@pnpm/resolving.npm-resolver 1101.3.2 → 1101.4.0

package/lib/createNpmResolutionVerifier.js

@@ -233,8 +233,8 @@ async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissi
  * attestation endpoint is cheaper than the packument: presence of
  * provenance on the current version is not sufficient to clear a
  * downgrade. A package could have shipped earlier versions under a
- * `trustedPublisher` (the higher-rank evidence) and then dropped
- * back to plain provenance for the version we're verifying —
+ * `trustedPublisher` with provenance (the higher-rank evidence) and
+ * then dropped back to plain provenance for the version we're verifying —
  * `failIfTrustDowngraded` correctly flags that, and a "has any
  * attestation → pass" shortcut would silently miss it.
  */
@@ -341,12 +341,23 @@ function projectTrustManifest(manifest) {
     // reads them; cast away the unsoundness so callers see the same nominal
     // shape without the per-version dependency graph / scripts / README bulk
     // carrying through. `_npmUser` is similarly narrowed to just
-    // `trustedPublisher` — the only sub-field the trust check inspects — so
-    // we don't keep maintainer name/email PII resident in the cache.
+    // `trustedPublisher` and `approver` — the only sub-fields the trust check
+    // inspects — so we don't keep maintainer name/email PII resident in the
+    // cache.
+    const approver = manifest._npmUser?.approver;
     const trustedPublisher = manifest._npmUser?.trustedPublisher;
     const provenance = manifest.dist?.attestations?.provenance;
+    let npmUser = undefined;
+    if (approver) {
+        npmUser ||= {};
+        npmUser.approver = {};
+    }
+    if (trustedPublisher) {
+        npmUser ||= {};
+        npmUser.trustedPublisher = trustedPublisher;
+    }
     return {
-        _npmUser: trustedPublisher != null ? { trustedPublisher } : undefined,
+        _npmUser: npmUser,
         dist: provenance != null
             ? { attestations: { provenance } }
             : undefined,

package/lib/index.d.ts

@@ -108,6 +108,7 @@ export type ResolveFromNpmOptions = {
     preferredVersions?: PreferredVersions;
     preferWorkspacePackages?: boolean;
     update?: false | 'compatible' | 'latest';
+    updateChecksums?: boolean;
     injectWorkspacePackages?: boolean;
     calcSpecifier?: boolean;
     pinnedVersion?: PinnedVersion;

package/lib/index.js

@@ -287,6 +287,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             preferredVersionSelectors: opts.preferredVersions?.[spec.name],
             registry,
             includeLatestTag: opts.update === 'latest',
+            updateChecksums: opts.updateChecksums,
             optional: wantedDependency.optional,
         });
     }
@@ -490,6 +491,7 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
         preferredVersionSelectors: opts.preferredVersions?.[spec.name],
         registry,
         includeLatestTag: opts.update === 'latest',
+        updateChecksums: opts.updateChecksums,
         optional: wantedDependency.optional,
     });
     if (pickedPackage == null) {

package/lib/pickPackage.d.ts

@@ -14,6 +14,15 @@ export interface PickPackageOptions extends PickPackageFromMetaOptions {
     dryRun: boolean;
     includeLatestTag?: boolean;
     optional?: boolean;
+    /**
+     * When true, skip the on-disk exact-version cache fast path so a
+     * stale on-disk packument can't satisfy the call without a
+     * conditional registry request. The in-memory cache is left alone:
+     * its entries can only be populated by this install's own fresh
+     * network fetches, so they're authoritative for second-and-onward
+     * lookups within the same install.
+     */
+    updateChecksums?: boolean;
 }
 export declare function pickPackage(ctx: {
     fetch: (pkgName: string, opts: {

package/lib/pickPackage.js

@@ -179,7 +179,7 @@ export async function pickPackage(ctx, spec, opts) {
                 }
             }
         }
-        if (!opts.includeLatestTag && spec.type === 'version') {
+        if (!opts.includeLatestTag && !opts.updateChecksums && spec.type === 'version') {
             metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
             // use the cached meta only if it has the required package version
             // otherwise it is probably out of date
@@ -201,7 +201,7 @@ export async function pickPackage(ctx, spec, opts) {
                 }
             }
         }
-        if (opts.publishedBy) {
+        if (opts.publishedBy && opts.publishedByExclude?.(spec.name) !== true) {
             const mtime = await limit(async () => getFileMtime(pkgMirror));
             if (mtime != null && mtime >= opts.publishedBy) {
                 metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));

package/lib/trustChecks.d.ts

@@ -1,6 +1,6 @@
 import type { PackageInRegistry, PackageMeta } from '@pnpm/resolving.registry.types';
 import type { PackageVersionPolicy } from '@pnpm/types';
-type TrustEvidence = 'provenance' | 'trustedPublisher';
+type TrustEvidence = 'provenance' | 'trustedPublisher' | 'stagedPublish';
 export declare function failIfTrustDowngraded(meta: PackageMeta, version: string, opts?: {
     trustPolicyExclude?: PackageVersionPolicy;
     trustPolicyIgnoreAfter?: number;

package/lib/trustChecks.js

@@ -2,6 +2,7 @@ import { PnpmError } from '@pnpm/error';
 import semver from 'semver';
 import { assertMetaHasTime } from './pickPackageFromMeta.js';
 const TRUST_RANK = {
+    stagedPublish: 3,
     trustedPublisher: 2,
     provenance: 1,
 };
@@ -51,6 +52,7 @@ export function failIfTrustDowngraded(meta, version, opts) {
 }
 function prettyPrintTrustEvidence(trustEvidence) {
     switch (trustEvidence) {
+        case 'stagedPublish': return 'staged publish';
         case 'trustedPublisher': return 'trusted publisher';
         case 'provenance': return 'provenance attestation';
         default: return 'no trust evidence';
@@ -70,15 +72,20 @@ function detectStrongestTrustEvidenceBeforeDate(meta, beforeDate, options) {
         const trustEvidence = getTrustEvidence(manifest);
         if (!trustEvidence)
             continue;
-        if (trustEvidence === 'trustedPublisher') {
-            return 'trustedPublisher';
+        if (best === undefined || TRUST_RANK[trustEvidence] > TRUST_RANK[best]) {
+            best = trustEvidence;
+            if (best === 'stagedPublish') {
+                return best;
+            }
         }
-        best ||= 'provenance';
     }
     return best;
 }
 export function getTrustEvidence(manifest) {
-    if (manifest._npmUser?.trustedPublisher) {
+    if (manifest._npmUser?.approver) {
+        return 'stagedPublish';
+    }
+    if (manifest._npmUser?.trustedPublisher && manifest.dist?.attestations?.provenance) {
         return 'trustedPublisher';
     }
     if (manifest.dist?.attestations?.provenance) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1101.3.2",
+  "version": "1101.4.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -28,39 +28,39 @@
   "dependencies": {
     "@zkochan/retry": "^0.2.0",
     "encode-registry": "^3.0.1",
-    "lru-cache": "^11.2.7",
+    "lru-cache": "^11.5.0",
     "normalize-path": "^3.0.0",
-    "p-limit": "^7.1.0",
+    "p-limit": "^7.3.0",
     "p-memoize": "8.0.0",
     "parse-npm-tarball-url": "^5.0.0",
     "path-temp": "^3.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^7.0.1",
-    "semver": "^7.7.2",
+    "semver": "^7.8.1",
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/config.version-policy": "1100.1.1",
-    "@pnpm/core-loggers": "1100.1.1",
+    "@pnpm/config.pick-registry-for-package": "1100.0.6",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/error": "1100.0.0",
     "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/fetching.types": "1100.0.1",
-    "@pnpm/constants": "1100.0.0",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.5",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.4",
-    "@pnpm/resolving.registry.types": "1100.0.4",
-    "@pnpm/resolving.resolver-base": "1100.3.0",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.6",
+    "@pnpm/resolving.registry.types": "1100.1.0",
     "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.6",
-    "@pnpm/workspace.range-resolver": "1100.0.1",
+    "@pnpm/store.cafs": "1100.1.7",
+    "@pnpm/store.index": "1100.1.0",
+    "@pnpm/types": "1101.2.0",
     "@pnpm/workspace.spec-parser": "1100.0.0",
-    "@pnpm/types": "1101.1.1",
-    "@pnpm/store.index": "1100.1.0"
+    "@pnpm/resolving.resolver-base": "1100.3.1",
+    "@pnpm/workspace.range-resolver": "1100.0.1",
+    "@pnpm/config.version-policy": "1100.1.2",
+    "@pnpm/core-loggers": "1100.1.2"
   },
   "peerDependencies": {
-    "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.7"
+    "@pnpm/logger": "^1001.0.1",
+    "@pnpm/worker": "^1100.1.8"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -71,10 +71,10 @@
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.0.6",
-    "@pnpm/resolving.npm-resolver": "1101.3.2",
+    "@pnpm/network.fetch": "1100.0.8",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.6"
+    "@pnpm/resolving.npm-resolver": "1101.4.0",
+    "@pnpm/testing.mock-agent": "1100.0.8"
   },
   "engines": {
     "node": ">=22.13"