pnpm 10.25.0 → 10.26.1

package/dist/node_modules/.modules.yaml

@@ -16,9 +16,9 @@ hoistedLocations:
   agent-base@7.1.4:
     - node_modules/agent-base
   ansi-regex@5.0.1:
-    - node_modules/strip-ansi-cjs/node_modules/ansi-regex
-    - node_modules/wrap-ansi-cjs/node_modules/ansi-regex
     - node_modules/string-width-cjs/node_modules/ansi-regex
+    - node_modules/wrap-ansi-cjs/node_modules/ansi-regex
+    - node_modules/strip-ansi-cjs/node_modules/ansi-regex
   ansi-regex@6.2.2:
     - node_modules/ansi-regex
   ansi-styles@4.3.0:
@@ -44,8 +44,8 @@ hoistedLocations:
   eastasianwidth@0.2.0:
     - node_modules/eastasianwidth
   emoji-regex@8.0.0:
-    - node_modules/wrap-ansi-cjs/node_modules/emoji-regex
     - node_modules/string-width-cjs/node_modules/emoji-regex
+    - node_modules/wrap-ansi-cjs/node_modules/emoji-regex
   emoji-regex@9.2.2:
     - node_modules/emoji-regex
   encoding@0.1.13:
@@ -103,8 +103,8 @@ hoistedLocations:
   minipass-sized@1.0.3:
     - node_modules/minipass-sized
   minipass@3.3.6:
-    - node_modules/minipass-flush/node_modules/minipass
     - node_modules/minipass-pipeline/node_modules/minipass
+    - node_modules/minipass-flush/node_modules/minipass
     - node_modules/minipass-sized/node_modules/minipass
   minipass@7.1.2:
     - node_modules/minipass
@@ -158,8 +158,8 @@ hoistedLocations:
   string-width@5.1.2:
     - node_modules/string-width
   strip-ansi@6.0.1:
-    - node_modules/wrap-ansi-cjs/node_modules/strip-ansi
     - node_modules/string-width-cjs/node_modules/strip-ansi
+    - node_modules/wrap-ansi-cjs/node_modules/strip-ansi
     - node_modules/strip-ansi-cjs
   strip-ansi@7.1.2:
     - node_modules/strip-ansi
@@ -182,8 +182,8 @@ hoistedLocations:
   wrap-ansi@8.1.0:
     - node_modules/wrap-ansi
   yallist@4.0.0:
-    - node_modules/minipass-flush/node_modules/yallist
     - node_modules/minipass-pipeline/node_modules/yallist
+    - node_modules/minipass-flush/node_modules/yallist
     - node_modules/minipass-sized/node_modules/yallist
   yallist@5.0.0:
     - node_modules/yallist
@@ -194,9 +194,9 @@ included:
 injectedDeps: {}
 layoutVersion: 5
 nodeLinker: hoisted
-packageManager: pnpm@10.19.0
+packageManager: pnpm@10.26.0
 pendingBuilds: []
-prunedAt: Mon, 08 Dec 2025 15:09:48 GMT
+prunedAt: Fri, 19 Dec 2025 01:15:55 GMT
 publicHoistPattern: []
 registries:
   '@jsr': https://npm.jsr.io/

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,5 +1,5 @@
 {
-  "lastValidatedTimestamp": 1765206588775,
+  "lastValidatedTimestamp": 1766106956005,
   "projects": {},
   "pnpmfiles": [],
   "settings": {

package/dist/pnpm.cjs

@@ -2972,7 +2972,7 @@ var require_lib4 = __commonJS({
     var load_json_file_1 = __importDefault2(require_load_json_file());
     var defaultManifest = {
       name: true ? "pnpm" : "pnpm",
-      version: true ? "10.25.0" : "0.0.0"
+      version: true ? "10.26.1" : "0.0.0"
     };
     var pkgJson;
     if (require.main == null) {
@@ -14654,7 +14654,8 @@ var require_dependencyBuildOptions = __commonJS({
       "dangerouslyAllowAllBuilds",
       "onlyBuiltDependencies",
       "onlyBuiltDependenciesFile",
-      "neverBuiltDependencies"
+      "neverBuiltDependencies",
+      "allowBuilds"
     ];
     var hasDependencyBuildOptions = (config) => exports2.DEPS_BUILD_CONFIG_KEYS.some((key) => config[key] != null);
     exports2.hasDependencyBuildOptions = hasDependencyBuildOptions;
@@ -15098,6 +15099,7 @@ var require_types2 = __commonJS({
       "public-hoist-pattern": Array,
       "publish-branch": String,
       "recursive-install": Boolean,
+      "block-exotic-subdeps": Boolean,
       reporter: String,
       "resolution-mode": ["highest", "time-based", "lowest-direct"],
       "resolve-peers-from-workspace-root": Boolean,
@@ -18817,6 +18819,7 @@ var require_getOptionsFromRootManifest = __commonJS({
       const settings = getOptionsFromPnpmSettings(manifestDir, {
         ...(0, pick_1.default)([
           "allowNonAppliedPatches",
+          "allowBuilds",
           "allowUnusedPatches",
           "allowedDeprecatedVersions",
           "auditConfig",
@@ -18849,7 +18852,7 @@ var require_getOptionsFromRootManifest = __commonJS({
       return settings;
     }
     function getOptionsFromPnpmSettings(manifestDir, pnpmSettings, manifest) {
-      const renamedKeys = ["allowNonAppliedPatches"];
+      const renamedKeys = ["allowNonAppliedPatches", "allowBuilds"];
       const settings = (0, omit_1.default)(renamedKeys, replaceEnvInSettings(pnpmSettings));
       if (settings.overrides) {
         if (Object.keys(settings.overrides).length === 0) {
@@ -18876,6 +18879,20 @@ var require_getOptionsFromRootManifest = __commonJS({
       if (pnpmSettings.ignorePatchFailures != null) {
         settings.ignorePatchFailures = pnpmSettings.ignorePatchFailures;
       }
+      if (pnpmSettings.allowBuilds) {
+        settings.onlyBuiltDependencies ??= [];
+        settings.ignoredBuiltDependencies ??= [];
+        for (const [packagePattern, build] of Object.entries(pnpmSettings.allowBuilds)) {
+          switch (build) {
+            case true:
+              settings.onlyBuiltDependencies.push(packagePattern);
+              break;
+            case false:
+              settings.ignoredBuiltDependencies.push(packagePattern);
+              break;
+          }
+        }
+      }
       return settings;
     }
     function replaceEnvInSettings(settings) {
@@ -19616,6 +19633,7 @@ var require_lib23 = __commonJS({
         "public-hoist-pattern": [],
         "recursive-install": true,
         registry: npmDefaults.registry,
+        "block-exotic-subdeps": false,
         "resolution-mode": "highest",
         "resolve-peers-from-workspace-root": true,
         "save-peer": false,
@@ -53795,6 +53813,7 @@ var require_lib33 = __commonJS({
     Object.defineProperty(exports2, "createGitHostedPkgId", { enumerable: true, get: function() {
       return createGitHostedPkgId_js_1.createGitHostedPkgId;
     } });
+    var error_1 = require_lib6();
     function createGitResolver(opts) {
       return async function resolveGit(wantedDependency) {
         const parsedSpec = await (0, parseBareSpecifier_js_1.parseBareSpecifier)(wantedDependency.bareSpecifier, opts);
@@ -53858,18 +53877,28 @@ var require_lib33 = __commonJS({
       return refs;
     }
     async function resolveRef(repo, ref, range) {
-      if (ref.match(/^[0-9a-f]{7,40}$/) != null) {
+      const committish = ref.match(/^[0-9a-f]{7,40}$/) !== null;
+      if (committish && ref.length === 40) {
         return ref;
       }
-      const refs = await getRepoRefs(repo, range ? null : ref);
-      return resolveRefFromRefs(refs, repo, ref, range);
+      const refs = await getRepoRefs(repo, range ?? committish ? null : ref);
+      const result2 = resolveRefFromRefs(refs, repo, ref, committish, range);
+      if (committish && !result2.startsWith(ref)) {
+        throw new error_1.PnpmError("GIT_AMBIGUOUS_REF", `resolved commit ${result2} from commit-ish reference ${ref}`);
+      }
+      return result2;
     }
-    function resolveRefFromRefs(refs, repo, ref, range) {
+    function resolveRefFromRefs(refs, repo, ref, committish, range) {
       if (!range) {
-        const commitId = refs[ref] || refs[`refs/${ref}`] || refs[`refs/tags/${ref}^{}`] || // prefer annotated tags
+        let commitId = refs[ref] || refs[`refs/${ref}`] || refs[`refs/tags/${ref}^{}`] || // prefer annotated tags
         refs[`refs/tags/${ref}`] || refs[`refs/heads/${ref}`];
         if (!commitId) {
-          throw new Error(`Could not resolve ${ref} to a commit of ${repo}.`);
+          const commits = committish ? Object.values(refs).filter((value) => value.startsWith(ref)) : [];
+          if (commits.length === 1) {
+            commitId = commits[0];
+          } else {
+            throw new Error(`Could not resolve ${ref} to a commit of ${repo}.`);
+          }
         }
         return commitId;
       } else {
@@ -60438,6 +60467,22 @@ var require_trustChecks = __commonJS({
   }
 });
 
+// ../resolving/npm-resolver/lib/normalizeRegistryUrl.js
+var require_normalizeRegistryUrl = __commonJS({
+  "../resolving/npm-resolver/lib/normalizeRegistryUrl.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.normalizeRegistryUrl = normalizeRegistryUrl;
+    function normalizeRegistryUrl(urlString) {
+      try {
+        return new URL(urlString).toString();
+      } catch {
+        return urlString;
+      }
+    }
+  }
+});
+
 // ../resolving/npm-resolver/lib/index.js
 var require_lib49 = __commonJS({
   "../resolving/npm-resolver/lib/index.js"(exports2) {
@@ -60476,6 +60521,7 @@ var require_lib49 = __commonJS({
     var whichVersionIsPinned_js_1 = require_whichVersionIsPinned();
     var pickPackageFromMeta_js_1 = require_pickPackageFromMeta();
     var trustChecks_js_1 = require_trustChecks();
+    var normalizeRegistryUrl_js_1 = require_normalizeRegistryUrl();
     var NoMatchingVersionError = class extends error_1.PnpmError {
       packageMeta;
       immatureVersion;
@@ -60669,7 +60715,7 @@ var require_lib49 = __commonJS({
       const id = `${pickedPackage.name}@${pickedPackage.version}`;
       const resolution = {
         integrity: getIntegrity(pickedPackage.dist),
-        tarball: pickedPackage.dist.tarball
+        tarball: (0, normalizeRegistryUrl_js_1.normalizeRegistryUrl)(pickedPackage.dist.tarball)
       };
       let normalizedBareSpecifier;
       if (opts.calcSpecifier) {
@@ -60714,7 +60760,7 @@ var require_lib49 = __commonJS({
       const id = `${pickedPackage.name}@${pickedPackage.version}`;
       const resolution = {
         integrity: getIntegrity(pickedPackage.dist),
-        tarball: pickedPackage.dist.tarball
+        tarball: (0, normalizeRegistryUrl_js_1.normalizeRegistryUrl)(pickedPackage.dist.tarball)
       };
       return {
         id,
@@ -60921,16 +60967,17 @@ var require_lib50 = __commonJS({
       }
       if (isRepository(wantedDependency.bareSpecifier))
         return null;
+      const normalizedBareSpecifier = new URL(wantedDependency.bareSpecifier).toString();
       let resolvedUrl;
-      const response = await fetchFromRegistry(wantedDependency.bareSpecifier, { method: "HEAD" });
+      const response = await fetchFromRegistry(normalizedBareSpecifier, { method: "HEAD" });
       if (response?.headers?.get("cache-control")?.includes("immutable")) {
         resolvedUrl = response.url;
       } else {
-        resolvedUrl = wantedDependency.bareSpecifier;
+        resolvedUrl = normalizedBareSpecifier;
       }
       return {
-        id: resolvedUrl,
-        normalizedBareSpecifier: resolvedUrl,
+        id: normalizedBareSpecifier,
+        normalizedBareSpecifier,
         resolution: {
           tarball: resolvedUrl
         },
@@ -97053,6 +97100,13 @@ var require_lib72 = __commonJS({
         return { shouldBeBuilt: false, pkgDir };
       if (opts.ignoreScripts)
         return { shouldBeBuilt: true, pkgDir };
+      if (!opts.allowBuild?.(manifest.name, manifest.version)) {
+        throw new error_1.PnpmError("GIT_DEP_PREPARE_NOT_ALLOWED", `The git-hosted package "${manifest.name}@${manifest.version}" needs to execute build scripts but is not in the "onlyBuiltDependencies" allowlist.`, {
+          hint: `Add the package to "onlyBuiltDependencies" in your project's pnpm-workspace.yaml to allow it to run scripts. For example:
+onlyBuiltDependencies:
+  - "${manifest.name}"`
+        });
+      }
       const pm = (await (0, preferred_pm_1.default)(gitRootDir))?.name ?? "npm";
       const execOpts = {
         depPath: `${manifest.name}@${manifest.version}`,
@@ -97583,17 +97637,13 @@ var require_lib74 = __commonJS({
     var logger_1 = require_lib();
     var prepare_package_1 = require_lib72();
     var worker_1 = require_lib73();
+    var error_1 = require_lib6();
     var rimraf_1 = __importDefault2(require_rimraf());
     var execa_1 = __importDefault2(require_lib17());
     var url_1 = require("url");
     function createGitFetcher(createOpts) {
       const allowedHosts = new Set(createOpts?.gitShallowHosts ?? []);
       const ignoreScripts = createOpts.ignoreScripts ?? false;
-      const preparePkg = prepare_package_1.preparePackage.bind(null, {
-        ignoreScripts: createOpts.ignoreScripts,
-        rawConfig: createOpts.rawConfig,
-        unsafePerm: createOpts.unsafePerm
-      });
       const gitFetcher = async (cafs, resolution, opts) => {
         const tempLocation = await cafs.tempDir();
         if (allowedHosts.size > 0 && shouldUseShallow(resolution.repo, allowedHosts)) {
@@ -97604,9 +97654,18 @@ var require_lib74 = __commonJS({
           await execGit(["clone", resolution.repo, tempLocation]);
         }
         await execGit(["checkout", resolution.commit], { cwd: tempLocation });
+        const receivedCommit = await execGit(["rev-parse", "HEAD"], { cwd: tempLocation });
+        if (receivedCommit.trim() !== resolution.commit) {
+          throw new error_1.PnpmError("GIT_CHECKOUT_FAILED", `received commit ${receivedCommit.trim()} does not match expected value ${resolution.commit}`);
+        }
         let pkgDir;
         try {
-          const prepareResult = await preparePkg(tempLocation, resolution.path ?? "");
+          const prepareResult = await (0, prepare_package_1.preparePackage)({
+            allowBuild: opts.allowBuild,
+            ignoreScripts: createOpts.ignoreScripts,
+            rawConfig: createOpts.rawConfig,
+            unsafePerm: createOpts.unsafePerm
+          }, tempLocation, resolution.path ?? "");
           pkgDir = prepareResult.pkgDir;
           if (ignoreScripts && prepareResult.shouldBeBuilt) {
             (0, logger_1.globalWarn)(`The git-hosted package fetched from "${resolution.repo}" has to be built but the build scripts were ignored.`);
@@ -97646,7 +97705,8 @@ var require_lib74 = __commonJS({
     }
     async function execGit(args, opts) {
       const fullArgs = prefixGitArgs().concat(args || []);
-      await (0, execa_1.default)("git", fullArgs, opts);
+      const { stdout } = await (0, execa_1.default)("git", fullArgs, opts);
+      return stdout;
     }
   }
 });
@@ -98082,7 +98142,10 @@ var require_gitHostedTarballFetcher = __commonJS({
         },
         force: true
       });
-      const { shouldBeBuilt, pkgDir } = await (0, prepare_package_1.preparePackage)(opts, tempLocation, resolution.path ?? "");
+      const { shouldBeBuilt, pkgDir } = await (0, prepare_package_1.preparePackage)({
+        ...opts,
+        allowBuild: fetcherOpts.allowBuild
+      }, tempLocation, resolution.path ?? "");
       const files = await (0, fs_packlist_1.packlist)(pkgDir);
       if (!resolution.path && files.length === Object.keys(filesIndex).length) {
         if (!shouldBeBuilt) {
@@ -108792,6 +108855,7 @@ var require_packageRequester = __commonJS({
       }
       const pkg = manifest != null ? (0, pick_1.default)(["name", "version"], manifest) : {};
       const fetchResult = ctx.fetchPackageToStore({
+        allowBuild: options.allowBuild,
         fetchRawManifest: true,
         force: forceFetch,
         ignoreScripts: options.ignoreScripts,
@@ -108805,7 +108869,11 @@ var require_packageRequester = __commonJS({
         supportedArchitectures: options.supportedArchitectures
       });
       if (!manifest) {
-        manifest = (await fetchResult.fetching()).bundledManifest;
+        const fetchedResult = await fetchResult.fetching();
+        manifest = fetchedResult.bundledManifest;
+        if (fetchedResult.integrity && !resolution.type && !resolution.integrity) {
+          resolution.integrity = fetchedResult.integrity;
+        }
       }
       return {
         body: {
@@ -108990,6 +109058,7 @@ If you want to ignore this issue, set the strict-store-pkg-content-check to fals
           }
           const priority = (++ctx.requestsQueue.counter % ctx.requestsQueue.concurrency === 0 ? -1 : 1) * 1e3;
           const fetchedPackage = await ctx.requestsQueue.add(async () => ctx.fetch(opts.pkg.id, resolution, {
+            allowBuild: opts.allowBuild,
             filesIndexFile,
             lockfileDir: opts.lockfileDir,
             readManifest: opts.fetchRawManifest,
@@ -109013,9 +109082,10 @@ If you want to ignore this issue, set the strict-store-pkg-content-check to fals
               version: opts.pkg.version
             }
           }), { priority });
-          if (isLocalTarballDep && opts.pkg.resolution.integrity) {
+          const integrity = opts.pkg.resolution.integrity ?? fetchedPackage.integrity;
+          if (isLocalTarballDep && integrity) {
             await fs_1.promises.mkdir(target, { recursive: true });
-            await graceful_fs_1.default.writeFile(path_1.default.join(target, TARBALL_INTEGRITY_FILENAME), opts.pkg.resolution.integrity, "utf8");
+            await graceful_fs_1.default.writeFile(path_1.default.join(target, TARBALL_INTEGRITY_FILENAME), integrity, "utf8");
           }
           fetching.resolve({
             files: {
@@ -109024,7 +109094,8 @@ If you want to ignore this issue, set the strict-store-pkg-content-check to fals
               packageImportMethod: fetchedPackage.packageImportMethod,
               requiresBuild: fetchedPackage.requiresBuild
             },
-            bundledManifest: fetchedPackage.manifest == null ? fetchedPackage.manifest : normalizeBundledManifest(fetchedPackage.manifest)
+            bundledManifest: fetchedPackage.manifest == null ? fetchedPackage.manifest : normalizeBundledManifest(fetchedPackage.manifest),
+            integrity
           });
         } catch (err) {
           fetching.reject(err);
@@ -109966,7 +110037,24 @@ var require_lib97 = __commonJS({
       if (opts.cleanupUnusedCatalogs) {
         shouldBeUpdated = removePackagesFromWorkspaceCatalog(manifest, opts.allProjects ?? []) || shouldBeUpdated;
       }
-      for (const [key, value] of Object.entries(opts.updatedFields ?? {})) {
+      const updatedFields = { ...opts.updatedFields };
+      if (manifest.allowBuilds != null && (updatedFields.onlyBuiltDependencies != null || updatedFields.ignoredBuiltDependencies != null)) {
+        const allowBuilds = { ...manifest.allowBuilds };
+        if (updatedFields.onlyBuiltDependencies != null) {
+          for (const pattern of updatedFields.onlyBuiltDependencies) {
+            allowBuilds[pattern] = true;
+          }
+        }
+        if (updatedFields.ignoredBuiltDependencies != null) {
+          for (const pattern of updatedFields.ignoredBuiltDependencies) {
+            allowBuilds[pattern] = false;
+          }
+        }
+        updatedFields.allowBuilds = allowBuilds;
+        delete updatedFields.onlyBuiltDependencies;
+        delete updatedFields.ignoredBuiltDependencies;
+      }
+      for (const [key, value] of Object.entries(updatedFields)) {
         if (!(0, equals_1.default)(manifest[key], value)) {
           shouldBeUpdated = true;
           if (value == null) {
@@ -148889,6 +148977,7 @@ var require_lockfileToDepGraph = __commonJS({
             core_loggers_1.progressLogger.debug({ packageId, requester: opts.lockfileDir, status: "resolved" });
             try {
               fetchResponse = await opts.storeController.fetchPackage({
+                allowBuild: opts.allowBuild,
                 force: false,
                 lockfileDir: opts.lockfileDir,
                 ignoreScripts: opts.ignoreScripts,
@@ -150020,6 +150109,7 @@ var require_lockfileToHoistedDepGraph = __commonJS({
         } else {
           try {
             fetchResponse = opts.storeController.fetchPackage({
+              allowBuild: opts.allowBuild,
               force: false,
               lockfileDir: opts.lockfileDir,
               ignoreScripts: opts.ignoreScripts,
@@ -150416,8 +150506,10 @@ var require_lib164 = __commonJS({
           }
         }
       }
+      const allowBuild = (0, builder_policy_1.createAllowBuildFunction)(opts);
       const lockfileToDepGraphOpts = {
         ...opts,
+        allowBuild,
         importerIds,
         lockfileDir,
         skipped,
@@ -150452,7 +150544,6 @@ var require_lib164 = __commonJS({
       }
       let newHoistedDependencies;
       let linkedToRoot = 0;
-      const allowBuild = (0, builder_policy_1.createAllowBuildFunction)(opts);
       if (opts.nodeLinker === "hoisted" && hierarchy && prevGraph) {
         await (0, linkHoistedModules_js_1.linkHoistedModules)(opts.storeController, graph, prevGraph, hierarchy, {
           allowBuild,
@@ -152451,6 +152542,7 @@ var require_resolveDependencies = __commonJS({
           wantedDependency.bareSpecifier = (0, replaceVersionInBareSpecifier_js_1.replaceVersionInBareSpecifier)(wantedDependency.bareSpecifier, options.preferredVersion);
         }
         pkgResponse = await ctx.storeController.requestPackage(wantedDependency, {
+          allowBuild: ctx.allowBuild,
           alwaysTryWorkspacePackages: ctx.linkWorkspacePackagesDepth >= options.currentDepth,
           currentPkg: currentPkg ? {
             id: currentPkg.pkgId,
@@ -152513,6 +152605,13 @@ var require_resolveDependencies = __commonJS({
           rawSpec: wantedDependency.bareSpecifier
         }
       });
+      if (ctx.blockExoticSubdeps && options.currentDepth > 0 && pkgResponse.body.resolvedVia != null && // This is already coming from the lockfile, we skip the check in this case for now. Should be fixed later.
+      isExoticDep(pkgResponse.body.resolvedVia)) {
+        const error = new error_1.PnpmError("EXOTIC_SUBDEP", `Exotic dependency "${wantedDependency.alias ?? wantedDependency.bareSpecifier}" (resolved via ${pkgResponse.body.resolvedVia}) is not allowed in subdependencies when blockExoticSubdeps is enabled`);
+        error.prefix = options.prefix;
+        error.pkgsStack = getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById);
+        throw error;
+      }
       if (ctx.allPreferredVersions && pkgResponse.body.manifest?.version) {
         if (!ctx.allPreferredVersions[pkgResponse.body.manifest.name]) {
           ctx.allPreferredVersions[pkgResponse.body.manifest.name] = {};
@@ -152801,6 +152900,19 @@ var require_resolveDependencies = __commonJS({
       const existingCatalogResolution = wantedLockfile.catalogs?.[catalogLookup.catalogName]?.[wantedDependency.alias];
       return existingCatalogResolution?.specifier === catalogLookup.specifier ? existingCatalogResolution.version : void 0;
     }
+    var NON_EXOTIC_RESOLVED_VIA = /* @__PURE__ */ new Set([
+      "custom-resolver",
+      "github.com/denoland/deno",
+      "github.com/oven-sh/bun",
+      "jsr-registry",
+      "local-filesystem",
+      "nodejs.org",
+      "npm-registry",
+      "workspace"
+    ]);
+    function isExoticDep(resolvedVia) {
+      return !NON_EXOTIC_RESOLVED_VIA.has(resolvedVia);
+    }
   }
 });
 
@@ -152826,6 +152938,7 @@ var require_resolveDependencyTree = __commonJS({
       const wantedToBeSkippedPackageIds = /* @__PURE__ */ new Set();
       const autoInstallPeers = opts.autoInstallPeers === true;
       const ctx = {
+        allowBuild: opts.allowBuild,
         autoInstallPeers,
         autoInstallPeersFromHighestMatch: opts.autoInstallPeersFromHighestMatch === true,
         allowedDeprecatedVersions: opts.allowedDeprecatedVersions,
@@ -152867,7 +152980,8 @@ var require_resolveDependencyTree = __commonJS({
         maximumPublishedBy: opts.minimumReleaseAge ? new Date(Date.now() - opts.minimumReleaseAge * 60 * 1e3) : void 0,
         publishedByExclude: opts.minimumReleaseAgeExclude ? createPackageVersionPolicyByExclude(opts.minimumReleaseAgeExclude, "minimumReleaseAgeExclude") : void 0,
         trustPolicy: opts.trustPolicy,
-        trustPolicyExclude: opts.trustPolicyExclude ? createPackageVersionPolicyByExclude(opts.trustPolicyExclude, "trustPolicyExclude") : void 0
+        trustPolicyExclude: opts.trustPolicyExclude ? createPackageVersionPolicyByExclude(opts.trustPolicyExclude, "trustPolicyExclude") : void 0,
+        blockExoticSubdeps: opts.blockExoticSubdeps
       };
       function createPackageVersionPolicyByExclude(patterns, key) {
         try {
@@ -157498,7 +157612,8 @@ var require_extendInstallOptions = __commonJS({
         disallowWorkspaceCycles: false,
         excludeLinksFromLockfile: false,
         virtualStoreDirMaxLength: 120,
-        peersSuffixMaxLength: 1e3
+        peersSuffixMaxLength: 1e3,
+        blockExoticSubdeps: false
       };
     };
     function extendOptions(opts) {
@@ -159031,7 +159146,9 @@ Note that in CI environments, this setting is enabled by default.`
       if (opts.dedupe) {
         forgetResolutionsOfAllPrevWantedDeps(ctx.wantedLockfile);
       }
+      const allowBuild = (0, builder_policy_1.createAllowBuildFunction)(opts);
       let { dependenciesGraph, dependenciesByProjectId, linkedDependenciesByProjectId, updatedCatalogs, newLockfile, outdatedDependencies, peerDependencyIssuesByProjects, wantedToBeSkippedPackageIds, waitTillAllFetchingsFinish } = await (0, resolve_dependencies_1.resolveDependencies)(projects, {
+        allowBuild,
         allowedDeprecatedVersions: opts.allowedDeprecatedVersions,
         allowUnusedPatches: opts.allowUnusedPatches,
         autoInstallPeers: opts.autoInstallPeers,
@@ -159077,7 +159194,8 @@ Note that in CI environments, this setting is enabled by default.`
         minimumReleaseAge: opts.minimumReleaseAge,
         minimumReleaseAgeExclude: opts.minimumReleaseAgeExclude,
         trustPolicy: opts.trustPolicy,
-        trustPolicyExclude: opts.trustPolicyExclude
+        trustPolicyExclude: opts.trustPolicyExclude,
+        blockExoticSubdeps: opts.blockExoticSubdeps
       });
       if (!opts.include.optionalDependencies || !opts.include.devDependencies || !opts.include.dependencies) {
         linkedDependenciesByProjectId = (0, map_1.default)((linkedDeps) => linkedDeps.filter((linkedDep) => !(linkedDep.dev && !opts.include.devDependencies || linkedDep.optional && !opts.include.optionalDependencies || !linkedDep.dev && !linkedDep.optional && !opts.include.dependencies)), linkedDependenciesByProjectId ?? {});
@@ -159112,7 +159230,6 @@ Note that in CI environments, this setting is enabled by default.`
         mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles
       };
       let stats;
-      const allowBuild = (0, builder_policy_1.createAllowBuildFunction)(opts);
       let ignoredBuilds;
       if (!opts.lockfileOnly && !isInstallationOnlyForLockfileCheck && opts.enableModulesDir) {
         const result2 = await (0, link_js_1.linkPackages)(projects, dependenciesGraph, {
@@ -175650,6 +175767,11 @@ var require_createDeployFiles = __commonJS({
           // the effects of the package extensions should already be part of the package snapshots
           pnpmfileChecksum: void 0,
           // the effects of the pnpmfile should already be part of the package snapshots
+          settings: {
+            ...lockfile.settings,
+            injectWorkspacePackages: void 0
+            // the effects of injecting workspace packages should already be part of the lockfile
+          },
           importers: {
             ["."]: targetSnapshot
           },
@@ -176026,6 +176148,8 @@ var require_deploy = __commonJS({
           modulesDir: void 0,
           confirmModulesPurge: false,
           frozenLockfile: true,
+          injectWorkspacePackages: void 0,
+          // the effects of injecting workspace packages should already be part of the package snapshots
           overrides: void 0,
           // the effects of the overrides should already be part of the package snapshots
           hooks: {
@@ -179248,7 +179372,11 @@ ${details}`;
       if (change === null || diff == null) {
         return latestManifest.deprecated ? chalk_1.default.redBright.bold("Deprecated") : latestManifest.version;
       }
-      return (0, colorize_semver_diff_1.default)({ change, diff });
+      const versionText = (0, colorize_semver_diff_1.default)({ change, diff });
+      if (latestManifest.deprecated) {
+        return `${versionText} ${chalk_1.default.redBright("(deprecated)")}`;
+      }
+      return versionText;
     }
     function renderDetails({ latestManifest }) {
       if (latestManifest == null)
@@ -181020,7 +181148,8 @@ var require_publish2 = __commonJS({
       const { tarballPath } = await pack.api({
         ...opts,
         dir,
-        packDestination
+        packDestination,
+        dryRun: false
       });
       await copyNpmrc({ dir, workspaceDir: opts.workspaceDir, packDestination });
       const { status } = (0, run_npm_1.runNpm)(opts.npmPath, ["publish", "--ignore-scripts", path_1.default.basename(tarballPath), ...args], {
@@ -181123,6 +181252,7 @@ var require_pack2 = __commonJS({
         out: String,
         recursive: Boolean,
         ...(0, pick_1.default)([
+          "dry-run",
           "pack-destination",
           "pack-gzip-level",
           "json",
@@ -181139,6 +181269,10 @@ var require_pack2 = __commonJS({
           {
             title: "Options",
             list: [
+              {
+                description: "Does everything `pnpm pack` would do except actually writing the tarball to disk.",
+                name: "--dry-run"
+              },
               {
                 description: "Directory in which `pnpm pack` will save tarballs. The default is the current working directory.",
                 name: "--pack-destination <dir>"
@@ -181285,20 +181419,22 @@ ${filename}`).join("\n\n");
         }
       }
       const destDir = packDestination ? path_1.default.isAbsolute(packDestination) ? packDestination : path_1.default.join(dir, packDestination ?? ".") : dir;
-      await fs_1.default.promises.mkdir(destDir, { recursive: true });
-      await packPkg({
-        destFile: path_1.default.join(destDir, tarballName),
-        filesMap,
-        modulesDir: path_1.default.join(opts.dir, "node_modules"),
-        packGzipLevel: opts.packGzipLevel,
-        manifest: publishManifest,
-        bins: [
-          ...(await (0, package_bins_1.getBinsFromPackageManifest)(publishManifest, dir)).map(({ path: path2 }) => path2),
-          ...(manifest.publishConfig?.executableFiles ?? []).map((executableFile) => path_1.default.join(dir, executableFile))
-        ]
-      });
-      if (!opts.ignoreScripts) {
-        await _runScriptsIfPresent(["postpack"], entryManifest);
+      if (!opts.dryRun) {
+        await fs_1.default.promises.mkdir(destDir, { recursive: true });
+        await packPkg({
+          destFile: path_1.default.join(destDir, tarballName),
+          filesMap,
+          modulesDir: path_1.default.join(opts.dir, "node_modules"),
+          packGzipLevel: opts.packGzipLevel,
+          manifest: publishManifest,
+          bins: [
+            ...(await (0, package_bins_1.getBinsFromPackageManifest)(publishManifest, dir)).map(({ path: path2 }) => path2),
+            ...(manifest.publishConfig?.executableFiles ?? []).map((executableFile) => path_1.default.join(dir, executableFile))
+          ]
+        });
+        if (!opts.ignoreScripts) {
+          await _runScriptsIfPresent(["postpack"], entryManifest);
+        }
       }
       let packedTarballPath;
       if (opts.dir !== destDir) {

package/dist/worker.js

@@ -9855,7 +9855,19 @@ var require_start = __commonJS({
       const { filesIndex, manifest } = cafs.addFilesFromTarball(buffer, true);
       const { filesIntegrity, filesMap } = processFilesIndex(filesIndex);
       const requiresBuild = writeFilesIndexFile(filesIndexFile, { manifest: manifest ?? {}, files: filesIntegrity });
-      return { status: "success", value: { filesIndex: filesMap, manifest, requiresBuild } };
+      return {
+        status: "success",
+        value: {
+          filesIndex: filesMap,
+          manifest,
+          requiresBuild,
+          integrity: integrity ?? calcIntegrity(buffer)
+        }
+      };
+    }
+    function calcIntegrity(buffer) {
+      const calculatedHash = crypto.hash("sha512", buffer, "hex");
+      return `sha512-${Buffer.from(calculatedHash, "hex").toString("base64")}`;
     }
     function initStore({ storeDir }) {
       fs_1.default.mkdirSync(storeDir, { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pnpm",
-  "version": "10.25.0",
+  "version": "10.26.1",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",