@pnpm/resolving.npm-resolver 1102.1.3 → 1102.1.5

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @pnpm/npm-resolver
 
+## 1102.1.5
+
+### Patch Changes
+
+- Recover from a metadata cache entry that disappears (concurrent cache cleanup, antivirus) after the registry has already answered the conditional request with `304 Not Modified`. The metadata is re-requested once without cache validators instead of failing the install with `ERR_PNPM_CACHE_MISSING_AFTER_304`.
+
+- Fixed an out-of-memory regression when workspace projects concurrently resolve a package with large registry metadata [pnpm/pnpm#13077](https://github.com/pnpm/pnpm/issues/13077).
+
+- Fixed `pnpm update` rewriting exact version pins that use the `=` operator (for example `=3.5.1`) to a caret range (`^3.5.1`). Exact pins are now preserved and written back as the bare version. See pnpm/pnpm#12745.
+
+## 1102.1.4
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/core-loggers@1100.2.3
+
 ## 1102.1.3
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1102.1.3",
+  "version": "1102.1.5",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -32,7 +32,7 @@
     "@pnpm/config.pick-registry-for-package": "1100.0.10",
     "@pnpm/config.version-policy": "1100.1.7",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.2.2",
+    "@pnpm/core-loggers": "1100.2.3",
     "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/error": "1100.0.1",
     "@pnpm/fetching.types": "1100.0.2",
@@ -63,15 +63,15 @@
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.4"
+    "@pnpm/worker": "^1100.2.5"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.5",
-    "@pnpm/resolving.npm-resolver": "1102.1.3",
+    "@pnpm/network.fetch": "1100.1.6",
+    "@pnpm/resolving.npm-resolver": "1102.1.5",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1101.0.5",
+    "@pnpm/testing.mock-agent": "1101.0.6",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",

package/lib/clearMeta.d.ts

@@ -1,16 +0,0 @@
-import type { PackageMeta } from '@pnpm/resolving.registry.types';
-/**
- * Reduces a package metadata document to the abbreviated field set that the
- * resolver actually reads, dropping install-irrelevant fields (scripts,
- * exports, readme, custom `_`-prefixed fields, etc.).
- *
- * Used in two places:
- * - The network layer (`fetch.ts`) normalizes a registry that ignored the
- *   abbreviated `Accept` header and returned a full document.
- * - The resolver (`pickPackage.ts`) narrows a deliberately-fetched full
- *   document into the `filterMetadata` cache slot.
- *
- * Null-safe on `versions` so it can be called on an unpublished package (no
- * versions), which the abbreviated path can reach.
- */
-export declare function clearMeta(pkg: PackageMeta): PackageMeta;

package/lib/clearMeta.js

@@ -1,55 +0,0 @@
-import { pick } from 'ramda';
-// The list taken from https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-version-object
-// with the addition of 'libc'
-const ABBREVIATED_VERSION_FIELDS = [
-    'name',
-    'version',
-    'bin',
-    'directories',
-    'devDependencies',
-    'optionalDependencies',
-    'dependencies',
-    'peerDependencies',
-    'dist',
-    'engines',
-    'peerDependenciesMeta',
-    'cpu',
-    'os',
-    'libc',
-    'deprecated',
-    'bundleDependencies',
-    'bundledDependencies',
-    'hasInstallScript',
-    '_npmUser',
-];
-/**
- * Reduces a package metadata document to the abbreviated field set that the
- * resolver actually reads, dropping install-irrelevant fields (scripts,
- * exports, readme, custom `_`-prefixed fields, etc.).
- *
- * Used in two places:
- * - The network layer (`fetch.ts`) normalizes a registry that ignored the
- *   abbreviated `Accept` header and returned a full document.
- * - The resolver (`pickPackage.ts`) narrows a deliberately-fetched full
- *   document into the `filterMetadata` cache slot.
- *
- * Null-safe on `versions` so it can be called on an unpublished package (no
- * versions), which the abbreviated path can reach.
- */
-export function clearMeta(pkg) {
-    // A null prototype so that a registry-controlled version key named
-    // `__proto__` becomes a regular own property instead of mutating the
-    // prototype of the map (js/prototype-polluting-assignment).
-    const versions = Object.create(null);
-    for (const [version, info] of Object.entries(pkg.versions ?? {})) {
-        versions[version] = pick(ABBREVIATED_VERSION_FIELDS, info);
-    }
-    return {
-        name: pkg.name,
-        'dist-tags': pkg['dist-tags'],
-        versions,
-        time: pkg.time,
-        modified: pkg.modified,
-    };
-}
-//# sourceMappingURL=clearMeta.js.map

package/lib/createNpmResolutionVerifier.d.ts

@@ -1,89 +0,0 @@
-import type { GetAuthHeader } from '@pnpm/fetching.types';
-import { type ResolutionVerifier } from '@pnpm/resolving.resolver-base';
-import type { Registries, TrustPolicy } from '@pnpm/types';
-import type { FetchMetadataFromFromRegistryOptions } from './fetch.js';
-import { type FetchFullMetadataCachedOptions } from './fetchFullMetadataCached.js';
-import type { PackageMetaCache } from './pickPackage.js';
-export interface CreateNpmResolutionVerifierOptions {
-    /**
-     * Minimum age (in minutes) a published version must reach before it is
-     * accepted. When unset, the verifier is a no-op for the age check.
-     */
-    minimumReleaseAge?: number;
-    /**
-     * Retained on the options bag because the resolver path branches on it
-     * (the lowest-version fallback) and tests forward both fields together.
-     * The verifier itself no longer gates on this flag — once the loose-mode
-     * auto-collect makes every accepted-immature pin explicit in
-     * `minimumReleaseAgeExclude`, running the verifier in loose mode is the
-     * thing that proves the manifest stays in sync with the lockfile.
-     */
-    minimumReleaseAgeStrict?: boolean;
-    minimumReleaseAgeExclude?: string[];
-    /**
-     * When the registry's metadata lacks the per-version `time` field
-     * (some self-hosted registries strip it), the verifier can't apply
-     * the maturity cutoff. Set this to `true` to mirror the resolver's
-     * `pickMatchingVersionFinal` warn-and-skip behavior — the verifier
-     * passes the entry with a one-time `globalWarn`, instead of failing
-     * closed. Defaults to `false` so the verifier stays stricter than
-     * the resolver only when the user has explicitly opted in to the
-     * skip on the resolver side.
-     */
-    ignoreMissingTimeField?: boolean;
-    /**
-     * `'no-downgrade'` rejects a lockfile entry whose version has weaker
-     * trust evidence (no attestations) than an earlier-published version
-     * had. This mirrors the resolver-time `failIfTrustDowngraded` check
-     * applied during fresh resolution — the verifier catches the same
-     * supply-chain signal on entries that bypassed resolution (peek-path,
-     * frozen lockfile, etc.).
-     */
-    trustPolicy?: TrustPolicy;
-    trustPolicyExclude?: string[];
-    trustPolicyIgnoreAfter?: number;
-    registries: Registries;
-    /**
-     * Registries reached via the named-registry resolver chain (e.g. `gh:` →
-     * GitHub Packages). When a lockfile entry's tarball URL falls under one of
-     * these registry base URLs, route the manifest fetch there instead of the
-     * scope-derived default.
-     */
-    namedRegistries?: Record<string, string>;
-    /**
-     * Cache-aware full-metadata fetcher. Decoupled from the resolver pipeline
-     * so abbreviated metadata and `peekManifestFromStore` fast paths cannot
-     * hide the publish timestamp.
-     */
-    fetchOpts: FetchMetadataFromFromRegistryOptions;
-    getAuthHeaderValueByURI: GetAuthHeader;
-    cacheDir?: FetchFullMetadataCachedOptions['cacheDir'];
-    /**
-     * Per-install LRU shared with the npm resolver's `pickPackage`
-     * (`{ get, set }` over `PackageMeta`). When provided, the verifier
-     * consults it before fetching: a name the resolver already pulled
-     * during the same install yields the cached packument instead of a
-     * fresh disk/network round-trip. Optional — frozen-install paths and
-     * unit tests don't have a resolver running alongside, in which case
-     * the verifier falls back to its own fetch chain.
-     */
-    metaCache?: PackageMetaCache;
-    /** Overrides Date.now() for tests. */
-    now?: number;
-}
-/**
- * Returns a `ResolutionVerifier` for npm-registry-resolved lockfile
- * entries. It always binds each entry's recorded tarball URL to the
- * artifact the registry's metadata lists (an anti-tamper check that does
- * not depend on any policy), and additionally re-applies the
- * `minimumReleaseAge` and/or `trustPolicy='no-downgrade'` policies when
- * those are configured. Pairs with `createNpmResolver`: each resolver
- * factory may export a sibling verifier factory that the default-resolver
- * combines.
- *
- * Designed for fail-closed semantics: if the manifest can't be loaded or
- * the pinned version is missing from it, the verifier reports a violation
- * rather than silently passing. Mirrors the post-resolution gate bun added
- * for the same shape of bug in oven-sh/bun#30526.
- */
-export declare function createNpmResolutionVerifier(opts: CreateNpmResolutionVerifierOptions): ResolutionVerifier;