(pickerOpts, spec, meta) {
+    return runPicker(pickerOpts, spec, (targetSpec) => {
+        const highest = pickHighest(pickerOpts, meta, targetSpec);
+        if (highest || pickerOpts.strictPublishedByCheck)
+            return highest;
+        return pickLowest({
+            preferredVersionSelectors: pickerOpts.preferredVersionSelectors,
+        }, meta, targetSpec);
+    });
+}
+// When minimumReleaseAge is not active: pick by pickLowestVersion preference.
+function pickIgnoringReleaseAge(pickerOpts, spec, meta) {
+    const pickVersion = pickerOpts.pickLowestVersion ? pickLowest : pickHighest;
+    return runPicker(pickerOpts, spec, (targetSpec) => pickVersion(pickerOpts, meta, targetSpec));
+}
+// Used in shortcut/fall-through paths: if it fails (including with
+// ERR_PNPM_MISSING_TIME), the caller falls through to the next path — e.g.
+// the network fetch that can upgrade abbreviated metadata to full.
+function pickMatchingVersionFast(pickerOpts, spec, meta) {
+    return pickerOpts.publishedBy
+        ? pickRespectingMinReleaseAge(pickerOpts, spec, meta)
+        : pickIgnoringReleaseAge(pickerOpts, spec, meta);
+}
+// Used at terminal return sites where no further fallback path exists. When
+// metadata lacks the per-version `time` field and ignoreMissingTimeField is
+// enabled, skip the minimumReleaseAge filter with a warning instead of
+// failing hard.
+function pickMatchingVersionFinal(pickerOpts, spec, meta) {
+    try {
+        return pickMatchingVersionFast(pickerOpts, spec, meta);
+    }
+    catch (err) {
+        if (pickerOpts.ignoreMissingTimeField && isMissingTimeError(err)) {
+            warnMissingTimeFieldOnce(meta.name);
+            return pickMatchingVersionFast({
+                ...pickerOpts,
+                publishedBy: undefined,
+                publishedByExclude: undefined,
+            }, spec, meta);
+        }
+        throw err;
+    }
 }
 export async function pickPackage(ctx, spec, opts) {
     opts = opts || {};
-    const pickPackageFromMetaBySpec = (opts.publishedBy
-        ? (ctx.strictPublishedByCheck ? pickPackageFromMetaUsingTimeStrict : pickPackageFromMetaUsingTime)
-        : (pickPackageFromMeta.bind(null, opts.pickLowestVersion ? pickLowestVersionByVersionRange : pickVersionByVersionRange))).bind(null, {
+    const pickerOpts = {
         preferredVersionSelectors: opts.preferredVersionSelectors,
         publishedBy: opts.publishedBy,
         publishedByExclude: opts.publishedByExclude,
-    });
-    let _pickPackageFromMeta;
-    if (opts.updateToLatest) {
-        _pickPackageFromMeta = (meta) => {
-            const latestStableSpec = { ...spec, type: 'tag', fetchSpec: 'latest' };
-            const latestStable = pickPackageFromMetaBySpec(latestStableSpec, meta);
-            const current = pickPackageFromMetaBySpec(spec, meta);
-            if (!latestStable)
-                return current;
-            if (!current)
-                return latestStable;
-            if (semver.lt(latestStable.version, current.version))
-                return current;
-            return latestStable;
-        };
-    }
-    else {
-        _pickPackageFromMeta = pickPackageFromMetaBySpec.bind(null, spec);
-    }
+        pickLowestVersion: opts.pickLowestVersion,
+        includeLatestTag: opts.includeLatestTag,
+        strictPublishedByCheck: ctx.strictPublishedByCheck,
+        ignoreMissingTimeField: ctx.ignoreMissingTimeField,
+    };
     validatePackageName(spec.name);
     // Use full metadata for optional dependencies to get libc field.
     // See: https://github.com/pnpm/pnpm/issues/9950
@@ -87,7 +127,7 @@ export async function pickPackage(ctx, spec, opts) {
     if (cachedMeta != null) {
         return {
             meta: cachedMeta,
-            pickedPackage: _pickPackageFromMeta(cachedMeta),
+            pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, cachedMeta),
         };
     }
     const registryName = getRegistryName(opts.registry);
@@ -100,12 +140,12 @@ export async function pickPackage(ctx, spec, opts) {
                 if (metaCachedInStore != null)
                     return {
                         meta: metaCachedInStore,
-                        pickedPackage: _pickPackageFromMeta(metaCachedInStore),
+                        pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, metaCachedInStore),
                     };
                 throw new PnpmError('NO_OFFLINE_META', `Failed to resolve ${toRaw(spec)} in package mirror ${pkgMirror}`);
             }
             if (metaCachedInStore != null) {
-                const pickedPackage = _pickPackageFromMeta(metaCachedInStore);
+                const pickedPackage = pickMatchingVersionFinal(pickerOpts, spec, metaCachedInStore);
                 if (pickedPackage) {
                     return {
                         meta: metaCachedInStore,
@@ -114,13 +154,13 @@ export async function pickPackage(ctx, spec, opts) {
                 }
             }
         }
-        if (!opts.updateToLatest && spec.type === 'version') {
+        if (!opts.includeLatestTag && spec.type === 'version') {
             metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
             // use the cached meta only if it has the required package version
             // otherwise it is probably out of date
             if ((metaCachedInStore?.versions?.[spec.fetchSpec]) != null) {
                 try {
-                    const pickedPackage = _pickPackageFromMeta(metaCachedInStore);
+                    const pickedPackage = pickMatchingVersionFast(pickerOpts, spec, metaCachedInStore);
                     if (pickedPackage) {
                         return {
                             meta: metaCachedInStore,
@@ -141,7 +181,7 @@ export async function pickPackage(ctx, spec, opts) {
                 metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
                 if (metaCachedInStore != null) {
                     try {
-                        const pickedPackage = _pickPackageFromMeta(metaCachedInStore);
+                        const pickedPackage = pickMatchingVersionFast(pickerOpts, spec, metaCachedInStore);
                         if (pickedPackage) {
                             return {
                                 meta: metaCachedInStore,
@@ -182,7 +222,7 @@ export async function pickPackage(ctx, spec, opts) {
                     ctx.metaCache.set(cacheKey, metaCachedInStore);
                     return {
                         meta: metaCachedInStore,
-                        pickedPackage: _pickPackageFromMeta(metaCachedInStore),
+                        pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, metaCachedInStore),
                     };
                 }
                 throw new PnpmError('CACHE_MISSING_AFTER_304', `Metadata cache for ${spec.name} is unreadable after receiving 304 Not Modified`);
@@ -250,7 +290,7 @@ export async function pickPackage(ctx, spec, opts) {
             ctx.metaCache.set(cacheKey, meta);
             return {
                 meta,
-                pickedPackage: _pickPackageFromMeta(meta),
+                pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, meta),
             };
         }
         catch (err) { // eslint-disable-line
@@ -262,7 +302,7 @@ export async function pickPackage(ctx, spec, opts) {
             logger.debug({ message: `Using cached meta from ${pkgMirror}` });
             return {
                 meta,
-                pickedPackage: _pickPackageFromMeta(meta),
+                pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, meta),
             };
         }
     });
@@ -325,6 +365,22 @@ function isMissingTimeError(err) {
         'code' in err &&
         err.code === 'ERR_PNPM_MISSING_TIME');
 }
+// Cap the size so long-lived processes (daemons, store servers) can't leak
+// memory via this Set as they resolve ever more distinct packages.
+const MAX_WARNED_MISSING_TIME = 1024;
+const warnedMissingTimeFor = new Set();
+function warnMissingTimeFieldOnce(pkgName) {
+    if (warnedMissingTimeFor.has(pkgName))
+        return;
+    if (warnedMissingTimeFor.size >= MAX_WARNED_MISSING_TIME) {
+        // Set preserves insertion order, so the first entry is the oldest.
+        const oldest = warnedMissingTimeFor.values().next().value;
+        if (oldest != null)
+            warnedMissingTimeFor.delete(oldest);
+    }
+    warnedMissingTimeFor.add(pkgName);
+    globalWarn(`The metadata of ${pkgName} is missing the "time" field; skipping the minimumReleaseAge check for this package.`);
+}
 async function getFileMtime(filePath) {
     try {
         const stat = await fs.stat(filePath);

package/lib/pickPackageFromMeta.d.ts

@@ -14,7 +14,7 @@ export interface PickPackageFromMetaOptions {
     publishedBy?: Date;
     publishedByExclude?: PackageVersionPolicy;
 }
-export declare function pickPackageFromMeta(pickVersionByVersionRangeFn: PickVersionByVersionRange, { preferredVersionSelectors, publishedBy, publishedByExclude }: PickPackageFromMetaOptions, spec: RegistryPackageSpec, meta: PackageMeta): PackageInRegistry | null;
+export declare function pickPackageFromMeta(pickVersionByVersionRangeFn: PickVersionByVersionRange, { preferredVersionSelectors, publishedBy, publishedByExclude }: PickPackageFromMetaOptions, meta: PackageMeta, spec: RegistryPackageSpec): PackageInRegistry | null;
 export declare function assertMetaHasTime(meta: PackageMeta): asserts meta is PackageMetaWithTime;
 export declare function pickLowestVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;
 export declare function pickVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;

package/lib/pickPackageFromMeta.js

@@ -2,7 +2,7 @@ import util from 'node:util';
 import { PnpmError } from '@pnpm/error';
 import { filterPkgMetadataByPublishDate } from '@pnpm/resolving.registry.pkg-metadata-filter';
 import semver from 'semver';
-export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVersionSelectors, publishedBy, publishedByExclude, }, spec, meta) {
+export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVersionSelectors, publishedBy, publishedByExclude, }, meta, spec) {
     if (publishedBy) {
         const excludeResult = publishedByExclude?.(meta.name) ?? false;
         if (excludeResult !== true) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1100.0.1",
+  "version": "1101.0.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -40,26 +40,26 @@
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.1",
     "@pnpm/constants": "1100.0.0",
     "@pnpm/core-loggers": "1100.0.1",
     "@pnpm/crypto.hash": "1100.0.0",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/fetching.types": "1100.0.0",
+    "@pnpm/config.pick-registry-for-package": "1100.0.1",
     "@pnpm/fs.graceful-fs": "1100.0.0",
+    "@pnpm/fetching.types": "1100.0.0",
     "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
+    "@pnpm/resolving.registry.types": "1100.0.1",
+    "@pnpm/resolving.resolver-base": "1100.1.0",
     "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.1",
-    "@pnpm/resolving.resolver-base": "1100.0.1",
-    "@pnpm/store.cafs": "1100.0.1",
+    "@pnpm/store.cafs": "1100.1.0",
     "@pnpm/store.index": "1100.0.0",
-    "@pnpm/workspace.range-resolver": "1100.0.0",
     "@pnpm/types": "1101.0.0",
-    "@pnpm/workspace.spec-parser": "1100.0.0",
-    "@pnpm/resolving.registry.types": "1100.0.1"
+    "@pnpm/workspace.range-resolver": "1100.0.0",
+    "@pnpm/workspace.spec-parser": "1100.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.0.1"
+    "@pnpm/worker": "^1100.1.0"
   },
   "devDependencies": {
     "@types/normalize-path": "^3.0.2",
@@ -71,9 +71,9 @@
     "@pnpm/config.version-policy": "1100.0.1",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/network.fetch": "1100.0.1",
-    "@pnpm/resolving.npm-resolver": "1100.0.1",
-    "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.1"
+    "@pnpm/resolving.npm-resolver": "1101.0.0",
+    "@pnpm/testing.mock-agent": "1100.0.1",
+    "@pnpm/test-fixtures": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"