@pnpm/workspace.workspace-manifest-writer 1100.1.2 → 1100.2.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @pnpm/workspace.manifest-writer
 
+## 1100.2.0
+
+### Minor Changes
+
+- Added a new setting `trustPolicyExcludePrune` (default: `false`). When enabled, `pnpm add`, `pnpm update`, and `pnpm remove` prune the entries of `trustPolicyExclude` in `pnpm-workspace.yaml` that the freshly written lockfile no longer resolves: versions that are gone are dropped (an entry is removed once none of its versions remain), and entries for packages that are no longer in the lockfile are removed too. Name patterns (`@scope/*`) are always kept. The cleanup is skipped when the install's lockfile does not cover the whole workspace (`sharedWorkspaceLockfile: false`), since entries another project still needs would look stale.
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/building.policy@1100.1.1
+
+## 1100.1.3
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/building.policy@1100.1.0
+  - @pnpm/config.parse-overrides@1100.1.5
+  - @pnpm/config.version-policy@1100.2.3
+  - @pnpm/lockfile.types@1100.1.1
+  - @pnpm/workspace.workspace-manifest-reader@1100.1.9
+
 ## 1100.1.2
 
 ### Patch Changes

package/lib/index.d.ts

@@ -22,11 +22,12 @@ export declare function updateWorkspaceManifest(dir: string, opts: {
     /**
      * Package name → the versions the freshly resolved lockfile records.
      * Supplied when a freshly resolved shared lockfile is available.
-     * `minimumReleaseAgeExcludePrune` gates only minimum-release-age cleanup;
-     * `allowBuilds` cleanup runs whenever this map is present.
+     * `minimumReleaseAgeExcludePrune` and `trustPolicyExcludePrune` gate their
+     * cleanups; `allowBuilds` cleanup runs whenever this map is present.
      */
     resolvedPackageVersions?: ReadonlyMap<string, ReadonlySet<string>>;
     minimumReleaseAgeExcludePrune?: boolean;
+    trustPolicyExcludePrune?: boolean;
 }): Promise<void>;
 export interface NewCatalogs {
     [catalogName: string]: {

package/lib/index.js

@@ -83,7 +83,10 @@ export async function updateWorkspaceManifest(dir, opts) {
     }
     if (opts.resolvedPackageVersions != null) {
         if (opts.minimumReleaseAgeExcludePrune) {
-            shouldBeUpdated = pruneMinimumReleaseAgeExcludes(manifest, opts.resolvedPackageVersions) || shouldBeUpdated;
+            shouldBeUpdated = pruneExcludeList(manifest, 'minimumReleaseAgeExclude', opts.resolvedPackageVersions) || shouldBeUpdated;
+        }
+        if (opts.trustPolicyExcludePrune) {
+            shouldBeUpdated = pruneExcludeList(manifest, 'trustPolicyExclude', opts.resolvedPackageVersions) || shouldBeUpdated;
         }
         shouldBeUpdated = pruneAllowBuilds(manifest, opts.resolvedPackageVersions) || shouldBeUpdated;
     }
@@ -220,63 +223,15 @@ function addPackageReference(packageReferences, pkgName, version) {
     }
     packageReferences[pkgName].add(version);
 }
-// The `minimumReleaseAgeExcludePrune` pass. An entry is dropped when the
-// freshly resolved lockfile no longer contains what it names: exact versions
-// that were not resolved are dropped (the entry goes away once none remain),
-// and a bare-name entry goes away when the package is absent entirely. Glob
-// patterns always stay — they are forward-looking and can't be proven stale.
-// Entries that fail to parse stay untouched so cleanup never breaks an
-// install.
-/**
- * Set the audit ignore list to `ghsas` (the complete desired list) in
- * whichever spelling the manifest uses — the canonical `audit.ignore` wins
- * over the deprecated `auditConfig.ignoreGhsas`, matching the reader's
- * precedence, so a stale canonical list can't shadow the update on the next
- * read. When both spellings are present, the shadowed deprecated list is
- * removed as part of the write. `auditConfig.ignoreGhsas` is created when
- * neither is present. An empty `ghsas` removes the list, dropping its parent
- * block when nothing else remains in it. Returns whether anything changed.
- */
-function setAuditIgnoreGhsas(manifest, ghsas) {
-    let changed = false;
-    if (manifest.audit?.ignore != null) {
-        if (ghsas.length === 0) {
-            delete manifest.audit.ignore;
-            if (Object.keys(manifest.audit).length === 0) {
-                delete manifest.audit;
-            }
-            changed = true;
-        }
-        else if (!equals(manifest.audit.ignore, ghsas)) {
-            manifest.audit.ignore = ghsas;
-            changed = true;
-        }
-        if (manifest.auditConfig?.ignoreGhsas != null) {
-            changed = removeAuditConfigIgnoreGhsas(manifest) || changed;
-        }
-        return changed;
-    }
-    if (ghsas.length === 0) {
-        return removeAuditConfigIgnoreGhsas(manifest);
-    }
-    if (equals(manifest.auditConfig?.ignoreGhsas, ghsas)) {
-        return false;
-    }
-    manifest.auditConfig = { ...manifest.auditConfig, ignoreGhsas: ghsas };
-    return true;
-}
-function removeAuditConfigIgnoreGhsas(manifest) {
-    if (manifest.auditConfig?.ignoreGhsas == null) {
-        return false;
-    }
-    delete manifest.auditConfig.ignoreGhsas;
-    if (Object.keys(manifest.auditConfig).length === 0) {
-        delete manifest.auditConfig;
-    }
-    return true;
-}
-function pruneMinimumReleaseAgeExcludes(manifest, resolvedPackageVersions) {
-    const excludes = manifest.minimumReleaseAgeExclude;
+// The `minimumReleaseAgeExcludePrune` / `trustPolicyExcludePrune` pass over
+// the exclude list `field` names. An entry is dropped when the freshly
+// resolved lockfile no longer contains what it names: exact versions that
+// were not resolved are dropped (the entry goes away once none remain), and a
+// bare-name entry goes away when the package is absent entirely. Glob patterns
+// always stay — they are forward-looking and can't be proven stale. Entries
+// that fail to parse stay untouched so cleanup never breaks an install.
+function pruneExcludeList(manifest, field, resolvedPackageVersions) {
+    const excludes = manifest[field];
     if (excludes == null || excludes.length === 0) {
         return false;
     }
@@ -320,10 +275,58 @@ function pruneMinimumReleaseAgeExcludes(manifest, resolvedPackageVersions) {
         return false;
     }
     if (survivingSpecs.length === 0) {
-        delete manifest.minimumReleaseAgeExclude;
+        delete manifest[field];
     }
     else {
-        manifest.minimumReleaseAgeExclude = survivingSpecs;
+        manifest[field] = survivingSpecs;
+    }
+    return true;
+}
+/**
+ * Set the audit ignore list to `ghsas` (the complete desired list) in
+ * whichever spelling the manifest uses — the canonical `audit.ignore` wins
+ * over the deprecated `auditConfig.ignoreGhsas`, matching the reader's
+ * precedence, so a stale canonical list can't shadow the update on the next
+ * read. When both spellings are present, the shadowed deprecated list is
+ * removed as part of the write. `auditConfig.ignoreGhsas` is created when
+ * neither is present. An empty `ghsas` removes the list, dropping its parent
+ * block when nothing else remains in it. Returns whether anything changed.
+ */
+function setAuditIgnoreGhsas(manifest, ghsas) {
+    let changed = false;
+    if (manifest.audit?.ignore != null) {
+        if (ghsas.length === 0) {
+            delete manifest.audit.ignore;
+            if (Object.keys(manifest.audit).length === 0) {
+                delete manifest.audit;
+            }
+            changed = true;
+        }
+        else if (!equals(manifest.audit.ignore, ghsas)) {
+            manifest.audit.ignore = ghsas;
+            changed = true;
+        }
+        if (manifest.auditConfig?.ignoreGhsas != null) {
+            changed = removeAuditConfigIgnoreGhsas(manifest) || changed;
+        }
+        return changed;
+    }
+    if (ghsas.length === 0) {
+        return removeAuditConfigIgnoreGhsas(manifest);
+    }
+    if (equals(manifest.auditConfig?.ignoreGhsas, ghsas)) {
+        return false;
+    }
+    manifest.auditConfig = { ...manifest.auditConfig, ignoreGhsas: ghsas };
+    return true;
+}
+function removeAuditConfigIgnoreGhsas(manifest) {
+    if (manifest.auditConfig?.ignoreGhsas == null) {
+        return false;
+    }
+    delete manifest.auditConfig.ignoreGhsas;
+    if (Object.keys(manifest.auditConfig).length === 0) {
+        delete manifest.auditConfig;
     }
     return true;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/workspace.workspace-manifest-writer",
-  "version": "1100.1.2",
+  "version": "1100.2.0",
   "description": "Updates the workspace manifest file",
   "keywords": [
     "pnpm",
@@ -27,15 +27,15 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/building.policy": "1100.0.21",
+    "@pnpm/building.policy": "1100.1.1",
     "@pnpm/catalogs.types": "1100.0.1",
-    "@pnpm/config.parse-overrides": "1100.1.4",
-    "@pnpm/config.version-policy": "1100.2.2",
+    "@pnpm/config.parse-overrides": "1100.1.5",
+    "@pnpm/config.version-policy": "1100.2.3",
     "@pnpm/constants": "1102.0.0",
-    "@pnpm/lockfile.types": "1100.1.0",
+    "@pnpm/lockfile.types": "1100.1.1",
     "@pnpm/text.ordinal-comparator": "1100.0.0",
     "@pnpm/types": "1102.1.0",
-    "@pnpm/workspace.workspace-manifest-reader": "1100.1.8",
+    "@pnpm/workspace.workspace-manifest-reader": "1100.1.9",
     "@pnpm/yaml.document-sync": "1100.0.1",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "write-file-atomic": "^7.0.1",
@@ -43,10 +43,10 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/prepare": "1100.0.28",
+    "@pnpm/prepare": "1100.0.30",
     "@pnpm/prepare-temp-dir": "1100.0.1",
-    "@pnpm/workspace.projects-reader": "1101.0.25",
-    "@pnpm/workspace.workspace-manifest-writer": "1100.1.2",
+    "@pnpm/workspace.projects-reader": "1101.0.27",
+    "@pnpm/workspace.workspace-manifest-writer": "1100.2.0",
     "@types/ramda": "0.32.0",
     "@types/write-file-atomic": "^4.0.3",
     "read-yaml-file": "^3.0.0",