@pnpm/resolving.npm-resolver 1102.1.0 → 1102.1.2

package/lib/clearMeta.d.ts

@@ -0,0 +1,16 @@
+import type { PackageMeta } from '@pnpm/resolving.registry.types';
+/**
+ * Reduces a package metadata document to the abbreviated field set that the
+ * resolver actually reads, dropping install-irrelevant fields (scripts,
+ * exports, readme, custom `_`-prefixed fields, etc.).
+ *
+ * Used in two places:
+ * - The network layer (`fetch.ts`) normalizes a registry that ignored the
+ *   abbreviated `Accept` header and returned a full document.
+ * - The resolver (`pickPackage.ts`) narrows a deliberately-fetched full
+ *   document into the `filterMetadata` cache slot.
+ *
+ * Null-safe on `versions` so it can be called on an unpublished package (no
+ * versions), which the abbreviated path can reach.
+ */
+export declare function clearMeta(pkg: PackageMeta): PackageMeta;

package/lib/clearMeta.js

@@ -0,0 +1,55 @@
+import { pick } from 'ramda';
+// The list taken from https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-version-object
+// with the addition of 'libc'
+const ABBREVIATED_VERSION_FIELDS = [
+    'name',
+    'version',
+    'bin',
+    'directories',
+    'devDependencies',
+    'optionalDependencies',
+    'dependencies',
+    'peerDependencies',
+    'dist',
+    'engines',
+    'peerDependenciesMeta',
+    'cpu',
+    'os',
+    'libc',
+    'deprecated',
+    'bundleDependencies',
+    'bundledDependencies',
+    'hasInstallScript',
+    '_npmUser',
+];
+/**
+ * Reduces a package metadata document to the abbreviated field set that the
+ * resolver actually reads, dropping install-irrelevant fields (scripts,
+ * exports, readme, custom `_`-prefixed fields, etc.).
+ *
+ * Used in two places:
+ * - The network layer (`fetch.ts`) normalizes a registry that ignored the
+ *   abbreviated `Accept` header and returned a full document.
+ * - The resolver (`pickPackage.ts`) narrows a deliberately-fetched full
+ *   document into the `filterMetadata` cache slot.
+ *
+ * Null-safe on `versions` so it can be called on an unpublished package (no
+ * versions), which the abbreviated path can reach.
+ */
+export function clearMeta(pkg) {
+    // A null prototype so that a registry-controlled version key named
+    // `__proto__` becomes a regular own property instead of mutating the
+    // prototype of the map (js/prototype-polluting-assignment).
+    const versions = Object.create(null);
+    for (const [version, info] of Object.entries(pkg.versions ?? {})) {
+        versions[version] = pick(ABBREVIATED_VERSION_FIELDS, info);
+    }
+    return {
+        name: pkg.name,
+        'dist-tags': pkg['dist-tags'],
+        versions,
+        time: pkg.time,
+        modified: pkg.modified,
+    };
+}
+//# sourceMappingURL=clearMeta.js.map

package/lib/fetch.d.ts

@@ -3,7 +3,14 @@ import type { FetchFromRegistry, RetryTimeoutOptions } from '@pnpm/fetching.type
 import type { PackageMeta } from '@pnpm/resolving.registry.types';
 export interface FetchMetadataResult {
     meta: PackageMeta;
-    jsonText: string;
+    /**
+     * The raw registry response body, used only to mirror the response to disk
+     * without re-serializing `meta`. A fresh fetch always sets it, but it
+     * reaches only the caller that initiated the request: the phase-long memo
+     * cache holds a body-less clone (see memoizeFetchMetadata.ts), so cache
+     * hits see `undefined` and the cache never pins the body.
+     */
+    jsonText: string | undefined;
     etag?: string;
     notModified?: false;
 }

package/lib/fetch.js

@@ -5,6 +5,15 @@ import { FetchError, PnpmError, redactUrlCredentials, } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import * as retry from '@zkochan/retry';
 import semver from 'semver';
+import { clearMeta } from './clearMeta.js';
+/**
+ * Content type of an abbreviated (install-oriented) package metadata document.
+ * A spec-compliant registry echoes this in the response `Content-Type` when it
+ * honors the abbreviated `Accept` header. Its absence signals that the registry
+ * ignored the header and served the full document instead.
+ * https://github.com/npm/registry/blob/main/docs/responses/package-metadata.md
+ */
+const ABBREVIATED_META_CONTENT_TYPE = 'application/vnd.npm.install-v1+json';
 export class RegistryResponseError extends FetchError {
     pkgName;
     constructor(request, response, pkgName) {
@@ -125,8 +134,7 @@ export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHe
                     globalWarn(`Request took ${elapsedMs}ms: ${uri}`);
                 }
                 resolve({
-                    meta,
-                    jsonText,
+                    ...normalizeAbbreviatedResponse({ fullMetadata, meta, jsonText, response }),
                     etag: response.headers.get('etag') ?? undefined,
                 });
             }
@@ -156,6 +164,38 @@ export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHe
         });
     });
 }
+/**
+ * When the resolver asked for abbreviated metadata but the registry ignored the
+ * `Accept` header and returned the full document (detected via the response
+ * `Content-Type`), strip it down to the abbreviated field set so downstream
+ * consumers — the in-memory cache, the on-disk mirror, and the resolver — never
+ * carry the megabytes of install-irrelevant data (scripts, exports, readme,
+ * custom fields) that a full document contains.
+ *
+ * Registries that honor the header (e.g. the npm registry) echo the abbreviated
+ * `Content-Type`, so this is a no-op for them: no re-serialization, no field
+ * stripping — the happy path pays nothing.
+ */
+function normalizeAbbreviatedResponse({ fullMetadata, meta, jsonText, response }) {
+    if (fullMetadata)
+        return { meta, jsonText };
+    if (parseMediaType(response.headers.get('content-type')) === ABBREVIATED_META_CONTENT_TYPE)
+        return { meta, jsonText };
+    const normalized = clearMeta(meta);
+    return { meta: normalized, jsonText: JSON.stringify(normalized) };
+}
+/**
+ * Extracts the media type from a `Content-Type` header value, dropping
+ * parameters such as `; charset=utf-8`. Media types are case-insensitive
+ * (RFC 9110 §8.3.1), so the result is lowercased for comparison.
+ */
+function parseMediaType(contentType) {
+    if (contentType == null)
+        return undefined;
+    const semicolonIndex = contentType.indexOf(';');
+    const mediaType = semicolonIndex === -1 ? contentType : contentType.slice(0, semicolonIndex);
+    return mediaType.trim().toLowerCase();
+}
 function toUri(pkgName, registry) {
     let encodedName;
     if (pkgName[0] === '@') {

package/lib/index.d.ts

@@ -94,6 +94,8 @@ export interface ResolveFromNpmContext {
         name?: string;
         version?: string;
     }) => Promise<DependencyManifest | undefined>;
+    /** Deduplicates the held-back-update warning per `(name, picked, preferred)`. */
+    warnedHeldBackUpdates: Set<string>;
 }
 export type ResolveFromNpmOptions = {
     alwaysTryWorkspacePackages?: boolean;
@@ -109,6 +111,7 @@ export type ResolveFromNpmOptions = {
     preferredVersions?: PreferredVersions;
     preferWorkspacePackages?: boolean;
     update?: false | 'compatible' | 'latest';
+    updateRequested?: boolean;
     updateChecksums?: boolean;
     injectWorkspacePackages?: boolean;
     calcSpecifier?: boolean;

package/lib/index.js

@@ -1,17 +1,19 @@
 import path from 'node:path';
 import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { PnpmError } from '@pnpm/error';
+import { globalWarn } from '@pnpm/logger';
+import { EXISTING_VERSION_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
 import { storeIndexKey } from '@pnpm/store.index';
 import { readPkgFromCafs, } from '@pnpm/worker';
 import { resolveWorkspaceRange } from '@pnpm/workspace.range-resolver';
 import { LRUCache } from 'lru-cache';
 import normalize from 'normalize-path';
-import pMemoize, { pMemoizeClear } from 'p-memoize';
 import { clone } from 'ramda';
 import semver from 'semver';
 import ssri from 'ssri';
 import versionSelectorType from 'version-selector-type';
 import { fetchMetadataFromFromRegistry, RegistryResponseError } from './fetch.js';
+import { memoizeFetchMetadata } from './memoizeFetchMetadata.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
 import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, parseNamedRegistrySpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
 import { pickPackage, } from './pickPackage.js';
@@ -73,9 +75,7 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
         timeout: opts.timeout ?? 60000,
         fetchWarnTimeoutMs: opts.fetchWarnTimeoutMs ?? 10 * 1000, // 10 sec
     };
-    const fetch = pMemoize(fetchMetadataFromFromRegistry.bind(null, fetchOpts), {
-        cacheKey: (...args) => JSON.stringify(args),
-    });
+    const { fetch, clear: clearFetchCache } = memoizeFetchMetadata(fetchMetadataFromFromRegistry.bind(null, fetchOpts));
     // Track ownership so `clearCache()` below only wipes the in-memory
     // cache when this factory created it. A caller-supplied
     // `opts.metaCache` may be shared with another resolver instance (or
@@ -130,6 +130,7 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
         namedRegistryNames,
         saveWorkspaceProtocol: opts.saveWorkspaceProtocol,
         peekManifestFromStore,
+        warnedHeldBackUpdates: new Set(),
     };
     const boundResolveFromNpm = resolveNpm.bind(null, ctx);
     const boundResolveFromJsr = resolveJsr.bind(null, ctx);
@@ -146,10 +147,100 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             if (ownsMetaCache && 'clear' in metaCache && typeof metaCache.clear === 'function') {
                 metaCache.clear();
             }
-            pMemoizeClear(fetch);
+            clearFetchCache();
         },
     };
 }
+/**
+ * The preferred-version selectors to hand the package picker for `pkgName`.
+ *
+ * When this package is the user's update target (`updateRequested`), the
+ * lockfile's contribution to its selectors is removed so the target
+ * re-resolves exactly the way a fresh install would after its lockfile
+ * entries were deleted. Everything a fresh install applies is preserved:
+ * manifest pins, the versions propagated down the dependency chain, and the
+ * negative-weight `range` penalties that `pnpm audit --fix` injects to steer
+ * resolution away from vulnerable versions.
+ */
+function preferredVersionSelectorsFor(opts, pkgName) {
+    const selectors = opts.preferredVersions?.[pkgName];
+    if (!opts.updateRequested)
+        return selectors;
+    return stripLockfileVersionPins(selectors);
+}
+/**
+ * Remove the lockfile-derived part of the selectors: the concrete pins
+ * `getPreferredVersionsFromLockfileAndManifests` seeds at
+ * `EXISTING_VERSION_SELECTOR_WEIGHT` — added onto the manifest weight when a
+ * manifest entry pins the same version, so the lockfile weight is subtracted
+ * rather than the selector dropped, leaving the manifest contribution in
+ * effect. Selectors a fresh install would also apply (manifest pins,
+ * chain-propagated versions, `range`/`tag` selectors) pass through unchanged.
+ * Returns `undefined` when nothing remains.
+ */
+function stripLockfileVersionPins(selectors) {
+    if (selectors == null)
+        return undefined;
+    let kept;
+    for (const [selector, value] of Object.entries(selectors)) {
+        let keptValue = value;
+        if (typeof value !== 'string' && value.selectorType === 'version' && value.weight >= EXISTING_VERSION_SELECTOR_WEIGHT) {
+            const manifestWeight = value.weight - EXISTING_VERSION_SELECTOR_WEIGHT;
+            if (manifestWeight <= 0)
+                continue;
+            keptValue = { selectorType: 'version', weight: manifestWeight };
+        }
+        // Null-prototype: selector keys come from manifests and the lockfile,
+        // and a dist-tag named `__proto__` is a valid selector key.
+        kept ??= Object.create(null);
+        kept[selector] = keptValue;
+    }
+    return kept;
+}
+/**
+ * During a targeted update the picker still honors the preferred versions a
+ * fresh install would apply (manifest pins and versions propagated down the
+ * dependency chain), so the target can legitimately settle below the highest
+ * version its range admits. Surface that once per package: reaching the
+ * newer version everywhere is an override's job, not an update's.
+ *
+ * The baseline for "held back" is the pick with only the non-pin selectors
+ * applied — `range`/`tag` selectors such as the `pnpm audit --fix`
+ * vulnerability penalties steer the baseline too, so the warning never
+ * recommends a version those selectors avoid.
+ *
+ * The recommended override is scoped to the declared range being resolved
+ * (`name@<range>`), so applying it can never violate any consumer's range:
+ * only declarations of exactly this range match the selector, and the
+ * recommended version satisfies it by construction.
+ */
+function warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedVersion) {
+    if (!opts.updateRequested || spec.type !== 'range')
+        return;
+    const selectors = preferredVersionSelectorsFor(opts, spec.name);
+    if (selectors == null)
+        return;
+    let nonPinSelectors;
+    for (const [selector, value] of Object.entries(selectors)) {
+        if ((typeof value === 'string' ? value : value.selectorType) === 'version')
+            continue;
+        // Null-prototype for the same reason as in `stripLockfileVersionPins`.
+        nonPinSelectors ??= Object.create(null);
+        nonPinSelectors[selector] = value;
+    }
+    const preferred = pickVersionByVersionRange({
+        meta,
+        versionRange: spec.fetchSpec,
+        preferredVersionSelectors: nonPinSelectors,
+    });
+    if (preferred == null || preferred === pickedVersion)
+        return;
+    const key = `${spec.name}@${spec.fetchSpec}:${pickedVersion}<${preferred}`;
+    if (ctx.warnedHeldBackUpdates.has(key))
+        return;
+    ctx.warnedHeldBackUpdates.add(key);
+    globalWarn(`"${spec.name}@${spec.fetchSpec}" was updated to ${pickedVersion}, not ${preferred}, to match the version preferred by your manifests and already installed dependencies. To use ${preferred}, add an override to pnpm-workspace.yaml: overrides: { "${spec.name}@${spec.fetchSpec}": "${preferred}" }`);
+}
 function isNpmSpec(query, defaultRegistry) {
     const { alias, bareSpecifier } = query.wantedDependency;
     if (!bareSpecifier)
@@ -285,7 +376,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             publishedByExclude: opts.publishedByExclude,
             authHeaderValue,
             dryRun: opts.dryRun === true,
-            preferredVersionSelectors: opts.preferredVersions?.[spec.name],
+            preferredVersionSelectors: preferredVersionSelectorsFor(opts, spec.name),
             registry,
             includeLatestTag: opts.update === 'latest',
             updateChecksums: opts.updateChecksums,
@@ -306,8 +397,13 @@ async function resolveNpm(ctx, wantedDependency, opts) {
                     pinnedVersion: opts.pinnedVersion,
                 });
             }
-            catch {
-                // ignore
+            catch (workspaceErr) {
+                // When the registry doesn't have the package and the workspace has it
+                // only at non-matching versions, the mismatch error (which lists the
+                // available workspace versions) is more actionable than the raw 404.
+                if (err.code === 'ERR_PNPM_FETCH_404' && workspaceErr.code === 'ERR_PNPM_NO_MATCHING_VERSION_INSIDE_WORKSPACE') {
+                    throw workspaceErr;
+                }
             }
         }
         throw err;
@@ -328,8 +424,13 @@ async function resolveNpm(ctx, wantedDependency, opts) {
                     pinnedVersion: opts.pinnedVersion,
                 });
             }
-            catch {
-                // ignore
+            catch (workspaceErr) {
+                // Neither the registry nor the workspace has a matching version; the
+                // workspace mismatch error carries the available local versions,
+                // which is the actionable detail here.
+                if (workspaceErr.code === 'ERR_PNPM_NO_MATCHING_VERSION_INSIDE_WORKSPACE') {
+                    throw workspaceErr;
+                }
             }
         }
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
@@ -370,6 +471,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             };
         }
     }
+    warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedPackage.version);
     const id = `${pickedPackage.name}@${pickedPackage.version}`;
     const resolution = {
         integrity: getIntegrity(pickedPackage.dist),
@@ -489,7 +591,7 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
         publishedByExclude: opts.publishedByExclude,
         authHeaderValue,
         dryRun: opts.dryRun === true,
-        preferredVersionSelectors: opts.preferredVersions?.[spec.name],
+        preferredVersionSelectors: preferredVersionSelectorsFor(opts, spec.name),
         registry,
         includeLatestTag: opts.update === 'latest',
         updateChecksums: opts.updateChecksums,
@@ -498,6 +600,7 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
     if (pickedPackage == null) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
+    warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedPackage.version);
     const resolution = {
         integrity: getIntegrity(pickedPackage.dist),
         tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),

package/lib/memoizeFetchMetadata.d.ts

@@ -0,0 +1,24 @@
+import type { FetchMetadataNotModifiedResult, FetchMetadataOptions, FetchMetadataResult } from './fetch.js';
+export type FetchMetadata = (pkgName: string, opts: FetchMetadataOptions) => Promise<FetchMetadataResult | FetchMetadataNotModifiedResult>;
+export interface MemoizedFetchMetadata {
+    fetch: FetchMetadata;
+    clear: () => void;
+}
+/**
+ * Memoizes metadata fetches for the whole resolution phase (cleared via
+ * `clear`, see `clearResolutionCache`), deduplicating concurrent and repeat
+ * requests for the same package.
+ *
+ * Unlike plain memoization, the cache holds a body-less clone of each result:
+ * `jsonText` — the raw registry response body, up to tens of MB for a popular
+ * package — reaches only the caller that initiated the fetch, which is the
+ * caller that writes the disk mirror. A phase-long cache that kept the bodies
+ * would pin hundreds of MB on large cold-cache graphs. A cache-hit caller
+ * that also writes the mirror falls back to `JSON.stringify(meta)` in
+ * `prepareJsonForDisk`, which is equivalent on read: `loadMeta` re-derives
+ * `etag` from the headers line.
+ *
+ * A rejected fetch is evicted so a transient network failure is retried by
+ * the next request instead of being cached for the rest of the phase.
+ */
+export declare function memoizeFetchMetadata(fetch: FetchMetadata): MemoizedFetchMetadata;

package/lib/memoizeFetchMetadata.js

@@ -0,0 +1,37 @@
+/**
+ * Memoizes metadata fetches for the whole resolution phase (cleared via
+ * `clear`, see `clearResolutionCache`), deduplicating concurrent and repeat
+ * requests for the same package.
+ *
+ * Unlike plain memoization, the cache holds a body-less clone of each result:
+ * `jsonText` — the raw registry response body, up to tens of MB for a popular
+ * package — reaches only the caller that initiated the fetch, which is the
+ * caller that writes the disk mirror. A phase-long cache that kept the bodies
+ * would pin hundreds of MB on large cold-cache graphs. A cache-hit caller
+ * that also writes the mirror falls back to `JSON.stringify(meta)` in
+ * `prepareJsonForDisk`, which is equivalent on read: `loadMeta` re-derives
+ * `etag` from the headers line.
+ *
+ * A rejected fetch is evicted so a transient network failure is retried by
+ * the next request instead of being cached for the rest of the phase.
+ */
+export function memoizeFetchMetadata(fetch) {
+    const cache = new Map();
+    return {
+        fetch: (pkgName, opts) => {
+            const key = JSON.stringify([pkgName, opts]);
+            const cached = cache.get(key);
+            if (cached != null)
+                return cached;
+            const pending = fetch(pkgName, opts);
+            const bodiless = pending.then((result) => result.notModified ? result : { ...result, jsonText: undefined });
+            bodiless.catch(() => cache.delete(key));
+            cache.set(key, bodiless);
+            return pending;
+        },
+        clear: () => {
+            cache.clear();
+        },
+    };
+}
+//# sourceMappingURL=memoizeFetchMetadata.js.map

package/lib/parseBareSpecifier.js

@@ -2,6 +2,7 @@ import { PnpmError } from '@pnpm/error';
 import { parseJsrSpecifier } from '@pnpm/resolving.jsr-specifier-parser';
 import { parseNpmTarballUrl } from 'parse-npm-tarball-url';
 import semver from 'semver';
+import validateNpmPackageName from 'validate-npm-package-name';
 import getVersionSelectorType from 'version-selector-type';
 export function parseBareSpecifier(bareSpecifier, alias, defaultTag, registry) {
     let name = alias;
@@ -69,6 +70,9 @@ export const BUILTIN_NAMED_REGISTRIES = Object.freeze({
 // Parses a named-registry specifier of the shape `<alias>:<body>` into a
 // RegistryPackageSpec. Returns `null` when the specifier does not use one of
 // the configured aliases, so the caller can fall through to other resolvers.
+// Throws INVALID_NAMED_REGISTRY_PACKAGE_NAME when the alias matches but the
+// package name is malformed (missing or empty scope/name segments, path
+// separators inside the name).
 // Supported shapes:
 // - `<alias>:[@<owner>/]<name>[@<version_selector>]`
 // - `<alias>:<version_selector>` paired with a package alias
@@ -100,9 +104,6 @@ export function parseNamedRegistrySpecifierToRegistryPackageSpec(rawSpecifier, k
             pkgName = body.substring(0, index);
             versionSelector = body.substring(index + '@'.length);
         }
-        if (pkgName.indexOf('/') === -1 || pkgName.endsWith('/')) {
-            throw new PnpmError('INVALID_NAMED_REGISTRY_PACKAGE_NAME', `The package name '${pkgName}' in named registry '${registryName}:' is invalid`);
-        }
     }
     else if (packageAlias?.startsWith('@')) {
         // `<alias>:<tag>` paired with a scoped alias — body is a version
@@ -124,6 +125,11 @@ export function parseNamedRegistrySpecifierToRegistryPackageSpec(rawSpecifier, k
         if (!pkgName)
             return null;
     }
+    // The name is used in registry URLs and metadata cache file paths, so
+    // anything that is not a valid npm package name must never make it through.
+    if (!validateNpmPackageName(pkgName).validForOldPackages) {
+        throw new PnpmError('INVALID_NAMED_REGISTRY_PACKAGE_NAME', `The package name '${pkgName}' in named registry '${registryName}:' is invalid`);
+    }
     const selector = getVersionSelectorType(versionSelector ?? defaultTag);
     if (selector == null)
         return null;

package/lib/pickPackage.d.ts

@@ -3,6 +3,14 @@ import type { FetchMetadataNotModifiedResult, FetchMetadataResult } from './fetc
 import type { RegistryPackageSpec } from './parseBareSpecifier.js';
 import { type PickPackageFromMetaOptions } from './pickPackageFromMeta.js';
 export interface PackageMetaCache {
+    /**
+     * Must return the same object reference that `set` stored for the key: the
+     * resolver tracks whether a cached packument was validated against the
+     * registry by object identity (see `unverifiedDiskPackuments`). In a cache
+     * that clones or deserializes on read, that provenance is lost and recovery
+     * degrades — a stale disk-promoted entry that can't satisfy a spec fails
+     * the pick instead of falling through to the registry.
+     */
     get: (key: string) => PackageMeta | undefined;
     set: (key: string, meta: PackageMeta) => void;
     has: (key: string) => boolean;

package/lib/pickPackage.js

@@ -8,9 +8,9 @@ import { globalWarn, logger } from '@pnpm/logger';
 import getRegistryName from 'encode-registry';
 import pLimit, {} from 'p-limit';
 import { fastPathTemp as pathTemp } from 'path-temp';
-import { pick } from 'ramda';
 import { renameOverwrite } from 'rename-overwrite';
 import semver from 'semver';
+import { clearMeta } from './clearMeta.js';
 import { pickLowestVersionByVersionRange, pickPackageFromMeta, pickVersionByVersionRange, } from './pickPackageFromMeta.js';
 import { toRaw } from './toRaw.js';
 /**
@@ -104,6 +104,29 @@ function pickMatchingVersionFinal(pickerOpts, spec, meta) {
         throw err;
     }
 }
+/**
+ * Packuments promoted into the in-memory cache straight from the on-disk
+ * mirror, without registry validation. The mirror may predate versions the
+ * registry has, so when a cache hit on such an entry can't satisfy the
+ * requested spec (and the resolver isn't offline), `pickPackage` falls
+ * through to the regular flow — a conditional registry request — instead of
+ * failing the pick, exactly as it would have before the entry was promoted.
+ * Network-fetched and 304-revalidated packuments are never in this set, so
+ * hits on them keep returning directly even when the pick fails (the caller
+ * then falls back to workspace packages or reports no matching version).
+ */
+const unverifiedDiskPackuments = new WeakSet();
+/**
+ * Promote a packument parsed from the on-disk mirror into the in-memory
+ * cache, so repeat resolutions of the same package (common across a large
+ * dependency graph) don't re-read and re-parse the mirror. The entry is
+ * remembered as disk-sourced (see {@link unverifiedDiskPackuments}) because it
+ * never went through registry validation.
+ */
+function cacheDiskLoadedMeta(metaCache, cacheKey, meta) {
+    unverifiedDiskPackuments.add(meta);
+    metaCache.set(cacheKey, meta);
+}
 export async function pickPackage(ctx, spec, opts) {
     opts = opts || {};
     const pickerOpts = {
@@ -147,21 +170,31 @@ export async function pickPackage(ctx, spec, opts) {
                 : persistUpgradedMeta(ctx, pkgMirror, upgrade.upgradedFrom);
             ctx.metaCache.set(cacheKey, metaForCache);
         }
-        return {
-            meta: metaForCache,
-            pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, metaForCache),
-        };
+        const pickedPackage = pickMatchingVersionFinal(pickerOpts, spec, metaForCache);
+        if (pickedPackage != null || ctx.offline === true || !unverifiedDiskPackuments.has(metaForCache)) {
+            return {
+                meta: metaForCache,
+                pickedPackage,
+            };
+        }
+        // Disk-promoted meta that can't satisfy the spec: fall through and
+        // revalidate against the registry (see unverifiedDiskPackuments).
     }
     return runLimited(pkgMirror, async (limit) => {
         let metaCachedInStore;
         if (ctx.offline === true || ctx.preferOffline === true || opts.pickLowestVersion) {
             metaCachedInStore = await limit(async () => loadMeta(pkgMirror));
             if (ctx.offline) {
-                if (metaCachedInStore != null)
+                if (metaCachedInStore != null) {
+                    // maybeUpgradeAbbreviatedMetaForReleaseAge short-circuits when
+                    // offline, so a later in-memory cache hit returns this same meta
+                    // without any network access.
+                    cacheDiskLoadedMeta(ctx.metaCache, cacheKey, metaCachedInStore);
                     return {
                         meta: metaCachedInStore,
                         pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, metaCachedInStore),
                     };
+                }
                 throw new PnpmError('NO_OFFLINE_META', `Failed to resolve ${toRaw(spec)} in package mirror ${pkgMirror}`);
             }
             if (metaCachedInStore != null) {
@@ -178,6 +211,14 @@ export async function pickPackage(ctx, spec, opts) {
                 }
                 const pickedPackage = pickMatchingVersionFinal(pickerOpts, spec, metaCachedInStore);
                 if (pickedPackage) {
+                    // A cache hit re-runs maybeUpgradeAbbreviatedMetaForReleaseAge, so
+                    // serving this meta from memory can't bypass the release-age
+                    // upgrade. When the upgrade branch above already cached the
+                    // registry-validated upgraded meta, don't overwrite it with a
+                    // disk-sourced marking.
+                    if (upgrade.upgradedFrom == null) {
+                        cacheDiskLoadedMeta(ctx.metaCache, cacheKey, metaCachedInStore);
+                    }
                     return {
                         meta: metaCachedInStore,
                         pickedPackage,
@@ -193,7 +234,7 @@ export async function pickPackage(ctx, spec, opts) {
                 try {
                     const pickedPackage = pickMatchingVersionFast(pickerOpts, spec, metaCachedInStore);
                     if (pickedPackage) {
-                        ctx.metaCache.set(cacheKey, metaCachedInStore);
+                        cacheDiskLoadedMeta(ctx.metaCache, cacheKey, metaCachedInStore);
                         return {
                             meta: metaCachedInStore,
                             pickedPackage,
@@ -303,7 +344,7 @@ export async function pickPackage(ctx, spec, opts) {
                 if (!isModifiedValid || modifiedDate > opts.publishedBy) {
                     // Save the abbreviated metadata to the abbreviated cache before re-fetching full.
                     if (!opts.dryRun) {
-                        const abbreviatedJson = prepareJsonForDisk(fetchResult.meta, fetchResult.etag, fetchResult.jsonText);
+                        const abbreviatedJson = prepareJsonForDisk(resultToSave.meta, resultToSave.etag, resultToSave.jsonText);
                         // Fire-and-forget save to the abbreviated cache path (pkgMirror).
                         runLimited(pkgMirror, (limit) => limit(async () => {
                             try {
@@ -431,41 +472,6 @@ function persistUpgradedMeta(ctx, pkgMirror, upgradedFrom) {
     }));
     return metaForCache;
 }
-function clearMeta(pkg) {
-    const versions = {};
-    for (const [version, info] of Object.entries(pkg.versions)) {
-        // The list taken from https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-version-object
-        // with the addition of 'libc'
-        versions[version] = pick([
-            'name',
-            'version',
-            'bin',
-            'directories',
-            'devDependencies',
-            'optionalDependencies',
-            'dependencies',
-            'peerDependencies',
-            'dist',
-            'engines',
-            'peerDependenciesMeta',
-            'cpu',
-            'os',
-            'libc',
-            'deprecated',
-            'bundleDependencies',
-            'bundledDependencies',
-            'hasInstallScript',
-            '_npmUser',
-        ], info);
-    }
-    return {
-        name: pkg.name,
-        'dist-tags': pkg['dist-tags'],
-        versions,
-        time: pkg.time,
-        modified: pkg.modified,
-    };
-}
 export function encodePkgName(pkgName) {
     if (pkgName !== pkgName.toLowerCase()) {
         return `${pkgName}_${createHexHash(pkgName)}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1102.1.0",
+  "version": "1102.1.2",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -34,7 +34,6 @@
     "lru-cache": "^11.5.0",
     "normalize-path": "^3.0.0",
     "p-limit": "^7.3.0",
-    "p-memoize": "8.0.0",
     "parse-npm-tarball-url": "^5.0.0",
     "path-temp": "^3.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
@@ -42,28 +41,29 @@
     "semver": "^7.8.4",
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
+    "validate-npm-package-name": "7.0.2",
     "version-selector-type": "^3.0.0",
     "@pnpm/config.pick-registry-for-package": "1100.0.9",
-    "@pnpm/constants": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.1.6",
-    "@pnpm/core-loggers": "1100.2.1",
     "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/config.version-policy": "1100.1.6",
     "@pnpm/fetching.types": "1100.0.2",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.1",
-    "@pnpm/fs.graceful-fs": "1100.1.0",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.9",
     "@pnpm/resolving.registry.types": "1100.1.3",
-    "@pnpm/resolving.resolver-base": "1100.5.0",
-    "@pnpm/store.index": "1100.2.1",
-    "@pnpm/store.cafs": "1100.1.11",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.2",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
     "@pnpm/types": "1101.3.2",
+    "@pnpm/fs.graceful-fs": "1100.1.0",
     "@pnpm/workspace.range-resolver": "1100.0.2",
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.9",
-    "@pnpm/workspace.spec-parser": "1100.0.0"
+    "@pnpm/store.index": "1100.2.1",
+    "@pnpm/workspace.spec-parser": "1100.0.0",
+    "@pnpm/store.cafs": "1100.1.12",
+    "@pnpm/core-loggers": "1100.2.1",
+    "@pnpm/constants": "1100.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.2"
+    "@pnpm/worker": "^1100.2.3"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
@@ -71,13 +71,14 @@
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/ssri": "^7.1.5",
+    "@types/validate-npm-package-name": "^4.0.2",
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
-    "@pnpm/network.fetch": "1100.1.4",
-    "@pnpm/resolving.npm-resolver": "1102.1.0",
+    "@pnpm/resolving.npm-resolver": "1102.1.2",
     "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/logger": "1100.0.0",
     "@pnpm/testing.mock-agent": "1101.0.4",
-    "@pnpm/logger": "1100.0.0"
+    "@pnpm/network.fetch": "1100.1.4"
   },
   "engines": {
     "node": ">=22.13"