@pnpm/resolving.npm-resolver 1101.5.2 → 1102.0.1

package/lib/createNpmResolutionVerifier.d.ts

@@ -1,3 +1,4 @@
+import type { GetAuthHeader } from '@pnpm/fetching.types';
 import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 import type { Registries, TrustPolicy } from '@pnpm/types';
 import type { FetchMetadataFromFromRegistryOptions } from './fetch.js';
@@ -55,7 +56,7 @@ export interface CreateNpmResolutionVerifierOptions {
      * hide the publish timestamp.
      */
     fetchOpts: FetchMetadataFromFromRegistryOptions;
-    getAuthHeaderValueByURI: (registry: string) => string | undefined;
+    getAuthHeaderValueByURI: GetAuthHeader;
     cacheDir?: FetchFullMetadataCachedOptions['cacheDir'];
     /**
      * Per-install LRU shared with the npm resolver's `pickPackage`

package/lib/createNpmResolutionVerifier.js

@@ -369,7 +369,7 @@ function fetchFullMetaForTrust(context, registry, name) {
             // workspaces OOMs CI runners with a 2GB heap (see #11860).
             cachedPromise = fetchFullMetadataCached(context.fetchOpts, name, {
                 registry,
-                authHeaderValue: context.getAuthHeaderValueByURI(registry),
+                authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
                 cacheDir: context.cacheDir,
             }).then(projectTrustMeta);
         }
@@ -467,7 +467,7 @@ async function resolvePublishedAt(context, registry, name, version) {
         return localTime[version];
     const attestationTime = await fetchAttestationPublishedAt(context.fetchOpts, name, version, {
         registry,
-        authHeaderValue: context.getAuthHeaderValueByURI(registry),
+        authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
     });
     if (attestationTime != null)
         return attestationTime;
@@ -526,7 +526,7 @@ function fetchAbbreviatedMeta(context, registry, name) {
         else {
             cachedPromise = fetchAbbreviatedMetadataCached(context.fetchOpts, name, {
                 registry,
-                authHeaderValue: context.getAuthHeaderValueByURI(registry),
+                authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
                 cacheDir: context.cacheDir,
             }).then(projectAbbreviatedMeta, () => undefined);
         }
@@ -612,7 +612,7 @@ function fetchFullMetaTime(context, registry, name) {
     if (cachedPromise == null) {
         cachedPromise = fetchFullMetadataCached(context.fetchOpts, name, {
             registry,
-            authHeaderValue: context.getAuthHeaderValueByURI(registry),
+            authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
             cacheDir: context.cacheDir,
         }).then((meta) => meta.time);
         context.fullMetaCache.set(cacheKey, cachedPromise);

package/lib/fetch.d.ts

@@ -27,4 +27,4 @@ export interface FetchMetadataOptions {
     etag?: string;
     modified?: string;
 }
-export declare function fetchMetadataFromFromRegistry(fetchOpts: FetchMetadataFromFromRegistryOptions, pkgName: string, { authHeaderValue, etag: cachedEtag, fullMetadata, modified: cachedModified, registry }: FetchMetadataOptions): Promise<FetchMetadataResult | FetchMetadataNotModifiedResult>;
+export declare function fetchMetadataFromFromRegistry(fetchOpts: FetchMetadataFromFromRegistryOptions, pkgName: string, { authHeaderValue, etag: cachedEtag, fullMetadata, modified: cachedModified, registry, }: FetchMetadataOptions): Promise<FetchMetadataResult | FetchMetadataNotModifiedResult>;

package/lib/index.d.ts

@@ -25,6 +25,7 @@ export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export interface ResolverFactoryOptions {
     cacheDir: string;
     storeDir?: string;
+    frozenStore?: boolean;
     fullMetadata?: boolean;
     filterMetadata?: boolean;
     offline?: boolean;
@@ -82,7 +83,7 @@ export declare function createNpmResolver(fetchFromRegistry: FetchFromRegistry,
 };
 export interface ResolveFromNpmContext {
     pickPackage: (spec: RegistryPackageSpec, opts: PickPackageOptions) => ReturnType<typeof pickPackage>;
-    getAuthHeaderValueByURI: (registry: string) => string | undefined;
+    getAuthHeaderValueByURI: GetAuthHeader;
     registries: Registries;
     namedRegistries: Record<string, string>;
     namedRegistryNames: ReadonlySet<string>;

package/lib/index.js

@@ -99,6 +99,7 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             const request = readPkgFromCafs({
                 storeDir,
                 verifyStoreIntegrity: false,
+                frozenStore: opts.frozenStore,
             }, filesIndexFile, {
                 expectedPkg: { name: peekOpts.name, version: peekOpts.version },
             }).then(({ bundledManifest }) => {
@@ -275,7 +276,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             }
         }
     }
-    const authHeaderValue = ctx.getAuthHeaderValueByURI(registry);
+    const authHeaderValue = ctx.getAuthHeaderValueByURI(registry, { pkgName: spec.name });
     let pickResult;
     try {
         pickResult = await ctx.pickPackage(spec, {
@@ -481,7 +482,7 @@ async function resolveFromNamedRegistry(ctx, wantedDependency, opts) {
 // fields common to their result envelopes; each caller adds its own
 // resolvedVia, alias, and normalizedBareSpecifier.
 async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registry) {
-    const authHeaderValue = ctx.getAuthHeaderValueByURI(registry);
+    const authHeaderValue = ctx.getAuthHeaderValueByURI(registry, { pkgName: spec.name });
     const { meta, pickedPackage } = await ctx.pickPackage(spec, {
         pickLowestVersion: opts.pickLowestVersion,
         publishedBy: opts.publishedBy,

package/lib/pickPackage.js

@@ -240,6 +240,17 @@ export async function pickPackage(ctx, spec, opts) {
             if (fetchResult.notModified) {
                 metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
                 if (metaCachedInStore != null) {
+                    // The registry just vouched that the cached packument equals its
+                    // current one, so the validation clock restarts now: bump the
+                    // mirror's mtime so the publishedBy freshness shortcut above can
+                    // fire again on the next install. Without this, a mirror older
+                    // than minimumReleaseAge re-validates on every subsequent
+                    // install — a 304 never rewrites the file. Fire-and-forget: a
+                    // read-only cache dir only costs another conditional request.
+                    if (!opts.dryRun) {
+                        const now = new Date();
+                        fs.utimes(pkgMirror, now, now).catch(() => { });
+                    }
                     // The cached metadata may be abbreviated (no per-version `time`).
                     // When minimumReleaseAge is active we need `time` for the maturity check,
                     // so upgrade to full metadata via a follow-up fetch when warranted.

package/lib/pickPackageFromMeta.d.ts

@@ -14,7 +14,7 @@ export interface PickPackageFromMetaOptions {
     publishedBy?: Date;
     publishedByExclude?: PackageVersionPolicy;
 }
-export declare function pickPackageFromMeta(pickVersionByVersionRangeFn: PickVersionByVersionRange, { preferredVersionSelectors, publishedBy, publishedByExclude }: PickPackageFromMetaOptions, meta: PackageMeta, spec: RegistryPackageSpec): PackageInRegistry | null;
+export declare function pickPackageFromMeta(pickVersionByVersionRangeFn: PickVersionByVersionRange, { preferredVersionSelectors, publishedBy, publishedByExclude, }: PickPackageFromMetaOptions, meta: PackageMeta, spec: RegistryPackageSpec): PackageInRegistry | null;
 export declare function assertMetaHasTime(meta: PackageMeta): asserts meta is PackageMetaWithTime;
 export declare function pickLowestVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;
 export declare function pickVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;

package/lib/whichVersionIsPinned.js

@@ -1,5 +1,11 @@
 import { parseRange } from 'semver-utils';
 export function whichVersionIsPinned(spec) {
+    // A catalog reference carries no version pinning of its own; the pinning is
+    // defined by the catalog entry it points to. Bail out so a catalog name that
+    // happens to look like a version (e.g. "catalog:express4-21") isn't misread
+    // as a pinned version.
+    if (spec.startsWith('catalog:'))
+        return undefined;
     const colonIndex = spec.indexOf(':');
     if (colonIndex !== -1) {
         spec = spec.substring(colonIndex + 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1101.5.2",
+  "version": "1102.0.1",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -39,44 +39,44 @@
     "path-temp": "^3.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^7.0.1",
-    "semver": "^7.8.1",
+    "semver": "^7.8.4",
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.8",
-    "@pnpm/core-loggers": "1100.2.0",
-    "@pnpm/error": "1100.0.0",
+    "@pnpm/core-loggers": "1100.2.1",
     "@pnpm/constants": "1100.0.0",
     "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/config.version-policy": "1100.1.4",
-    "@pnpm/fetching.types": "1100.0.1",
+    "@pnpm/error": "1100.0.0",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.8",
+    "@pnpm/resolving.resolver-base": "1100.4.2",
     "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.9",
-    "@pnpm/resolving.resolver-base": "1100.4.1",
-    "@pnpm/store.index": "1100.1.0",
-    "@pnpm/types": "1101.3.1",
-    "@pnpm/resolving.registry.types": "1100.1.2",
+    "@pnpm/resolving.registry.types": "1100.1.3",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.9",
+    "@pnpm/fetching.types": "1100.0.2",
+    "@pnpm/store.cafs": "1100.1.10",
+    "@pnpm/store.index": "1100.2.0",
+    "@pnpm/types": "1101.3.2",
     "@pnpm/workspace.spec-parser": "1100.0.0",
-    "@pnpm/workspace.range-resolver": "1100.0.1"
+    "@pnpm/config.pick-registry-for-package": "1100.0.9",
+    "@pnpm/config.version-policy": "1100.1.5",
+    "@pnpm/workspace.range-resolver": "1100.0.2"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1",
-    "@pnpm/worker": "^1100.1.11"
+    "@pnpm/logger": "^1100.0.0",
+    "@pnpm/worker": "^1100.2.1"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/ssri": "^7.1.5",
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
-    "@pnpm/resolving.npm-resolver": "1101.5.2",
-    "@pnpm/network.fetch": "1100.1.2",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1101.0.2",
+    "@pnpm/network.fetch": "1100.1.3",
+    "@pnpm/resolving.npm-resolver": "1102.0.1",
+    "@pnpm/testing.mock-agent": "1101.0.3",
     "@pnpm/test-fixtures": "1100.0.0"
   },
   "engines": {