@pnpm/resolving.npm-resolver 1103.0.0 → 1103.1.0

package/CHANGELOG.md

@@ -1,5 +1,84 @@
 # @pnpm/npm-resolver
 
+## 1103.1.0
+
+### Minor Changes
+
+- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below.
+
+  The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got.
+
+  That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell.
+
+  Packages resolved from a named registry are now recorded under registry-qualified keys (`<name>@<registryName>:<version>`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from.
+
+  The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file.
+
+  ### If you use named registries
+
+  Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating.
+
+  Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it.
+
+  There is no setting to keep the old behavior: the old shape is the vulnerability.
+
+  Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand.
+
+  To use named registries, map your aliases in `pnpm-workspace.yaml`:
+
+  ```yaml
+  namedRegistries:
+    work: https://npm.enterprise.example.com/
+  ```
+
+  ### New built-in `npmjs:` alias
+
+  `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy:
+
+  ```json
+  { "dependencies": { "left-pad": "npmjs:^1.3.0" } }
+  ```
+
+  `npm:` cannot do this — it is the alias protocol (`npm:<name>@<range>`) and resolves through whatever `registry` points at.
+
+  **If you mirror or proxy npmjs, point the alias at your mirror:**
+
+  ```yaml
+  namedRegistries:
+    npmjs: https://npm.internal.example.com/
+  ```
+
+  Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`.
+
+  Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it.
+
+  Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver.
+
+  `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier.
+
+### Patch Changes
+
+- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs.
+
+- Dependency resolution is faster: package metadata is now filtered once per packument instead of once per dependency edge when `minimumReleaseAge` is active, and parsed semver versions and ranges are reused instead of re-parsed on every comparison.
+
+- Updated dependencies:
+  - @pnpm/config.normalize-registries@1100.1.0
+  - @pnpm/config.pick-registry-for-package@1100.1.0
+  - @pnpm/config.version-policy@1100.1.12
+  - @pnpm/constants@1101.0.0
+  - @pnpm/core-loggers@1100.3.2
+  - @pnpm/deps.path@1100.1.0
+  - @pnpm/error@1100.1.1
+  - @pnpm/pkg-manifest.utils@1100.3.1
+  - @pnpm/resolving.jsr-specifier-parser@1100.0.4
+  - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.15
+  - @pnpm/resolving.registry.types@1100.1.9
+  - @pnpm/resolving.resolver-base@1101.1.0
+  - @pnpm/store.cafs@1100.1.18
+  - @pnpm/store.index@1100.2.3
+  - @pnpm/types@1101.9.0
+
 ## 1103.0.0
 
 ### Major Changes

package/lib/clearMeta.js

@@ -1,4 +1,3 @@
-import { pick } from 'ramda';
 // The list taken from https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-version-object
 // with the addition of 'libc'
 const ABBREVIATED_VERSION_FIELDS = [
@@ -48,7 +47,7 @@ export function clearMeta(pkg) {
     // prototype of the map (js/prototype-polluting-assignment).
     const versions = Object.create(null);
     for (const [version, info] of Object.entries(pkg.versions ?? {})) {
-        versions[version] = pick(ABBREVIATED_VERSION_FIELDS, info);
+        versions[version] = pickAbbreviatedVersionFields(info);
     }
     const condensed = {
         name: pkg.name,
@@ -64,6 +63,20 @@ export function clearMeta(pkg) {
     condensedPackuments.set(condensed, condensed);
     return condensed;
 }
+// Hand-rolled rather than delegated to a generic field picker because it runs
+// for every version of every packument an install parses. Testing the value
+// for `undefined` is equivalent to testing for the key's presence: version
+// objects come from JSON, which cannot encode undefined.
+function pickAbbreviatedVersionFields(info) {
+    const picked = {};
+    for (const field of ABBREVIATED_VERSION_FIELDS) {
+        const value = info[field];
+        if (value !== undefined) {
+            picked[field] = value;
+        }
+    }
+    return picked;
+}
 /**
  * Whether a resolver keeps full packuments rather than condensing them with
  * {@link clearMeta}: only `fullMetadata` without `filterMetadata`, whose

package/lib/createNpmResolutionVerifier.js

@@ -1,4 +1,6 @@
-import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { createHash } from 'node:crypto';
+import { normalizeNamedRegistries } from '@pnpm/config.normalize-registries';
+import { namedRegistryTarballPrefixes, pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { createPackageVersionPolicy } from '@pnpm/config.version-policy';
 import { FULL_META_DIR } from '@pnpm/constants';
 import { PnpmError } from '@pnpm/error';
@@ -7,10 +9,9 @@ import semver from 'semver';
 import { fetchAttestationPublishedAt } from './fetchAttestationPublishedAt.js';
 import { fetchAbbreviatedMetadataCached, fetchFullMetadataCached, } from './fetchFullMetadataCached.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
-import { BUILTIN_NAMED_REGISTRIES } from './parseBareSpecifier.js';
 import { getPkgMetaCacheKey, getPkgMirrorPath, loadMeta, warnMissingTimeFieldOnce } from './pickPackage.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
-import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, MISSING_TARBALL_INTEGRITY_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, MISSING_NAMED_REGISTRY_VIOLATION_CODE, MISSING_TARBALL_INTEGRITY_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 /**
  * Returns a `ResolutionVerifier` for npm-registry-resolved lockfile
  * entries. It always binds each entry's recorded tarball URL to the
@@ -38,30 +39,8 @@ export function createNpmResolutionVerifier(opts) {
     const trustExcludePolicy = opts.trustPolicyExclude?.length
         ? createExcludePolicy(opts.trustPolicyExclude, 'trustPolicyExclude')
         : undefined;
-    // Pre-normalize named-registry URLs and sort by length so two registries
-    // that share a hostname but differ by path (e.g. `https://npm/team-a/` vs
-    // `https://npm/team-b/`) route to the longest matching prefix — matching
-    // only `origin` would silently send lookups to the wrong one. Built-in
-    // aliases (`gh:` → npm.pkg.github.com, etc.) are merged in alongside the
-    // user-defined ones so the verifier recognizes the same set of named
-    // registries the resolver does; otherwise a package resolved via `gh:`
-    // would land in the lockfile with a tarball URL the verifier can't route.
-    const namedRegistryPrefixes = Object.values({
-        ...BUILTIN_NAMED_REGISTRIES,
-        ...(opts.namedRegistries ?? {}),
-    })
-        .map((url) => {
-        const parsed = tryParseUrl(url);
-        if (!parsed)
-            return null;
-        // Ensure trailing slash so prefix matching against tarball URLs (which
-        // always include the package path under the registry root) does not
-        // accidentally match a sibling registry whose URL shares a prefix string.
-        const pathname = parsed.pathname.endsWith('/') ? parsed.pathname : `${parsed.pathname}/`;
-        return `${parsed.origin}${pathname}`;
-    })
-        .filter((value) => value != null)
-        .sort((a, b) => b.length - a.length);
+    const mergedNamedRegistries = normalizeNamedRegistries(opts.namedRegistries);
+    const namedRegistryPrefixes = namedRegistryTarballPrefixes(mergedNamedRegistries);
     // Per-install dedup of every network/disk fetch the verifier issues.
     // The maturity check uses the layered `fetchPublishedAt` lookup; the
     // trust check uses an attestation fast-path before falling back to
@@ -85,7 +64,7 @@ export function createNpmResolutionVerifier(opts) {
     const minimumReleaseAge = opts.minimumReleaseAge ?? 0;
     const trustPolicy = opts.trustPolicy;
     const trustPolicyIgnoreAfter = opts.trustPolicyIgnoreAfter;
-    const verify = async (resolution, { name, version, nonSemverVersion }) => {
+    const verify = async (resolution, { name, version, nonSemverVersion, registryName }) => {
         if (!isRegistryTarballResolution(resolution))
             return { ok: true };
         // Network-free structural checks must run before registry metadata shortcuts.
@@ -120,7 +99,26 @@ export function createNpmResolutionVerifier(opts) {
             };
         }
         const tarballUrl = typeof rawTarball === 'string' ? rawTarball : undefined;
-        const registry = pickRegistryForVersion(opts.registries, namedRegistryPrefixes, name, tarballUrl);
+        let registry;
+        if (registryName != null) {
+            // Registry-qualified entries name their registry in the dep path, so
+            // routing does not depend on a recorded tarball URL (canonical URLs
+            // are omitted from the lockfile in the 12.0 format).
+            const namedRegistry = mergedNamedRegistries[registryName];
+            if (!namedRegistry) {
+                // Fail closed: without the registry URL, none of the metadata-backed
+                // checks below can vouch for this entry.
+                return {
+                    ok: false,
+                    code: MISSING_NAMED_REGISTRY_VIOLATION_CODE,
+                    reason: `was resolved from the named registry '${registryName}:', which is not present in the namedRegistries setting`,
+                };
+            }
+            registry = namedRegistry;
+        }
+        else {
+            registry = pickRegistryForVersion(opts.registries, namedRegistryPrefixes, name, tarballUrl);
+        }
         // A registry entry that pins an explicit tarball URL must point at the
         // artifact the registry's own metadata lists. Otherwise a trusted
         // `name@version` could front bytes from an attacker-chosen URL (with a
@@ -164,6 +162,10 @@ export function createNpmResolutionVerifier(opts) {
     // stays trusted after its exclude entry has been pulled.
     const sortedMinAgeExcludes = [...new Set(opts.minimumReleaseAgeExclude ?? [])].sort();
     const sortedTrustExcludes = [...new Set(opts.trustPolicyExclude ?? [])].sort();
+    const sortedNamedRegistries = Object.fromEntries(Object.entries(mergedNamedRegistries).sort(([aliasA], [aliasB]) => aliasA.localeCompare(aliasB)));
+    const namedRegistriesRouting = createHash('sha256')
+        .update(JSON.stringify(sortedNamedRegistries))
+        .digest('hex');
     return {
         verify,
         policy: {
@@ -175,6 +177,7 @@ export function createNpmResolutionVerifier(opts) {
             tarballUrlBinding: true,
             // Same cache identity rule for the missing-integrity structural check.
             integrityRequired: true,
+            namedRegistriesRouting,
             minimumReleaseAge,
             minimumReleaseAgeExclude: sortedMinAgeExcludes,
             trustPolicy: trustPolicy ?? null,
@@ -190,6 +193,8 @@ export function createNpmResolutionVerifier(opts) {
             // without the flag cannot prove they rejected unverifiable tarballs.
             if (cached.integrityRequired !== true)
                 return false;
+            if (cached.namedRegistriesRouting !== namedRegistriesRouting)
+                return false;
             // Maturity: a previously cached run under a larger cutoff
             // (stricter window) is trustworthy under a smaller current one —
             // its set of accepted versions is a subset of today's. The

package/lib/index.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { isWellFormedRegistryName, RESERVED_VERSION_PREFIXES } from '@pnpm/deps.path';
 import { PnpmError } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import { rangeSpecGranularity, versionWithRangeSpecStyle } from '@pnpm/pkg-manifest.utils';
@@ -539,6 +540,11 @@ function mergeNamedRegistries(userDefined) {
     if (!userDefined)
         return merged;
     for (const [alias, url] of Object.entries(userDefined)) {
+        if (RESERVED_VERSION_PREFIXES.has(alias) || !isWellFormedRegistryName(alias)) {
+            throw new PnpmError('RESERVED_NAMED_REGISTRY_NAME', RESERVED_VERSION_PREFIXES.has(alias)
+                ? `'${alias}' cannot be used as a named registry alias: it is a reserved dependency specifier prefix.`
+                : `'${alias}' cannot be used as a named registry alias: aliases must start with a letter and contain only letters, digits, ".", "_", and "-".`, { hint: 'Rename the entry in the namedRegistries setting.' });
+        }
         if (typeof url !== 'string' || !isValidHttpUrl(url)) {
             throw new PnpmError('INVALID_NAMED_REGISTRY_URL', `The named registry alias '${alias}' is mapped to '${String(url)}', which is not a valid http(s) URL.`, { hint: 'Provide a URL that starts with http:// or https://, e.g. https://npm.pkg.example.com/' });
         }
@@ -574,6 +580,11 @@ async function resolveFromNamedRegistry(ctx, wantedDependency, opts) {
     const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registry);
     return {
         ...picked,
+        // Qualifying the id with the registry alias is what keeps the same
+        // name@version resolved from two registries distinct in the lockfile.
+        // Without it they collapse onto one entry and whichever resolved first
+        // decides the tarball both consumers get.
+        id: `${picked.manifest.name}@${spec.registryName}:${picked.manifest.version}`,
         normalizedBareSpecifier: opts.calcSpecifier
             ? calcPrefixedSpecifier(`${spec.registryName}:`, spec.name, wantedDependency, picked.manifest.version, opts.rangeSpecStyle)
             : undefined,

package/lib/parseBareSpecifier.d.ts

@@ -9,7 +9,7 @@ export interface JsrRegistryPackageSpec extends RegistryPackageSpec {
     jsrPkgName: string;
 }
 export declare function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier: string, alias: string | undefined, defaultTag: string): JsrRegistryPackageSpec | null;
-export declare const BUILTIN_NAMED_REGISTRIES: Readonly<Record<string, string>>;
+export { BUILTIN_NAMED_REGISTRIES } from '@pnpm/constants';
 export interface NamedRegistryPackageSpec extends RegistryPackageSpec {
     registryName: string;
 }

package/lib/parseBareSpecifier.js

@@ -64,9 +64,7 @@ export function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier, alias, defa
         jsrPkgName: spec.jsrPkgName,
     };
 }
-export const BUILTIN_NAMED_REGISTRIES = Object.freeze({
-    gh: 'https://npm.pkg.github.com/',
-});
+export { BUILTIN_NAMED_REGISTRIES } from '@pnpm/constants';
 // Parses a named-registry specifier of the shape `<alias>:<body>` into a
 // RegistryPackageSpec. Returns `null` when the specifier does not use one of
 // the configured aliases, so the caller can fall through to other resolvers.

package/lib/pickPackage.js

@@ -191,13 +191,29 @@ export async function pickPackage(ctx, spec, opts) {
         };
         let diskMeta;
         if (ctx.offline === true || ctx.preferOffline === true || opts.pickLowestVersion) {
-            diskMeta = await limit(loadMetaCondensed);
+            // Concurrent offline picks of one package all miss the pre-queue cache
+            // check and queue behind this limiter, so the check is repeated inside
+            // the queue and the promotion happens before the limiter releases —
+            // otherwise every queued pick re-reads and re-parses the mirror. Serving
+            // a queued pick from the cache is equivalent to it having arrived after
+            // the first caller cached it: offline entries are always disk-sourced
+            // and maybeUpgradeAbbreviatedMetaForReleaseAge short-circuits when
+            // offline, so an in-memory hit returns this same meta with no network
+            // access.
+            diskMeta = await limit(async () => {
+                if (ctx.offline !== true)
+                    return loadMetaCondensed();
+                const cached = ctx.metaCache.get(cacheKey);
+                if (cached != null)
+                    return cached;
+                const meta = await loadMetaCondensed();
+                if (meta != null) {
+                    cacheDiskLoadedMeta(ctx.metaCache, cacheKey, meta);
+                }
+                return meta;
+            });
             if (ctx.offline) {
                 if (diskMeta != null) {
-                    // maybeUpgradeAbbreviatedMetaForReleaseAge short-circuits when
-                    // offline, so a later in-memory cache hit returns this same meta
-                    // without any network access.
-                    cacheDiskLoadedMeta(ctx.metaCache, cacheKey, diskMeta);
                     return {
                         meta: diskMeta,
                         pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, diskMeta),

package/lib/pickPackageFromMeta.js

@@ -90,36 +90,11 @@ function parseModifiedDate(modified) {
         return null;
     return date;
 }
-const semverRangeCache = new Map();
-// This is a performance optimization; working with string-ish semver
-// causes lots of allocations and repeated work, but caching the Range
-// and ensuring we give it a SemVer instance greatly speeds things up.
-function semverSatisfiesLoose(version, range) {
-    let semverRange = semverRangeCache.get(range);
-    if (semverRange === undefined) {
-        try {
-            semverRange = new semver.Range(range, true);
-        }
-        catch {
-            semverRange = null;
-        }
-        semverRangeCache.set(range, semverRange);
-    }
-    if (semverRange) {
-        try {
-            return semverRange.test(new semver.SemVer(version, true));
-        }
-        catch {
-            return false;
-        }
-    }
-    return false;
-}
 export function pickLowestVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }) {
     if (preferredVersionSelectors != null && Object.keys(preferredVersionSelectors).length > 0) {
         const prioritizedPreferredVersions = prioritizePreferredVersions(meta, versionRange, preferredVersionSelectors);
         for (const preferredVersions of prioritizedPreferredVersions) {
-            const preferredVersion = semver.minSatisfying(preferredVersions, versionRange, true);
+            const preferredVersion = minSatisfyingLoose(preferredVersions, versionRange);
             if (preferredVersion) {
                 return preferredVersion;
             }
@@ -128,7 +103,7 @@ export function pickLowestVersionByVersionRange({ meta, versionRange, preferredV
     if (versionRange === '*') {
         return Object.keys(meta.versions).sort(semver.compare)[0];
     }
-    return semver.minSatisfying(Object.keys(meta.versions), versionRange, true);
+    return minSatisfyingLoose(Object.keys(meta.versions), versionRange);
 }
 export function pickVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }) {
     const latest = meta['dist-tags'].latest;
@@ -138,7 +113,7 @@ export function pickVersionByVersionRange({ meta, versionRange, preferredVersion
             if (preferredVersions.includes(latest) && semverSatisfiesLoose(latest, versionRange)) {
                 return latest;
             }
-            const preferredVersion = semver.maxSatisfying(preferredVersions, versionRange, true);
+            const preferredVersion = maxSatisfyingLoose(preferredVersions, versionRange);
             if (preferredVersion) {
                 return preferredVersion;
             }
@@ -150,13 +125,13 @@ export function pickVersionByVersionRange({ meta, versionRange, preferredVersion
         // E.g.: 1.0.0-beta.1. See issue: https://github.com/pnpm/pnpm/issues/865
         return latest;
     }
-    const maxVersion = semver.maxSatisfying(versions, versionRange, true);
+    const maxVersion = maxSatisfyingLoose(versions, versionRange);
     // if the selected version is deprecated, try to find a non-deprecated one that satisfies the range
     if (maxVersion && meta.versions[maxVersion].deprecated && versions.length > 1) {
         const nonDeprecatedVersions = versions.map((version) => meta.versions[version])
             .filter((versionMeta) => !versionMeta.deprecated)
             .map((versionMeta) => versionMeta.version);
-        const maxNonDeprecatedVersion = semver.maxSatisfying(nonDeprecatedVersions, versionRange, true);
+        const maxNonDeprecatedVersion = maxSatisfyingLoose(nonDeprecatedVersions, versionRange);
         if (maxNonDeprecatedVersion)
             return maxNonDeprecatedVersion;
     }
@@ -224,4 +199,76 @@ class PreferredVersionsPrioritizer {
             .map((weight) => versionsByWeight[parseInt(weight, 10)]);
     }
 }
+function semverSatisfiesLoose(version, range) {
+    const semverRange = parseRangeLoose(range);
+    if (semverRange == null)
+        return false;
+    const parsedVersion = parseSemverLoose(version);
+    return parsedVersion != null && semverRange.test(parsedVersion);
+}
+// semver's own maxSatisfying/minSatisfying re-parse the range and every
+// version string on each call, which dominates resolution time on large
+// packuments; these reuse the parse caches instead.
+function maxSatisfyingLoose(versions, range) {
+    return findSatisfyingLoose(versions, range, (candidate, best) => candidate.compare(best) > 0);
+}
+function minSatisfyingLoose(versions, range) {
+    return findSatisfyingLoose(versions, range, (candidate, best) => candidate.compare(best) < 0);
+}
+function findSatisfyingLoose(versions, range, isBetter) {
+    const semverRange = parseRangeLoose(range);
+    if (semverRange == null)
+        return null;
+    let bestVersion = null;
+    let bestParsed = null;
+    for (const version of versions) {
+        const parsed = parseSemverLoose(version);
+        if (parsed == null || !semverRange.test(parsed))
+            continue;
+        if (bestParsed == null || isBetter(parsed, bestParsed)) {
+            bestVersion = version;
+            bestParsed = parsed;
+        }
+    }
+    return bestVersion;
+}
+function parseRangeLoose(range) {
+    let semverRange = semverRangeCache.get(range);
+    if (semverRange === undefined) {
+        try {
+            semverRange = new semver.Range(range, true);
+        }
+        catch {
+            semverRange = null;
+        }
+        if (semverRangeCache.size >= SEMVER_CACHE_MAX_SIZE)
+            semverRangeCache.clear();
+        semverRangeCache.set(range, semverRange);
+    }
+    return semverRange;
+}
+function parseSemverLoose(version) {
+    let parsed = semverInstanceCache.get(version);
+    if (parsed === undefined) {
+        try {
+            parsed = new semver.SemVer(version, true);
+        }
+        catch {
+            parsed = null;
+        }
+        if (semverInstanceCache.size >= SEMVER_CACHE_MAX_SIZE)
+            semverInstanceCache.clear();
+        semverInstanceCache.set(version, parsed);
+    }
+    return parsed;
+}
+// Working with string-ish semver causes lots of allocations and repeated
+// work, and a dependency graph tests the same ranges and versions over and
+// over, so both parses are cached. Parse failures are cached as null, so a
+// malformed version string is never re-parsed either. The caches are dropped
+// wholesale once they grow past this size, so a long-lived process (daemon,
+// store server) can't retain them without bound.
+const SEMVER_CACHE_MAX_SIZE = 50_000;
+const semverRangeCache = new Map();
+const semverInstanceCache = new Map();
 //# sourceMappingURL=pickPackageFromMeta.js.map

package/lib/violationCodes.d.ts

@@ -12,3 +12,4 @@ export declare const MINIMUM_RELEASE_AGE_VIOLATION_CODE = "MINIMUM_RELEASE_AGE_V
 export declare const TRUST_DOWNGRADE_VIOLATION_CODE = "TRUST_DOWNGRADE";
 export declare const TARBALL_URL_MISMATCH_VIOLATION_CODE = "TARBALL_URL_MISMATCH";
 export declare const MISSING_TARBALL_INTEGRITY_VIOLATION_CODE = "MISSING_TARBALL_INTEGRITY";
+export declare const MISSING_NAMED_REGISTRY_VIOLATION_CODE = "MISSING_NAMED_REGISTRY";

package/lib/violationCodes.js

@@ -12,4 +12,5 @@ export const MINIMUM_RELEASE_AGE_VIOLATION_CODE = 'MINIMUM_RELEASE_AGE_VIOLATION
 export const TRUST_DOWNGRADE_VIOLATION_CODE = 'TRUST_DOWNGRADE';
 export const TARBALL_URL_MISMATCH_VIOLATION_CODE = 'TARBALL_URL_MISMATCH';
 export const MISSING_TARBALL_INTEGRITY_VIOLATION_CODE = 'MISSING_TARBALL_INTEGRITY';
+export const MISSING_NAMED_REGISTRY_VIOLATION_CODE = 'MISSING_NAMED_REGISTRY';
 //# sourceMappingURL=violationCodes.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1103.0.0",
+  "version": "1103.1.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -29,22 +29,24 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/config.pick-registry-for-package": "1100.0.14",
-    "@pnpm/config.version-policy": "1100.1.11",
-    "@pnpm/constants": "1100.0.1",
-    "@pnpm/core-loggers": "1100.3.1",
+    "@pnpm/config.normalize-registries": "1100.1.0",
+    "@pnpm/config.pick-registry-for-package": "1100.1.0",
+    "@pnpm/config.version-policy": "1100.1.12",
+    "@pnpm/constants": "1101.0.0",
+    "@pnpm/core-loggers": "1100.3.2",
     "@pnpm/crypto.hash": "1100.0.2",
-    "@pnpm/error": "1100.1.0",
+    "@pnpm/deps.path": "1100.1.0",
+    "@pnpm/error": "1100.1.1",
     "@pnpm/fetching.types": "1100.0.3",
     "@pnpm/fs.graceful-fs": "1100.1.1",
-    "@pnpm/pkg-manifest.utils": "1100.3.0",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.3",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.14",
-    "@pnpm/resolving.registry.types": "1100.1.8",
-    "@pnpm/resolving.resolver-base": "1101.0.0",
-    "@pnpm/store.cafs": "1100.1.17",
-    "@pnpm/store.index": "1100.2.2",
-    "@pnpm/types": "1101.8.0",
+    "@pnpm/pkg-manifest.utils": "1100.3.1",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.4",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.15",
+    "@pnpm/resolving.registry.types": "1100.1.9",
+    "@pnpm/resolving.resolver-base": "1101.1.0",
+    "@pnpm/store.cafs": "1100.1.18",
+    "@pnpm/store.index": "1100.2.3",
+    "@pnpm/types": "1101.9.0",
     "@pnpm/workspace.range-resolver": "1100.0.3",
     "@pnpm/workspace.spec-parser": "1100.0.1",
     "@zkochan/retry": "^0.2.0",
@@ -64,13 +66,13 @@
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.9"
+    "@pnpm/worker": "^1100.2.10"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.10",
-    "@pnpm/resolving.npm-resolver": "1103.0.0",
+    "@pnpm/network.fetch": "1100.1.11",
+    "@pnpm/resolving.npm-resolver": "1103.1.0",
     "@pnpm/test-fixtures": "1100.0.1",
     "@pnpm/testing.mock-agent": "1101.0.7",
     "@types/normalize-path": "^3.0.2",