@pnpm/resolving.npm-resolver 1101.3.2 → 1101.3.3

package/lib/createNpmResolutionVerifier.js

@@ -233,8 +233,8 @@ async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissi
  * attestation endpoint is cheaper than the packument: presence of
  * provenance on the current version is not sufficient to clear a
  * downgrade. A package could have shipped earlier versions under a
- * `trustedPublisher` (the higher-rank evidence) and then dropped
- * back to plain provenance for the version we're verifying —
+ * `trustedPublisher` with provenance (the higher-rank evidence) and
+ * then dropped back to plain provenance for the version we're verifying —
  * `failIfTrustDowngraded` correctly flags that, and a "has any
  * attestation → pass" shortcut would silently miss it.
  */

package/lib/index.d.ts

@@ -108,6 +108,7 @@ export type ResolveFromNpmOptions = {
     preferredVersions?: PreferredVersions;
     preferWorkspacePackages?: boolean;
     update?: false | 'compatible' | 'latest';
+    updateChecksums?: boolean;
     injectWorkspacePackages?: boolean;
     calcSpecifier?: boolean;
     pinnedVersion?: PinnedVersion;

package/lib/index.js

@@ -287,6 +287,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             preferredVersionSelectors: opts.preferredVersions?.[spec.name],
             registry,
             includeLatestTag: opts.update === 'latest',
+            updateChecksums: opts.updateChecksums,
             optional: wantedDependency.optional,
         });
     }
@@ -490,6 +491,7 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
         preferredVersionSelectors: opts.preferredVersions?.[spec.name],
         registry,
         includeLatestTag: opts.update === 'latest',
+        updateChecksums: opts.updateChecksums,
         optional: wantedDependency.optional,
     });
     if (pickedPackage == null) {

package/lib/pickPackage.d.ts

@@ -14,6 +14,15 @@ export interface PickPackageOptions extends PickPackageFromMetaOptions {
     dryRun: boolean;
     includeLatestTag?: boolean;
     optional?: boolean;
+    /**
+     * When true, skip the on-disk exact-version cache fast path so a
+     * stale on-disk packument can't satisfy the call without a
+     * conditional registry request. The in-memory cache is left alone:
+     * its entries can only be populated by this install's own fresh
+     * network fetches, so they're authoritative for second-and-onward
+     * lookups within the same install.
+     */
+    updateChecksums?: boolean;
 }
 export declare function pickPackage(ctx: {
     fetch: (pkgName: string, opts: {

package/lib/pickPackage.js

@@ -179,7 +179,7 @@ export async function pickPackage(ctx, spec, opts) {
                 }
             }
         }
-        if (!opts.includeLatestTag && spec.type === 'version') {
+        if (!opts.includeLatestTag && !opts.updateChecksums && spec.type === 'version') {
             metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
             // use the cached meta only if it has the required package version
             // otherwise it is probably out of date

package/lib/trustChecks.js

@@ -78,7 +78,7 @@ function detectStrongestTrustEvidenceBeforeDate(meta, beforeDate, options) {
     return best;
 }
 export function getTrustEvidence(manifest) {
-    if (manifest._npmUser?.trustedPublisher) {
+    if (manifest._npmUser?.trustedPublisher && manifest.dist?.attestations?.provenance) {
         return 'trustedPublisher';
     }
     if (manifest.dist?.attestations?.provenance) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1101.3.2",
+  "version": "1101.3.3",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -28,39 +28,39 @@
   "dependencies": {
     "@zkochan/retry": "^0.2.0",
     "encode-registry": "^3.0.1",
-    "lru-cache": "^11.2.7",
+    "lru-cache": "^11.5.0",
     "normalize-path": "^3.0.0",
-    "p-limit": "^7.1.0",
+    "p-limit": "^7.3.0",
     "p-memoize": "8.0.0",
     "parse-npm-tarball-url": "^5.0.0",
     "path-temp": "^3.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^7.0.1",
-    "semver": "^7.7.2",
+    "semver": "^7.8.1",
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/config.version-policy": "1100.1.1",
-    "@pnpm/core-loggers": "1100.1.1",
+    "@pnpm/config.pick-registry-for-package": "1100.0.6",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/core-loggers": "1100.1.2",
     "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/config.version-policy": "1100.1.2",
+    "@pnpm/error": "1100.0.0",
     "@pnpm/fetching.types": "1100.0.1",
-    "@pnpm/constants": "1100.0.0",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.5",
+    "@pnpm/resolving.registry.types": "1100.0.5",
+    "@pnpm/resolving.resolver-base": "1100.3.1",
+    "@pnpm/store.cafs": "1100.1.7",
+    "@pnpm/store.index": "1100.1.0",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.5",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.4",
-    "@pnpm/resolving.registry.types": "1100.0.4",
-    "@pnpm/resolving.resolver-base": "1100.3.0",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.6",
+    "@pnpm/types": "1101.2.0",
     "@pnpm/workspace.range-resolver": "1100.0.1",
-    "@pnpm/workspace.spec-parser": "1100.0.0",
-    "@pnpm/types": "1101.1.1",
-    "@pnpm/store.index": "1100.1.0"
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
+    "@pnpm/workspace.spec-parser": "1100.0.0"
   },
   "peerDependencies": {
-    "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.7"
+    "@pnpm/logger": "^1001.0.1",
+    "@pnpm/worker": "^1100.1.8"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -71,10 +71,10 @@
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.0.6",
-    "@pnpm/resolving.npm-resolver": "1101.3.2",
+    "@pnpm/testing.mock-agent": "1100.0.7",
+    "@pnpm/resolving.npm-resolver": "1101.3.3",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.6"
+    "@pnpm/network.fetch": "1100.0.7"
   },
   "engines": {
     "node": ">=22.13"