@pnpm/resolving.npm-resolver 1103.0.0 → 1103.2.0

package/CHANGELOG.md

@@ -1,5 +1,97 @@
 # @pnpm/npm-resolver
 
+## 1103.2.0
+
+### Minor Changes
+
+- Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same `ERR_PNPM_NO_OFFLINE_META` condition used by offline resolution.
+
+### Patch Changes
+
+- The held-back-update warning printed by `pnpm update` no longer fires when `minimumReleaseAge` is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See pnpm/pnpm#13071.
+
+- Updated dependencies:
+  - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.16
+
+## 1103.1.0
+
+### Minor Changes
+
+- **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below.
+
+  The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got.
+
+  That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell.
+
+  Packages resolved from a named registry are now recorded under registry-qualified keys (`<name>@<registryName>:<version>`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from.
+
+  The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file.
+
+  ### If you use named registries
+
+  Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating.
+
+  Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it.
+
+  There is no setting to keep the old behavior: the old shape is the vulnerability.
+
+  Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand.
+
+  To use named registries, map your aliases in `pnpm-workspace.yaml`:
+
+  ```yaml
+  namedRegistries:
+    work: https://npm.enterprise.example.com/
+  ```
+
+  ### New built-in `npmjs:` alias
+
+  `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy:
+
+  ```json
+  { "dependencies": { "left-pad": "npmjs:^1.3.0" } }
+  ```
+
+  `npm:` cannot do this — it is the alias protocol (`npm:<name>@<range>`) and resolves through whatever `registry` points at.
+
+  **If you mirror or proxy npmjs, point the alias at your mirror:**
+
+  ```yaml
+  namedRegistries:
+    npmjs: https://npm.internal.example.com/
+  ```
+
+  Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`.
+
+  Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it.
+
+  Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver.
+
+  `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier.
+
+### Patch Changes
+
+- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs.
+
+- Dependency resolution is faster: package metadata is now filtered once per packument instead of once per dependency edge when `minimumReleaseAge` is active, and parsed semver versions and ranges are reused instead of re-parsed on every comparison.
+
+- Updated dependencies:
+  - @pnpm/config.normalize-registries@1100.1.0
+  - @pnpm/config.pick-registry-for-package@1100.1.0
+  - @pnpm/config.version-policy@1100.1.12
+  - @pnpm/constants@1101.0.0
+  - @pnpm/core-loggers@1100.3.2
+  - @pnpm/deps.path@1100.1.0
+  - @pnpm/error@1100.1.1
+  - @pnpm/pkg-manifest.utils@1100.3.1
+  - @pnpm/resolving.jsr-specifier-parser@1100.0.4
+  - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.15
+  - @pnpm/resolving.registry.types@1100.1.9
+  - @pnpm/resolving.resolver-base@1101.1.0
+  - @pnpm/store.cafs@1100.1.18
+  - @pnpm/store.index@1100.2.3
+  - @pnpm/types@1101.9.0
+
 ## 1103.0.0
 
 ### Major Changes

package/lib/clearMeta.js

@@ -1,4 +1,3 @@
-import { pick } from 'ramda';
 // The list taken from https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-version-object
 // with the addition of 'libc'
 const ABBREVIATED_VERSION_FIELDS = [
@@ -48,7 +47,7 @@ export function clearMeta(pkg) {
     // prototype of the map (js/prototype-polluting-assignment).
     const versions = Object.create(null);
     for (const [version, info] of Object.entries(pkg.versions ?? {})) {
-        versions[version] = pick(ABBREVIATED_VERSION_FIELDS, info);
+        versions[version] = pickAbbreviatedVersionFields(info);
     }
     const condensed = {
         name: pkg.name,
@@ -64,6 +63,20 @@ export function clearMeta(pkg) {
     condensedPackuments.set(condensed, condensed);
     return condensed;
 }
+// Hand-rolled rather than delegated to a generic field picker because it runs
+// for every version of every packument an install parses. Testing the value
+// for `undefined` is equivalent to testing for the key's presence: version
+// objects come from JSON, which cannot encode undefined.
+function pickAbbreviatedVersionFields(info) {
+    const picked = {};
+    for (const field of ABBREVIATED_VERSION_FIELDS) {
+        const value = info[field];
+        if (value !== undefined) {
+            picked[field] = value;
+        }
+    }
+    return picked;
+}
 /**
  * Whether a resolver keeps full packuments rather than condensing them with
  * {@link clearMeta}: only `fullMetadata` without `filterMetadata`, whose

package/lib/createNpmResolutionVerifier.d.ts

@@ -58,6 +58,11 @@ export interface CreateNpmResolutionVerifierOptions {
     fetchOpts: FetchMetadataFromFromRegistryOptions;
     getAuthHeaderValueByURI: GetAuthHeader;
     cacheDir?: FetchFullMetadataCachedOptions['cacheDir'];
+    /**
+     * When true, verifier metadata lookups must use the local mirror
+     * only and never reach the registry or attestation endpoint.
+     */
+    offline?: boolean;
     /**
      * Per-install LRU shared with the npm resolver's `pickPackage`
      * (`{ get, set }` over `PackageMeta`). When provided, the verifier

package/lib/createNpmResolutionVerifier.js

@@ -1,4 +1,6 @@
-import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { createHash } from 'node:crypto';
+import { normalizeNamedRegistries } from '@pnpm/config.normalize-registries';
+import { namedRegistryTarballPrefixes, pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { createPackageVersionPolicy } from '@pnpm/config.version-policy';
 import { FULL_META_DIR } from '@pnpm/constants';
 import { PnpmError } from '@pnpm/error';
@@ -7,10 +9,9 @@ import semver from 'semver';
 import { fetchAttestationPublishedAt } from './fetchAttestationPublishedAt.js';
 import { fetchAbbreviatedMetadataCached, fetchFullMetadataCached, } from './fetchFullMetadataCached.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
-import { BUILTIN_NAMED_REGISTRIES } from './parseBareSpecifier.js';
 import { getPkgMetaCacheKey, getPkgMirrorPath, loadMeta, warnMissingTimeFieldOnce } from './pickPackage.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
-import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, MISSING_TARBALL_INTEGRITY_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, MISSING_NAMED_REGISTRY_VIOLATION_CODE, MISSING_TARBALL_INTEGRITY_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 /**
  * Returns a `ResolutionVerifier` for npm-registry-resolved lockfile
  * entries. It always binds each entry's recorded tarball URL to the
@@ -38,30 +39,8 @@ export function createNpmResolutionVerifier(opts) {
     const trustExcludePolicy = opts.trustPolicyExclude?.length
         ? createExcludePolicy(opts.trustPolicyExclude, 'trustPolicyExclude')
         : undefined;
-    // Pre-normalize named-registry URLs and sort by length so two registries
-    // that share a hostname but differ by path (e.g. `https://npm/team-a/` vs
-    // `https://npm/team-b/`) route to the longest matching prefix — matching
-    // only `origin` would silently send lookups to the wrong one. Built-in
-    // aliases (`gh:` → npm.pkg.github.com, etc.) are merged in alongside the
-    // user-defined ones so the verifier recognizes the same set of named
-    // registries the resolver does; otherwise a package resolved via `gh:`
-    // would land in the lockfile with a tarball URL the verifier can't route.
-    const namedRegistryPrefixes = Object.values({
-        ...BUILTIN_NAMED_REGISTRIES,
-        ...(opts.namedRegistries ?? {}),
-    })
-        .map((url) => {
-        const parsed = tryParseUrl(url);
-        if (!parsed)
-            return null;
-        // Ensure trailing slash so prefix matching against tarball URLs (which
-        // always include the package path under the registry root) does not
-        // accidentally match a sibling registry whose URL shares a prefix string.
-        const pathname = parsed.pathname.endsWith('/') ? parsed.pathname : `${parsed.pathname}/`;
-        return `${parsed.origin}${pathname}`;
-    })
-        .filter((value) => value != null)
-        .sort((a, b) => b.length - a.length);
+    const mergedNamedRegistries = normalizeNamedRegistries(opts.namedRegistries);
+    const namedRegistryPrefixes = namedRegistryTarballPrefixes(mergedNamedRegistries);
     // Per-install dedup of every network/disk fetch the verifier issues.
     // The maturity check uses the layered `fetchPublishedAt` lookup; the
     // trust check uses an attestation fast-path before falling back to
@@ -74,6 +53,7 @@ export function createNpmResolutionVerifier(opts) {
         fetchOpts: opts.fetchOpts,
         getAuthHeaderValueByURI: opts.getAuthHeaderValueByURI,
         cacheDir: opts.cacheDir,
+        offline: opts.offline === true,
         cutoffMs: cutoff,
         sharedMetaCache: opts.metaCache,
         abbreviatedMetaCache: new Map(),
@@ -85,7 +65,7 @@ export function createNpmResolutionVerifier(opts) {
     const minimumReleaseAge = opts.minimumReleaseAge ?? 0;
     const trustPolicy = opts.trustPolicy;
     const trustPolicyIgnoreAfter = opts.trustPolicyIgnoreAfter;
-    const verify = async (resolution, { name, version, nonSemverVersion }) => {
+    const verify = async (resolution, { name, version, nonSemverVersion, registryName }) => {
         if (!isRegistryTarballResolution(resolution))
             return { ok: true };
         // Network-free structural checks must run before registry metadata shortcuts.
@@ -120,7 +100,26 @@ export function createNpmResolutionVerifier(opts) {
             };
         }
         const tarballUrl = typeof rawTarball === 'string' ? rawTarball : undefined;
-        const registry = pickRegistryForVersion(opts.registries, namedRegistryPrefixes, name, tarballUrl);
+        let registry;
+        if (registryName != null) {
+            // Registry-qualified entries name their registry in the dep path, so
+            // routing does not depend on a recorded tarball URL (canonical URLs
+            // are omitted from the lockfile in the 12.0 format).
+            const namedRegistry = mergedNamedRegistries[registryName];
+            if (!namedRegistry) {
+                // Fail closed: without the registry URL, none of the metadata-backed
+                // checks below can vouch for this entry.
+                return {
+                    ok: false,
+                    code: MISSING_NAMED_REGISTRY_VIOLATION_CODE,
+                    reason: `was resolved from the named registry '${registryName}:', which is not present in the namedRegistries setting`,
+                };
+            }
+            registry = namedRegistry;
+        }
+        else {
+            registry = pickRegistryForVersion(opts.registries, namedRegistryPrefixes, name, tarballUrl);
+        }
         // A registry entry that pins an explicit tarball URL must point at the
         // artifact the registry's own metadata lists. Otherwise a trusted
         // `name@version` could front bytes from an attacker-chosen URL (with a
@@ -164,6 +163,10 @@ export function createNpmResolutionVerifier(opts) {
     // stays trusted after its exclude entry has been pulled.
     const sortedMinAgeExcludes = [...new Set(opts.minimumReleaseAgeExclude ?? [])].sort();
     const sortedTrustExcludes = [...new Set(opts.trustPolicyExclude ?? [])].sort();
+    const sortedNamedRegistries = Object.fromEntries(Object.entries(mergedNamedRegistries).sort(([aliasA], [aliasB]) => aliasA.localeCompare(aliasB)));
+    const namedRegistriesRouting = createHash('sha256')
+        .update(JSON.stringify(sortedNamedRegistries))
+        .digest('hex');
     return {
         verify,
         policy: {
@@ -175,6 +178,7 @@ export function createNpmResolutionVerifier(opts) {
             tarballUrlBinding: true,
             // Same cache identity rule for the missing-integrity structural check.
             integrityRequired: true,
+            namedRegistriesRouting,
             minimumReleaseAge,
             minimumReleaseAgeExclude: sortedMinAgeExcludes,
             trustPolicy: trustPolicy ?? null,
@@ -190,6 +194,8 @@ export function createNpmResolutionVerifier(opts) {
             // without the flag cannot prove they rejected unverifiable tarballs.
             if (cached.integrityRequired !== true)
                 return false;
+            if (cached.namedRegistriesRouting !== namedRegistriesRouting)
+                return false;
             // Maturity: a previously cached run under a larger cutoff
             // (stricter window) is trustworthy under a smaller current one —
             // its set of accepted versions is a subset of today's. The
@@ -386,6 +392,7 @@ function fetchFullMetaForTrust(context, registry, name) {
                 registry,
                 authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
                 cacheDir: context.cacheDir,
+                offline: context.offline,
             }).then(projectTrustMeta);
         }
         context.fullMetaForTrustCache.set(cacheKey, cachedPromise);
@@ -480,12 +487,14 @@ async function resolvePublishedAt(context, registry, name, version) {
     const localTime = await readLocalMetaTime(context, registry, name);
     if (localTime?.[version])
         return localTime[version];
-    const attestationTime = await fetchAttestationPublishedAt(context.fetchOpts, name, version, {
-        registry,
-        authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
-    });
-    if (attestationTime != null)
-        return attestationTime;
+    if (!context.offline) {
+        const attestationTime = await fetchAttestationPublishedAt(context.fetchOpts, name, version, {
+            registry,
+            authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
+        });
+        if (attestationTime != null)
+            return attestationTime;
+    }
     const fullMetaTime = await fetchFullMetaTime(context, registry, name);
     return fullMetaTime?.[version];
 }
@@ -550,6 +559,7 @@ function fetchAbbreviatedMeta(context, registry, name) {
                 registry,
                 authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
                 cacheDir: context.cacheDir,
+                offline: context.offline,
             }).then((meta) => ({ meta: projectAbbreviatedMeta(meta) }), (error) => ({ error }));
         }
         context.abbreviatedMetaCache.set(cacheKey, cachedPromise);
@@ -641,6 +651,7 @@ function fetchFullMetaTime(context, registry, name) {
             registry,
             authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
             cacheDir: context.cacheDir,
+            offline: context.offline,
         }).then((meta) => meta.time);
         context.fullMetaCache.set(cacheKey, cachedPromise);
     }

package/lib/fetchFullMetadataCached.d.ts

@@ -10,6 +10,10 @@ export interface FetchMetadataCachedOptions {
      * back. Omit to disable caching — every call re-fetches.
      */
     cacheDir?: string;
+    /**
+     * Use only pnpm's on-disk metadata mirror and never reach the registry.
+     */
+    offline?: boolean;
 }
 export type FetchFullMetadataCachedOptions = FetchMetadataCachedOptions;
 /**

package/lib/fetchFullMetadataCached.js

@@ -1,4 +1,5 @@
 import { ABBREVIATED_META_DIR, FULL_META_DIR } from '@pnpm/constants';
+import { PnpmError } from '@pnpm/error';
 import { fetchMetadataFromFromRegistry, } from './fetch.js';
 import { getPkgMirrorPath, loadMeta, loadMetaHeaders, prepareJsonForDisk, saveMeta } from './pickPackage.js';
 /**
@@ -28,6 +29,14 @@ async function fetchMetadataCached(fetchOpts, pkgName, opts) {
     const pkgMirror = opts.cacheDir != null
         ? getPkgMirrorPath(opts.cacheDir, opts.metaDir, opts.registry, pkgName)
         : null;
+    if (opts.offline === true) {
+        if (pkgMirror != null) {
+            const cached = await loadMeta(pkgMirror);
+            if (cached != null)
+                return cached;
+        }
+        throw new PnpmError('NO_OFFLINE_META', `Failed to resolve ${pkgName} in package mirror ${pkgMirror ?? ''}`);
+    }
     const cacheHeaders = pkgMirror != null ? await loadMetaHeaders(pkgMirror) : null;
     const conditional = await fetchMetadataFromFromRegistry(fetchOpts, pkgName, {
         registry: opts.registry,

package/lib/index.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { isWellFormedRegistryName, RESERVED_VERSION_PREFIXES } from '@pnpm/deps.path';
 import { PnpmError } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import { rangeSpecGranularity, versionWithRangeSpecStyle } from '@pnpm/pkg-manifest.utils';
@@ -20,7 +21,7 @@ import { memoizeFetchMetadata } from './memoizeFetchMetadata.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
 import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, parseNamedRegistrySpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
 import { pickPackage, } from './pickPackage.js';
-import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
+import { applyPublishedByPolicy, pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
 import { MINIMUM_RELEASE_AGE_VIOLATION_CODE } from './violationCodes.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
@@ -211,7 +212,10 @@ function stripLockfileVersionPins(selectors) {
  * The baseline for "held back" is the pick with only the non-pin selectors
  * applied — `range`/`tag` selectors such as the `pnpm audit --fix`
  * vulnerability penalties steer the baseline too, so the warning never
- * recommends a version those selectors avoid.
+ * recommends a version those selectors avoid. The baseline also honors the
+ * `publishedBy` maturity cutoff the actual pick applied: a version blocked
+ * by `minimumReleaseAge` is not an update the manifests held back, and
+ * recommending an override for it would defeat the age gate.
  *
  * The recommended override is scoped to the declared range being resolved
  * (`name@<range>`), so applying it can never violate any consumer's range:
@@ -232,8 +236,14 @@ function warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedVersion) {
         nonPinSelectors ??= Object.create(null);
         nonPinSelectors[selector] = value;
     }
+    // `needsFullMetadata` is not this caller's problem: the pick already
+    // succeeded on this metadata, which for an abbreviated packument means
+    // every version cleared the cutoff, so `meta` is the filtered view.
+    const baselineMeta = opts.publishedBy != null
+        ? applyPublishedByPolicy(meta, opts.publishedBy, opts.publishedByExclude).meta
+        : meta;
     const preferred = pickVersionByVersionRange({
-        meta,
+        meta: baselineMeta,
         versionRange: spec.fetchSpec,
         preferredVersionSelectors: nonPinSelectors,
     });
@@ -539,6 +549,11 @@ function mergeNamedRegistries(userDefined) {
     if (!userDefined)
         return merged;
     for (const [alias, url] of Object.entries(userDefined)) {
+        if (RESERVED_VERSION_PREFIXES.has(alias) || !isWellFormedRegistryName(alias)) {
+            throw new PnpmError('RESERVED_NAMED_REGISTRY_NAME', RESERVED_VERSION_PREFIXES.has(alias)
+                ? `'${alias}' cannot be used as a named registry alias: it is a reserved dependency specifier prefix.`
+                : `'${alias}' cannot be used as a named registry alias: aliases must start with a letter and contain only letters, digits, ".", "_", and "-".`, { hint: 'Rename the entry in the namedRegistries setting.' });
+        }
         if (typeof url !== 'string' || !isValidHttpUrl(url)) {
             throw new PnpmError('INVALID_NAMED_REGISTRY_URL', `The named registry alias '${alias}' is mapped to '${String(url)}', which is not a valid http(s) URL.`, { hint: 'Provide a URL that starts with http:// or https://, e.g. https://npm.pkg.example.com/' });
         }
@@ -574,6 +589,11 @@ async function resolveFromNamedRegistry(ctx, wantedDependency, opts) {
     const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registry);
     return {
         ...picked,
+        // Qualifying the id with the registry alias is what keeps the same
+        // name@version resolved from two registries distinct in the lockfile.
+        // Without it they collapse onto one entry and whichever resolved first
+        // decides the tarball both consumers get.
+        id: `${picked.manifest.name}@${spec.registryName}:${picked.manifest.version}`,
         normalizedBareSpecifier: opts.calcSpecifier
             ? calcPrefixedSpecifier(`${spec.registryName}:`, spec.name, wantedDependency, picked.manifest.version, opts.rangeSpecStyle)
             : undefined,

package/lib/parseBareSpecifier.d.ts

@@ -9,7 +9,7 @@ export interface JsrRegistryPackageSpec extends RegistryPackageSpec {
     jsrPkgName: string;
 }
 export declare function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier: string, alias: string | undefined, defaultTag: string): JsrRegistryPackageSpec | null;
-export declare const BUILTIN_NAMED_REGISTRIES: Readonly<Record<string, string>>;
+export { BUILTIN_NAMED_REGISTRIES } from '@pnpm/constants';
 export interface NamedRegistryPackageSpec extends RegistryPackageSpec {
     registryName: string;
 }

package/lib/parseBareSpecifier.js

@@ -64,9 +64,7 @@ export function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier, alias, defa
         jsrPkgName: spec.jsrPkgName,
     };
 }
-export const BUILTIN_NAMED_REGISTRIES = Object.freeze({
-    gh: 'https://npm.pkg.github.com/',
-});
+export { BUILTIN_NAMED_REGISTRIES } from '@pnpm/constants';
 // Parses a named-registry specifier of the shape `<alias>:<body>` into a
 // RegistryPackageSpec. Returns `null` when the specifier does not use one of
 // the configured aliases, so the caller can fall through to other resolvers.

package/lib/pickPackage.js

@@ -191,13 +191,29 @@ export async function pickPackage(ctx, spec, opts) {
         };
         let diskMeta;
         if (ctx.offline === true || ctx.preferOffline === true || opts.pickLowestVersion) {
-            diskMeta = await limit(loadMetaCondensed);
+            // Concurrent offline picks of one package all miss the pre-queue cache
+            // check and queue behind this limiter, so the check is repeated inside
+            // the queue and the promotion happens before the limiter releases —
+            // otherwise every queued pick re-reads and re-parses the mirror. Serving
+            // a queued pick from the cache is equivalent to it having arrived after
+            // the first caller cached it: offline entries are always disk-sourced
+            // and maybeUpgradeAbbreviatedMetaForReleaseAge short-circuits when
+            // offline, so an in-memory hit returns this same meta with no network
+            // access.
+            diskMeta = await limit(async () => {
+                if (ctx.offline !== true)
+                    return loadMetaCondensed();
+                const cached = ctx.metaCache.get(cacheKey);
+                if (cached != null)
+                    return cached;
+                const meta = await loadMetaCondensed();
+                if (meta != null) {
+                    cacheDiskLoadedMeta(ctx.metaCache, cacheKey, meta);
+                }
+                return meta;
+            });
             if (ctx.offline) {
                 if (diskMeta != null) {
-                    // maybeUpgradeAbbreviatedMetaForReleaseAge short-circuits when
-                    // offline, so a later in-memory cache hit returns this same meta
-                    // without any network access.
-                    cacheDiskLoadedMeta(ctx.metaCache, cacheKey, diskMeta);
                     return {
                         meta: diskMeta,
                         pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, diskMeta),

package/lib/pickPackageFromMeta.d.ts

@@ -15,6 +15,29 @@ export interface PickPackageFromMetaOptions {
     publishedByExclude?: PackageVersionPolicy;
 }
 export declare function pickPackageFromMeta(pickVersionByVersionRangeFn: PickVersionByVersionRange, { preferredVersionSelectors, publishedBy, publishedByExclude, }: PickPackageFromMetaOptions, meta: PackageMeta, spec: RegistryPackageSpec): PackageInRegistry | null;
+export interface PublishedByView {
+    /** The metadata the cutoff leaves visible. `meta` itself when nothing is filtered out. */
+    meta: PackageMeta;
+    /**
+     * The cutoff could not be applied: the metadata is abbreviated, so there
+     * are no per-version timestamps to filter on. Whether that is fatal is the
+     * caller's call — the pick needs full metadata to honor the cutoff, while a
+     * caller reasoning about a pick that already succeeded knows the versions
+     * cleared the cutoff some other way.
+     */
+    needsFullMetadata: boolean;
+}
+/**
+ * Narrows `meta` to the versions the `publishedBy` cutoff admits, honoring
+ * `publishedByExclude`: a package the policy excludes wholesale keeps its
+ * unfiltered metadata, and versions the policy names explicitly stay in
+ * regardless of their age.
+ *
+ * Every consumer of the cutoff goes through here so they agree on what the
+ * policy admits — a baseline that filters differently from the pick would
+ * misreport why a version was chosen.
+ */
+export declare function applyPublishedByPolicy(meta: PackageMeta, publishedBy: Date, publishedByExclude?: PackageVersionPolicy): PublishedByView;
 export declare function assertMetaHasTime(meta: PackageMeta): asserts meta is PackageMetaWithTime;
 export declare function pickLowestVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;
 export declare function pickVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;

package/lib/pickPackageFromMeta.js

@@ -4,28 +4,20 @@ import { filterPkgMetadataByPublishDate } from '@pnpm/resolving.registry.pkg-met
 import semver from 'semver';
 export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVersionSelectors, publishedBy, publishedByExclude, }, meta, spec) {
     if (publishedBy) {
-        const excludeResult = publishedByExclude?.(meta.name) ?? false;
-        if (excludeResult !== true) {
-            if (meta.time != null) {
-                // Full metadata with per-version timestamps: filter normally
+        const view = applyPublishedByPolicy(meta, publishedBy, publishedByExclude);
+        meta = view.meta;
+        if (view.needsFullMetadata) {
+            const modifiedDate = parseModifiedDate(meta.modified);
+            if (modifiedDate == null || modifiedDate > publishedBy) {
+                // The package was modified after the cutoff (or carries no usable
+                // `modified`), so which of its versions are mature is unknowable
+                // from abbreviated metadata. The error tells the caller to refetch.
                 assertMetaHasTime(meta);
-                const trustedVersions = Array.isArray(excludeResult) ? excludeResult : undefined;
-                meta = filterPkgMetadataByPublishDate(meta, publishedBy, trustedVersions);
-            }
-            else {
-                const modifiedDate = parseModifiedDate(meta.modified);
-                if (modifiedDate == null || modifiedDate > publishedBy) {
-                    // Abbreviated metadata without per-version timestamps, and the package
-                    // was recently modified (or has no/invalid modified field). We cannot determine
-                    // which individual versions are mature enough — need full metadata.
-                    assertMetaHasTime(meta);
-                }
-                // else: meta.modified <= publishedBy — every version was published at or
-                // before the cutoff (modified is an upper bound on per-version time), so
-                // they all pass the per-version `<=` maturity filter and no filtering is
-                // needed. Inclusive at the boundary on purpose so this branch matches the
-                // per-version filter in `filterPkgMetadataByPublishDate`.
             }
+            // else: `modified` is an upper bound on every per-version timestamp, so
+            // `modified <= publishedBy` means they all pass the maturity filter and
+            // nothing would be dropped. Inclusive at the boundary on purpose, to
+            // match the per-version `<=` in `filterPkgMetadataByPublishDate`.
         }
     }
     if ((!meta.versions || Object.keys(meta.versions).length === 0) && !publishedBy) {
@@ -77,6 +69,29 @@ export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVers
         throw new PnpmError('MALFORMED_METADATA', `Received malformed metadata for "${spec.name}"`, { hint: 'This might mean that the package was unpublished from the registry', cause: err });
     }
 }
+/**
+ * Narrows `meta` to the versions the `publishedBy` cutoff admits, honoring
+ * `publishedByExclude`: a package the policy excludes wholesale keeps its
+ * unfiltered metadata, and versions the policy names explicitly stay in
+ * regardless of their age.
+ *
+ * Every consumer of the cutoff goes through here so they agree on what the
+ * policy admits — a baseline that filters differently from the pick would
+ * misreport why a version was chosen.
+ */
+export function applyPublishedByPolicy(meta, publishedBy, publishedByExclude) {
+    const excludeResult = publishedByExclude?.(meta.name) ?? false;
+    if (excludeResult === true)
+        return { meta, needsFullMetadata: false };
+    if (meta.time == null)
+        return { meta, needsFullMetadata: true };
+    assertMetaHasTime(meta);
+    const trustedVersions = Array.isArray(excludeResult) ? excludeResult : undefined;
+    return {
+        meta: filterPkgMetadataByPublishDate(meta, publishedBy, trustedVersions),
+        needsFullMetadata: false,
+    };
+}
 export function assertMetaHasTime(meta) {
     if (meta.time == null) {
         throw new PnpmError('MISSING_TIME', `The metadata of ${meta.name} is missing the "time" field`);
@@ -90,36 +105,11 @@ function parseModifiedDate(modified) {
         return null;
     return date;
 }
-const semverRangeCache = new Map();
-// This is a performance optimization; working with string-ish semver
-// causes lots of allocations and repeated work, but caching the Range
-// and ensuring we give it a SemVer instance greatly speeds things up.
-function semverSatisfiesLoose(version, range) {
-    let semverRange = semverRangeCache.get(range);
-    if (semverRange === undefined) {
-        try {
-            semverRange = new semver.Range(range, true);
-        }
-        catch {
-            semverRange = null;
-        }
-        semverRangeCache.set(range, semverRange);
-    }
-    if (semverRange) {
-        try {
-            return semverRange.test(new semver.SemVer(version, true));
-        }
-        catch {
-            return false;
-        }
-    }
-    return false;
-}
 export function pickLowestVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }) {
     if (preferredVersionSelectors != null && Object.keys(preferredVersionSelectors).length > 0) {
         const prioritizedPreferredVersions = prioritizePreferredVersions(meta, versionRange, preferredVersionSelectors);
         for (const preferredVersions of prioritizedPreferredVersions) {
-            const preferredVersion = semver.minSatisfying(preferredVersions, versionRange, true);
+            const preferredVersion = minSatisfyingLoose(preferredVersions, versionRange);
             if (preferredVersion) {
                 return preferredVersion;
             }
@@ -128,7 +118,7 @@ export function pickLowestVersionByVersionRange({ meta, versionRange, preferredV
     if (versionRange === '*') {
         return Object.keys(meta.versions).sort(semver.compare)[0];
     }
-    return semver.minSatisfying(Object.keys(meta.versions), versionRange, true);
+    return minSatisfyingLoose(Object.keys(meta.versions), versionRange);
 }
 export function pickVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }) {
     const latest = meta['dist-tags'].latest;
@@ -138,7 +128,7 @@ export function pickVersionByVersionRange({ meta, versionRange, preferredVersion
             if (preferredVersions.includes(latest) && semverSatisfiesLoose(latest, versionRange)) {
                 return latest;
             }
-            const preferredVersion = semver.maxSatisfying(preferredVersions, versionRange, true);
+            const preferredVersion = maxSatisfyingLoose(preferredVersions, versionRange);
             if (preferredVersion) {
                 return preferredVersion;
             }
@@ -150,13 +140,13 @@ export function pickVersionByVersionRange({ meta, versionRange, preferredVersion
         // E.g.: 1.0.0-beta.1. See issue: https://github.com/pnpm/pnpm/issues/865
         return latest;
     }
-    const maxVersion = semver.maxSatisfying(versions, versionRange, true);
+    const maxVersion = maxSatisfyingLoose(versions, versionRange);
     // if the selected version is deprecated, try to find a non-deprecated one that satisfies the range
     if (maxVersion && meta.versions[maxVersion].deprecated && versions.length > 1) {
         const nonDeprecatedVersions = versions.map((version) => meta.versions[version])
             .filter((versionMeta) => !versionMeta.deprecated)
             .map((versionMeta) => versionMeta.version);
-        const maxNonDeprecatedVersion = semver.maxSatisfying(nonDeprecatedVersions, versionRange, true);
+        const maxNonDeprecatedVersion = maxSatisfyingLoose(nonDeprecatedVersions, versionRange);
         if (maxNonDeprecatedVersion)
             return maxNonDeprecatedVersion;
     }
@@ -224,4 +214,76 @@ class PreferredVersionsPrioritizer {
             .map((weight) => versionsByWeight[parseInt(weight, 10)]);
     }
 }
+function semverSatisfiesLoose(version, range) {
+    const semverRange = parseRangeLoose(range);
+    if (semverRange == null)
+        return false;
+    const parsedVersion = parseSemverLoose(version);
+    return parsedVersion != null && semverRange.test(parsedVersion);
+}
+// semver's own maxSatisfying/minSatisfying re-parse the range and every
+// version string on each call, which dominates resolution time on large
+// packuments; these reuse the parse caches instead.
+function maxSatisfyingLoose(versions, range) {
+    return findSatisfyingLoose(versions, range, (candidate, best) => candidate.compare(best) > 0);
+}
+function minSatisfyingLoose(versions, range) {
+    return findSatisfyingLoose(versions, range, (candidate, best) => candidate.compare(best) < 0);
+}
+function findSatisfyingLoose(versions, range, isBetter) {
+    const semverRange = parseRangeLoose(range);
+    if (semverRange == null)
+        return null;
+    let bestVersion = null;
+    let bestParsed = null;
+    for (const version of versions) {
+        const parsed = parseSemverLoose(version);
+        if (parsed == null || !semverRange.test(parsed))
+            continue;
+        if (bestParsed == null || isBetter(parsed, bestParsed)) {
+            bestVersion = version;
+            bestParsed = parsed;
+        }
+    }
+    return bestVersion;
+}
+function parseRangeLoose(range) {
+    let semverRange = semverRangeCache.get(range);
+    if (semverRange === undefined) {
+        try {
+            semverRange = new semver.Range(range, true);
+        }
+        catch {
+            semverRange = null;
+        }
+        if (semverRangeCache.size >= SEMVER_CACHE_MAX_SIZE)
+            semverRangeCache.clear();
+        semverRangeCache.set(range, semverRange);
+    }
+    return semverRange;
+}
+function parseSemverLoose(version) {
+    let parsed = semverInstanceCache.get(version);
+    if (parsed === undefined) {
+        try {
+            parsed = new semver.SemVer(version, true);
+        }
+        catch {
+            parsed = null;
+        }
+        if (semverInstanceCache.size >= SEMVER_CACHE_MAX_SIZE)
+            semverInstanceCache.clear();
+        semverInstanceCache.set(version, parsed);
+    }
+    return parsed;
+}
+// Working with string-ish semver causes lots of allocations and repeated
+// work, and a dependency graph tests the same ranges and versions over and
+// over, so both parses are cached. Parse failures are cached as null, so a
+// malformed version string is never re-parsed either. The caches are dropped
+// wholesale once they grow past this size, so a long-lived process (daemon,
+// store server) can't retain them without bound.
+const SEMVER_CACHE_MAX_SIZE = 50_000;
+const semverRangeCache = new Map();
+const semverInstanceCache = new Map();
 //# sourceMappingURL=pickPackageFromMeta.js.map

package/lib/violationCodes.d.ts

@@ -12,3 +12,4 @@ export declare const MINIMUM_RELEASE_AGE_VIOLATION_CODE = "MINIMUM_RELEASE_AGE_V
 export declare const TRUST_DOWNGRADE_VIOLATION_CODE = "TRUST_DOWNGRADE";
 export declare const TARBALL_URL_MISMATCH_VIOLATION_CODE = "TARBALL_URL_MISMATCH";
 export declare const MISSING_TARBALL_INTEGRITY_VIOLATION_CODE = "MISSING_TARBALL_INTEGRITY";
+export declare const MISSING_NAMED_REGISTRY_VIOLATION_CODE = "MISSING_NAMED_REGISTRY";

package/lib/violationCodes.js

@@ -12,4 +12,5 @@ export const MINIMUM_RELEASE_AGE_VIOLATION_CODE = 'MINIMUM_RELEASE_AGE_VIOLATION
 export const TRUST_DOWNGRADE_VIOLATION_CODE = 'TRUST_DOWNGRADE';
 export const TARBALL_URL_MISMATCH_VIOLATION_CODE = 'TARBALL_URL_MISMATCH';
 export const MISSING_TARBALL_INTEGRITY_VIOLATION_CODE = 'MISSING_TARBALL_INTEGRITY';
+export const MISSING_NAMED_REGISTRY_VIOLATION_CODE = 'MISSING_NAMED_REGISTRY';
 //# sourceMappingURL=violationCodes.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1103.0.0",
+  "version": "1103.2.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -29,22 +29,24 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/config.pick-registry-for-package": "1100.0.14",
-    "@pnpm/config.version-policy": "1100.1.11",
-    "@pnpm/constants": "1100.0.1",
-    "@pnpm/core-loggers": "1100.3.1",
+    "@pnpm/config.normalize-registries": "1100.1.0",
+    "@pnpm/config.pick-registry-for-package": "1100.1.0",
+    "@pnpm/config.version-policy": "1100.1.12",
+    "@pnpm/constants": "1101.0.0",
+    "@pnpm/core-loggers": "1100.3.2",
     "@pnpm/crypto.hash": "1100.0.2",
-    "@pnpm/error": "1100.1.0",
+    "@pnpm/deps.path": "1100.1.0",
+    "@pnpm/error": "1100.1.1",
     "@pnpm/fetching.types": "1100.0.3",
     "@pnpm/fs.graceful-fs": "1100.1.1",
-    "@pnpm/pkg-manifest.utils": "1100.3.0",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.3",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.14",
-    "@pnpm/resolving.registry.types": "1100.1.8",
-    "@pnpm/resolving.resolver-base": "1101.0.0",
-    "@pnpm/store.cafs": "1100.1.17",
-    "@pnpm/store.index": "1100.2.2",
-    "@pnpm/types": "1101.8.0",
+    "@pnpm/pkg-manifest.utils": "1100.3.1",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.4",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.16",
+    "@pnpm/resolving.registry.types": "1100.1.9",
+    "@pnpm/resolving.resolver-base": "1101.1.0",
+    "@pnpm/store.cafs": "1100.1.18",
+    "@pnpm/store.index": "1100.2.3",
+    "@pnpm/types": "1101.9.0",
     "@pnpm/workspace.range-resolver": "1100.0.3",
     "@pnpm/workspace.spec-parser": "1100.0.1",
     "@zkochan/retry": "^0.2.0",
@@ -64,18 +66,18 @@
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.9"
+    "@pnpm/worker": "^1100.2.10"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.10",
-    "@pnpm/resolving.npm-resolver": "1103.0.0",
+    "@pnpm/network.fetch": "1100.1.11",
+    "@pnpm/resolving.npm-resolver": "1103.2.0",
     "@pnpm/test-fixtures": "1100.0.1",
     "@pnpm/testing.mock-agent": "1101.0.7",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.32.0",
-    "@types/semver": "7.7.1",
+    "@types/semver": "7.8.0",
     "@types/ssri": "^7.1.5",
     "@types/validate-npm-package-name": "^4.0.2",
     "load-json-file": "^7.0.1",