pnpm 10.27.0 → 10.28.0

package/dist/node_modules/.modules.yaml

@@ -17,8 +17,8 @@ hoistedLocations:
     - node_modules/agent-base
   ansi-regex@5.0.1:
     - node_modules/wrap-ansi-cjs/node_modules/ansi-regex
-    - node_modules/string-width-cjs/node_modules/ansi-regex
     - node_modules/strip-ansi-cjs/node_modules/ansi-regex
+    - node_modules/string-width-cjs/node_modules/ansi-regex
   ansi-regex@6.2.2:
     - node_modules/ansi-regex
   ansi-styles@4.3.0:
@@ -194,9 +194,9 @@ included:
 injectedDeps: {}
 layoutVersion: 5
 nodeLinker: hoisted
-packageManager: pnpm@10.26.0
+packageManager: pnpm@10.27.0
 pendingBuilds: []
-prunedAt: Tue, 30 Dec 2025 21:14:00 GMT
+prunedAt: Fri, 09 Jan 2026 23:04:58 GMT
 publicHoistPattern: []
 registries:
   '@jsr': https://npm.jsr.io/

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,5 +1,5 @@
 {
-  "lastValidatedTimestamp": 1767129240557,
+  "lastValidatedTimestamp": 1767999898134,
   "projects": {},
   "pnpmfiles": [],
   "settings": {

package/dist/pnpm.cjs

@@ -2972,7 +2972,7 @@ var require_lib4 = __commonJS({
     var load_json_file_1 = __importDefault2(require_load_json_file());
     var defaultManifest = {
       name: true ? "pnpm" : "pnpm",
-      version: true ? "10.27.0" : "0.0.0"
+      version: true ? "10.28.0" : "0.0.0"
     };
     var pkgJson;
     if (require.main == null) {
@@ -18844,6 +18844,7 @@ var require_getOptionsFromRootManifest = __commonJS({
           "packageExtensions",
           "patchedDependencies",
           "peerDependencyRules",
+          "requiredScripts",
           "supportedArchitectures",
           "updateConfig"
         ], manifest.pnpm ?? {}),
@@ -108776,11 +108777,13 @@ var require_packageRequester = __commonJS({
       });
       const getIndexFilePathInCafs = store_cafs_1.getIndexFilePathInCafs.bind(null, opts.storeDir);
       const fetch = fetcher.bind(null, opts.fetchers, opts.cafs);
+      const getFilePathByModeInCafs = store_cafs_1.getFilePathByModeInCafs.bind(null, opts.storeDir);
+      const readPkgFromCafs = worker_1.readPkgFromCafs.bind(null, opts.storeDir, opts.verifyStoreIntegrity);
       const fetchPackageToStore = fetchToStore.bind(null, {
-        readPkgFromCafs: worker_1.readPkgFromCafs.bind(null, opts.storeDir, opts.verifyStoreIntegrity),
+        readPkgFromCafs,
         fetch,
         fetchingLocker: /* @__PURE__ */ new Map(),
-        getFilePathByModeInCafs: store_cafs_1.getFilePathByModeInCafs.bind(null, opts.storeDir),
+        getFilePathByModeInCafs,
         getIndexFilePathInCafs,
         requestsQueue: Object.assign(requestsQueue, {
           counter: 0,
@@ -108790,12 +108793,19 @@ var require_packageRequester = __commonJS({
         virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
         strictStorePkgContentCheck: opts.strictStorePkgContentCheck
       });
+      const peekPackageFromStore = peekFromStore.bind(null, {
+        getIndexFilePathInCafs,
+        readPkgFromCafs,
+        fetchingLockerForPeek: /* @__PURE__ */ new Map(),
+        strictStorePkgContentCheck: opts.strictStorePkgContentCheck
+      });
       const requestPackage = resolveAndFetch.bind(null, {
         engineStrict: opts.engineStrict,
         nodeVersion: opts.nodeVersion,
         pnpmVersion: opts.pnpmVersion,
         force: opts.force,
         fetchPackageToStore,
+        peekPackageFromStore,
         requestsQueue,
         resolve: opts.resolve,
         storeDir: opts.storeDir
@@ -108822,7 +108832,7 @@ var require_packageRequester = __commonJS({
       let updated = false;
       let resolvedVia;
       let publishedAt;
-      if (!skipResolution || options.skipFetch === true || Boolean(pkgId?.startsWith("file:")) || wantedDependency.optional === true) {
+      async function performResolution() {
         const preferredVersions = skipResolution && options.currentPkg?.name != null && options.currentPkg?.version != null ? {
           ...options.preferredVersions,
           [options.currentPkg.name]: { [options.currentPkg.version]: "version" }
@@ -108857,6 +108867,19 @@ var require_packageRequester = __commonJS({
         normalizedBareSpecifier = resolveResult.normalizedBareSpecifier;
         alias = resolveResult.alias;
       }
+      if (!skipResolution || options.skipFetch === true || Boolean(pkgId?.startsWith("file:")) || wantedDependency.optional === true) {
+        if (skipResolution && !pkgId?.startsWith("file:") && wantedDependency.optional !== true && pkgId != null) {
+          const pkg2 = await ctx.peekPackageFromStore({
+            ...options.expectedPkg,
+            id: pkgId,
+            resolution
+          });
+          manifest = pkg2?.bundledManifest;
+        }
+        if (manifest == null) {
+          await performResolution();
+        }
+      }
       const id = pkgId;
       if ("type" in resolution && resolution.type === "directory" && !id.startsWith("file:")) {
         if (manifest == null) {
@@ -109066,23 +109089,7 @@ var require_packageRequester = __commonJS({
           if (!opts.force && (!isLocalTarballDep || await tarballIsUpToDate(opts.pkg.resolution, target, opts.lockfileDir)) && !isLocalPkg) {
             const { verified, pkgFilesIndex, manifest, requiresBuild } = await ctx.readPkgFromCafs(filesIndexFile, opts.fetchRawManifest);
             if (verified) {
-              if (pkgFilesIndex.name != null && opts.pkg?.name != null && pkgFilesIndex.name.toLowerCase() !== opts.pkg.name.toLowerCase() || pkgFilesIndex.version != null && opts.pkg?.version != null && // We used to not normalize the package versions before writing them to the lockfile and store.
-              // So it may happen that the version will be in different formats.
-              // For instance, v1.0.0 and 1.0.0
-              // Hence, we need to use semver.eq() to compare them.
-              !(0, equalOrSemverEqual_js_1.equalOrSemverEqual)(pkgFilesIndex.version, opts.pkg.version)) {
-                const msg = `Package name mismatch found while reading ${JSON.stringify(opts.pkg.resolution)} from the store.`;
-                const hint = `This means that either the lockfile is broken or the package metadata (name and version) inside the package's package.json file doesn't match the metadata in the registry. Expected package: ${opts.pkg.name}@${opts.pkg.version}. Actual package in the store with the given integrity: ${pkgFilesIndex.name}@${pkgFilesIndex.version}.`;
-                if (ctx.strictStorePkgContentCheck ?? true) {
-                  throw new error_1.PnpmError("UNEXPECTED_PKG_CONTENT_IN_STORE", msg, {
-                    hint: `${hint}
-
-If you want to ignore this issue, set the strict-store-pkg-content-check to false.`
-                  });
-                } else {
-                  (0, logger_1.globalWarn)(`${msg} ${hint}`);
-                }
-              }
+              checkPackageMismatch({ pkgFilesIndex, pkg: opts.pkg, strictStorePkgContentCheck: ctx.strictStorePkgContentCheck });
               fetching.resolve({
                 files: {
                   unprocessed: true,
@@ -109148,9 +109155,56 @@ If you want to ignore this issue, set the strict-store-pkg-content-check to fals
         }
       }
     }
+    async function peekFromStore(ctx, pkg) {
+      if (pkg.resolution.type != null || pkg.resolution.integrity == null) {
+        return void 0;
+      }
+      const indexFilePathInCafs = ctx.getIndexFilePathInCafs(pkg.resolution.integrity, pkg.id);
+      const existingRequest = ctx.fetchingLockerForPeek.get(indexFilePathInCafs);
+      if (existingRequest != null) {
+        return existingRequest;
+      }
+      const request = ctx.readPkgFromCafs(indexFilePathInCafs, true).then(({ pkgFilesIndex, manifest, requiresBuild, verified }) => {
+        if (!verified) {
+          return void 0;
+        }
+        checkPackageMismatch({ pkgFilesIndex, pkg, strictStorePkgContentCheck: ctx.strictStorePkgContentCheck });
+        return {
+          files: {
+            unprocessed: true,
+            resolvedFrom: "store",
+            filesIndex: pkgFilesIndex.files,
+            sideEffects: pkgFilesIndex.sideEffects,
+            requiresBuild
+          },
+          bundledManifest: manifest == null ? manifest : normalizeBundledManifest(manifest)
+        };
+      });
+      ctx.fetchingLockerForPeek.set(indexFilePathInCafs, request);
+      return request;
+    }
     async function readBundledManifest(pkgJsonPath) {
       return pickBundledManifest(await (0, read_package_json_1.readPackageJson)(pkgJsonPath));
     }
+    function checkPackageMismatch({ pkgFilesIndex, pkg, strictStorePkgContentCheck }) {
+      if (pkgFilesIndex.name != null && pkg?.name != null && pkgFilesIndex.name.toLowerCase() !== pkg.name.toLowerCase() || pkgFilesIndex.version != null && pkg?.version != null && // We used to not normalize the package versions before writing them to the lockfile and store.
+      // So it may happen that the version will be in different formats.
+      // For instance, v1.0.0 and 1.0.0
+      // Hence, we need to use semver.eq() to compare them.
+      !(0, equalOrSemverEqual_js_1.equalOrSemverEqual)(pkgFilesIndex.version, pkg.version)) {
+        const msg = `Package name mismatch found while reading ${JSON.stringify(pkg.resolution)} from the store.`;
+        const hint = `This means that either the lockfile is broken or the package metadata (name and version) inside the package's package.json file doesn't match the metadata in the registry. Expected package: ${pkg.name}@${pkg.version}. Actual package in the store with the given integrity: ${pkgFilesIndex.name}@${pkgFilesIndex.version}.`;
+        if (strictStorePkgContentCheck ?? true) {
+          throw new error_1.PnpmError("UNEXPECTED_PKG_CONTENT_IN_STORE", msg, {
+            hint: `${hint}
+
+If you want to ignore this issue, set the strict-store-pkg-content-check to false.`
+          });
+        } else {
+          (0, logger_1.globalWarn)(`${msg} ${hint}`);
+        }
+      }
+    }
     async function tarballIsUpToDate(resolution, pkgInStoreLocation, lockfileDir) {
       let currentIntegrity;
       try {
@@ -109214,11 +109268,15 @@ var require_projectRegistry = __commonJS({
     var error_1 = require_lib6();
     var logger_1 = require_lib();
     var symlink_dir_1 = __importDefault2(require_dist18());
+    var is_subdir_1 = __importDefault2(require_is_subdir());
     var PROJECTS_DIR = "projects";
     function getProjectsRegistryDir(storeDir) {
       return path_1.default.join(storeDir, PROJECTS_DIR);
     }
     async function registerProject(storeDir, projectDir) {
+      if ((0, is_subdir_1.default)(projectDir, storeDir)) {
+        return;
+      }
       const registryDir = getProjectsRegistryDir(storeDir);
       await fs_1.promises.mkdir(registryDir, { recursive: true });
       const linkPath = path_1.default.join(registryDir, (0, crypto_hash_1.createShortHash)(projectDir));
@@ -110862,6 +110920,9 @@ var require_requirePnpmfile = __commonJS({
             }
             return newPkg;
           };
+          if (pnpmfile?.hooks?.beforePacking && typeof pnpmfile.hooks.beforePacking !== "function") {
+            throw new TypeError("hooks.beforePacking should be a function");
+          }
         }
         return { pnpmfileModule: pnpmfile };
       } catch (err) {
@@ -110944,6 +111005,7 @@ var require_requireHooks = __commonJS({
       const mergedFinders = {};
       const cookedHooks = {
         readPackage: [],
+        beforePacking: [],
         preResolution: [],
         afterAllResolved: [],
         filterLog: [],
@@ -110983,6 +111045,11 @@ var require_requireHooks = __commonJS({
             cookedHooks[hookName].push((pkg) => fn(pkg, context));
           }
         }
+        if (fileHooks.beforePacking) {
+          const fn = fileHooks.beforePacking;
+          const context = createReadPackageHookContext(file, prefix, "beforePacking");
+          cookedHooks.beforePacking.push((pkg, dir) => fn(pkg, dir, context));
+        }
         if (fileHooks.filterLog) {
           cookedHooks.filterLog.push(fileHooks.filterLog);
         }
@@ -179895,7 +179962,7 @@ var require_lib187 = __commonJS({
       "postpublish"
     ];
     async function createExportableManifest(dir, originalManifest, opts) {
-      const publishManifest = (0, omit_1.default)(["pnpm", "scripts", "packageManager"], originalManifest);
+      let publishManifest = (0, omit_1.default)(["pnpm", "scripts", "packageManager"], originalManifest);
       if (originalManifest.scripts != null) {
         publishManifest.scripts = (0, omit_1.default)(PREPUBLISH_SCRIPTS, originalManifest.scripts);
       }
@@ -179923,6 +179990,9 @@ var require_lib187 = __commonJS({
       if (opts?.readmeFile) {
         publishManifest.readme ??= opts.readmeFile;
       }
+      for (const hook of opts?.hooks?.beforePacking ?? []) {
+        publishManifest = await hook(publishManifest, dir) ?? publishManifest;
+      }
       return publishManifest;
     }
     function combineConverters(...converters) {
@@ -181790,7 +181860,8 @@ ${filename}`).join("\n\n");
         modulesDir: path_1.default.join(opts.dir, "node_modules"),
         manifest,
         embedReadme: opts.embedReadme,
-        catalogs: opts.catalogs ?? {}
+        catalogs: opts.catalogs ?? {},
+        hooks: opts.hooks
       });
       const files = await (0, fs_packlist_1.packlist)(dir, {
         packageJsonCache: {
@@ -181876,10 +181947,11 @@ ${filename}`).join("\n\n");
       });
     }
     async function createPublishManifest(opts) {
-      const { projectDir, embedReadme, modulesDir, manifest, catalogs } = opts;
+      const { projectDir, embedReadme, modulesDir, manifest, catalogs, hooks } = opts;
       const readmeFile = embedReadme ? await readReadmeFile(projectDir) : void 0;
       return (0, exportable_manifest_1.createExportableManifest)(projectDir, manifest, {
         catalogs,
+        hooks,
         readmeFile,
         modulesDir
       });
@@ -183720,7 +183792,7 @@ var require_runRecursive = __commonJS({
       const stdio = !opts.stream && (opts.workspaceConcurrency === 1 || packageChunks.length === 1 && packageChunks[0].length === 1) ? "inherit" : "pipe";
       const existsPnp = existsInDir_js_1.existsInDir.bind(null, ".pnp.cjs");
       const workspacePnpPath = opts.workspaceDir && existsPnp(opts.workspaceDir);
-      const requiredScripts = opts.rootProjectManifest?.pnpm?.requiredScripts ?? [];
+      const requiredScripts = opts.requiredScripts ?? [];
       if (requiredScripts.includes(scriptName)) {
         const missingScriptPackages = packageChunks.flat().map((prefix) => opts.selectedProjectsGraph[prefix]).filter((pkg) => getSpecifiedScripts(pkg.package.manifest.scripts ?? {}, scriptName).length < 1).map((pkg) => pkg.package.manifest.name ?? pkg.package.rootDir);
         if (missingScriptPackages.length) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pnpm",
-  "version": "10.27.0",
+  "version": "10.28.0",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",