pnpm 11.0.0 → 11.0.1

package/dist/pnpm.mjs

@@ -1000,7 +1000,7 @@ var init_lib2 = __esm({
     "use strict";
     defaultManifest = {
       name: true ? "pnpm" : "pnpm",
-      version: true ? "11.0.0" : "0.0.0"
+      version: true ? "11.0.1" : "0.0.0"
     };
     pkgJson = defaultManifest;
     packageManager = {
@@ -12178,7 +12178,7 @@ var require_npa = __commonJS({
     module2.exports.resolve = resolve3;
     module2.exports.Result = Result;
     var HostedGit2;
-    var semver50;
+    var semver51;
     var path208;
     var validatePackageName2;
     var os15;
@@ -12433,9 +12433,9 @@ var require_npa = __commonJS({
       const spec = res.rawSpec === "" ? "latest" : res.rawSpec;
       res.saveSpec = null;
       res.fetchSpec = spec;
-      if (!semver50) semver50 = require_semver2();
-      const version2 = semver50.valid(spec, true);
-      const range = semver50.validRange(spec, true);
+      if (!semver51) semver51 = require_semver2();
+      const version2 = semver51.valid(spec, true);
+      const range = semver51.validRange(spec, true);
       if (version2) {
         res.type = "version";
       } else if (range) {
@@ -22828,7 +22828,7 @@ var require_lib6 = __commonJS({
 var require_version_selector_type = __commonJS({
   "../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/version-selector-type/3.0.0/bb5374a17b8844b39694ff4483fb613e6fef31ded46a26ae6d88676a1b27fe57/node_modules/version-selector-type/index.js"(exports2, module2) {
     "use strict";
-    var semver50 = require_semver2();
+    var semver51 = require_semver2();
     module2.exports = (selector) => versionSelectorType3(true, selector);
     module2.exports.strict = (selector) => versionSelectorType3(false, selector);
     function versionSelectorType3(loose, selector) {
@@ -22836,13 +22836,13 @@ var require_version_selector_type = __commonJS({
         throw new TypeError("`selector` should be a string");
       }
       let normalizedSelector;
-      if (normalizedSelector = semver50.valid(selector, loose)) {
+      if (normalizedSelector = semver51.valid(selector, loose)) {
         return {
           normalized: normalizedSelector,
           type: "version"
         };
       }
-      if (normalizedSelector = semver50.validRange(selector, loose)) {
+      if (normalizedSelector = semver51.validRange(selector, loose)) {
         return {
           normalized: normalizedSelector,
           type: "range"
@@ -42166,6 +42166,9 @@ function assertValidWorkspaceManifestCatalogs(manifest) {
     if (Array.isArray(catalog)) {
       throw new InvalidWorkspaceManifestError(`Expected named catalog ${catalogName} to be an object, but found - array`);
     }
+    if (catalog === null) {
+      throw new InvalidWorkspaceManifestError(`Expected named catalog ${catalogName} to be an object, but found - null`);
+    }
     if (typeof catalog !== "object") {
       throw new InvalidWorkspaceManifestError(`Expected named catalog ${catalogName} to be an object, but found - ${typeof catalog}`);
     }
@@ -193979,7 +193982,7 @@ function createOverrides(advisories) {
       continue;
     entries.push([`${advisory.module_name}@${advisory.vulnerable_versions}`, caretRangeForPatched(advisory.patched_versions)]);
   }
-  return Object.fromEntries(entries);
+  return sortDirectKeys(Object.fromEntries(entries));
 }
 function caretRangeForPatched(patchedRange) {
   const min = import_semver36.default.minVersion(patchedRange);
@@ -194004,6 +194007,7 @@ var init_fix = __esm({
     "use strict";
     init_lib99();
     init_lib140();
+    init_lib76();
     import_semver36 = __toESM(require_semver2(), 1);
   }
 });
@@ -195668,7 +195672,7 @@ async function walkStep(step2, parentPurl, depTypes, componentsMap, relationship
       return;
     const integrity = pkgSnapshot.resolution.integrity;
     const resolution = pkgSnapshotToResolution(depPath, pkgSnapshot, opts2.registries);
-    const tarballUrl = resolution.tarball;
+    const tarballUrl = resolution.tarball ?? gitDownloadUrl(resolution);
     let metadata = {};
     if (metadataOpts) {
       metadata = await getPkgMetadata(depPath, pkgSnapshot, opts2.registries, metadataOpts);
@@ -195688,6 +195692,13 @@ async function walkStep(step2, parentPurl, depTypes, componentsMap, relationship
     await walkStep(subStep, purl, depTypes, componentsMap, relationships, opts2, metadataOpts);
   }));
 }
+function gitDownloadUrl(resolution) {
+  if (resolution.type !== "git")
+    return void 0;
+  const needsGitPlusPrefix = resolution.repo.includes("://") && !resolution.repo.startsWith("git+");
+  const prefix = needsGitPlusPrefix ? "git+" : "";
+  return `${prefix}${resolution.repo}#${resolution.commit}`;
+}
 var init_collectComponents = __esm({
   "../deps/compliance/sbom/lib/collectComponents.js"() {
     "use strict";
@@ -201683,22 +201694,27 @@ async function handler31(opts2, params) {
     if (opts2.wantedPackageManager?.version !== resolution.manifest.version) {
       const { manifest, writeProjectManifest: writeProjectManifest2 } = await readProjectManifest(opts2.rootProjectManifestDir);
       if (manifest.devEngines?.packageManager) {
-        if (Array.isArray(manifest.devEngines.packageManager)) {
-          const pnpmEntry = manifest.devEngines.packageManager.find((e) => e.name === "pnpm");
-          if (pnpmEntry) {
-            const updated = updateVersionConstraint(pnpmEntry.version, resolution.manifest.version);
-            if (updated !== pnpmEntry.version) {
-              pnpmEntry.version = updated;
-              await writeProjectManifest2(manifest);
-            }
-          }
-        } else if (manifest.devEngines.packageManager.name === "pnpm") {
-          const updated = updateVersionConstraint(manifest.devEngines.packageManager.version, resolution.manifest.version);
-          if (updated !== manifest.devEngines.packageManager.version) {
-            manifest.devEngines.packageManager.version = updated;
-            await writeProjectManifest2(manifest);
-          }
-        }
+        let manifestChanged = false;
+        const legacyPm = manifest.packageManager != null ? parsePackageManager(manifest.packageManager) : void 0;
+        const legacyPinsPnpm = legacyPm?.name === "pnpm" && legacyPm.version != null;
+        const devEnginesPm = manifest.devEngines.packageManager;
+        const pnpmEntry = Array.isArray(devEnginesPm) ? devEnginesPm.find((e) => e.name === "pnpm") : devEnginesPm.name === "pnpm" ? devEnginesPm : void 0;
+        if (pnpmEntry) {
+          const updated = legacyPinsPnpm ? resolution.manifest.version : updateVersionConstraint(pnpmEntry.version, resolution.manifest.version);
+          if (updated !== pnpmEntry.version) {
+            pnpmEntry.version = updated;
+            manifestChanged = true;
+          }
+        }
+        if (legacyPinsPnpm) {
+          const newLegacy = `pnpm@${resolution.manifest.version}`;
+          if (manifest.packageManager !== newLegacy) {
+            manifest.packageManager = newLegacy;
+            manifestChanged = true;
+          }
+        }
+        if (manifestChanged)
+          await writeProjectManifest2(manifest);
         const store2 = await createStoreController(opts2);
         await resolvePackageManagerIntegrities(resolution.manifest.version, {
           registries: opts2.registries,
@@ -223326,7 +223342,7 @@ var require_npa2 = __commonJS({
     var path208 = isWindows15 ? __require("node:path/win32") : __require("node:path");
     var { homedir } = __require("node:os");
     var HostedGit2 = require_lib12();
-    var semver50 = require_semver2();
+    var semver51 = require_semver2();
     var validatePackageName2 = require_lib22();
     var { log: log3 } = require_lib10();
     var hasSlashes = isWindows15 ? /\\|[/]/ : /[/]/;
@@ -223691,8 +223707,8 @@ var require_npa2 = __commonJS({
       const spec = res.rawSpec.trim();
       res.saveSpec = null;
       res.fetchSpec = spec;
-      const version2 = semver50.valid(spec, true);
-      const range = semver50.validRange(spec, true);
+      const version2 = semver51.valid(spec, true);
+      const range = semver51.validRange(spec, true);
       if (version2) {
         res.type = "version";
       } else if (range) {
@@ -225970,9 +225986,9 @@ var require_get_options = __commonJS({
 // ../../../../setup-pnpm/node_modules/.bin/store/v11/links/@npmcli/fs/5.0.0/4cafda806c7bf4ef531e7305fbcb8288c728be229f52fd03536e072af5fe3626/node_modules/@npmcli/fs/lib/common/node.js
 var require_node2 = __commonJS({
   "../../../../setup-pnpm/node_modules/.bin/store/v11/links/@npmcli/fs/5.0.0/4cafda806c7bf4ef531e7305fbcb8288c728be229f52fd03536e072af5fe3626/node_modules/@npmcli/fs/lib/common/node.js"(exports2, module2) {
-    var semver50 = require_semver2();
+    var semver51 = require_semver2();
     var satisfies3 = (range) => {
-      return semver50.satisfies(process.version, range, { includePrerelease: true });
+      return semver51.satisfies(process.version, range, { includePrerelease: true });
     };
     module2.exports = {
       satisfies: satisfies3
@@ -235698,7 +235714,7 @@ var require_spawn = __commonJS({
 // ../../../../setup-pnpm/node_modules/.bin/store/v11/links/@npmcli/git/7.0.2/fcff604bc4ab9d779aa0cb3b1a89e49c8a830d5da2b6bf098a38c578a421b59e/node_modules/@npmcli/git/lib/lines-to-revs.js
 var require_lines_to_revs = __commonJS({
   "../../../../setup-pnpm/node_modules/.bin/store/v11/links/@npmcli/git/7.0.2/fcff604bc4ab9d779aa0cb3b1a89e49c8a830d5da2b6bf098a38c578a421b59e/node_modules/@npmcli/git/lib/lines-to-revs.js"(exports2, module2) {
-    var semver50 = require_semver2();
+    var semver51 = require_semver2();
     module2.exports = (lines) => finish(lines.reduce(linesToRevsReducer, {
       versions: {},
       "dist-tags": {},
@@ -235795,8 +235811,8 @@ var require_lines_to_revs = __commonJS({
       revs.refs[doc.rawRef] = doc;
       if (doc.type === "tag") {
         const match = !doc.ref.endsWith("^{}") && doc.ref.match(/v?(\d+\.\d+\.\d+(?:[-+].+)?)$/);
-        if (match && semver50.valid(match[1], true)) {
-          revs.versions[semver50.clean(match[1], true)] = doc;
+        if (match && semver51.valid(match[1], true)) {
+          revs.versions[semver51.clean(match[1], true)] = doc;
         }
       }
       return revs;
@@ -236054,7 +236070,7 @@ var require_dev_engines = __commonJS({
 // ../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/npm-install-checks/8.0.0/8ae449895bd2a6446a641a7633b6e675f92cb82df40fe4e25fb59f55325ac30c/node_modules/npm-install-checks/lib/index.js
 var require_lib43 = __commonJS({
   "../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/npm-install-checks/8.0.0/8ae449895bd2a6446a641a7633b6e675f92cb82df40fe4e25fb59f55325ac30c/node_modules/npm-install-checks/lib/index.js"(exports2, module2) {
-    var semver50 = require_semver2();
+    var semver51 = require_semver2();
     var currentEnv = require_current_env();
     var { checkDevEngines } = require_dev_engines();
     var checkEngine2 = (target2, npmVer, nodeVer, force = false) => {
@@ -236064,8 +236080,8 @@ var require_lib43 = __commonJS({
       if (!eng) {
         return;
       }
-      const nodeFail = nodev && eng.node && !semver50.satisfies(nodev, eng.node, opt);
-      const npmFail = npmVer && eng.npm && !semver50.satisfies(npmVer, eng.npm, opt);
+      const nodeFail = nodev && eng.node && !semver51.satisfies(nodev, eng.node, opt);
+      const npmFail = npmVer && eng.npm && !semver51.satisfies(npmVer, eng.npm, opt);
       if (nodeFail || npmFail) {
         throw Object.assign(new Error("Unsupported engine"), {
           pkgid: target2._id,
@@ -236192,7 +236208,7 @@ var require_lib45 = __commonJS({
   "../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/npm-pick-manifest/11.0.3/5ad64713f08c0dadca6f376eb2187b2fbcbe9469fdf3dfe99e5f5010003b82c0/node_modules/npm-pick-manifest/lib/index.js"(exports2, module2) {
     "use strict";
     var npa11 = require_npa2();
-    var semver50 = require_semver2();
+    var semver51 = require_semver2();
     var { checkEngine: checkEngine2 } = require_lib43();
     var normalizeBin = require_lib44();
     var engineOk = (manifest, npmVersion, nodeVersion) => {
@@ -236205,7 +236221,7 @@ var require_lib45 = __commonJS({
     };
     var isBefore = (verTimes, ver, time) => !verTimes || !verTimes[ver] || Date.parse(verTimes[ver]) <= time;
     var avoidSemverOpt = { includePrerelease: true, loose: true };
-    var shouldAvoid = (ver, avoid) => avoid && semver50.satisfies(ver, avoid, avoidSemverOpt);
+    var shouldAvoid = (ver, avoid) => avoid && semver51.satisfies(ver, avoid, avoidSemverOpt);
     var decorateAvoid = (result2, avoid) => result2 && shouldAvoid(result2.version, avoid) ? { ...result2, _shouldAvoid: true } : result2;
     var pickManifest = (packument, wanted, opts2) => {
       const {
@@ -236271,13 +236287,13 @@ var require_lib45 = __commonJS({
         }
       }
       if (wanted && type4 === "version") {
-        const ver = semver50.clean(wanted, { loose: true });
+        const ver = semver51.clean(wanted, { loose: true });
         const mani = versions[ver] || staged[ver] || restricted[ver];
         return isBefore(verTimes, ver, time) ? decorateAvoid(mani, avoid) : null;
       }
       const range = type4 === "range" ? wanted : "*";
       const defaultVer = distTags[defaultTag];
-      if (defaultVer && (range === "*" || semver50.satisfies(defaultVer, range, { loose: true })) && !restricted[defaultVer] && !shouldAvoid(defaultVer, avoid)) {
+      if (defaultVer && (range === "*" || semver51.satisfies(defaultVer, range, { loose: true })) && !restricted[defaultVer] && !shouldAvoid(defaultVer, avoid)) {
         const mani = versions[defaultVer];
         const ok = mani && isBefore(verTimes, defaultVer, time) && engineOk(mani, npmVersion, nodeVersion) && !mani.deprecated && !staged[defaultVer];
         if (ok) {
@@ -236296,7 +236312,7 @@ var require_lib45 = __commonJS({
         });
       }
       const sortSemverOpt = { loose: true };
-      const entries = allEntries.filter(([ver]) => semver50.satisfies(ver, range, { loose: true })).sort((a2, b) => {
+      const entries = allEntries.filter(([ver]) => semver51.satisfies(ver, range, { loose: true })).sort((a2, b) => {
         const [vera, mania] = a2;
         const [verb, manib] = b;
         const notavoida = !shouldAvoid(vera, avoid);
@@ -236309,7 +236325,7 @@ var require_lib45 = __commonJS({
         const notdeprb = !manib.deprecated;
         const enginea = engineOk(mania, npmVersion, nodeVersion);
         const engineb = engineOk(manib, npmVersion, nodeVersion);
-        return notavoidb - notavoida || notrestrb - notrestra || notstageb - notstagea || (notdeprb && engineb) - (notdepra && enginea) || engineb - enginea || notdeprb - notdepra || semver50.rcompare(vera, verb, sortSemverOpt);
+        return notavoidb - notavoida || notrestrb - notrestra || notstageb - notstagea || (notdeprb && engineb) - (notdepra && enginea) || engineb - enginea || notdeprb - notdepra || semver51.rcompare(vera, verb, sortSemverOpt);
       });
       return decorateAvoid(entries[0] && entries[0][1], avoid);
     };
@@ -246879,7 +246895,7 @@ var require_publish = __commonJS({
     var npa11 = require_npa2();
     var PackageJson = require_lib47();
     var { log: log3 } = require_lib10();
-    var semver50 = require_semver2();
+    var semver51 = require_semver2();
     var { URL: URL7 } = __require("node:url");
     var ssri6 = require_lib6();
     var ciInfo2 = require_ci_info();
@@ -246935,7 +246951,7 @@ Remove the 'private' field from the package.json to publish it.`),
         manifestInput._npmVersion = npmVersion;
       }
       const manifest = await new PackageJson().fromContent(manifestInput).normalize({ steps }).then((p) => p.content);
-      const version2 = semver50.clean(manifest.version);
+      const version2 = semver51.clean(manifest.version);
       if (!version2) {
         throw Object.assign(
           new Error("invalid semver: " + manifest.version),
@@ -247062,7 +247078,7 @@ var require_unpublish = __commonJS({
     var { URL: URL7 } = __require("node:url");
     var npa11 = require_npa2();
     var npmFetch = require_lib39();
-    var semver50 = require_semver2();
+    var semver51 = require_semver2();
     var getPathname = (tarball, registry) => {
       const registryUrl = new URL7(registry).pathname.slice(1);
       let tarballUrl = new URL7(tarball).pathname.slice(1);
@@ -247112,7 +247128,7 @@ var require_unpublish = __commonJS({
           if (latestVer === version2) {
             pkg["dist-tags"].latest = Object.keys(
               allVersions
-            ).sort(semver50.compareLoose).pop();
+            ).sort(semver51.compareLoose).pop();
           }
           delete pkg._revisions;
           delete pkg._attachments;
@@ -250409,7 +250425,7 @@ var init_clean = __esm({
     shorthands19 = {
       l: "--lockfile"
     };
-    PNPM_HIDDEN_ENTRIES = /* @__PURE__ */ new Set([".bin", ".modules.yaml", ".pnpm"]);
+    PNPM_HIDDEN_ENTRIES = /* @__PURE__ */ new Set([".bin", ".modules.yaml", ".pnpm", ".pnpm-workspace-state-v1.json"]);
   }
 });
 
@@ -268571,6 +268587,50 @@ var init_switchCliVersion = __esm({
   }
 });
 
+// lib/syncEnvLockfile.js
+async function syncEnvLockfile(config, context) {
+  const pm2 = context.wantedPackageManager;
+  if (pm2 == null || pm2.name !== "pnpm" || pm2.version == null)
+    return;
+  if (!shouldPersistLockfile(pm2))
+    return;
+  if (!import_semver53.default.satisfies(packageManager.version, pm2.version, { includePrerelease: true }))
+    return;
+  const envLockfile = await readEnvLockfile(context.rootProjectManifestDir);
+  if (envLockfile == null)
+    return;
+  const lockedVersion = envLockfile.importers["."].packageManagerDependencies?.["pnpm"]?.version;
+  if (lockedVersion == null)
+    return;
+  if (import_semver53.default.satisfies(lockedVersion, pm2.version, { includePrerelease: true }))
+    return;
+  const store = await createStoreController({ ...config, ...context });
+  try {
+    await resolvePackageManagerIntegrities(packageManager.version, {
+      envLockfile,
+      registries: config.registries,
+      rootDir: context.rootProjectManifestDir,
+      storeController: store.ctrl,
+      storeDir: store.dir,
+      save: true
+    });
+  } finally {
+    await store.ctrl.close();
+  }
+}
+var import_semver53;
+var init_syncEnvLockfile = __esm({
+  "lib/syncEnvLockfile.js"() {
+    "use strict";
+    init_lib2();
+    init_lib125();
+    init_lib78();
+    init_lib89();
+    import_semver53 = __toESM(require_semver2(), 1);
+    init_shouldPersistLockfile();
+  }
+});
+
 // lib/main.js
 var main_exports = {};
 __export(main_exports, {
@@ -268597,7 +268657,7 @@ async function main4(inputArgv) {
     process.exitCode = 1;
     return;
   }
-  if (unknownOptions.size > 0 && !fallbackCommandUsed && !(cmd && NOT_IMPLEMENTED_COMMAND_SET.has(cmd))) {
+  if (unknownOptions.size > 0 && !(cmd && NOT_IMPLEMENTED_COMMAND_SET.has(cmd))) {
     printError(formatUnknownOptionsError(unknownOptions), `For help, run: pnpm help${cmd ? ` ${cmd}` : ""}`);
     process.exitCode = 1;
     return;
@@ -268619,13 +268679,14 @@ async function main4(inputArgv) {
     }));
     if (!isExecutedByCorepack() && cmd !== "setup" && context.wantedPackageManager != null && !shouldSkipPmHandling(cmd, cliParams)) {
       const pm2 = context.wantedPackageManager;
-      if (pm2.onFail === "download" && pm2.name === "pnpm") {
-        await switchCliVersion(config, context);
-      } else if (pm2.onFail !== "ignore") {
-        if (cliOptions.global) {
+      if (pm2.onFail !== "ignore") {
+        if (pm2.name === "pnpm" && pm2.onFail === "download") {
+          await switchCliVersion(config, context);
+        } else if (cliOptions.global) {
           globalWarn("Using --global skips the package manager check for this project");
         } else {
           checkPackageManager(pm2);
+          await syncEnvLockfile(config, context);
         }
       }
     }
@@ -268849,7 +268910,7 @@ function checkPackageManager(pm2) {
     globalWarn(msg);
   } else if (pm2.version) {
     const currentPnpmVersion = packageManager.name === "pnpm" ? packageManager.version : void 0;
-    if (currentPnpmVersion && !import_semver53.default.satisfies(currentPnpmVersion, pm2.version, { includePrerelease: true })) {
+    if (currentPnpmVersion && !import_semver54.default.satisfies(currentPnpmVersion, pm2.version, { includePrerelease: true })) {
       const msg = `This project is configured to use ${pm2.version} of pnpm. Your current pnpm is v${currentPnpmVersion}`;
       if (shouldError) {
         throw new PnpmError("BAD_PM_VERSION", msg, {
@@ -268861,7 +268922,7 @@ function checkPackageManager(pm2) {
     }
   }
 }
-var import_loud_rejection, import_semver53, REPORTER_INITIALIZED;
+var import_loud_rejection, import_semver54, REPORTER_INITIALIZED;
 var init_main2 = __esm({
   "lib/main.js"() {
     "use strict";
@@ -268875,7 +268936,7 @@ var init_main2 = __esm({
     init_source2();
     import_loud_rejection = __toESM(require_loud_rejection(), 1);
     init_es();
-    import_semver53 = __toESM(require_semver2(), 1);
+    import_semver54 = __toESM(require_semver2(), 1);
     init_checkForUpdates();
     init_cmd();
     init_formatError();
@@ -268883,6 +268944,7 @@ var init_main2 = __esm({
     init_parseCliArgs();
     init_reporter();
     init_switchCliVersion();
+    init_syncEnvLockfile();
     if (!global["pnpm__startedAt"]) {
       global["pnpm__startedAt"] = Date.now();
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pnpm",
-  "version": "11.0.0",
+  "version": "11.0.1",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",