@pnpm/resolving.npm-resolver 1101.0.2 → 1101.1.0

package/lib/index.d.ts

@@ -4,7 +4,7 @@ import type { PackageMeta } from '@pnpm/resolving.registry.types';
 import type { DirectoryResolution, PkgResolutionId, PreferredVersions, ResolveResult, TarballResolution, WantedDependency, WorkspacePackages } from '@pnpm/resolving.resolver-base';
 import type { DependencyManifest, PackageVersionPolicy, PinnedVersion, Registries, TrustPolicy } from '@pnpm/types';
 import { fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, RegistryResponseError } from './fetch.js';
-import { parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
+import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
 import { type PackageMetaCache, pickPackage, type PickPackageOptions } from './pickPackage.js';
 import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
@@ -20,7 +20,8 @@ export declare class NoMatchingVersionError extends PnpmError {
     readonly immatureVersion?: string;
     constructor(opts: NoMatchingVersionErrorOptions);
 }
-export { fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
+export declare function formatTimeAgo(date: Date): string | null;
+export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
 export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export interface ResolverFactoryOptions {
     cacheDir: string;
@@ -32,6 +33,7 @@ export interface ResolverFactoryOptions {
     retry?: RetryTimeoutOptions;
     timeout?: number;
     registries: Registries;
+    namedRegistries?: Record<string, string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
     preserveAbsolutePaths?: boolean;
     strictPublishedByCheck?: boolean;
@@ -54,6 +56,14 @@ export interface JsrResolveResult extends ResolveResult {
     resolution: TarballResolution;
     resolvedVia: 'jsr-registry';
 }
+export interface NamedRegistryResolveResult extends ResolveResult {
+    alias: string;
+    /** The named-registry alias that was matched, e.g. `gh` or a user-defined name. */
+    registryName: string;
+    manifest: DependencyManifest;
+    resolution: TarballResolution;
+    resolvedVia: 'named-registry';
+}
 export interface WorkspaceResolveResult extends ResolveResult {
     manifest: DependencyManifest;
     resolution: DirectoryResolution;
@@ -61,16 +71,19 @@ export interface WorkspaceResolveResult extends ResolveResult {
 }
 export type NpmResolver = (wantedDependency: WantedDependency & {
     optional?: boolean;
-}, opts: ResolveFromNpmOptions) => Promise<NpmResolveResult | JsrResolveResult | WorkspaceResolveResult | null>;
+}, opts: ResolveFromNpmOptions) => Promise<NpmResolveResult | JsrResolveResult | NamedRegistryResolveResult | WorkspaceResolveResult | null>;
 export declare function createNpmResolver(fetchFromRegistry: FetchFromRegistry, getAuthHeader: GetAuthHeader, opts: ResolverFactoryOptions): {
     resolveFromNpm: NpmResolver;
     resolveFromJsr: NpmResolver;
+    resolveFromNamedRegistry: NpmResolver;
     clearCache: () => void;
 };
 export interface ResolveFromNpmContext {
     pickPackage: (spec: RegistryPackageSpec, opts: PickPackageOptions) => ReturnType<typeof pickPackage>;
     getAuthHeaderValueByURI: (registry: string) => string | undefined;
     registries: Registries;
+    namedRegistries: Record<string, string>;
+    namedRegistryNames: ReadonlySet<string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
     peekManifestFromStore?: (opts: {
         id: PkgResolutionId;

package/lib/index.js

@@ -13,7 +13,7 @@ import ssri from 'ssri';
 import versionSelectorType from 'version-selector-type';
 import { fetchMetadataFromFromRegistry, RegistryResponseError } from './fetch.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
-import { parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
+import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, parseNamedRegistrySpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
 import { pickPackage, } from './pickPackage.js';
 import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
@@ -29,7 +29,7 @@ export class NoMatchingVersionError extends PnpmError {
         let errorMessage;
         if (opts.publishedBy && opts.immatureVersion && opts.packageMeta.time) {
             const time = new Date(opts.packageMeta.time[opts.immatureVersion]);
-            const releaseAgeText = formatTimeAgo(time);
+            const releaseAgeText = formatTimeAgo(time) ?? 'just now';
             const pkgName = opts.wantedDependency.alias ?? opts.packageMeta.name;
             errorMessage = `Version ${opts.immatureVersion} (released ${releaseAgeText}) of ${pkgName} does not meet the minimumReleaseAge constraint`;
         }
@@ -41,25 +41,36 @@ export class NoMatchingVersionError extends PnpmError {
         this.immatureVersion = opts.immatureVersion;
     }
 }
-function formatTimeAgo(date) {
-    const now = Date.now();
-    const diffMs = now - date.getTime();
-    // Handle clock skew (future dates) and very recent releases (< 1 minute)
-    if (diffMs < 60 * 1000) {
-        return 'just now';
-    }
-    const diffMinutes = Math.floor(diffMs / (60 * 1000));
-    const diffHours = Math.floor(diffMs / (60 * 60 * 1000));
-    const diffDays = Math.floor(diffMs / (24 * 60 * 60 * 1000));
-    if (diffHours >= 48) {
-        return `${diffDays} day${diffDays === 1 ? '' : 's'} ago`;
+export function formatTimeAgo(date) {
+    const ts = date.getTime();
+    if (isNaN(ts)) {
+        return null;
     }
-    if (diffMinutes >= 90) {
-        return `${diffHours} hour${diffHours === 1 ? '' : 's'} ago`;
+    const now = Date.now();
+    const diffMs = now - ts;
+    // Handle clock skew (future dates)
+    if (diffMs < 0) {
+        return null;
     }
-    return `${diffMinutes} minute${diffMinutes === 1 ? '' : 's'} ago`;
+    const diffSec = Math.floor(diffMs / 1000);
+    const diffMin = Math.floor(diffSec / 60);
+    const diffHour = Math.floor(diffMin / 60);
+    const diffDay = Math.floor(diffHour / 24);
+    const diffMonth = Math.floor(diffDay / 30);
+    const diffYear = Math.floor(diffDay / 365);
+    if (diffYear > 0)
+        return `${diffYear} year${diffYear === 1 ? '' : 's'} ago`;
+    if (diffMonth > 0)
+        return `${diffMonth} month${diffMonth === 1 ? '' : 's'} ago`;
+    if (diffDay > 0)
+        return `${diffDay} day${diffDay === 1 ? '' : 's'} ago`;
+    if (diffHour > 0)
+        return `${diffHour} hour${diffHour === 1 ? '' : 's'} ago`;
+    if (diffMin > 0)
+        return `${diffMin} minute${diffMin === 1 ? '' : 's'} ago`;
+    return 'a few seconds ago';
 }
-export { fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
+export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
 export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     if (typeof opts.cacheDir !== 'string') {
@@ -103,6 +114,8 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             return request;
         };
     }
+    const namedRegistries = mergeNamedRegistries(opts.namedRegistries);
+    const namedRegistryNames = new Set(Object.keys(namedRegistries));
     const ctx = {
         getAuthHeaderValueByURI: getAuthHeader,
         pickPackage: pickPackage.bind(null, {
@@ -117,12 +130,15 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             ignoreMissingTimeField: opts.ignoreMissingTimeField,
         }),
         registries: opts.registries,
+        namedRegistries,
+        namedRegistryNames,
         saveWorkspaceProtocol: opts.saveWorkspaceProtocol,
         peekManifestFromStore,
     };
     return {
         resolveFromNpm: resolveNpm.bind(null, ctx),
         resolveFromJsr: resolveJsr.bind(null, ctx),
+        resolveFromNamedRegistry: resolveFromNamedRegistry.bind(null, ctx),
         clearCache: () => {
             if ('clear' in metaCache && typeof metaCache.clear === 'function') {
                 metaCache.clear();
@@ -326,52 +342,117 @@ async function resolveNpm(ctx, wantedDependency, opts) {
 async function resolveJsr(ctx, wantedDependency, opts) {
     if (!wantedDependency.bareSpecifier)
         return null;
-    const defaultTag = opts.defaultTag ?? 'latest';
-    const registry = ctx.registries['@jsr']; // '@jsr' is always defined
-    const spec = parseJsrSpecifierToRegistryPackageSpec(wantedDependency.bareSpecifier, wantedDependency.alias, defaultTag);
+    const spec = parseJsrSpecifierToRegistryPackageSpec(wantedDependency.bareSpecifier, wantedDependency.alias, opts.defaultTag ?? 'latest');
+    if (spec == null)
+        return null;
+    const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, ctx.registries['@jsr']); // '@jsr' is always defined
+    return {
+        ...picked,
+        normalizedBareSpecifier: opts.calcSpecifier
+            ? calcPrefixedSpecifier('jsr:', spec.jsrPkgName, wantedDependency, picked.manifest.version, opts.pinnedVersion)
+            : undefined,
+        resolvedVia: 'jsr-registry',
+        alias: spec.jsrPkgName,
+    };
+}
+// Merges user-supplied named-registry aliases (from config) on top of pnpm's
+// built-in defaults (e.g. `gh` → GitHub Packages). User entries take precedence
+// so GHES users can point `gh` at their enterprise host. URLs are validated
+// here so typos like `npm.work.example.com` (no scheme) surface at startup
+// rather than as a confusing 404 during resolution. The named-registry
+// resolver runs last in the resolution chain, so an alias that collides with
+// another specifier scheme (e.g. `git`, `github`, `jsr`) is silently shadowed
+// by that scheme's dedicated resolver — no cross-resolver knowledge needed.
+function mergeNamedRegistries(userDefined) {
+    const merged = { ...BUILTIN_NAMED_REGISTRIES };
+    if (!userDefined)
+        return merged;
+    for (const [alias, url] of Object.entries(userDefined)) {
+        if (typeof url !== 'string' || !isValidHttpUrl(url)) {
+            throw new PnpmError('INVALID_NAMED_REGISTRY_URL', `The named registry alias '${alias}' is mapped to '${String(url)}', which is not a valid http(s) URL.`, { hint: 'Provide a URL that starts with http:// or https://, e.g. https://npm.pkg.example.com/' });
+        }
+        merged[alias] = url;
+    }
+    return merged;
+}
+function isValidHttpUrl(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+// Resolves a `<alias>:` specifier from one of the configured named registries.
+// The `gh:` alias ships as a built-in default pointing at the GitHub Packages
+// npm registry; additional aliases come from pnpm-workspace.yaml's
+// `namedRegistries` field. Auth tokens are looked up by the resolved registry
+// URL, so a `//npm.pkg.github.com/:_authToken=...` entry in `.npmrc` is
+// picked up automatically for `gh:` specifiers (and analogously for any user-
+// configured alias).
+async function resolveFromNamedRegistry(ctx, wantedDependency, opts) {
+    if (!wantedDependency.bareSpecifier)
+        return null;
+    const spec = parseNamedRegistrySpecifierToRegistryPackageSpec(wantedDependency.bareSpecifier, ctx.namedRegistryNames, wantedDependency.alias, opts.defaultTag ?? 'latest');
     if (spec == null)
         return null;
+    const registry = ctx.namedRegistries[spec.registryName];
+    if (!registry)
+        return null; // defensive: should never trigger because parse checks the alias set
+    const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registry);
+    return {
+        ...picked,
+        normalizedBareSpecifier: opts.calcSpecifier
+            ? calcPrefixedSpecifier(`${spec.registryName}:`, spec.name, wantedDependency, picked.manifest.version, opts.pinnedVersion)
+            : undefined,
+        resolvedVia: 'named-registry',
+        registryName: spec.registryName,
+        // Exposes the scoped package name so callers that omit an explicit alias
+        // (e.g. `pnpm add gh:@acme/foo`) record the dependency under `@acme/foo`.
+        alias: spec.name,
+    };
+}
+// Shared inner shell for resolvers that pull from a single registry URL with
+// an already-parsed RegistryPackageSpec (jsr, named-registry). Returns the
+// fields common to their result envelopes; each caller adds its own
+// resolvedVia, alias, and normalizedBareSpecifier.
+async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registry) {
     const authHeaderValue = ctx.getAuthHeaderValueByURI(registry);
     const { meta, pickedPackage } = await ctx.pickPackage(spec, {
         pickLowestVersion: opts.pickLowestVersion,
         publishedBy: opts.publishedBy,
+        publishedByExclude: opts.publishedByExclude,
         authHeaderValue,
         dryRun: opts.dryRun === true,
         preferredVersionSelectors: opts.preferredVersions?.[spec.name],
         registry,
         includeLatestTag: opts.update === 'latest',
+        optional: wantedDependency.optional,
     });
     if (pickedPackage == null) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
-    const id = `${pickedPackage.name}@${pickedPackage.version}`;
-    const resolution = {
-        integrity: getIntegrity(pickedPackage.dist),
-        tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
-    };
     return {
-        id,
+        id: `${pickedPackage.name}@${pickedPackage.version}`,
         latest: meta['dist-tags'].latest,
         manifest: pickedPackage,
-        normalizedBareSpecifier: opts.calcSpecifier
-            ? calcJsrSpecifier({
-                wantedDependency,
-                spec,
-                version: pickedPackage.version,
-                defaultPinnedVersion: opts.pinnedVersion,
-            })
-            : undefined,
-        resolution,
-        resolvedVia: 'jsr-registry',
+        resolution: {
+            integrity: getIntegrity(pickedPackage.dist),
+            tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
+        },
         publishedAt: meta.time?.[pickedPackage.version],
-        alias: spec.jsrPkgName,
     };
 }
-function calcJsrSpecifier({ wantedDependency, spec, version, defaultPinnedVersion, }) {
+// Builds a `<prefix><pkgName>@<range>` specifier (or a bare `<prefix><range>`
+// when the dependency alias matches the package name). Shared between the
+// jsr and named-registry resolvers since they only differ in `prefix` and
+// which spec field holds the package name.
+function calcPrefixedSpecifier(prefix, pkgName, wantedDependency, version, defaultPinnedVersion) {
     const range = calcRange(version, wantedDependency, defaultPinnedVersion);
-    if (!wantedDependency.alias || spec.jsrPkgName === wantedDependency.alias)
-        return `jsr:${range}`;
-    return `jsr:${spec.jsrPkgName}@${range}`;
+    if (!wantedDependency.alias || pkgName === wantedDependency.alias)
+        return `${prefix}${range}`;
+    return `${prefix}${pkgName}@${range}`;
 }
 function calcSpecifier({ wantedDependency, spec, version, defaultPinnedVersion, }) {
     if (wantedDependency.prevSpecifier === wantedDependency.bareSpecifier && wantedDependency.prevSpecifier && versionSelectorType(wantedDependency.prevSpecifier)?.type === 'tag') {

package/lib/parseBareSpecifier.d.ts

@@ -9,3 +9,8 @@ export interface JsrRegistryPackageSpec extends RegistryPackageSpec {
     jsrPkgName: string;
 }
 export declare function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier: string, alias: string | undefined, defaultTag: string): JsrRegistryPackageSpec | null;
+export declare const BUILTIN_NAMED_REGISTRIES: Readonly<Record<string, string>>;
+export interface NamedRegistryPackageSpec extends RegistryPackageSpec {
+    registryName: string;
+}
+export declare function parseNamedRegistrySpecifierToRegistryPackageSpec(rawSpecifier: string, knownRegistryNames: ReadonlySet<string>, packageAlias: string | undefined, defaultTag: string): NamedRegistryPackageSpec | null;

package/lib/parseBareSpecifier.js

@@ -1,18 +1,29 @@
+import { PnpmError } from '@pnpm/error';
 import { parseJsrSpecifier } from '@pnpm/resolving.jsr-specifier-parser';
-import parseNpmTarballUrl from 'parse-npm-tarball-url';
+import { parseNpmTarballUrl } from 'parse-npm-tarball-url';
+import semver from 'semver';
 import getVersionSelectorType from 'version-selector-type';
 export function parseBareSpecifier(bareSpecifier, alias, defaultTag, registry) {
     let name = alias;
     if (bareSpecifier.startsWith('npm:')) {
         bareSpecifier = bareSpecifier.slice(4);
-        const index = bareSpecifier.lastIndexOf('@');
-        if (index < 1) {
-            name = bareSpecifier;
-            bareSpecifier = defaultTag;
+        // `npm:<version_selector>` — fall back to the outer dependency alias as
+        // the package name, mirroring the named-registry shape (e.g. `gh:^1.0.0`).
+        // Restricted to semver ranges/versions so unscoped package names like
+        // `npm:is-positive` keep their npm package-aliasing meaning.
+        if (alias && semver.validRange(bareSpecifier) != null) {
+            name = alias;
         }
         else {
-            name = bareSpecifier.slice(0, index);
-            bareSpecifier = bareSpecifier.slice(index + 1);
+            const index = bareSpecifier.lastIndexOf('@');
+            if (index < 1) {
+                name = bareSpecifier;
+                bareSpecifier = defaultTag;
+            }
+            else {
+                name = bareSpecifier.slice(0, index);
+                bareSpecifier = bareSpecifier.slice(index + 1);
+            }
         }
     }
     if (name) {
@@ -26,7 +37,7 @@ export function parseBareSpecifier(bareSpecifier, alias, defaultTag, registry) {
         }
     }
     if (bareSpecifier.startsWith(registry)) {
-        const pkg = parseNpmTarballUrl.default(bareSpecifier);
+        const pkg = parseNpmTarballUrl(bareSpecifier);
         if (pkg != null) {
             return {
                 fetchSpec: pkg.version,
@@ -52,4 +63,75 @@ export function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier, alias, defa
         jsrPkgName: spec.jsrPkgName,
     };
 }
+export const BUILTIN_NAMED_REGISTRIES = Object.freeze({
+    gh: 'https://npm.pkg.github.com/',
+});
+// Parses a named-registry specifier of the shape `<alias>:<body>` into a
+// RegistryPackageSpec. Returns `null` when the specifier does not use one of
+// the configured aliases, so the caller can fall through to other resolvers.
+// Supported shapes:
+// - `<alias>:[@<owner>/]<name>[@<version_selector>]`
+// - `<alias>:<version_selector>` paired with a package alias
+export function parseNamedRegistrySpecifierToRegistryPackageSpec(rawSpecifier, knownRegistryNames, packageAlias, defaultTag) {
+    const colon = rawSpecifier.indexOf(':');
+    if (colon <= 0)
+        return null;
+    const registryName = rawSpecifier.substring(0, colon);
+    if (!knownRegistryNames.has(registryName))
+        return null;
+    const body = rawSpecifier.substring(colon + 1);
+    let pkgName;
+    let versionSelector;
+    if (semver.validRange(body) != null) {
+        // `<alias>:<version_selector>` — fall back to the dependency alias as
+        // the package name. Unresolvable without one.
+        if (!packageAlias)
+            return null;
+        pkgName = packageAlias;
+        versionSelector = body;
+    }
+    else if (body[0] === '@') {
+        // `<alias>:@<owner>/<name>[@<version_selector>]` — scoped package.
+        const index = body.lastIndexOf('@');
+        if (index === 0) {
+            pkgName = body;
+        }
+        else {
+            pkgName = body.substring(0, index);
+            versionSelector = body.substring(index + '@'.length);
+        }
+        if (pkgName.indexOf('/') === -1 || pkgName.endsWith('/')) {
+            throw new PnpmError('INVALID_NAMED_REGISTRY_PACKAGE_NAME', `The package name '${pkgName}' in named registry '${registryName}:' is invalid`);
+        }
+    }
+    else if (packageAlias?.startsWith('@')) {
+        // `<alias>:<tag>` paired with a scoped alias — body is a version
+        // selector (tag/dist-tag). Mirrors GitHub Packages, where the package
+        // is always scoped and a bare body is a tag.
+        pkgName = packageAlias;
+        versionSelector = body;
+    }
+    else {
+        // `<alias>:<name>[@<version_selector>]` — unscoped package in body.
+        const index = body.lastIndexOf('@');
+        if (index < 1) {
+            pkgName = body;
+        }
+        else {
+            pkgName = body.substring(0, index);
+            versionSelector = body.substring(index + '@'.length);
+        }
+        if (!pkgName)
+            return null;
+    }
+    const selector = getVersionSelectorType(versionSelector ?? defaultTag);
+    if (selector == null)
+        return null;
+    return {
+        fetchSpec: selector.normalized,
+        name: pkgName,
+        type: selector.type,
+        registryName,
+    };
+}
 //# sourceMappingURL=parseBareSpecifier.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1101.0.2",
+  "version": "1101.1.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -28,38 +28,38 @@
   "dependencies": {
     "@zkochan/retry": "^0.2.0",
     "encode-registry": "^3.0.1",
-    "lru-cache": "^11.3.6",
+    "lru-cache": "^11.2.7",
     "normalize-path": "^3.0.0",
-    "p-limit": "^7.3.0",
+    "p-limit": "^7.1.0",
     "p-memoize": "8.0.0",
-    "parse-npm-tarball-url": "^4.0.0",
+    "parse-npm-tarball-url": "^5.0.0",
     "path-temp": "^3.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^7.0.1",
-    "semver": "^7.7.4",
+    "semver": "^7.7.2",
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.2",
-    "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.0.1",
+    "@pnpm/config.pick-registry-for-package": "1100.0.3",
     "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/error": "1100.0.0",
     "@pnpm/fetching.types": "1100.0.1",
-    "@pnpm/fs.graceful-fs": "1100.1.0",
     "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.2",
-    "@pnpm/resolving.registry.types": "1100.0.2",
-    "@pnpm/resolving.resolver-base": "1100.1.2",
-    "@pnpm/store.cafs": "1100.1.2",
-    "@pnpm/store.index": "1100.0.0",
-    "@pnpm/types": "1101.0.0",
+    "@pnpm/fs.graceful-fs": "1100.1.0",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.3",
+    "@pnpm/store.cafs": "1100.1.3",
+    "@pnpm/store.index": "1100.1.0",
+    "@pnpm/resolving.registry.types": "1100.0.3",
+    "@pnpm/types": "1101.1.0",
+    "@pnpm/resolving.resolver-base": "1100.1.3",
+    "@pnpm/constants": "1100.0.0",
     "@pnpm/workspace.range-resolver": "1100.0.1",
-    "@pnpm/workspace.spec-parser": "1100.0.0"
+    "@pnpm/workspace.spec-parser": "1100.0.0",
+    "@pnpm/core-loggers": "1100.0.2"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1",
-    "@pnpm/worker": "^1100.1.2"
+    "@pnpm/logger": ">=1001.0.0 <1002.0.0",
+    "@pnpm/worker": "^1100.1.4"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -69,12 +69,12 @@
     "@types/ssri": "^7.1.5",
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
-    "@pnpm/config.version-policy": "1100.0.2",
+    "@pnpm/config.version-policy": "1100.0.3",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.0.2",
-    "@pnpm/resolving.npm-resolver": "1101.0.2",
+    "@pnpm/resolving.npm-resolver": "1101.1.0",
+    "@pnpm/network.fetch": "1100.0.3",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.2"
+    "@pnpm/testing.mock-agent": "1100.0.3"
   },
   "engines": {
     "node": ">=22.13"