@pnpm/resolving.npm-resolver 1102.1.4 → 1102.1.6

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @pnpm/npm-resolver
 
+## 1102.1.6
+
+### Patch Changes
+
+- Fixed `pnpm install` running out of memory while resolving large dependency graphs [#8441](https://github.com/pnpm/pnpm/issues/8441). The resolver kept full registry documents — per-version readmes, scripts, descriptions, and other install-irrelevant bulk — in memory for every package fetched with full metadata (optional dependencies, and packages re-fetched for `minimumReleaseAge`'s publish timestamps). Every retained document is now condensed down to the field set installation actually reads, which reduces peak resolution memory by several times on workspaces with more than a thousand packages.
+
+## 1102.1.5
+
+### Patch Changes
+
+- Recover from a metadata cache entry that disappears (concurrent cache cleanup, antivirus) after the registry has already answered the conditional request with `304 Not Modified`. The metadata is re-requested once without cache validators instead of failing the install with `ERR_PNPM_CACHE_MISSING_AFTER_304`.
+
+- Fixed an out-of-memory regression when workspace projects concurrently resolve a package with large registry metadata [pnpm/pnpm#13077](https://github.com/pnpm/pnpm/issues/13077).
+
+- Fixed `pnpm update` rewriting exact version pins that use the `=` operator (for example `=3.5.1`) to a caret range (`^3.5.1`). Exact pins are now preserved and written back as the bare version. See pnpm/pnpm#12745.
+
 ## 1102.1.4
 
 ### Patch Changes

package/lib/index.js

@@ -12,6 +12,7 @@ import { clone } from 'ramda';
 import semver from 'semver';
 import ssri from 'ssri';
 import versionSelectorType from 'version-selector-type';
+import { clearMeta, retainsFullMeta } from './clearMeta.js';
 import { fetchMetadataFromFromRegistry, RegistryResponseError } from './fetch.js';
 import { memoizeFetchMetadata } from './memoizeFetchMetadata.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
@@ -75,7 +76,9 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
         timeout: opts.timeout ?? 60000,
         fetchWarnTimeoutMs: opts.fetchWarnTimeoutMs ?? 10 * 1000, // 10 sec
     };
-    const { fetch, clear: clearFetchCache } = memoizeFetchMetadata(fetchMetadataFromFromRegistry.bind(null, fetchOpts));
+    const { fetch, clear: clearFetchCache } = memoizeFetchMetadata(fetchMetadataFromFromRegistry.bind(null, fetchOpts), {
+        condenseSettledMeta: retainsFullMeta(opts) ? undefined : clearMeta,
+    });
     // Track ownership so `clearCache()` below only wipes the in-memory
     // cache when this factory created it. A caller-supplied
     // `opts.metaCache` may be shared with another resolver instance (or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1102.1.4",
+  "version": "1102.1.6",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -69,7 +69,7 @@
     "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/network.fetch": "1100.1.6",
-    "@pnpm/resolving.npm-resolver": "1102.1.4",
+    "@pnpm/resolving.npm-resolver": "1102.1.6",
     "@pnpm/test-fixtures": "1100.0.0",
     "@pnpm/testing.mock-agent": "1101.0.6",
     "@types/normalize-path": "^3.0.2",