@rushstack/rush-sdk 5.160.0 → 5.161.0

package/dist/rush-lib.d.ts

@@ -301,6 +301,7 @@ export declare class CommonVersionsConfiguration {
     private _preferredVersions;
     private _allowedAlternativeVersions;
     private _modified;
+    private _commonVersionsJsonHasEnsureConsistentVersionsProperty;
     /**
      * Get the absolute file path of the common-versions.json file.
      */
@@ -2282,6 +2283,14 @@ export declare interface _IPnpmOptionsJson extends IPackageManagerOptionsJsonBas
      * {@inheritDoc PnpmOptionsConfiguration.autoInstallPeers}
      */
     autoInstallPeers?: boolean;
+    /**
+     * {@inheritDoc PnpmOptionsConfiguration.minimumReleaseAge}
+     */
+    minimumReleaseAge?: number;
+    /**
+     * {@inheritDoc PnpmOptionsConfiguration.minimumReleaseAgeExclude}
+     */
+    minimumReleaseAgeExclude?: string[];
     /**
      * {@inheritDoc PnpmOptionsConfiguration.alwaysInjectDependenciesFromOtherSubspaces}
      */
@@ -3419,6 +3428,31 @@ export declare class PnpmOptionsConfiguration extends PackageManagerOptionsConfi
      * The default value is same as PNPM default value.  (In PNPM 8.x, this value is true)
      */
     readonly autoInstallPeers: boolean | undefined;
+    /**
+     * The minimum number of minutes that must pass after a version is published before pnpm will install it.
+     * This setting helps reduce the risk of installing compromised packages, as malicious releases are typically
+     * discovered and removed within a short time frame.
+     *
+     * @remarks
+     * (SUPPORTED ONLY IN PNPM 10.16.0 AND NEWER)
+     *
+     * PNPM documentation: https://pnpm.io/settings#minimumreleaseage
+     *
+     * The default value is 0 (disabled).
+     */
+    readonly minimumReleaseAge: number | undefined;
+    /**
+     * List of package names or patterns that are excluded from the minimumReleaseAge check.
+     * These packages will always install the newest version immediately, even if minimumReleaseAge is set.
+     *
+     * @remarks
+     * (SUPPORTED ONLY IN PNPM 10.16.0 AND NEWER)
+     *
+     * PNPM documentation: https://pnpm.io/settings#minimumreleaseageexclude
+     *
+     * Example: ["webpack", "react", "\@myorg/*"]
+     */
+    readonly minimumReleaseAgeExclude: string[] | undefined;
     /**
      * If true, then `rush update` add injected install options for all cross-subspace
      * workspace dependencies, to avoid subspace doppelganger issue.

package/dist/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.52.15"
+      "packageVersion": "7.53.1"
     }
   ]
 }

package/lib/api/CommandLineJson.d.ts

@@ -19,6 +19,7 @@ export interface IBaseCommandJson {
 export interface IBulkCommandJson extends IBaseCommandJson {
     commandKind: 'bulk';
     enableParallelism: boolean;
+    allowOversubscription?: boolean;
     ignoreDependencyOrder?: boolean;
     ignoreMissingScript?: boolean;
     incremental?: boolean;
@@ -33,6 +34,7 @@ export interface IBulkCommandJson extends IBaseCommandJson {
 export interface IPhasedCommandWithoutPhasesJson extends IBaseCommandJson {
     commandKind: 'phased';
     enableParallelism: boolean;
+    allowOversubscription?: boolean;
     incremental?: boolean;
 }
 /**

package/lib/api/CommonVersionsConfiguration.d.ts

@@ -29,6 +29,7 @@ export declare class CommonVersionsConfiguration {
     private _preferredVersions;
     private _allowedAlternativeVersions;
     private _modified;
+    private _commonVersionsJsonHasEnsureConsistentVersionsProperty;
     /**
      * Get the absolute file path of the common-versions.json file.
      */

package/lib/cli/actions/AddAction.d.ts

@@ -1,16 +1,13 @@
-import type { CommandLineFlagParameter, CommandLineStringListParameter } from '@rushstack/ts-command-line';
 import { BaseAddAndRemoveAction } from './BaseAddAndRemoveAction';
 import type { RushCommandLineParser } from '../RushCommandLineParser';
 import { type IPackageJsonUpdaterRushAddOptions } from '../../logic/PackageJsonUpdaterTypes';
+export declare const MAKE_CONSISTENT_FLAG_NAME: '--make-consistent';
 export declare class AddAction extends BaseAddAndRemoveAction {
-    protected readonly _allFlag: CommandLineFlagParameter;
-    protected readonly _packageNameList: CommandLineStringListParameter;
     private readonly _exactFlag;
     private readonly _caretFlag;
     private readonly _devDependencyFlag;
     private readonly _peerDependencyFlag;
     private readonly _makeConsistentFlag;
-    private readonly _variantParameter;
     constructor(parser: RushCommandLineParser);
     getUpdateOptionsAsync(): Promise<IPackageJsonUpdaterRushAddOptions>;
 }

package/lib/cli/actions/BaseAddAndRemoveAction.d.ts

@@ -1,7 +1,8 @@
-import type { CommandLineFlagParameter, CommandLineStringListParameter } from '@rushstack/ts-command-line';
+import type { CommandLineFlagParameter, CommandLineStringListParameter, CommandLineStringParameter } from '@rushstack/ts-command-line';
 import { BaseRushAction, type IBaseRushActionOptions } from './BaseRushAction';
 import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
 import type { IPackageForRushUpdate, IPackageJsonUpdaterRushBaseUpdateOptions } from '../../logic/PackageJsonUpdaterTypes';
+export declare const PACKAGE_PARAMETER_NAME: '--package';
 export interface IBasePackageJsonUpdaterRushOptions {
     /**
      * The projects whose package.jsons should get updated
@@ -20,15 +21,20 @@ export interface IBasePackageJsonUpdaterRushOptions {
      */
     debugInstall: boolean;
 }
+export interface IBaseAddAndRemoveActionOptions extends IBaseRushActionOptions {
+    allFlagDescription: string;
+    packageNameListParameterDescription: string;
+}
 /**
  * This is the common base class for AddAction and RemoveAction.
  */
 export declare abstract class BaseAddAndRemoveAction extends BaseRushAction {
-    protected abstract readonly _allFlag: CommandLineFlagParameter;
     protected readonly _skipUpdateFlag: CommandLineFlagParameter;
-    protected abstract readonly _packageNameList: CommandLineStringListParameter;
+    protected readonly _packageNameListParameter: CommandLineStringListParameter;
+    protected readonly _allFlag: CommandLineFlagParameter;
+    protected readonly _variantParameter: CommandLineStringParameter;
     protected get specifiedPackageNameList(): readonly string[];
-    constructor(options: IBaseRushActionOptions);
+    constructor(options: IBaseAddAndRemoveActionOptions);
     protected abstract getUpdateOptionsAsync(): Promise<IPackageJsonUpdaterRushBaseUpdateOptions>;
     protected getProjects(): RushConfigurationProject[];
     runAsync(): Promise<void>;

package/lib/cli/actions/RemoveAction.d.ts

@@ -1,11 +1,7 @@
-import type { CommandLineFlagParameter, CommandLineStringListParameter } from '@rushstack/ts-command-line';
 import { BaseAddAndRemoveAction } from './BaseAddAndRemoveAction';
 import type { RushCommandLineParser } from '../RushCommandLineParser';
 import type { IPackageJsonUpdaterRushRemoveOptions } from '../../logic/PackageJsonUpdaterTypes';
 export declare class RemoveAction extends BaseAddAndRemoveAction {
-    protected readonly _allFlag: CommandLineFlagParameter;
-    protected readonly _packageNameList: CommandLineStringListParameter;
-    private readonly _variantParameter;
     constructor(parser: RushCommandLineParser);
     getUpdateOptionsAsync(): Promise<IPackageJsonUpdaterRushRemoveOptions>;
 }

package/lib/cli/scriptActions/PhasedScriptAction.d.ts

@@ -7,6 +7,7 @@ import type { IPhase, IPhasedCommandConfig } from '../../api/CommandLineConfigur
  */
 export interface IPhasedScriptActionOptions extends IBaseScriptActionOptions<IPhasedCommandConfig> {
     enableParallelism: boolean;
+    allowOversubscription: boolean;
     incremental: boolean;
     disableBuildCache: boolean;
     originalPhases: Set<IPhase>;
@@ -34,6 +35,7 @@ export declare class PhasedScriptAction extends BaseScriptAction<IPhasedCommandC
     readonly hooks: PhasedCommandHooks;
     readonly sessionAbortController: AbortController;
     private readonly _enableParallelism;
+    private readonly _allowOversubscription;
     private readonly _isIncrementalBuildAllowed;
     private readonly _disableBuildCache;
     private readonly _originalPhases;

package/lib/logic/operations/OperationExecutionManager.d.ts

@@ -9,6 +9,7 @@ export interface IOperationExecutionManagerOptions {
     quietMode: boolean;
     debugMode: boolean;
     parallelism: number;
+    allowOversubscription: boolean;
     inputsSnapshot?: IInputsSnapshot;
     destination?: TerminalWritable;
     beforeExecuteOperationAsync?: (operation: OperationExecutionRecord) => Promise<OperationStatus | undefined>;
@@ -27,6 +28,7 @@ export declare class OperationExecutionManager {
     private readonly _executionRecords;
     private readonly _quietMode;
     private readonly _parallelism;
+    private readonly _allowOversubscription;
     private readonly _totalOperations;
     private readonly _outputWritable;
     private readonly _colorsNewlinesTransform;

package/lib/logic/pnpm/PnpmOptionsConfiguration.d.ts

@@ -118,6 +118,14 @@ export interface IPnpmOptionsJson extends IPackageManagerOptionsJsonBase {
      * {@inheritDoc PnpmOptionsConfiguration.autoInstallPeers}
      */
     autoInstallPeers?: boolean;
+    /**
+     * {@inheritDoc PnpmOptionsConfiguration.minimumReleaseAge}
+     */
+    minimumReleaseAge?: number;
+    /**
+     * {@inheritDoc PnpmOptionsConfiguration.minimumReleaseAgeExclude}
+     */
+    minimumReleaseAgeExclude?: string[];
     /**
      * {@inheritDoc PnpmOptionsConfiguration.alwaysInjectDependenciesFromOtherSubspaces}
      */
@@ -229,6 +237,31 @@ export declare class PnpmOptionsConfiguration extends PackageManagerOptionsConfi
      * The default value is same as PNPM default value.  (In PNPM 8.x, this value is true)
      */
     readonly autoInstallPeers: boolean | undefined;
+    /**
+     * The minimum number of minutes that must pass after a version is published before pnpm will install it.
+     * This setting helps reduce the risk of installing compromised packages, as malicious releases are typically
+     * discovered and removed within a short time frame.
+     *
+     * @remarks
+     * (SUPPORTED ONLY IN PNPM 10.16.0 AND NEWER)
+     *
+     * PNPM documentation: https://pnpm.io/settings#minimumreleaseage
+     *
+     * The default value is 0 (disabled).
+     */
+    readonly minimumReleaseAge: number | undefined;
+    /**
+     * List of package names or patterns that are excluded from the minimumReleaseAge check.
+     * These packages will always install the newest version immediately, even if minimumReleaseAge is set.
+     *
+     * @remarks
+     * (SUPPORTED ONLY IN PNPM 10.16.0 AND NEWER)
+     *
+     * PNPM documentation: https://pnpm.io/settings#minimumreleaseageexclude
+     *
+     * Example: ["webpack", "react", "\@myorg/*"]
+     */
+    readonly minimumReleaseAgeExclude: string[] | undefined;
     /**
      * If true, then `rush update` add injected install options for all cross-subspace
      * workspace dependencies, to avoid subspace doppelganger issue.

package/lib/utilities/Utilities.d.ts

@@ -87,6 +87,12 @@ export interface IEnvironmentPathOptions {
 export interface IDisposable {
     dispose(): void;
 }
+type OptionalKeys<T> = {
+    [K in keyof T]-?: {} extends Pick<T, K> ? K : never;
+}[keyof T];
+export type OptionalToUndefined<T> = Omit<T, OptionalKeys<T>> & {
+    [K in OptionalKeys<T>]-?: Exclude<T[K], undefined> | undefined;
+};
 export declare class Utilities {
     static syncNpmrc: typeof syncNpmrc;
     private static _homeFolder;
@@ -193,4 +199,5 @@ export declare class Utilities {
     private static _executeCommandInternalAsync;
     private static _processResult;
 }
+export {};
 //# sourceMappingURL=Utilities.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rushstack/rush-sdk",
-  "version": "5.160.0",
+  "version": "5.161.0",
   "description": "An API for interacting with the Rush engine",
   "repository": {
     "type": "git",
@@ -36,23 +36,23 @@
   "dependencies": {
     "@pnpm/lockfile.types": "~1.0.3",
     "tapable": "2.2.1",
-    "@rushstack/lookup-by-path": "0.8.2",
-    "@rushstack/node-core-library": "5.16.0",
-    "@rushstack/package-deps-hash": "4.5.0",
-    "@rushstack/terminal": "0.19.0"
+    "@rushstack/node-core-library": "5.17.0",
+    "@rushstack/lookup-by-path": "0.8.3",
+    "@rushstack/package-deps-hash": "4.5.1",
+    "@rushstack/terminal": "0.19.1"
   },
   "devDependencies": {
     "@types/semver": "7.5.0",
     "@types/webpack-env": "1.18.8",
-    "eslint": "~9.25.1",
+    "eslint": "~9.37.0",
     "webpack": "~5.98.0",
-    "@rushstack/heft-webpack5-plugin": "1.1.0",
-    "@microsoft/rush-lib": "5.160.0",
-    "@rushstack/heft": "1.1.0",
-    "@rushstack/webpack-preserve-dynamic-require-plugin": "0.11.111",
-    "@rushstack/ts-command-line": "5.1.0",
+    "@microsoft/rush-lib": "5.161.0",
+    "@rushstack/heft": "1.1.1",
+    "@rushstack/heft-webpack5-plugin": "1.2.1",
+    "@rushstack/ts-command-line": "5.1.1",
     "local-node-rig": "1.0.0",
-    "@rushstack/stream-collator": "4.1.112"
+    "@rushstack/webpack-preserve-dynamic-require-plugin": "0.11.112",
+    "@rushstack/stream-collator": "4.1.113"
   },
   "scripts": {
     "build": "heft build --clean",