@pnpm/resolving.npm-resolver 1101.1.0 → 1101.1.1

package/lib/fetch.js

@@ -3,24 +3,71 @@ import { requestRetryLogger } from '@pnpm/core-loggers';
 import { FetchError, PnpmError, } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import * as retry from '@zkochan/retry';
-// https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
-// eslint-disable-next-line regexp/no-super-linear-backtracking, regexp/use-ignore-case
-const semverRegex = /(.*)(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
+import semver from 'semver';
 export class RegistryResponseError extends FetchError {
     pkgName;
     constructor(request, response, pkgName) {
         let hint;
         if (response.status === 404) {
             hint = `${pkgName} is not in the npm registry, or you have no permission to fetch it.`;
-            const matched = pkgName.match(semverRegex);
-            if (matched != null) {
-                hint += ` Did you mean ${matched[1]}?`;
+            const nameWithoutVersion = stripTrailingSemverSuffix(pkgName);
+            if (nameWithoutVersion != null) {
+                hint += ` Did you mean ${nameWithoutVersion}?`;
             }
         }
         super(request, response, hint);
         this.pkgName = pkgName;
     }
 }
+/**
+ * Detect when a package name accidentally includes a `<version>` suffix
+ * (e.g. `lodash@4.17.21` or `lodash4.17.21`) and return the part before the
+ * version. Returns `undefined` when no semver suffix is present.
+ *
+ * Implemented as an O(n) scan to avoid polynomial backtracking on adversarial
+ * input (CodeQL: js/polynomial-redos).
+ */
+function stripTrailingSemverSuffix(pkgName) {
+    // Common case: "name@version" – split on the rightmost '@'.
+    // `atIdx > 0` rules out the leading '@' of scoped names like '@scope/foo'.
+    const atIdx = pkgName.lastIndexOf('@');
+    if (atIdx > 0 && semver.valid(pkgName.slice(atIdx + 1)) != null) {
+        return pkgName.slice(0, atIdx);
+    }
+    // Fallback: detect a trailing "<digits>.<digits>.<digits>" appended to a name
+    // with no separator (e.g. "foo1.0.0"). We walk backwards through three
+    // digit-blocks separated by dots; this is O(n) and free of regex backtracking.
+    let i = pkgName.length;
+    i = consumeTrailingDigits(pkgName, i);
+    if (i === pkgName.length || i === 0 || pkgName.charCodeAt(i - 1) !== 46 /* '.' */)
+        return undefined;
+    i--;
+    const beforePatch = i;
+    i = consumeTrailingDigits(pkgName, i);
+    if (i === beforePatch || i === 0 || pkgName.charCodeAt(i - 1) !== 46)
+        return undefined;
+    i--;
+    const beforeMinor = i;
+    i = consumeTrailingDigits(pkgName, i);
+    if (i === beforeMinor || i === 0)
+        return undefined;
+    if (semver.valid(pkgName.slice(i)) == null)
+        return undefined;
+    let prefix = pkgName.slice(0, i);
+    if (prefix.endsWith('@'))
+        prefix = prefix.slice(0, -1);
+    return prefix.length > 0 ? prefix : undefined;
+}
+function consumeTrailingDigits(s, end) {
+    let i = end;
+    while (i > 0) {
+        const c = s.charCodeAt(i - 1);
+        if (c < 48 || c > 57)
+            break;
+        i--;
+    }
+    return i;
+}
 export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHeaderValue, etag: cachedEtag, fullMetadata, modified: cachedModified, registry, }) {
     const uri = toUri(pkgName, registry);
     const op = retry.operation(fetchOpts.retry);

package/lib/index.js

@@ -180,7 +180,13 @@ async function resolveNpm(ctx, wantedDependency, opts) {
     // Fast path: if we have a current resolution with integrity, try to peek the manifest from the store.
     // This avoids the expensive metadata fetch from the registry.
     // We do this AFTER ensuring the spec is valid for this resolver to avoids hijacking other resolvers.
-    if (ctx.peekManifestFromStore && opts.currentPkg?.resolution && !opts.update) {
+    // If publishedBy is set (resolutionMode=time-based or minimumReleaseAge is configured), we only take
+    // the fast path when publishedAt is already known from the lockfile's `time:` block; otherwise we
+    // fall through to a registry fetch so the cutoff isn't computed from missing data.
+    if (ctx.peekManifestFromStore &&
+        opts.currentPkg?.resolution &&
+        !opts.update &&
+        (opts.publishedBy == null || opts.currentPkg.publishedAt != null)) {
         const currentResolution = opts.currentPkg.resolution;
         // Only use this optimization for tarball resolutions with integrity (npm packages)
         if ('tarball' in currentResolution && currentResolution.integrity) {
@@ -200,7 +206,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
                         manifest,
                         resolution: currentResolution,
                         resolvedVia: 'npm-registry',
-                        publishedAt: undefined, // Don't have this without metadata
+                        publishedAt: opts.currentPkg.publishedAt,
                     };
                 }
             }

package/lib/pickPackage.js

@@ -123,15 +123,30 @@ export async function pickPackage(ctx, spec, opts) {
         : ABBREVIATED_META_DIR;
     // Cache key includes fullMetadata to avoid returning abbreviated metadata when full metadata is requested.
     const cacheKey = fullMetadata ? `${spec.name}:full` : spec.name;
+    const registryName = getRegistryName(opts.registry);
+    const pkgMirror = path.join(ctx.cacheDir, metaDir, registryName, `${encodePkgName(spec.name)}.jsonl`);
     const cachedMeta = ctx.metaCache.get(cacheKey);
     if (cachedMeta != null) {
+        // The in-memory cache may hold abbreviated metadata from an earlier call
+        // that didn't need `time` (no publishedBy then). If this call has
+        // publishedBy and the package was modified recently, upgrade to full
+        // metadata so the maturity check runs properly.
+        const upgrade = await maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, cachedMeta);
+        let metaForCache = upgrade.meta;
+        if (upgrade.upgradedFrom != null) {
+            // Persist the upgraded meta to disk too: the on-disk mirror still holds
+            // the abbreviated form, so without this a fresh process would re-trigger
+            // the upgrade fetch on its next install.
+            metaForCache = opts.dryRun
+                ? upgrade.meta
+                : persistUpgradedMeta(ctx, pkgMirror, upgrade.upgradedFrom);
+            ctx.metaCache.set(cacheKey, metaForCache);
+        }
         return {
-            meta: cachedMeta,
-            pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, cachedMeta),
+            meta: metaForCache,
+            pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, metaForCache),
         };
     }
-    const registryName = getRegistryName(opts.registry);
-    const pkgMirror = path.join(ctx.cacheDir, metaDir, registryName, `${encodePkgName(spec.name)}.jsonl`);
     return runLimited(pkgMirror, async (limit) => {
         let metaCachedInStore;
         if (ctx.offline === true || ctx.preferOffline === true || opts.pickLowestVersion) {
@@ -145,6 +160,17 @@ export async function pickPackage(ctx, spec, opts) {
                 throw new PnpmError('NO_OFFLINE_META', `Failed to resolve ${toRaw(spec)} in package mirror ${pkgMirror}`);
             }
             if (metaCachedInStore != null) {
+                // Disk-cached meta may be abbreviated; upgrade for the maturity check
+                // before letting pickMatchingVersionFinal warn-and-skip on missing time.
+                const upgrade = await maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, metaCachedInStore);
+                metaCachedInStore = upgrade.meta;
+                if (upgrade.upgradedFrom != null) {
+                    // Persist so the next install skips this upgrade fetch entirely.
+                    if (!opts.dryRun) {
+                        metaCachedInStore = persistUpgradedMeta(ctx, pkgMirror, upgrade.upgradedFrom);
+                    }
+                    ctx.metaCache.set(cacheKey, metaCachedInStore);
+                }
                 const pickedPackage = pickMatchingVersionFinal(pickerOpts, spec, metaCachedInStore);
                 if (pickedPackage) {
                     return {
@@ -169,7 +195,7 @@ export async function pickPackage(ctx, spec, opts) {
                     }
                 }
                 catch (err) {
-                    if (ctx.strictPublishedByCheck) {
+                    if (shouldRethrowFromFastPathCache(err, ctx.strictPublishedByCheck)) {
                         throw err;
                     }
                 }
@@ -190,10 +216,7 @@ export async function pickPackage(ctx, spec, opts) {
                         }
                     }
                     catch (err) {
-                        // Don't rethrow ERR_PNPM_MISSING_TIME from cached abbreviated metadata —
-                        // let the code fall through to the network fetch path which will get full metadata.
-                        if (ctx.strictPublishedByCheck &&
-                            !(isMissingTimeError(err))) {
+                        if (shouldRethrowFromFastPathCache(err, ctx.strictPublishedByCheck)) {
                             throw err;
                         }
                     }
@@ -219,6 +242,19 @@ export async function pickPackage(ctx, spec, opts) {
             if (fetchResult.notModified) {
                 metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
                 if (metaCachedInStore != null) {
+                    // The cached metadata may be abbreviated (no per-version `time`).
+                    // When minimumReleaseAge is active we need `time` for the maturity check,
+                    // so upgrade to full metadata via a follow-up fetch when warranted.
+                    // Without this, repeat installs of recently-modified packages would
+                    // silently bypass the maturity check via the warn-and-skip fallback.
+                    const upgrade = await maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, metaCachedInStore);
+                    metaCachedInStore = upgrade.meta;
+                    if (upgrade.upgradedFrom != null && !opts.dryRun) {
+                        // Persist the upgraded full metadata to disk so subsequent installs
+                        // skip this upgrade fetch entirely (the cached meta will then have
+                        // `time` populated, so the upgrade condition won't trigger).
+                        metaCachedInStore = persistUpgradedMeta(ctx, pkgMirror, upgrade.upgradedFrom);
+                    }
                     ctx.metaCache.set(cacheKey, metaCachedInStore);
                     return {
                         meta: metaCachedInStore,
@@ -307,6 +343,77 @@ export async function pickPackage(ctx, spec, opts) {
         }
     });
 }
+// When `minimumReleaseAge` is active and we have abbreviated metadata (which
+// the npm registry serves by default and which omits per-version `time`),
+// the maturity check can't run on the data we have. If the package has been
+// modified since the maturity cutoff, re-fetch with `fullMetadata: true` so
+// `time` is populated and the check can proceed properly. Without this,
+// `pickMatchingVersionFinal` would fall back to its warn-and-skip path,
+// silently bypassing the minimumReleaseAge guarantee for affected packages.
+//
+// Returns the original meta when no upgrade is needed. When an upgrade
+// happens, returns both the upgraded meta and the underlying fetch result
+// so callers can persist it to disk and avoid re-fetching on next install.
+async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
+    if (ctx.offline === true ||
+        !opts.publishedBy ||
+        meta.time != null ||
+        opts.publishedByExclude?.(spec.name) === true) {
+        return { meta };
+    }
+    const modifiedDate = meta.modified ? new Date(meta.modified) : null;
+    const isModifiedValid = modifiedDate != null && !Number.isNaN(modifiedDate.getTime());
+    if (isModifiedValid && modifiedDate < opts.publishedBy) {
+        // The package was last modified before the maturity cutoff. No individual
+        // version can be newer than the cutoff, so the abbreviated form is fine.
+        return { meta };
+    }
+    // When `modified` is missing or malformed we fall through to the upgrade
+    // fetch: prefer correctness (run the maturity check on real `time` data)
+    // over saving a network call when our cached freshness signal is unusable.
+    // Forward etag/modified so the registry can answer 304 if the upgraded
+    // representation hasn't actually changed (rare on the npm registry where
+    // full and abbreviated have distinct etags, but cheap to support).
+    const fullFetchResult = await ctx.fetch(spec.name, {
+        authHeaderValue: opts.authHeaderValue,
+        fullMetadata: true,
+        etag: meta.etag,
+        modified: meta.modified,
+        registry: opts.registry,
+    });
+    if (fullFetchResult.notModified) {
+        // Upgrade fetch came back 304: keep the abbreviated meta. The downstream
+        // `pickMatchingVersionFinal` will fall through to its warn-and-skip path.
+        return { meta };
+    }
+    return { meta: fullFetchResult.meta, upgradedFrom: fullFetchResult };
+}
+// Returns true when a fast-path cache catch should rethrow under
+// strictPublishedByCheck. ERR_PNPM_MISSING_TIME is excluded so callers fall
+// through to the network fetch path, which can upgrade abbreviated cached
+// metadata to full and run the maturity check on real `time` data.
+function shouldRethrowFromFastPathCache(err, strictPublishedByCheck) {
+    return strictPublishedByCheck === true && !isMissingTimeError(err);
+}
+// Persists upgraded full metadata to the on-disk cache mirror and returns
+// the meta to store in the in-memory cache. When `filterMetadata` is on, the
+// in-memory and on-disk forms are both stripped via `clearMeta`; otherwise
+// the original raw response body is written and the unstripped meta is kept.
+function persistUpgradedMeta(ctx, pkgMirror, upgradedFrom) {
+    const metaForCache = ctx.filterMetadata ? clearMeta(upgradedFrom.meta) : upgradedFrom.meta;
+    const jsonForDisk = ctx.filterMetadata
+        ? prepareJsonForDisk(metaForCache, upgradedFrom.etag)
+        : prepareJsonForDisk(upgradedFrom.meta, upgradedFrom.etag, upgradedFrom.jsonText);
+    runLimited(pkgMirror, (l) => l(async () => {
+        try {
+            await saveMeta(pkgMirror, jsonForDisk);
+        }
+        catch (err) { // eslint-disable-line
+            // We don't care if this file was not written to the cache
+        }
+    }));
+    return metaForCache;
+}
 function clearMeta(pkg) {
     const versions = {};
     for (const [version, info] of Object.entries(pkg.versions)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1101.1.0",
+  "version": "1101.1.1",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -40,26 +40,26 @@
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.3",
+    "@pnpm/core-loggers": "1100.0.2",
+    "@pnpm/constants": "1100.0.0",
     "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/fs.graceful-fs": "1100.1.0",
     "@pnpm/error": "1100.0.0",
     "@pnpm/fetching.types": "1100.0.1",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
-    "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.3",
-    "@pnpm/store.cafs": "1100.1.3",
-    "@pnpm/store.index": "1100.1.0",
     "@pnpm/resolving.registry.types": "1100.0.3",
-    "@pnpm/types": "1101.1.0",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.3",
     "@pnpm/resolving.resolver-base": "1100.1.3",
-    "@pnpm/constants": "1100.0.0",
-    "@pnpm/workspace.range-resolver": "1100.0.1",
+    "@pnpm/types": "1101.1.0",
+    "@pnpm/store.index": "1100.1.0",
+    "@pnpm/store.cafs": "1100.1.4",
     "@pnpm/workspace.spec-parser": "1100.0.0",
-    "@pnpm/core-loggers": "1100.0.2"
+    "@pnpm/workspace.range-resolver": "1100.0.1",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
+    "@pnpm/config.pick-registry-for-package": "1100.0.3"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.4"
+    "@pnpm/worker": "^1100.1.5"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -70,11 +70,11 @@
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
     "@pnpm/config.version-policy": "1100.0.3",
+    "@pnpm/network.fetch": "1100.0.4",
+    "@pnpm/resolving.npm-resolver": "1101.1.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/resolving.npm-resolver": "1101.1.0",
-    "@pnpm/network.fetch": "1100.0.3",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.3"
+    "@pnpm/testing.mock-agent": "1100.0.4"
   },
   "engines": {
     "node": ">=22.13"