@pnpm/resolving.npm-resolver 1103.1.0 → 1103.2.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @pnpm/npm-resolver
 
+## 1103.2.0
+
+### Minor Changes
+
+- Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same `ERR_PNPM_NO_OFFLINE_META` condition used by offline resolution.
+
+### Patch Changes
+
+- The held-back-update warning printed by `pnpm update` no longer fires when `minimumReleaseAge` is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See pnpm/pnpm#13071.
+
+- Updated dependencies:
+  - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.16
+
 ## 1103.1.0
 
 ### Minor Changes

package/lib/createNpmResolutionVerifier.d.ts

@@ -58,6 +58,11 @@ export interface CreateNpmResolutionVerifierOptions {
     fetchOpts: FetchMetadataFromFromRegistryOptions;
     getAuthHeaderValueByURI: GetAuthHeader;
     cacheDir?: FetchFullMetadataCachedOptions['cacheDir'];
+    /**
+     * When true, verifier metadata lookups must use the local mirror
+     * only and never reach the registry or attestation endpoint.
+     */
+    offline?: boolean;
     /**
      * Per-install LRU shared with the npm resolver's `pickPackage`
      * (`{ get, set }` over `PackageMeta`). When provided, the verifier

package/lib/createNpmResolutionVerifier.js

@@ -53,6 +53,7 @@ export function createNpmResolutionVerifier(opts) {
         fetchOpts: opts.fetchOpts,
         getAuthHeaderValueByURI: opts.getAuthHeaderValueByURI,
         cacheDir: opts.cacheDir,
+        offline: opts.offline === true,
         cutoffMs: cutoff,
         sharedMetaCache: opts.metaCache,
         abbreviatedMetaCache: new Map(),
@@ -391,6 +392,7 @@ function fetchFullMetaForTrust(context, registry, name) {
                 registry,
                 authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
                 cacheDir: context.cacheDir,
+                offline: context.offline,
             }).then(projectTrustMeta);
         }
         context.fullMetaForTrustCache.set(cacheKey, cachedPromise);
@@ -485,12 +487,14 @@ async function resolvePublishedAt(context, registry, name, version) {
     const localTime = await readLocalMetaTime(context, registry, name);
     if (localTime?.[version])
         return localTime[version];
-    const attestationTime = await fetchAttestationPublishedAt(context.fetchOpts, name, version, {
-        registry,
-        authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
-    });
-    if (attestationTime != null)
-        return attestationTime;
+    if (!context.offline) {
+        const attestationTime = await fetchAttestationPublishedAt(context.fetchOpts, name, version, {
+            registry,
+            authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
+        });
+        if (attestationTime != null)
+            return attestationTime;
+    }
     const fullMetaTime = await fetchFullMetaTime(context, registry, name);
     return fullMetaTime?.[version];
 }
@@ -555,6 +559,7 @@ function fetchAbbreviatedMeta(context, registry, name) {
                 registry,
                 authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
                 cacheDir: context.cacheDir,
+                offline: context.offline,
             }).then((meta) => ({ meta: projectAbbreviatedMeta(meta) }), (error) => ({ error }));
         }
         context.abbreviatedMetaCache.set(cacheKey, cachedPromise);
@@ -646,6 +651,7 @@ function fetchFullMetaTime(context, registry, name) {
             registry,
             authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
             cacheDir: context.cacheDir,
+            offline: context.offline,
         }).then((meta) => meta.time);
         context.fullMetaCache.set(cacheKey, cachedPromise);
     }

package/lib/fetchFullMetadataCached.d.ts

@@ -10,6 +10,10 @@ export interface FetchMetadataCachedOptions {
      * back. Omit to disable caching — every call re-fetches.
      */
     cacheDir?: string;
+    /**
+     * Use only pnpm's on-disk metadata mirror and never reach the registry.
+     */
+    offline?: boolean;
 }
 export type FetchFullMetadataCachedOptions = FetchMetadataCachedOptions;
 /**

package/lib/fetchFullMetadataCached.js

@@ -1,4 +1,5 @@
 import { ABBREVIATED_META_DIR, FULL_META_DIR } from '@pnpm/constants';
+import { PnpmError } from '@pnpm/error';
 import { fetchMetadataFromFromRegistry, } from './fetch.js';
 import { getPkgMirrorPath, loadMeta, loadMetaHeaders, prepareJsonForDisk, saveMeta } from './pickPackage.js';
 /**
@@ -28,6 +29,14 @@ async function fetchMetadataCached(fetchOpts, pkgName, opts) {
     const pkgMirror = opts.cacheDir != null
         ? getPkgMirrorPath(opts.cacheDir, opts.metaDir, opts.registry, pkgName)
         : null;
+    if (opts.offline === true) {
+        if (pkgMirror != null) {
+            const cached = await loadMeta(pkgMirror);
+            if (cached != null)
+                return cached;
+        }
+        throw new PnpmError('NO_OFFLINE_META', `Failed to resolve ${pkgName} in package mirror ${pkgMirror ?? ''}`);
+    }
     const cacheHeaders = pkgMirror != null ? await loadMetaHeaders(pkgMirror) : null;
     const conditional = await fetchMetadataFromFromRegistry(fetchOpts, pkgName, {
         registry: opts.registry,

package/lib/index.js

@@ -21,7 +21,7 @@ import { memoizeFetchMetadata } from './memoizeFetchMetadata.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
 import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, parseNamedRegistrySpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
 import { pickPackage, } from './pickPackage.js';
-import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
+import { applyPublishedByPolicy, pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
 import { MINIMUM_RELEASE_AGE_VIOLATION_CODE } from './violationCodes.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
@@ -212,7 +212,10 @@ function stripLockfileVersionPins(selectors) {
  * The baseline for "held back" is the pick with only the non-pin selectors
  * applied — `range`/`tag` selectors such as the `pnpm audit --fix`
  * vulnerability penalties steer the baseline too, so the warning never
- * recommends a version those selectors avoid.
+ * recommends a version those selectors avoid. The baseline also honors the
+ * `publishedBy` maturity cutoff the actual pick applied: a version blocked
+ * by `minimumReleaseAge` is not an update the manifests held back, and
+ * recommending an override for it would defeat the age gate.
  *
  * The recommended override is scoped to the declared range being resolved
  * (`name@<range>`), so applying it can never violate any consumer's range:
@@ -233,8 +236,14 @@ function warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedVersion) {
         nonPinSelectors ??= Object.create(null);
         nonPinSelectors[selector] = value;
     }
+    // `needsFullMetadata` is not this caller's problem: the pick already
+    // succeeded on this metadata, which for an abbreviated packument means
+    // every version cleared the cutoff, so `meta` is the filtered view.
+    const baselineMeta = opts.publishedBy != null
+        ? applyPublishedByPolicy(meta, opts.publishedBy, opts.publishedByExclude).meta
+        : meta;
     const preferred = pickVersionByVersionRange({
-        meta,
+        meta: baselineMeta,
         versionRange: spec.fetchSpec,
         preferredVersionSelectors: nonPinSelectors,
     });

package/lib/pickPackageFromMeta.d.ts

@@ -15,6 +15,29 @@ export interface PickPackageFromMetaOptions {
     publishedByExclude?: PackageVersionPolicy;
 }
 export declare function pickPackageFromMeta(pickVersionByVersionRangeFn: PickVersionByVersionRange, { preferredVersionSelectors, publishedBy, publishedByExclude, }: PickPackageFromMetaOptions, meta: PackageMeta, spec: RegistryPackageSpec): PackageInRegistry | null;
+export interface PublishedByView {
+    /** The metadata the cutoff leaves visible. `meta` itself when nothing is filtered out. */
+    meta: PackageMeta;
+    /**
+     * The cutoff could not be applied: the metadata is abbreviated, so there
+     * are no per-version timestamps to filter on. Whether that is fatal is the
+     * caller's call — the pick needs full metadata to honor the cutoff, while a
+     * caller reasoning about a pick that already succeeded knows the versions
+     * cleared the cutoff some other way.
+     */
+    needsFullMetadata: boolean;
+}
+/**
+ * Narrows `meta` to the versions the `publishedBy` cutoff admits, honoring
+ * `publishedByExclude`: a package the policy excludes wholesale keeps its
+ * unfiltered metadata, and versions the policy names explicitly stay in
+ * regardless of their age.
+ *
+ * Every consumer of the cutoff goes through here so they agree on what the
+ * policy admits — a baseline that filters differently from the pick would
+ * misreport why a version was chosen.
+ */
+export declare function applyPublishedByPolicy(meta: PackageMeta, publishedBy: Date, publishedByExclude?: PackageVersionPolicy): PublishedByView;
 export declare function assertMetaHasTime(meta: PackageMeta): asserts meta is PackageMetaWithTime;
 export declare function pickLowestVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;
 export declare function pickVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;

package/lib/pickPackageFromMeta.js

@@ -4,28 +4,20 @@ import { filterPkgMetadataByPublishDate } from '@pnpm/resolving.registry.pkg-met
 import semver from 'semver';
 export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVersionSelectors, publishedBy, publishedByExclude, }, meta, spec) {
     if (publishedBy) {
-        const excludeResult = publishedByExclude?.(meta.name) ?? false;
-        if (excludeResult !== true) {
-            if (meta.time != null) {
-                // Full metadata with per-version timestamps: filter normally
+        const view = applyPublishedByPolicy(meta, publishedBy, publishedByExclude);
+        meta = view.meta;
+        if (view.needsFullMetadata) {
+            const modifiedDate = parseModifiedDate(meta.modified);
+            if (modifiedDate == null || modifiedDate > publishedBy) {
+                // The package was modified after the cutoff (or carries no usable
+                // `modified`), so which of its versions are mature is unknowable
+                // from abbreviated metadata. The error tells the caller to refetch.
                 assertMetaHasTime(meta);
-                const trustedVersions = Array.isArray(excludeResult) ? excludeResult : undefined;
-                meta = filterPkgMetadataByPublishDate(meta, publishedBy, trustedVersions);
-            }
-            else {
-                const modifiedDate = parseModifiedDate(meta.modified);
-                if (modifiedDate == null || modifiedDate > publishedBy) {
-                    // Abbreviated metadata without per-version timestamps, and the package
-                    // was recently modified (or has no/invalid modified field). We cannot determine
-                    // which individual versions are mature enough — need full metadata.
-                    assertMetaHasTime(meta);
-                }
-                // else: meta.modified <= publishedBy — every version was published at or
-                // before the cutoff (modified is an upper bound on per-version time), so
-                // they all pass the per-version `<=` maturity filter and no filtering is
-                // needed. Inclusive at the boundary on purpose so this branch matches the
-                // per-version filter in `filterPkgMetadataByPublishDate`.
             }
+            // else: `modified` is an upper bound on every per-version timestamp, so
+            // `modified <= publishedBy` means they all pass the maturity filter and
+            // nothing would be dropped. Inclusive at the boundary on purpose, to
+            // match the per-version `<=` in `filterPkgMetadataByPublishDate`.
         }
     }
     if ((!meta.versions || Object.keys(meta.versions).length === 0) && !publishedBy) {
@@ -77,6 +69,29 @@ export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVers
         throw new PnpmError('MALFORMED_METADATA', `Received malformed metadata for "${spec.name}"`, { hint: 'This might mean that the package was unpublished from the registry', cause: err });
     }
 }
+/**
+ * Narrows `meta` to the versions the `publishedBy` cutoff admits, honoring
+ * `publishedByExclude`: a package the policy excludes wholesale keeps its
+ * unfiltered metadata, and versions the policy names explicitly stay in
+ * regardless of their age.
+ *
+ * Every consumer of the cutoff goes through here so they agree on what the
+ * policy admits — a baseline that filters differently from the pick would
+ * misreport why a version was chosen.
+ */
+export function applyPublishedByPolicy(meta, publishedBy, publishedByExclude) {
+    const excludeResult = publishedByExclude?.(meta.name) ?? false;
+    if (excludeResult === true)
+        return { meta, needsFullMetadata: false };
+    if (meta.time == null)
+        return { meta, needsFullMetadata: true };
+    assertMetaHasTime(meta);
+    const trustedVersions = Array.isArray(excludeResult) ? excludeResult : undefined;
+    return {
+        meta: filterPkgMetadataByPublishDate(meta, publishedBy, trustedVersions),
+        needsFullMetadata: false,
+    };
+}
 export function assertMetaHasTime(meta) {
     if (meta.time == null) {
         throw new PnpmError('MISSING_TIME', `The metadata of ${meta.name} is missing the "time" field`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1103.1.0",
+  "version": "1103.2.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -41,7 +41,7 @@
     "@pnpm/fs.graceful-fs": "1100.1.1",
     "@pnpm/pkg-manifest.utils": "1100.3.1",
     "@pnpm/resolving.jsr-specifier-parser": "1100.0.4",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.15",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.16",
     "@pnpm/resolving.registry.types": "1100.1.9",
     "@pnpm/resolving.resolver-base": "1101.1.0",
     "@pnpm/store.cafs": "1100.1.18",
@@ -72,12 +72,12 @@
     "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/network.fetch": "1100.1.11",
-    "@pnpm/resolving.npm-resolver": "1103.1.0",
+    "@pnpm/resolving.npm-resolver": "1103.2.0",
     "@pnpm/test-fixtures": "1100.0.1",
     "@pnpm/testing.mock-agent": "1101.0.7",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.32.0",
-    "@types/semver": "7.7.1",
+    "@types/semver": "7.8.0",
     "@types/ssri": "^7.1.5",
     "@types/validate-npm-package-name": "^4.0.2",
     "load-json-file": "^7.0.1",