pnpm 10.33.1 → 10.33.2

package/dist/node_modules/.modules.yaml

@@ -22,9 +22,6 @@
     "tar@7.5.13": [
       "node_modules/tar"
     ],
-    "env-paths@2.2.1": [
-      "node_modules/env-paths"
-    ],
     "proc-log@5.0.0": [
       "node_modules/proc-log"
     ],
@@ -34,6 +31,9 @@
     "exponential-backoff@3.1.3": [
       "node_modules/exponential-backoff"
     ],
+    "env-paths@2.2.1": [
+      "node_modules/env-paths"
+    ],
     "which@5.0.0": [
       "node_modules/which"
     ],
@@ -49,14 +49,14 @@
     "abbrev@3.0.1": [
       "node_modules/abbrev"
     ],
-    "@isaacs/fs-minipass@4.0.1": [
-      "node_modules/@isaacs/fs-minipass"
+    "yallist@5.0.0": [
+      "node_modules/yallist"
     ],
     "chownr@3.0.0": [
       "node_modules/chownr"
     ],
-    "yallist@5.0.0": [
-      "node_modules/yallist"
+    "@isaacs/fs-minipass@4.0.1": [
+      "node_modules/@isaacs/fs-minipass"
     ],
     "minizlib@3.1.0": [
       "node_modules/minizlib"
@@ -76,6 +76,12 @@
     "ssri@12.0.0": [
       "node_modules/ssri"
     ],
+    "negotiator@1.0.0": [
+      "node_modules/negotiator"
+    ],
+    "cacache@19.0.1": [
+      "node_modules/cacache"
+    ],
     "minipass@3.3.6": [
       "node_modules/minipass-flush/node_modules/minipass",
       "node_modules/minipass-pipeline/node_modules/minipass",
@@ -86,32 +92,47 @@
       "node_modules/minipass-pipeline/node_modules/yallist",
       "node_modules/minipass-sized/node_modules/yallist"
     ],
+    "http-cache-semantics@4.2.0": [
+      "node_modules/http-cache-semantics"
+    ],
     "promise-retry@2.0.1": [
       "node_modules/promise-retry"
     ],
+    "minipass-fetch@4.0.1": [
+      "node_modules/minipass-fetch"
+    ],
     "@npmcli/agent@3.0.0": [
       "node_modules/@npmcli/agent"
     ],
-    "negotiator@1.0.0": [
-      "node_modules/negotiator"
+    "unique-filename@4.0.0": [
+      "node_modules/unique-filename"
     ],
-    "minipass-fetch@4.0.1": [
-      "node_modules/minipass-fetch"
+    "minipass-collect@2.0.1": [
+      "node_modules/minipass-collect"
     ],
-    "cacache@19.0.1": [
-      "node_modules/cacache"
+    "fs-minipass@3.0.3": [
+      "node_modules/fs-minipass"
     ],
-    "http-cache-semantics@4.2.0": [
-      "node_modules/http-cache-semantics"
+    "p-map@7.0.4": [
+      "node_modules/p-map"
     ],
-    "err-code@2.0.3": [
-      "node_modules/err-code"
+    "@npmcli/fs@4.0.0": [
+      "node_modules/@npmcli/fs"
+    ],
+    "glob@10.5.0": [
+      "node_modules/glob"
+    ],
+    "lru-cache@10.4.3": [
+      "node_modules/lru-cache"
     ],
     "retry@0.12.0": [
       "node_modules/retry"
     ],
-    "agent-base@7.1.4": [
-      "node_modules/agent-base"
+    "err-code@2.0.3": [
+      "node_modules/err-code"
+    ],
+    "encoding@0.1.13": [
+      "node_modules/encoding"
     ],
     "http-proxy-agent@7.0.2": [
       "node_modules/http-proxy-agent"
@@ -119,74 +140,41 @@
     "https-proxy-agent@7.0.6": [
       "node_modules/https-proxy-agent"
     ],
+    "agent-base@7.1.4": [
+      "node_modules/agent-base"
+    ],
     "socks-proxy-agent@8.0.5": [
       "node_modules/socks-proxy-agent"
     ],
-    "lru-cache@10.4.3": [
-      "node_modules/lru-cache"
-    ],
-    "encoding@0.1.13": [
-      "node_modules/encoding"
-    ],
-    "minipass-collect@2.0.1": [
-      "node_modules/minipass-collect"
-    ],
-    "fs-minipass@3.0.3": [
-      "node_modules/fs-minipass"
-    ],
-    "@npmcli/fs@4.0.0": [
-      "node_modules/@npmcli/fs"
-    ],
-    "p-map@7.0.4": [
-      "node_modules/p-map"
-    ],
-    "glob@10.5.0": [
-      "node_modules/glob"
-    ],
-    "unique-filename@4.0.0": [
-      "node_modules/unique-filename"
-    ],
-    "debug@4.4.3": [
-      "node_modules/debug"
-    ],
-    "socks@2.8.7": [
-      "node_modules/socks"
+    "unique-slug@5.0.0": [
+      "node_modules/unique-slug"
     ],
-    "iconv-lite@0.6.3": [
-      "node_modules/iconv-lite"
+    "foreground-child@3.3.1": [
+      "node_modules/foreground-child"
     ],
     "package-json-from-dist@1.0.1": [
       "node_modules/package-json-from-dist"
     ],
-    "foreground-child@3.3.1": [
-      "node_modules/foreground-child"
+    "path-scurry@1.11.1": [
+      "node_modules/path-scurry"
     ],
     "jackspeak@3.4.3": [
       "node_modules/jackspeak"
     ],
-    "path-scurry@1.11.1": [
-      "node_modules/path-scurry"
-    ],
     "minimatch@9.0.9": [
       "node_modules/minimatch"
     ],
-    "unique-slug@5.0.0": [
-      "node_modules/unique-slug"
-    ],
-    "ms@2.1.3": [
-      "node_modules/ms"
-    ],
-    "ip-address@10.1.0": [
-      "node_modules/ip-address"
+    "iconv-lite@0.6.3": [
+      "node_modules/iconv-lite"
     ],
-    "smart-buffer@4.2.0": [
-      "node_modules/smart-buffer"
+    "debug@4.4.3": [
+      "node_modules/debug"
     ],
-    "safer-buffer@2.1.2": [
-      "node_modules/safer-buffer"
+    "socks@2.8.7": [
+      "node_modules/socks"
     ],
-    "signal-exit@4.1.0": [
-      "node_modules/signal-exit"
+    "imurmurhash@0.1.4": [
+      "node_modules/imurmurhash"
     ],
     "which@2.0.2": [
       "node_modules/cross-spawn/node_modules/which"
@@ -194,6 +182,9 @@
     "isexe@2.0.0": [
       "node_modules/cross-spawn/node_modules/isexe"
     ],
+    "signal-exit@4.1.0": [
+      "node_modules/signal-exit"
+    ],
     "@isaacs/cliui@8.0.2": [
       "node_modules/@isaacs/cliui"
     ],
@@ -203,8 +194,17 @@
     "brace-expansion@2.1.0": [
       "node_modules/brace-expansion"
     ],
-    "imurmurhash@0.1.4": [
-      "node_modules/imurmurhash"
+    "safer-buffer@2.1.2": [
+      "node_modules/safer-buffer"
+    ],
+    "ms@2.1.3": [
+      "node_modules/ms"
+    ],
+    "smart-buffer@4.2.0": [
+      "node_modules/smart-buffer"
+    ],
+    "ip-address@10.1.0": [
+      "node_modules/ip-address"
     ],
     "shebang-command@2.0.0": [
       "node_modules/shebang-command"
@@ -212,29 +212,22 @@
     "path-key@3.1.1": [
       "node_modules/path-key"
     ],
-    "string-width@5.1.2": [
-      "node_modules/string-width"
-    ],
-    "strip-ansi@6.0.1": [
-      "node_modules/string-width-cjs/node_modules/strip-ansi",
-      "node_modules/wrap-ansi-cjs/node_modules/strip-ansi",
-      "node_modules/strip-ansi-cjs"
-    ],
-    "emoji-regex@8.0.0": [
-      "node_modules/string-width-cjs/node_modules/emoji-regex",
-      "node_modules/wrap-ansi-cjs/node_modules/emoji-regex"
+    "strip-ansi@7.2.0": [
+      "node_modules/strip-ansi"
     ],
     "ansi-regex@5.0.1": [
-      "node_modules/string-width-cjs/node_modules/ansi-regex",
       "node_modules/strip-ansi-cjs/node_modules/ansi-regex",
-      "node_modules/wrap-ansi-cjs/node_modules/ansi-regex"
-    ],
-    "strip-ansi@7.2.0": [
-      "node_modules/strip-ansi"
+      "node_modules/wrap-ansi-cjs/node_modules/ansi-regex",
+      "node_modules/string-width-cjs/node_modules/ansi-regex"
     ],
     "wrap-ansi@8.1.0": [
       "node_modules/wrap-ansi"
     ],
+    "strip-ansi@6.0.1": [
+      "node_modules/wrap-ansi-cjs/node_modules/strip-ansi",
+      "node_modules/string-width-cjs/node_modules/strip-ansi",
+      "node_modules/strip-ansi-cjs"
+    ],
     "string-width@4.2.3": [
       "node_modules/wrap-ansi-cjs/node_modules/string-width",
       "node_modules/string-width-cjs"
@@ -242,30 +235,37 @@
     "ansi-styles@4.3.0": [
       "node_modules/wrap-ansi-cjs/node_modules/ansi-styles"
     ],
+    "emoji-regex@8.0.0": [
+      "node_modules/wrap-ansi-cjs/node_modules/emoji-regex",
+      "node_modules/string-width-cjs/node_modules/emoji-regex"
+    ],
+    "string-width@5.1.2": [
+      "node_modules/string-width"
+    ],
     "balanced-match@1.0.2": [
       "node_modules/balanced-match"
     ],
     "shebang-regex@3.0.0": [
       "node_modules/shebang-regex"
     ],
-    "eastasianwidth@0.2.0": [
-      "node_modules/eastasianwidth"
-    ],
-    "emoji-regex@9.2.2": [
-      "node_modules/emoji-regex"
-    ],
-    "is-fullwidth-code-point@3.0.0": [
-      "node_modules/is-fullwidth-code-point"
-    ],
     "ansi-regex@6.2.2": [
       "node_modules/ansi-regex"
     ],
     "ansi-styles@6.2.3": [
       "node_modules/ansi-styles"
     ],
+    "is-fullwidth-code-point@3.0.0": [
+      "node_modules/is-fullwidth-code-point"
+    ],
     "color-convert@2.0.1": [
       "node_modules/color-convert"
     ],
+    "eastasianwidth@0.2.0": [
+      "node_modules/eastasianwidth"
+    ],
+    "emoji-regex@9.2.2": [
+      "node_modules/emoji-regex"
+    ],
     "color-name@1.1.4": [
       "node_modules/color-name"
     ],
@@ -286,10 +286,10 @@
     ]
   },
   "nodeLinker": "hoisted",
-  "packageManager": "pnpm@10.33.0",
+  "packageManager": "pnpm@10.33.1",
   "pendingBuilds": [],
   "publicHoistPattern": [],
-  "prunedAt": "Wed, 22 Apr 2026 09:31:19 GMT",
+  "prunedAt": "Thu, 23 Apr 2026 11:46:36 GMT",
   "registries": {
     "default": "https://registry.npmjs.org/",
     "@jsr": "https://npm.jsr.io/"

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,5 +1,5 @@
 {
-  "lastValidatedTimestamp": 1776850279834,
+  "lastValidatedTimestamp": 1776944796156,
   "projects": {},
   "pnpmfiles": [],
   "settings": {

package/dist/pnpm.cjs

@@ -2973,7 +2973,7 @@ var require_lib4 = __commonJS({
     var load_json_file_1 = __importDefault2(require_load_json_file());
     var defaultManifest = {
       name: true ? "pnpm" : "pnpm",
-      version: true ? "10.33.1" : "0.0.0"
+      version: true ? "10.33.2" : "0.0.0"
     };
     var pkgJson;
     if (require.main == null) {
@@ -164609,6 +164609,7 @@ var require_nodeExecPath = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.getNodeExecPath = getNodeExecPath;
     var fs_1 = require("fs");
+    var cli_meta_1 = require_lib4();
     var which_1 = __importDefault2(require_lib21());
     async function getNodeExecPath() {
       try {
@@ -164617,6 +164618,8 @@ var require_nodeExecPath = __commonJS({
       } catch (err) {
         if (err["code"] !== "ENOENT")
           throw err;
+        if ((0, cli_meta_1.detectIfCurrentPkgIsExecutable)())
+          return void 0;
         return process.env.NODE ?? process.execPath;
       }
     }
@@ -165196,7 +165199,7 @@ var require_installDeps = __commonJS({
       };
       if (opts.global && opts.pnpmHomeDir != null) {
         const nodeExecPath = await (0, nodeExecPath_js_1.getNodeExecPath)();
-        if ((0, is_subdir_1.default)(opts.pnpmHomeDir, nodeExecPath)) {
+        if (nodeExecPath != null && (0, is_subdir_1.default)(opts.pnpmHomeDir, nodeExecPath)) {
           installOpts["nodeExecPath"] = nodeExecPath;
         }
       }
@@ -181071,10 +181074,11 @@ var require_lib179 = __commonJS({
     exports2.runPnpmCli = runPnpmCli;
     var path_1 = __importDefault2(require("path"));
     var execa_1 = require_lib18();
-    function runPnpmCli(command, { cwd }) {
+    function runPnpmCli(command, { cwd, env }) {
       const execOpts = {
         cwd,
-        stdio: "inherit"
+        stdio: "inherit",
+        ...env ? { env } : {}
       };
       const execFileName = path_1.default.basename(process.execPath).toLowerCase();
       if (execFileName === "pnpm" || execFileName === "pnpm.exe") {
@@ -181152,8 +181156,28 @@ var require_installPnpmToTools = __commonJS({
           // We want to avoid symlinks because of the rename step,
           // which breaks the junctions on Windows.
           "--config.node-linker=hoisted",
-          "--config.bin=bin"
-        ], { cwd: stage });
+          "--config.bin=bin",
+          // This is an isolated install into `stage` and must not inherit the
+          // caller's workspace context. Without this, the child's workspace
+          // walk-up from `stage` can discover an ancestor pnpm-workspace.yaml
+          // and treat the caller's project as the workspace root — breaking the
+          // add (it's outside the workspace's packages list) and, before the env
+          // guards below existed, picking up the caller's packageManager field
+          // and re-entering switchCliVersion for a fork bomb. See pnpm/pnpm#11337.
+          "--ignore-workspace"
+        ], {
+          cwd: stage,
+          // Defense in depth against re-entering switchCliVersion in the child,
+          // in case any future code path surfaces a wantedPackageManager without
+          // going through workspace discovery. Both env-var names are set so the
+          // guard works regardless of whether the child reads pnpm's v10
+          // (npm_config_*) or v11+ (pnpm_config_*) convention.
+          env: {
+            ...process.env,
+            npm_config_manage_package_manager_versions: "false",
+            pnpm_config_pm_on_fail: "ignore"
+          }
+        });
         if (currentPkgName === "@pnpm/exe") {
           linkExePlatformBinary(stage);
         }
@@ -201715,7 +201739,12 @@ var require_switchCliVersion = __commonJS({
         env: {
           ...process.env,
           [pnpmEnv.name]: pnpmEnv.value,
-          npm_config_manage_package_manager_versions: "false"
+          // Disable the target pnpm's own package-manager-version management so
+          // it doesn't try to switch again. We set both names because v10 reads
+          // npm_config_* while v11+ reads pnpm_config_*, and this spawn may
+          // target either major.
+          npm_config_manage_package_manager_versions: "false",
+          pnpm_config_pm_on_fail: "ignore"
         }
       });
       if (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pnpm",
-  "version": "10.33.1",
+  "version": "10.33.2",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",