@pnpm/resolving.npm-resolver 1102.0.1 → 1102.1.1

package/lib/clearMeta.d.ts

@@ -0,0 +1,16 @@
+import type { PackageMeta } from '@pnpm/resolving.registry.types';
+/**
+ * Reduces a package metadata document to the abbreviated field set that the
+ * resolver actually reads, dropping install-irrelevant fields (scripts,
+ * exports, readme, custom `_`-prefixed fields, etc.).
+ *
+ * Used in two places:
+ * - The network layer (`fetch.ts`) normalizes a registry that ignored the
+ *   abbreviated `Accept` header and returned a full document.
+ * - The resolver (`pickPackage.ts`) narrows a deliberately-fetched full
+ *   document into the `filterMetadata` cache slot.
+ *
+ * Null-safe on `versions` so it can be called on an unpublished package (no
+ * versions), which the abbreviated path can reach.
+ */
+export declare function clearMeta(pkg: PackageMeta): PackageMeta;

package/lib/clearMeta.js

@@ -0,0 +1,55 @@
+import { pick } from 'ramda';
+// The list taken from https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-version-object
+// with the addition of 'libc'
+const ABBREVIATED_VERSION_FIELDS = [
+    'name',
+    'version',
+    'bin',
+    'directories',
+    'devDependencies',
+    'optionalDependencies',
+    'dependencies',
+    'peerDependencies',
+    'dist',
+    'engines',
+    'peerDependenciesMeta',
+    'cpu',
+    'os',
+    'libc',
+    'deprecated',
+    'bundleDependencies',
+    'bundledDependencies',
+    'hasInstallScript',
+    '_npmUser',
+];
+/**
+ * Reduces a package metadata document to the abbreviated field set that the
+ * resolver actually reads, dropping install-irrelevant fields (scripts,
+ * exports, readme, custom `_`-prefixed fields, etc.).
+ *
+ * Used in two places:
+ * - The network layer (`fetch.ts`) normalizes a registry that ignored the
+ *   abbreviated `Accept` header and returned a full document.
+ * - The resolver (`pickPackage.ts`) narrows a deliberately-fetched full
+ *   document into the `filterMetadata` cache slot.
+ *
+ * Null-safe on `versions` so it can be called on an unpublished package (no
+ * versions), which the abbreviated path can reach.
+ */
+export function clearMeta(pkg) {
+    // A null prototype so that a registry-controlled version key named
+    // `__proto__` becomes a regular own property instead of mutating the
+    // prototype of the map (js/prototype-polluting-assignment).
+    const versions = Object.create(null);
+    for (const [version, info] of Object.entries(pkg.versions ?? {})) {
+        versions[version] = pick(ABBREVIATED_VERSION_FIELDS, info);
+    }
+    return {
+        name: pkg.name,
+        'dist-tags': pkg['dist-tags'],
+        versions,
+        time: pkg.time,
+        modified: pkg.modified,
+    };
+}
+//# sourceMappingURL=clearMeta.js.map

package/lib/createNpmResolutionVerifier.d.ts

@@ -1,5 +1,5 @@
 import type { GetAuthHeader } from '@pnpm/fetching.types';
-import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
+import { type ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 import type { Registries, TrustPolicy } from '@pnpm/types';
 import type { FetchMetadataFromFromRegistryOptions } from './fetch.js';
 import { type FetchFullMetadataCachedOptions } from './fetchFullMetadataCached.js';

package/lib/createNpmResolutionVerifier.js

@@ -2,14 +2,15 @@ import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { createPackageVersionPolicy } from '@pnpm/config.version-policy';
 import { FULL_META_DIR } from '@pnpm/constants';
 import { PnpmError } from '@pnpm/error';
+import { isGitHostedTarballUrl, } from '@pnpm/resolving.resolver-base';
 import semver from 'semver';
 import { fetchAttestationPublishedAt } from './fetchAttestationPublishedAt.js';
 import { fetchAbbreviatedMetadataCached, fetchFullMetadataCached, } from './fetchFullMetadataCached.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
 import { BUILTIN_NAMED_REGISTRIES } from './parseBareSpecifier.js';
-import { getPkgMirrorPath, loadMeta, warnMissingTimeFieldOnce } from './pickPackage.js';
+import { getPkgMetaCacheKey, getPkgMirrorPath, loadMeta, warnMissingTimeFieldOnce } from './pickPackage.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
-import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, MISSING_TARBALL_INTEGRITY_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 /**
  * Returns a `ResolutionVerifier` for npm-registry-resolved lockfile
  * entries. It always binds each entry's recorded tarball URL to the
@@ -85,8 +86,17 @@ export function createNpmResolutionVerifier(opts) {
     const trustPolicy = opts.trustPolicy;
     const trustPolicyIgnoreAfter = opts.trustPolicyIgnoreAfter;
     const verify = async (resolution, { name, version, nonSemverVersion }) => {
-        if (!isNpmRegistryResolution(resolution))
+        if (!isRegistryTarballResolution(resolution))
             return { ok: true };
+        // Network-free structural checks must run before registry metadata shortcuts.
+        const integrity = resolution.integrity;
+        if (typeof integrity !== 'string' || integrity.length === 0) {
+            return {
+                ok: false,
+                code: MISSING_TARBALL_INTEGRITY_VIOLATION_CODE,
+                reason: 'has no "integrity" field, so its downloaded tarball cannot be verified',
+            };
+        }
         // URL/git-keyed entries are deliberate non-registry deps. They can still
         // carry a semver `version` copied from the resolved manifest, so the
         // semver guard below isn't enough on its own — the registry policies and
@@ -94,9 +104,22 @@ export function createNpmResolutionVerifier(opts) {
         // would 404.
         if (nonSemverVersion != null)
             return { ok: true };
-        if (!semver.valid(version))
-            return { ok: true };
-        const tarballUrl = resolution.tarball;
+        if (!semver.valid(version)) {
+            return {
+                ok: false,
+                code: TARBALL_URL_MISMATCH_VIOLATION_CODE,
+                reason: `has a non-semver version ("${version}") and so cannot be verified against the registry's published metadata`,
+            };
+        }
+        const rawTarball = resolution.tarball;
+        if (rawTarball != null && typeof rawTarball !== 'string') {
+            return {
+                ok: false,
+                code: TARBALL_URL_MISMATCH_VIOLATION_CODE,
+                reason: 'has a non-string "tarball" field, so its URL cannot be verified',
+            };
+        }
+        const tarballUrl = typeof rawTarball === 'string' ? rawTarball : undefined;
         const registry = pickRegistryForVersion(opts.registries, namedRegistryPrefixes, name, tarballUrl);
         // A registry entry that pins an explicit tarball URL must point at the
         // artifact the registry's own metadata lists. Otherwise a trusted
@@ -150,6 +173,8 @@ export function createNpmResolutionVerifier(opts) {
             // applies the binding — otherwise an upgrade could keep trusting a
             // lockfile that was only ever age/trust-checked.
             tarballUrlBinding: true,
+            // Same cache identity rule for the missing-integrity structural check.
+            integrityRequired: true,
             minimumReleaseAge,
             minimumReleaseAgeExclude: sortedMinAgeExcludes,
             trustPolicy: trustPolicy ?? null,
@@ -161,6 +186,10 @@ export function createNpmResolutionVerifier(opts) {
             // didn't record it can't be trusted to have enforced it.
             if (cached.tarballUrlBinding !== true)
                 return false;
+            // The missing-integrity check is also unconditional; older cache records
+            // without the flag cannot prove they rejected unverifiable tarballs.
+            if (cached.integrityRequired !== true)
+                return false;
             // Maturity: a previously cached run under a larger cutoff
             // (stricter window) is trustworthy under a smaller current one —
             // its set of accepted versions is a subset of today's. The
@@ -203,17 +232,11 @@ export function createNpmResolutionVerifier(opts) {
     };
 }
 async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissingTimeField) {
-    let published;
-    try {
-        published = await fetchPublishedAt(context, registry, name, version);
-    }
-    catch (err) {
-        return {
-            ok: false,
-            code: MINIMUM_RELEASE_AGE_VIOLATION_CODE,
-            reason: uncheckable('minimumReleaseAge', err instanceof Error ? err.message : String(err)),
-        };
-    }
+    // A transport failure (auth/network/5xx) propagates the registry's own fetch
+    // error (e.g. ERR_PNPM_FETCH_403); the gate aborts the install with it rather
+    // than folding it into a policy violation. A successful fetch that simply
+    // lacks a publish timestamp for this version is handled below.
+    const published = await fetchPublishedAt(context, registry, name, version);
     if (!published) {
         // No source — attestation, local mirror, or full metadata —
         // surfaced a publish timestamp for this version. The resolver's
@@ -262,7 +285,15 @@ async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissi
  * pointing it at a `name@version` the registry can't vouch for.
  */
 async function runTarballUrlCheck(context, registry, name, version, lockfileTarball) {
-    const meta = await fetchAbbreviatedMeta(context, registry, name);
+    const { meta, error } = await fetchAbbreviatedMeta(context, registry, name);
+    if (error != null) {
+        // Couldn't reach the registry to verify (auth/network/5xx). Propagate the
+        // registry's own fetch error (e.g. ERR_PNPM_FETCH_403, which already
+        // explains the auth situation) instead of mislabeling a transport failure
+        // as a tampering-style URL mismatch. The gate aborts the install with that
+        // error — still fail-closed, the entry never reaches the filesystem.
+        throw error;
+    }
     const registryTarball = meta?.versionTarballs?.get(version);
     if (registryTarball != null && sameTarballUrl(lockfileTarball, registryTarball)) {
         return undefined;
@@ -304,20 +335,11 @@ function canonicalTarballUrl(url) {
  * attestation → pass" shortcut would silently miss it.
  */
 async function runTrustCheck(context, registry, name, version, opts) {
-    let meta;
-    try {
-        meta = await fetchFullMetaForTrust(context, registry, name);
-    }
-    catch (err) {
-        // `fetchFullMetadataCached` rejects (network error, 404, etc.); the
-        // verifier fails closed so a missing manifest can't be mistaken
-        // for a passing trust check.
-        return {
-            ok: false,
-            code: TRUST_DOWNGRADE_VIOLATION_CODE,
-            reason: uncheckable('trustPolicy', err instanceof Error ? err.message : String(err)),
-        };
-    }
+    // A transport failure (auth/network/5xx) propagates the registry's own fetch
+    // error; the gate aborts the install with it rather than folding it into a
+    // policy violation. Still fail-closed: a missing manifest can't be mistaken
+    // for a passing trust check because the install never proceeds.
+    const meta = await fetchFullMetaForTrust(context, registry, name);
     try {
         failIfTrustDowngraded(meta, version, opts);
     }
@@ -335,20 +357,13 @@ function fetchFullMetaForTrust(context, registry, name) {
     let cachedPromise = context.fullMetaForTrustCache.get(cacheKey);
     if (cachedPromise == null) {
         // Fast path: if the resolver already upgraded to full meta for this
-        // name during the same install (e.g. minimumReleaseAge active),
-        // reuse that document. Abbreviated meta is rejected here — it lacks
-        // per-version `time` and per-version trust evidence, both required
-        // by failIfTrustDowngraded.
-        //
-        // Limitation: the resolver's `metaCache` keys by `${name}:full` —
-        // it doesn't include the registry (pickPackage.ts cacheKey shape).
-        // If two registries serve packages of the same name in one install
-        // the resolver itself silently keeps the first fetch; the verifier
-        // here inherits that scope. The name check below is a defensive
-        // guard against accidental cache mixups; tightening this to a
-        // registry-qualified read needs the resolver's `metaCache` key
-        // shape to change first.
-        const shared = readSharedMetaForTrust(context.sharedMetaCache, name);
+        // (registry, name) during the same install (e.g. minimumReleaseAge
+        // active), reuse that document. Abbreviated meta is rejected here —
+        // it lacks per-version `time` and per-version trust evidence, both
+        // required by failIfTrustDowngraded. The read is registry-qualified
+        // (see `getPkgMetaCacheKey`), so a package of the same name served by
+        // a different registry can't be returned here.
+        const shared = readSharedMetaForTrust(context.sharedMetaCache, registry, name);
         if (shared != null) {
             cachedPromise = Promise.resolve(projectTrustMeta(shared));
         }
@@ -492,7 +507,9 @@ async function resolvePublishedAt(context, registry, name, version) {
  * lookups.
  */
 async function tryAbbreviatedModifiedShortcut(context, registry, name, version) {
-    const meta = await fetchAbbreviatedMeta(context, registry, name);
+    // A fetch failure here is fine: ignore `error` and fall back to per-version
+    // lookups, the same as a successful-but-uninformative metadata response.
+    const { meta } = await fetchAbbreviatedMeta(context, registry, name);
     const modified = meta?.modified;
     if (typeof modified !== 'string')
         return undefined;
@@ -516,49 +533,59 @@ function fetchAbbreviatedMeta(context, registry, name) {
         // Fast path: the resolver's per-install LRU already holds this
         // packument from its own pickPackage pass — abbreviated or full.
         // Project it for the shortcut and skip the disk/network round-trip.
-        // Mismatch on `name` is the same risk the resolver carries today
-        // (its cache key omits the registry), so reuse is no less correct
-        // than the resolver's own get.
-        const shared = readSharedMeta(context.sharedMetaCache, name);
+        // The read is registry-qualified (see `getPkgMetaCacheKey`), so it
+        // can only return this registry's own packument.
+        const shared = readSharedMeta(context.sharedMetaCache, registry, name);
         if (shared != null) {
-            cachedPromise = Promise.resolve(projectAbbreviatedMeta(shared));
+            cachedPromise = Promise.resolve({ meta: projectAbbreviatedMeta(shared) });
         }
         else {
+            // Carry a fetch failure (auth/network/5xx) as `error` instead of
+            // collapsing it to `undefined`: the tarball-URL check rethrows it (so the
+            // registry's own error surfaces, not a tampering-style mismatch) while
+            // the age shortcut ignores it and falls back to per-version lookups.
+            // Keeping it a resolved value — not a rejected promise — lets the two
+            // callers share one cached promise without an unhandled rejection.
             cachedPromise = fetchAbbreviatedMetadataCached(context.fetchOpts, name, {
                 registry,
                 authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
                 cacheDir: context.cacheDir,
-            }).then(projectAbbreviatedMeta, () => undefined);
+            }).then((meta) => ({ meta: projectAbbreviatedMeta(meta) }), (error) => ({ error }));
         }
         context.abbreviatedMetaCache.set(cacheKey, cachedPromise);
     }
     return cachedPromise;
 }
-function readSharedMeta(cache, name) {
+function readSharedMeta(cache, registry, name) {
     if (cache == null)
         return undefined;
-    // Prefer the full entry — a `name:full` hit subsumes the abbreviated
-    // hit (full meta carries every field the abbreviated form does, plus
-    // `time` and per-version trust evidence the trust check needs). The
-    // resolver only populates `name:full` when the install ran with
-    // `minimumReleaseAge` configured, otherwise the bare `name` key holds
+    // Prefer a full entry — it carries every field the abbreviated form
+    // does, plus `time` and per-version trust evidence the trust check
+    // needs. The resolver only populates a full key when the install ran
+    // with `minimumReleaseAge` configured, otherwise the bare key holds
     // the abbreviated form.
-    return validateSharedMeta(cache.get(`${name}:full`), name) ??
-        validateSharedMeta(cache.get(name), name);
+    return readSharedFullMeta(cache, registry, name) ??
+        validateSharedMeta(cache.get(getPkgMetaCacheKey(registry, name, false, false)), name);
 }
-function readSharedMetaForTrust(cache, name) {
+function readSharedMetaForTrust(cache, registry, name) {
     if (cache == null)
         return undefined;
     // Abbreviated meta is rejected for the trust check — it lacks
     // per-version `time` and per-version trust evidence.
-    return validateSharedMeta(cache.get(`${name}:full`), name);
+    return readSharedFullMeta(cache, registry, name);
 }
-// Defensive guard against the resolver's `name`-only cache key
-// returning something unexpected. The known correctness gap (two
-// registries serving the same package name share one cache slot)
-// is inherited from the resolver itself — see the `pickPackage.ts`
-// cacheKey shape; the verifier can't be stricter than the resolver
-// without changing both. This name check at least catches accidental
+// The resolver keys full metadata as either filtered or unfiltered
+// depending on its own `filterMetadata` setting; the verifier doesn't
+// know which, and a filtered full packument keeps everything the
+// verifier reads (`time`, per-version `_npmUser`, `dist`), so try both.
+function readSharedFullMeta(cache, registry, name) {
+    return validateSharedMeta(cache.get(getPkgMetaCacheKey(registry, name, true, false)), name) ??
+        validateSharedMeta(cache.get(getPkgMetaCacheKey(registry, name, true, true)), name);
+}
+// Defensive guard against the resolver's `metaCache` returning an
+// unexpected entry. The cache key is registry-qualified (see
+// `getPkgMetaCacheKey`), so a package of the same name from another
+// registry can't be returned; this name check catches accidental
 // returns of a different package (cache corruption, factory misuse)
 // rather than silently feeding wrong data to the trust / age check.
 function validateSharedMeta(meta, name) {
@@ -672,25 +699,26 @@ function isExcluded(policy, name, version) {
         return true;
     return false;
 }
-function isNpmRegistryResolution(resolution) {
+function isRegistryTarballResolution(resolution) {
     if (resolution == null || typeof resolution !== 'object')
         return false;
     // Only plain tarball resolutions (npm registry / named registries) have no
     // `type` field. Git / directory / binary / custom resolutions all carry one.
     if ('type' in resolution && resolution.type != null)
         return false;
-    // Git-hosted tarballs (codeload/gitlab/bitbucket) are special-cased in
-    // the resolver and aren't subject to release-age policy.
-    if ('gitHosted' in resolution && resolution.gitHosted)
-        return false;
     const tarball = resolution.tarball;
     if (typeof tarball === 'string') {
+        // Git-hosted tarballs (codeload/gitlab/bitbucket) are special-cased in
+        // the resolver and aren't subject to registry policy.
+        if (isGitHostedTarballUrl(tarball))
+            return false;
         // Local/non-registry tarballs (for example `file:`) have no packument
         // metadata, so minimumReleaseAge/trustPolicy verification cannot apply.
         const protocol = tryParseUrl(tarball)?.protocol;
         if (protocol != null && protocol !== 'http:' && protocol !== 'https:')
             return false;
     }
-    return 'tarball' in resolution || 'integrity' in resolution;
+    // Canonical registry entries may omit both `tarball` and `integrity`.
+    return true;
 }
 //# sourceMappingURL=createNpmResolutionVerifier.js.map

package/lib/fetch.js

@@ -1,9 +1,19 @@
 import url from 'node:url';
+import util from 'node:util';
 import { requestRetryLogger } from '@pnpm/core-loggers';
-import { FetchError, PnpmError, } from '@pnpm/error';
+import { FetchError, PnpmError, redactUrlCredentials, } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import * as retry from '@zkochan/retry';
 import semver from 'semver';
+import { clearMeta } from './clearMeta.js';
+/**
+ * Content type of an abbreviated (install-oriented) package metadata document.
+ * A spec-compliant registry echoes this in the response `Content-Type` when it
+ * honors the abbreviated `Accept` header. Its absence signals that the registry
+ * ignored the header and served the full document instead.
+ * https://github.com/npm/registry/blob/main/docs/responses/package-metadata.md
+ */
+const ABBREVIATED_META_CONTENT_TYPE = 'application/vnd.npm.install-v1+json';
 export class RegistryResponseError extends FetchError {
     pkgName;
     constructor(request, response, pkgName) {
@@ -87,7 +97,18 @@ export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHe
                 });
             }
             catch (error) { // eslint-disable-line
-                reject(new PnpmError('META_FETCH_FAIL', `GET ${uri}: ${error.message}`, { attempts: attempt, cause: error }));
+                // Redact credentials embedded in the URL from the cause as well, not
+                // just the top-level message: a reporter or debugger that renders
+                // `error.cause` would otherwise print the raw URL-bearing message. The
+                // `stack` string embeds the original (pre-mutation) message, so redact
+                // it too — mutating `message` alone leaves the credentials in `stack`.
+                if (util.types.isNativeError(error)) {
+                    if (typeof error.message === 'string')
+                        error.message = redactUrlCredentials(error.message);
+                    if (typeof error.stack === 'string')
+                        error.stack = redactUrlCredentials(error.stack);
+                }
+                reject(new PnpmError('META_FETCH_FAIL', redactUrlCredentials(`GET ${uri}: ${error.message}`), { attempts: attempt, cause: error }));
                 return;
             }
             if (response.status === 304) {
@@ -113,8 +134,7 @@ export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHe
                     globalWarn(`Request took ${elapsedMs}ms: ${uri}`);
                 }
                 resolve({
-                    meta,
-                    jsonText,
+                    ...normalizeAbbreviatedResponse({ fullMetadata, meta, jsonText, response }),
                     etag: response.headers.get('etag') ?? undefined,
                 });
             }
@@ -144,6 +164,38 @@ export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHe
         });
     });
 }
+/**
+ * When the resolver asked for abbreviated metadata but the registry ignored the
+ * `Accept` header and returned the full document (detected via the response
+ * `Content-Type`), strip it down to the abbreviated field set so downstream
+ * consumers — the in-memory cache, the on-disk mirror, and the resolver — never
+ * carry the megabytes of install-irrelevant data (scripts, exports, readme,
+ * custom fields) that a full document contains.
+ *
+ * Registries that honor the header (e.g. the npm registry) echo the abbreviated
+ * `Content-Type`, so this is a no-op for them: no re-serialization, no field
+ * stripping — the happy path pays nothing.
+ */
+function normalizeAbbreviatedResponse({ fullMetadata, meta, jsonText, response }) {
+    if (fullMetadata)
+        return { meta, jsonText };
+    if (parseMediaType(response.headers.get('content-type')) === ABBREVIATED_META_CONTENT_TYPE)
+        return { meta, jsonText };
+    const normalized = clearMeta(meta);
+    return { meta: normalized, jsonText: JSON.stringify(normalized) };
+}
+/**
+ * Extracts the media type from a `Content-Type` header value, dropping
+ * parameters such as `; charset=utf-8`. Media types are case-insensitive
+ * (RFC 9110 §8.3.1), so the result is lowercased for comparison.
+ */
+function parseMediaType(contentType) {
+    if (contentType == null)
+        return undefined;
+    const semicolonIndex = contentType.indexOf(';');
+    const mediaType = semicolonIndex === -1 ? contentType : contentType.slice(0, semicolonIndex);
+    return mediaType.trim().toLowerCase();
+}
 function toUri(pkgName, registry) {
     let encodedName;
     if (pkgName[0] === '@') {

package/lib/index.d.ts

@@ -94,6 +94,8 @@ export interface ResolveFromNpmContext {
         name?: string;
         version?: string;
     }) => Promise<DependencyManifest | undefined>;
+    /** Deduplicates the held-back-update warning per `(name, picked, preferred)`. */
+    warnedHeldBackUpdates: Set<string>;
 }
 export type ResolveFromNpmOptions = {
     alwaysTryWorkspacePackages?: boolean;
@@ -109,6 +111,7 @@ export type ResolveFromNpmOptions = {
     preferredVersions?: PreferredVersions;
     preferWorkspacePackages?: boolean;
     update?: false | 'compatible' | 'latest';
+    updateRequested?: boolean;
     updateChecksums?: boolean;
     injectWorkspacePackages?: boolean;
     calcSpecifier?: boolean;

package/lib/index.js

@@ -1,6 +1,8 @@
 import path from 'node:path';
 import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { PnpmError } from '@pnpm/error';
+import { globalWarn } from '@pnpm/logger';
+import { EXISTING_VERSION_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
 import { storeIndexKey } from '@pnpm/store.index';
 import { readPkgFromCafs, } from '@pnpm/worker';
 import { resolveWorkspaceRange } from '@pnpm/workspace.range-resolver';
@@ -130,6 +132,7 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
         namedRegistryNames,
         saveWorkspaceProtocol: opts.saveWorkspaceProtocol,
         peekManifestFromStore,
+        warnedHeldBackUpdates: new Set(),
     };
     const boundResolveFromNpm = resolveNpm.bind(null, ctx);
     const boundResolveFromJsr = resolveJsr.bind(null, ctx);
@@ -150,6 +153,96 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
         },
     };
 }
+/**
+ * The preferred-version selectors to hand the package picker for `pkgName`.
+ *
+ * When this package is the user's update target (`updateRequested`), the
+ * lockfile's contribution to its selectors is removed so the target
+ * re-resolves exactly the way a fresh install would after its lockfile
+ * entries were deleted. Everything a fresh install applies is preserved:
+ * manifest pins, the versions propagated down the dependency chain, and the
+ * negative-weight `range` penalties that `pnpm audit --fix` injects to steer
+ * resolution away from vulnerable versions.
+ */
+function preferredVersionSelectorsFor(opts, pkgName) {
+    const selectors = opts.preferredVersions?.[pkgName];
+    if (!opts.updateRequested)
+        return selectors;
+    return stripLockfileVersionPins(selectors);
+}
+/**
+ * Remove the lockfile-derived part of the selectors: the concrete pins
+ * `getPreferredVersionsFromLockfileAndManifests` seeds at
+ * `EXISTING_VERSION_SELECTOR_WEIGHT` — added onto the manifest weight when a
+ * manifest entry pins the same version, so the lockfile weight is subtracted
+ * rather than the selector dropped, leaving the manifest contribution in
+ * effect. Selectors a fresh install would also apply (manifest pins,
+ * chain-propagated versions, `range`/`tag` selectors) pass through unchanged.
+ * Returns `undefined` when nothing remains.
+ */
+function stripLockfileVersionPins(selectors) {
+    if (selectors == null)
+        return undefined;
+    let kept;
+    for (const [selector, value] of Object.entries(selectors)) {
+        let keptValue = value;
+        if (typeof value !== 'string' && value.selectorType === 'version' && value.weight >= EXISTING_VERSION_SELECTOR_WEIGHT) {
+            const manifestWeight = value.weight - EXISTING_VERSION_SELECTOR_WEIGHT;
+            if (manifestWeight <= 0)
+                continue;
+            keptValue = { selectorType: 'version', weight: manifestWeight };
+        }
+        // Null-prototype: selector keys come from manifests and the lockfile,
+        // and a dist-tag named `__proto__` is a valid selector key.
+        kept ??= Object.create(null);
+        kept[selector] = keptValue;
+    }
+    return kept;
+}
+/**
+ * During a targeted update the picker still honors the preferred versions a
+ * fresh install would apply (manifest pins and versions propagated down the
+ * dependency chain), so the target can legitimately settle below the highest
+ * version its range admits. Surface that once per package: reaching the
+ * newer version everywhere is an override's job, not an update's.
+ *
+ * The baseline for "held back" is the pick with only the non-pin selectors
+ * applied — `range`/`tag` selectors such as the `pnpm audit --fix`
+ * vulnerability penalties steer the baseline too, so the warning never
+ * recommends a version those selectors avoid.
+ *
+ * The recommended override is scoped to the declared range being resolved
+ * (`name@<range>`), so applying it can never violate any consumer's range:
+ * only declarations of exactly this range match the selector, and the
+ * recommended version satisfies it by construction.
+ */
+function warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedVersion) {
+    if (!opts.updateRequested || spec.type !== 'range')
+        return;
+    const selectors = preferredVersionSelectorsFor(opts, spec.name);
+    if (selectors == null)
+        return;
+    let nonPinSelectors;
+    for (const [selector, value] of Object.entries(selectors)) {
+        if ((typeof value === 'string' ? value : value.selectorType) === 'version')
+            continue;
+        // Null-prototype for the same reason as in `stripLockfileVersionPins`.
+        nonPinSelectors ??= Object.create(null);
+        nonPinSelectors[selector] = value;
+    }
+    const preferred = pickVersionByVersionRange({
+        meta,
+        versionRange: spec.fetchSpec,
+        preferredVersionSelectors: nonPinSelectors,
+    });
+    if (preferred == null || preferred === pickedVersion)
+        return;
+    const key = `${spec.name}@${spec.fetchSpec}:${pickedVersion}<${preferred}`;
+    if (ctx.warnedHeldBackUpdates.has(key))
+        return;
+    ctx.warnedHeldBackUpdates.add(key);
+    globalWarn(`"${spec.name}@${spec.fetchSpec}" was updated to ${pickedVersion}, not ${preferred}, to match the version preferred by your manifests and already installed dependencies. To use ${preferred}, add an override to pnpm-workspace.yaml: overrides: { "${spec.name}@${spec.fetchSpec}": "${preferred}" }`);
+}
 function isNpmSpec(query, defaultRegistry) {
     const { alias, bareSpecifier } = query.wantedDependency;
     if (!bareSpecifier)
@@ -285,7 +378,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             publishedByExclude: opts.publishedByExclude,
             authHeaderValue,
             dryRun: opts.dryRun === true,
-            preferredVersionSelectors: opts.preferredVersions?.[spec.name],
+            preferredVersionSelectors: preferredVersionSelectorsFor(opts, spec.name),
             registry,
             includeLatestTag: opts.update === 'latest',
             updateChecksums: opts.updateChecksums,
@@ -306,8 +399,13 @@ async function resolveNpm(ctx, wantedDependency, opts) {
                     pinnedVersion: opts.pinnedVersion,
                 });
             }
-            catch {
-                // ignore
+            catch (workspaceErr) {
+                // When the registry doesn't have the package and the workspace has it
+                // only at non-matching versions, the mismatch error (which lists the
+                // available workspace versions) is more actionable than the raw 404.
+                if (err.code === 'ERR_PNPM_FETCH_404' && workspaceErr.code === 'ERR_PNPM_NO_MATCHING_VERSION_INSIDE_WORKSPACE') {
+                    throw workspaceErr;
+                }
             }
         }
         throw err;
@@ -328,8 +426,13 @@ async function resolveNpm(ctx, wantedDependency, opts) {
                     pinnedVersion: opts.pinnedVersion,
                 });
             }
-            catch {
-                // ignore
+            catch (workspaceErr) {
+                // Neither the registry nor the workspace has a matching version; the
+                // workspace mismatch error carries the available local versions,
+                // which is the actionable detail here.
+                if (workspaceErr.code === 'ERR_PNPM_NO_MATCHING_VERSION_INSIDE_WORKSPACE') {
+                    throw workspaceErr;
+                }
             }
         }
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
@@ -370,6 +473,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             };
         }
     }
+    warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedPackage.version);
     const id = `${pickedPackage.name}@${pickedPackage.version}`;
     const resolution = {
         integrity: getIntegrity(pickedPackage.dist),
@@ -489,7 +593,7 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
         publishedByExclude: opts.publishedByExclude,
         authHeaderValue,
         dryRun: opts.dryRun === true,
-        preferredVersionSelectors: opts.preferredVersions?.[spec.name],
+        preferredVersionSelectors: preferredVersionSelectorsFor(opts, spec.name),
         registry,
         includeLatestTag: opts.update === 'latest',
         updateChecksums: opts.updateChecksums,
@@ -498,6 +602,7 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
     if (pickedPackage == null) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
+    warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedPackage.version);
     const resolution = {
         integrity: getIntegrity(pickedPackage.dist),
         tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),

package/lib/parseBareSpecifier.js

@@ -2,6 +2,7 @@ import { PnpmError } from '@pnpm/error';
 import { parseJsrSpecifier } from '@pnpm/resolving.jsr-specifier-parser';
 import { parseNpmTarballUrl } from 'parse-npm-tarball-url';
 import semver from 'semver';
+import validateNpmPackageName from 'validate-npm-package-name';
 import getVersionSelectorType from 'version-selector-type';
 export function parseBareSpecifier(bareSpecifier, alias, defaultTag, registry) {
     let name = alias;
@@ -69,6 +70,9 @@ export const BUILTIN_NAMED_REGISTRIES = Object.freeze({
 // Parses a named-registry specifier of the shape `<alias>:<body>` into a
 // RegistryPackageSpec. Returns `null` when the specifier does not use one of
 // the configured aliases, so the caller can fall through to other resolvers.
+// Throws INVALID_NAMED_REGISTRY_PACKAGE_NAME when the alias matches but the
+// package name is malformed (missing or empty scope/name segments, path
+// separators inside the name).
 // Supported shapes:
 // - `<alias>:[@<owner>/]<name>[@<version_selector>]`
 // - `<alias>:<version_selector>` paired with a package alias
@@ -100,9 +104,6 @@ export function parseNamedRegistrySpecifierToRegistryPackageSpec(rawSpecifier, k
             pkgName = body.substring(0, index);
             versionSelector = body.substring(index + '@'.length);
         }
-        if (pkgName.indexOf('/') === -1 || pkgName.endsWith('/')) {
-            throw new PnpmError('INVALID_NAMED_REGISTRY_PACKAGE_NAME', `The package name '${pkgName}' in named registry '${registryName}:' is invalid`);
-        }
     }
     else if (packageAlias?.startsWith('@')) {
         // `<alias>:<tag>` paired with a scoped alias — body is a version
@@ -124,6 +125,11 @@ export function parseNamedRegistrySpecifierToRegistryPackageSpec(rawSpecifier, k
         if (!pkgName)
             return null;
     }
+    // The name is used in registry URLs and metadata cache file paths, so
+    // anything that is not a valid npm package name must never make it through.
+    if (!validateNpmPackageName(pkgName).validForOldPackages) {
+        throw new PnpmError('INVALID_NAMED_REGISTRY_PACKAGE_NAME', `The package name '${pkgName}' in named registry '${registryName}:' is invalid`);
+    }
     const selector = getVersionSelectorType(versionSelector ?? defaultTag);
     if (selector == null)
         return null;

package/lib/pickPackage.d.ts

@@ -3,6 +3,14 @@ import type { FetchMetadataNotModifiedResult, FetchMetadataResult } from './fetc
 import type { RegistryPackageSpec } from './parseBareSpecifier.js';
 import { type PickPackageFromMetaOptions } from './pickPackageFromMeta.js';
 export interface PackageMetaCache {
+    /**
+     * Must return the same object reference that `set` stored for the key: the
+     * resolver tracks whether a cached packument was validated against the
+     * registry by object identity (see `unverifiedDiskPackuments`). In a cache
+     * that clones or deserializes on read, that provenance is lost and recovery
+     * degrades — a stale disk-promoted entry that can't satisfy a spec fails
+     * the pick instead of falling through to the registry.
+     */
     get: (key: string) => PackageMeta | undefined;
     set: (key: string, meta: PackageMeta) => void;
     has: (key: string) => boolean;
@@ -15,12 +23,14 @@ export interface PickPackageOptions extends PickPackageFromMetaOptions {
     includeLatestTag?: boolean;
     optional?: boolean;
     /**
-     * When true, skip the on-disk exact-version cache fast path so a
-     * stale on-disk packument can't satisfy the call without a
-     * conditional registry request. The in-memory cache is left alone:
-     * its entries can only be populated by this install's own fresh
-     * network fetches, so they're authoritative for second-and-onward
-     * lookups within the same install.
+     * When true, force a conditional registry request so a stale on-disk
+     * packument can't satisfy the call: the on-disk exact-version fast
+     * path is skipped, and the in-memory cache is bypassed too. The fast
+     * path now promotes disk-loaded packuments into the in-memory cache,
+     * so an entry there can no longer be assumed to come from this
+     * install's own fresh network fetch — on a shared or long-lived
+     * resolver it might be disk-sourced, which would short-circuit the
+     * revalidation updateChecksums exists to force.
      */
     updateChecksums?: boolean;
 }
@@ -44,6 +54,28 @@ export declare function pickPackage(ctx: {
     pickedPackage: PackageInRegistry | null;
 }>;
 export declare function encodePkgName(pkgName: string): string;
+/**
+ * Key for the in-memory `metaCache` holding a package's registry metadata. The
+ * registry is part of the key so that a package of the same name served by two
+ * registries in one install can't collide on a single slot (which would resolve
+ * the wrong tarball/integrity). `fullMetadata` and `filterMetadata` keep the
+ * abbreviated, full, and filtered-full documents in distinct slots, mirroring
+ * the on-disk `metaDir` split: a `filterMetadata` resolver stores a `clearMeta`-
+ * stripped packument, so it must not share a slot with an unfiltered full one
+ * (reachable only when a `metaCache` is shared across resolvers with different
+ * settings). `filterMetadata` only narrows the full slot — abbreviated metadata
+ * shares one on-disk mirror regardless, so its key carries no filtered variant.
+ * `\x00` can't appear in a registry URL or a package name, so it's an
+ * unambiguous separator. The verifier reads this same cache and must build the
+ * key with this function.
+ *
+ * The registry is canonicalized to its origin plus a trailing-slashed path, so
+ * the resolver (which may pass a configured named-registry URL verbatim) and
+ * the verifier (which routes through trailing-slashed prefixes) converge on one
+ * key for the same logical registry instead of creating duplicate slots. Origin
+ * and path are preserved, so two registries that genuinely differ never collapse.
+ */
+export declare function getPkgMetaCacheKey(registry: string, pkgName: string, fullMetadata: boolean, filterMetadata: boolean): string;
 /**
  * Path of the on-disk JSONL document where pnpm mirrors a package's registry
  * metadata. `metaDir` selects between abbreviated and full caches.

package/lib/pickPackage.js

@@ -8,9 +8,9 @@ import { globalWarn, logger } from '@pnpm/logger';
 import getRegistryName from 'encode-registry';
 import pLimit, {} from 'p-limit';
 import { fastPathTemp as pathTemp } from 'path-temp';
-import { pick } from 'ramda';
 import { renameOverwrite } from 'rename-overwrite';
 import semver from 'semver';
+import { clearMeta } from './clearMeta.js';
 import { pickLowestVersionByVersionRange, pickPackageFromMeta, pickVersionByVersionRange, } from './pickPackageFromMeta.js';
 import { toRaw } from './toRaw.js';
 /**
@@ -104,6 +104,29 @@ function pickMatchingVersionFinal(pickerOpts, spec, meta) {
         throw err;
     }
 }
+/**
+ * Packuments promoted into the in-memory cache straight from the on-disk
+ * mirror, without registry validation. The mirror may predate versions the
+ * registry has, so when a cache hit on such an entry can't satisfy the
+ * requested spec (and the resolver isn't offline), `pickPackage` falls
+ * through to the regular flow — a conditional registry request — instead of
+ * failing the pick, exactly as it would have before the entry was promoted.
+ * Network-fetched and 304-revalidated packuments are never in this set, so
+ * hits on them keep returning directly even when the pick fails (the caller
+ * then falls back to workspace packages or reports no matching version).
+ */
+const unverifiedDiskPackuments = new WeakSet();
+/**
+ * Promote a packument parsed from the on-disk mirror into the in-memory
+ * cache, so repeat resolutions of the same package (common across a large
+ * dependency graph) don't re-read and re-parse the mirror. The entry is
+ * remembered as disk-sourced (see {@link unverifiedDiskPackuments}) because it
+ * never went through registry validation.
+ */
+function cacheDiskLoadedMeta(metaCache, cacheKey, meta) {
+    unverifiedDiskPackuments.add(meta);
+    metaCache.set(cacheKey, meta);
+}
 export async function pickPackage(ctx, spec, opts) {
     opts = opts || {};
     const pickerOpts = {
@@ -121,10 +144,16 @@ export async function pickPackage(ctx, spec, opts) {
     const metaDir = fullMetadata
         ? (ctx.filterMetadata ? FULL_FILTERED_META_DIR : FULL_META_DIR)
         : ABBREVIATED_META_DIR;
-    // Cache key includes fullMetadata to avoid returning abbreviated metadata when full metadata is requested.
-    const cacheKey = fullMetadata ? `${spec.name}:full` : spec.name;
+    // Cache key includes the registry so a package of the same name served by two
+    // registries in one install can't share a slot (which would resolve the wrong
+    // tarball/integrity), plus fullMetadata/filterMetadata so a request is never
+    // served a less-detailed or differently-stripped document than it asked for.
+    const cacheKey = getPkgMetaCacheKey(opts.registry, spec.name, fullMetadata, ctx.filterMetadata === true);
     const pkgMirror = getPkgMirrorPath(ctx.cacheDir, metaDir, opts.registry, spec.name);
-    const cachedMeta = ctx.metaCache.get(cacheKey);
+    // updateChecksums must reach the conditional registry request below, so it
+    // can't be served from the in-memory cache — which may hold a disk-promoted
+    // entry rather than a fresh network fetch (see the updateChecksums doc).
+    const cachedMeta = opts.updateChecksums ? undefined : ctx.metaCache.get(cacheKey);
     if (cachedMeta != null) {
         // The in-memory cache may hold abbreviated metadata from an earlier call
         // that didn't need `time` (no publishedBy then). If this call has
@@ -141,21 +170,31 @@ export async function pickPackage(ctx, spec, opts) {
                 : persistUpgradedMeta(ctx, pkgMirror, upgrade.upgradedFrom);
             ctx.metaCache.set(cacheKey, metaForCache);
         }
-        return {
-            meta: metaForCache,
-            pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, metaForCache),
-        };
+        const pickedPackage = pickMatchingVersionFinal(pickerOpts, spec, metaForCache);
+        if (pickedPackage != null || ctx.offline === true || !unverifiedDiskPackuments.has(metaForCache)) {
+            return {
+                meta: metaForCache,
+                pickedPackage,
+            };
+        }
+        // Disk-promoted meta that can't satisfy the spec: fall through and
+        // revalidate against the registry (see unverifiedDiskPackuments).
     }
     return runLimited(pkgMirror, async (limit) => {
         let metaCachedInStore;
         if (ctx.offline === true || ctx.preferOffline === true || opts.pickLowestVersion) {
             metaCachedInStore = await limit(async () => loadMeta(pkgMirror));
             if (ctx.offline) {
-                if (metaCachedInStore != null)
+                if (metaCachedInStore != null) {
+                    // maybeUpgradeAbbreviatedMetaForReleaseAge short-circuits when
+                    // offline, so a later in-memory cache hit returns this same meta
+                    // without any network access.
+                    cacheDiskLoadedMeta(ctx.metaCache, cacheKey, metaCachedInStore);
                     return {
                         meta: metaCachedInStore,
                         pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, metaCachedInStore),
                     };
+                }
                 throw new PnpmError('NO_OFFLINE_META', `Failed to resolve ${toRaw(spec)} in package mirror ${pkgMirror}`);
             }
             if (metaCachedInStore != null) {
@@ -172,6 +211,14 @@ export async function pickPackage(ctx, spec, opts) {
                 }
                 const pickedPackage = pickMatchingVersionFinal(pickerOpts, spec, metaCachedInStore);
                 if (pickedPackage) {
+                    // A cache hit re-runs maybeUpgradeAbbreviatedMetaForReleaseAge, so
+                    // serving this meta from memory can't bypass the release-age
+                    // upgrade. When the upgrade branch above already cached the
+                    // registry-validated upgraded meta, don't overwrite it with a
+                    // disk-sourced marking.
+                    if (upgrade.upgradedFrom == null) {
+                        cacheDiskLoadedMeta(ctx.metaCache, cacheKey, metaCachedInStore);
+                    }
                     return {
                         meta: metaCachedInStore,
                         pickedPackage,
@@ -187,6 +234,7 @@ export async function pickPackage(ctx, spec, opts) {
                 try {
                     const pickedPackage = pickMatchingVersionFast(pickerOpts, spec, metaCachedInStore);
                     if (pickedPackage) {
+                        cacheDiskLoadedMeta(ctx.metaCache, cacheKey, metaCachedInStore);
                         return {
                             meta: metaCachedInStore,
                             pickedPackage,
@@ -424,47 +472,49 @@ function persistUpgradedMeta(ctx, pkgMirror, upgradedFrom) {
     }));
     return metaForCache;
 }
-function clearMeta(pkg) {
-    const versions = {};
-    for (const [version, info] of Object.entries(pkg.versions)) {
-        // The list taken from https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-version-object
-        // with the addition of 'libc'
-        versions[version] = pick([
-            'name',
-            'version',
-            'bin',
-            'directories',
-            'devDependencies',
-            'optionalDependencies',
-            'dependencies',
-            'peerDependencies',
-            'dist',
-            'engines',
-            'peerDependenciesMeta',
-            'cpu',
-            'os',
-            'libc',
-            'deprecated',
-            'bundleDependencies',
-            'bundledDependencies',
-            'hasInstallScript',
-            '_npmUser',
-        ], info);
-    }
-    return {
-        name: pkg.name,
-        'dist-tags': pkg['dist-tags'],
-        versions,
-        time: pkg.time,
-        modified: pkg.modified,
-    };
-}
 export function encodePkgName(pkgName) {
     if (pkgName !== pkgName.toLowerCase()) {
         return `${pkgName}_${createHexHash(pkgName)}`;
     }
     return pkgName;
 }
+/**
+ * Key for the in-memory `metaCache` holding a package's registry metadata. The
+ * registry is part of the key so that a package of the same name served by two
+ * registries in one install can't collide on a single slot (which would resolve
+ * the wrong tarball/integrity). `fullMetadata` and `filterMetadata` keep the
+ * abbreviated, full, and filtered-full documents in distinct slots, mirroring
+ * the on-disk `metaDir` split: a `filterMetadata` resolver stores a `clearMeta`-
+ * stripped packument, so it must not share a slot with an unfiltered full one
+ * (reachable only when a `metaCache` is shared across resolvers with different
+ * settings). `filterMetadata` only narrows the full slot — abbreviated metadata
+ * shares one on-disk mirror regardless, so its key carries no filtered variant.
+ * `\x00` can't appear in a registry URL or a package name, so it's an
+ * unambiguous separator. The verifier reads this same cache and must build the
+ * key with this function.
+ *
+ * The registry is canonicalized to its origin plus a trailing-slashed path, so
+ * the resolver (which may pass a configured named-registry URL verbatim) and
+ * the verifier (which routes through trailing-slashed prefixes) converge on one
+ * key for the same logical registry instead of creating duplicate slots. Origin
+ * and path are preserved, so two registries that genuinely differ never collapse.
+ */
+export function getPkgMetaCacheKey(registry, pkgName, fullMetadata, filterMetadata) {
+    const key = `${canonicalizeRegistry(registry)}\x00${pkgName}`;
+    if (!fullMetadata)
+        return key;
+    return filterMetadata ? `${key}:full:filtered` : `${key}:full`;
+}
+function canonicalizeRegistry(registry) {
+    try {
+        const parsed = new URL(registry);
+        const pathname = parsed.pathname.endsWith('/') ? parsed.pathname : `${parsed.pathname}/`;
+        return `${parsed.origin}${pathname}`;
+    }
+    catch {
+        return registry;
+    }
+}
 /**
  * Path of the on-disk JSONL document where pnpm mirrors a package's registry
  * metadata. `metaDir` selects between abbreviated and full caches.

package/lib/violationCodes.d.ts

@@ -11,3 +11,4 @@
 export declare const MINIMUM_RELEASE_AGE_VIOLATION_CODE = "MINIMUM_RELEASE_AGE_VIOLATION";
 export declare const TRUST_DOWNGRADE_VIOLATION_CODE = "TRUST_DOWNGRADE";
 export declare const TARBALL_URL_MISMATCH_VIOLATION_CODE = "TARBALL_URL_MISMATCH";
+export declare const MISSING_TARBALL_INTEGRITY_VIOLATION_CODE = "MISSING_TARBALL_INTEGRITY";

package/lib/violationCodes.js

@@ -11,4 +11,5 @@
 export const MINIMUM_RELEASE_AGE_VIOLATION_CODE = 'MINIMUM_RELEASE_AGE_VIOLATION';
 export const TRUST_DOWNGRADE_VIOLATION_CODE = 'TRUST_DOWNGRADE';
 export const TARBALL_URL_MISMATCH_VIOLATION_CODE = 'TARBALL_URL_MISMATCH';
+export const MISSING_TARBALL_INTEGRITY_VIOLATION_CODE = 'MISSING_TARBALL_INTEGRITY';
 //# sourceMappingURL=violationCodes.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1102.0.1",
+  "version": "1102.1.1",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -12,9 +12,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/resolving/npm-resolver"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/resolving/npm-resolver"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/resolving/npm-resolver#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/resolving/npm-resolver#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -42,28 +42,29 @@
     "semver": "^7.8.4",
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
+    "validate-npm-package-name": "7.0.2",
     "version-selector-type": "^3.0.0",
-    "@pnpm/core-loggers": "1100.2.1",
+    "@pnpm/config.pick-registry-for-package": "1100.0.9",
+    "@pnpm/config.version-policy": "1100.1.6",
     "@pnpm/constants": "1100.0.0",
+    "@pnpm/core-loggers": "1100.2.1",
     "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/error": "1100.0.0",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/fetching.types": "1100.0.2",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/resolving.resolver-base": "1100.4.2",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
-    "@pnpm/resolving.registry.types": "1100.1.3",
     "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.9",
-    "@pnpm/fetching.types": "1100.0.2",
-    "@pnpm/store.cafs": "1100.1.10",
-    "@pnpm/store.index": "1100.2.0",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.2",
+    "@pnpm/resolving.registry.types": "1100.1.3",
+    "@pnpm/store.cafs": "1100.1.12",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
+    "@pnpm/store.index": "1100.2.1",
     "@pnpm/types": "1101.3.2",
-    "@pnpm/workspace.spec-parser": "1100.0.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.9",
-    "@pnpm/config.version-policy": "1100.1.5",
-    "@pnpm/workspace.range-resolver": "1100.0.2"
+    "@pnpm/workspace.range-resolver": "1100.0.2",
+    "@pnpm/workspace.spec-parser": "1100.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.1"
+    "@pnpm/worker": "^1100.2.3"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
@@ -71,13 +72,14 @@
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/ssri": "^7.1.5",
+    "@types/validate-npm-package-name": "^4.0.2",
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.3",
-    "@pnpm/resolving.npm-resolver": "1102.0.1",
-    "@pnpm/testing.mock-agent": "1101.0.3",
-    "@pnpm/test-fixtures": "1100.0.0"
+    "@pnpm/resolving.npm-resolver": "1102.1.1",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/network.fetch": "1100.1.4",
+    "@pnpm/testing.mock-agent": "1101.0.4"
   },
   "engines": {
     "node": ">=22.13"