pnpm 11.22.0 → 11.24.0

package/dist/worker.js

@@ -6904,7 +6904,7 @@ function filesIncludeInstallScripts(filesIndex) {
 var LOCKFILE_MAJOR_VERSION = "9";
 var LOCKFILE_VERSION = `${LOCKFILE_MAJOR_VERSION}.0`;
 var ENGINE_NAME = `${process.platform};${process.arch};node${process.version.split(".")[0].substring(1)}`;
-var BUILTIN_NAMED_REGISTRIES = Object.freeze({
+var BUILTIN_REGISTRIES_BY_PREFIX = Object.freeze({
   gh: "https://npm.pkg.github.com/",
   npmjs: "https://registry.npmjs.org/"
 });
@@ -8040,7 +8040,12 @@ function contentPathFromHex(fileType, hex) {
 }
 
 // ../store/cafs/lib/checkPkgFilesIntegrity.js
-global["verifiedFileIntegrity"] = 0;
+var verifiedFileIntegrity = { files: 0, ms: 0 };
+function takeVerifiedFileIntegrity() {
+  const taken = verifiedFileIntegrity;
+  verifiedFileIntegrity = { files: 0, ms: 0 };
+  return taken;
+}
 function checkPkgFilesIntegrity(storeDir, pkgIndex) {
   const verifiedFilesCache = /* @__PURE__ */ new Set();
   const _checkFilesIntegrity = checkFilesIntegrity.bind(null, verifiedFilesCache, storeDir, pkgIndex.algo);
@@ -8129,7 +8134,7 @@ function verifyFile(filename, fstat, algorithm) {
       rimrafSync(filename);
       return false;
     }
-    const passed = verifyFileIntegrity(filename, { digest: fstat.digest, algorithm });
+    const passed = tallyVerifyFileIntegrity(filename, { digest: fstat.digest, algorithm });
     if (!passed) {
       lib_default.unlinkSync(filename);
     }
@@ -8137,21 +8142,39 @@ function verifyFile(filename, fstat, algorithm) {
   }
   return true;
 }
+function tallyVerifyFileIntegrity(filename, integrity) {
+  const startedAt = performance.now();
+  const data = readFileForIntegrity(filename);
+  if (data == null)
+    return false;
+  const passed = hashMatches(data, integrity);
+  if (passed == null)
+    return false;
+  verifiedFileIntegrity.files++;
+  verifiedFileIntegrity.ms += performance.now() - startedAt;
+  return passed;
+}
 function verifyFileIntegrity(filename, integrity) {
-  global["verifiedFileIntegrity"]++;
-  let data;
+  const data = readFileForIntegrity(filename);
+  if (data == null)
+    return false;
+  return hashMatches(data, integrity) ?? false;
+}
+function readFileForIntegrity(filename) {
   try {
-    data = lib_default.readFileSync(filename);
+    return lib_default.readFileSync(filename);
   } catch (err) {
     if (util4.types.isNativeError(err) && "code" in err && err.code === "ENOENT") {
-      return false;
+      return null;
     }
     throw err;
   }
+}
+function hashMatches(data, integrity) {
   try {
     return crypto3.hash(integrity.algorithm, data, "hex") === integrity.digest;
   } catch {
-    return false;
+    return null;
   }
 }
 function checkFile(filename, checkedAt) {
@@ -11811,6 +11834,7 @@ async function handleMessage(message) {
         if (!pkgFilesIndex) {
           parentPort.postMessage({
             status: "success",
+            verifiedFileIntegrity: takeVerifiedFileIntegrity(),
             value: {
               verified: false,
               pkgFilesIndex: null
@@ -11845,6 +11869,10 @@ If you want to ignore this issue, set strictStorePkgContentCheck to false in you
         parentPort.postMessage({
           status: "success",
           warnings,
+          // Store verification happens here, in the worker, but the
+          // install reports it from the main thread. Hand this worker's
+          // share back with the answer it belongs to.
+          verifiedFileIntegrity: takeVerifiedFileIntegrity(),
           value: {
             verified: verifyResult.passed,
             bundledManifest,
@@ -11871,6 +11899,10 @@ If you want to ignore this issue, set strictStorePkgContentCheck to false in you
   } catch (e) {
     parentPort.postMessage({
       status: "error",
+      // Drained here too: a request that hashed and then threw would
+      // otherwise leave its share in this worker, to be handed to
+      // whichever install asks next.
+      verifiedFileIntegrity: takeVerifiedFileIntegrity(),
       error: {
         code: e.code,
         message: e.message ?? e.toString(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pnpm",
-  "version": "11.22.0",
+  "version": "11.24.0",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",

package/artifacts/exe/dist/node-gyp-bin/node-gyp

@@ -1,6 +0,0 @@
-#!/usr/bin/env sh
-if [ "x$npm_config_node_gyp" = "x" ]; then
-  node "`dirname "$0"`/../node_modules/node-gyp/bin/node-gyp.js" "$@"
-else
-  "$npm_config_node_gyp" "$@"
-fi

package/artifacts/exe/dist/node-gyp-bin/node-gyp.cmd

@@ -1,5 +0,0 @@
-if not defined npm_config_node_gyp (
-  node "%~dp0\..\node_modules\node-gyp\bin\node-gyp.js" %*
-) else (
-  node "%npm_config_node_gyp%" %*
-)

package/artifacts/exe/dist/node_modules/.bin/node-gyp

@@ -1,50 +0,0 @@
-#!/bin/sh
-# Resolve $0 through symlinks so basedir is the shim's real directory.
-# Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
-link="$0"
-hops=0
-while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
-  hops=$((hops+1))
-  target=$(readlink "$link")
-  case "$target" in
-    /*) link="$target" ;;
-    *)  link="$(dirname "$link")/$target" ;;
-  esac
-done
-basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
-basedir_win="$basedir"
-exe=""
-msys=""
-
-case `uname -a` in
-  *CYGWIN*|*MINGW*|*MSYS*)
-    if command -v cygpath > /dev/null 2>&1; then
-      basedir_win=`cygpath -w "$basedir"`
-    fi
-    exe=".exe"
-    msys="true"
-  ;;
-  *WSL2*)
-    if command -v wslpath > /dev/null 2>&1; then
-      basedir_win="$(wslpath -w "$basedir" 2> /dev/null)"
-      if [ $? -ne 0 ] || [ -z "$basedir_win" ]; then
-        basedir_win="$basedir"
-      else
-        exe=".exe"
-      fi
-    fi
-  ;;
-esac
-
-if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
-  exec "$basedir/node.exe"  "$basedir_win/../node-gyp/bin/node-gyp.js" "$@"
-elif [ -x "$basedir/node" ]; then
-  exec "$basedir/node"  "$basedir/../node-gyp/bin/node-gyp.js" "$@"
-elif command -v node >/dev/null 2>&1; then
-  exec node  "$basedir/../node-gyp/bin/node-gyp.js" "$@"
-elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then
-  exec node.exe  "$basedir_win/../node-gyp/bin/node-gyp.js" "$@"
-else
-  exec node  "$basedir/../node-gyp/bin/node-gyp.js" "$@"
-fi
-# cmd-shim-target=/Users/runner/work/pnpm/pnpm/pnpm11/pnpm/temp-deploy/node_modules/node-gyp/./bin/node-gyp.js

package/artifacts/exe/dist/node_modules/.bin/node-which

@@ -1,50 +0,0 @@
-#!/bin/sh
-# Resolve $0 through symlinks so basedir is the shim's real directory.
-# Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
-link="$0"
-hops=0
-while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
-  hops=$((hops+1))
-  target=$(readlink "$link")
-  case "$target" in
-    /*) link="$target" ;;
-    *)  link="$(dirname "$link")/$target" ;;
-  esac
-done
-basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
-basedir_win="$basedir"
-exe=""
-msys=""
-
-case `uname -a` in
-  *CYGWIN*|*MINGW*|*MSYS*)
-    if command -v cygpath > /dev/null 2>&1; then
-      basedir_win=`cygpath -w "$basedir"`
-    fi
-    exe=".exe"
-    msys="true"
-  ;;
-  *WSL2*)
-    if command -v wslpath > /dev/null 2>&1; then
-      basedir_win="$(wslpath -w "$basedir" 2> /dev/null)"
-      if [ $? -ne 0 ] || [ -z "$basedir_win" ]; then
-        basedir_win="$basedir"
-      else
-        exe=".exe"
-      fi
-    fi
-  ;;
-esac
-
-if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
-  exec "$basedir/node.exe"  "$basedir_win/../which/bin/which.js" "$@"
-elif [ -x "$basedir/node" ]; then
-  exec "$basedir/node"  "$basedir/../which/bin/which.js" "$@"
-elif command -v node >/dev/null 2>&1; then
-  exec node  "$basedir/../which/bin/which.js" "$@"
-elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then
-  exec node.exe  "$basedir_win/../which/bin/which.js" "$@"
-else
-  exec node  "$basedir/../which/bin/which.js" "$@"
-fi
-# cmd-shim-target=/Users/runner/work/pnpm/pnpm/pnpm11/pnpm/temp-deploy/node_modules/which/./bin/which.js

package/artifacts/exe/dist/node_modules/.bin/nopt

@@ -1,50 +0,0 @@
-#!/bin/sh
-# Resolve $0 through symlinks so basedir is the shim's real directory.
-# Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
-link="$0"
-hops=0
-while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
-  hops=$((hops+1))
-  target=$(readlink "$link")
-  case "$target" in
-    /*) link="$target" ;;
-    *)  link="$(dirname "$link")/$target" ;;
-  esac
-done
-basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
-basedir_win="$basedir"
-exe=""
-msys=""
-
-case `uname -a` in
-  *CYGWIN*|*MINGW*|*MSYS*)
-    if command -v cygpath > /dev/null 2>&1; then
-      basedir_win=`cygpath -w "$basedir"`
-    fi
-    exe=".exe"
-    msys="true"
-  ;;
-  *WSL2*)
-    if command -v wslpath > /dev/null 2>&1; then
-      basedir_win="$(wslpath -w "$basedir" 2> /dev/null)"
-      if [ $? -ne 0 ] || [ -z "$basedir_win" ]; then
-        basedir_win="$basedir"
-      else
-        exe=".exe"
-      fi
-    fi
-  ;;
-esac
-
-if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
-  exec "$basedir/node.exe"  "$basedir_win/../nopt/bin/nopt.js" "$@"
-elif [ -x "$basedir/node" ]; then
-  exec "$basedir/node"  "$basedir/../nopt/bin/nopt.js" "$@"
-elif command -v node >/dev/null 2>&1; then
-  exec node  "$basedir/../nopt/bin/nopt.js" "$@"
-elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then
-  exec node.exe  "$basedir_win/../nopt/bin/nopt.js" "$@"
-else
-  exec node  "$basedir/../nopt/bin/nopt.js" "$@"
-fi
-# cmd-shim-target=/Users/runner/work/pnpm/pnpm/pnpm11/pnpm/temp-deploy/node_modules/nopt/bin/nopt.js

package/artifacts/exe/dist/node_modules/.bin/semver

@@ -1,50 +0,0 @@
-#!/bin/sh
-# Resolve $0 through symlinks so basedir is the shim's real directory.
-# Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
-link="$0"
-hops=0
-while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
-  hops=$((hops+1))
-  target=$(readlink "$link")
-  case "$target" in
-    /*) link="$target" ;;
-    *)  link="$(dirname "$link")/$target" ;;
-  esac
-done
-basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
-basedir_win="$basedir"
-exe=""
-msys=""
-
-case `uname -a` in
-  *CYGWIN*|*MINGW*|*MSYS*)
-    if command -v cygpath > /dev/null 2>&1; then
-      basedir_win=`cygpath -w "$basedir"`
-    fi
-    exe=".exe"
-    msys="true"
-  ;;
-  *WSL2*)
-    if command -v wslpath > /dev/null 2>&1; then
-      basedir_win="$(wslpath -w "$basedir" 2> /dev/null)"
-      if [ $? -ne 0 ] || [ -z "$basedir_win" ]; then
-        basedir_win="$basedir"
-      else
-        exe=".exe"
-      fi
-    fi
-  ;;
-esac
-
-if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
-  exec "$basedir/node.exe"  "$basedir_win/../semver/bin/semver.js" "$@"
-elif [ -x "$basedir/node" ]; then
-  exec "$basedir/node"  "$basedir/../semver/bin/semver.js" "$@"
-elif command -v node >/dev/null 2>&1; then
-  exec node  "$basedir/../semver/bin/semver.js" "$@"
-elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then
-  exec node.exe  "$basedir_win/../semver/bin/semver.js" "$@"
-else
-  exec node  "$basedir/../semver/bin/semver.js" "$@"
-fi
-# cmd-shim-target=/Users/runner/work/pnpm/pnpm/pnpm11/pnpm/temp-deploy/node_modules/semver/bin/semver.js

package/artifacts/exe/dist/node_modules/.package-map.json

@@ -1 +0,0 @@
-{"packages":{".":{"url":"..","dependencies":{"@reflink/reflink":"@reflink/reflink","node-gyp":"node-gyp","pnpm":".","v8-compile-cache":"v8-compile-cache"}},"@isaacs/fs-minipass":{"url":"./@isaacs/fs-minipass","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","minipass":"minipass"}},"@reflink/reflink":{"url":"./@reflink/reflink","dependencies":{"@reflink/reflink":"@reflink/reflink","@reflink/reflink-darwin-arm64":"@reflink/reflink-darwin-arm64","@reflink/reflink-darwin-x64":"@reflink/reflink-darwin-x64","@reflink/reflink-win32-arm64-msvc":"@reflink/reflink-win32-arm64-msvc","@reflink/reflink-win32-x64-msvc":"@reflink/reflink-win32-x64-msvc"}},"@reflink/reflink-darwin-arm64":{"url":"./@reflink/reflink-darwin-arm64","dependencies":{"@reflink/reflink-darwin-arm64":"@reflink/reflink-darwin-arm64"}},"@reflink/reflink-darwin-x64":{"url":"./@reflink/reflink-darwin-x64","dependencies":{"@reflink/reflink-darwin-x64":"@reflink/reflink-darwin-x64"}},"@reflink/reflink-win32-arm64-msvc":{"url":"./@reflink/reflink-win32-arm64-msvc","dependencies":{"@reflink/reflink-win32-arm64-msvc":"@reflink/reflink-win32-arm64-msvc"}},"@reflink/reflink-win32-x64-msvc":{"url":"./@reflink/reflink-win32-x64-msvc","dependencies":{"@reflink/reflink-win32-x64-msvc":"@reflink/reflink-win32-x64-msvc"}},"abbrev":{"url":"./abbrev","dependencies":{"abbrev":"abbrev"}},"chownr":{"url":"./chownr","dependencies":{"chownr":"chownr"}},"env-paths":{"url":"./env-paths","dependencies":{"env-paths":"env-paths"}},"exponential-backoff":{"url":"./exponential-backoff","dependencies":{"exponential-backoff":"exponential-backoff"}},"fdir":{"url":"./fdir","dependencies":{"fdir":"fdir","picomatch":"picomatch"}},"graceful-fs":{"url":"./graceful-fs","dependencies":{"graceful-fs":"graceful-fs"}},"isexe":{"url":"./isexe","dependencies":{"isexe":"isexe"}},"minipass":{"url":"./minipass","dependencies":{"minipass":"minipass"}},"minizlib":{"url":"./minizlib","dependencies":{"minipass":"minipass","minizlib":"minizlib"}},"node-gyp":{"url":"./node-gyp","dependencies":{"env-paths":"env-paths","exponential-backoff":"exponential-backoff","graceful-fs":"graceful-fs","node-gyp":"node-gyp","nopt":"nopt","proc-log":"proc-log","semver":"semver","tar":"tar","tinyglobby":"tinyglobby","undici":"undici","which":"which"}},"nopt":{"url":"./nopt","dependencies":{"abbrev":"abbrev","nopt":"nopt"}},"picomatch":{"url":"./picomatch","dependencies":{"picomatch":"picomatch"}},"proc-log":{"url":"./proc-log","dependencies":{"proc-log":"proc-log"}},"semver":{"url":"./semver","dependencies":{"semver":"semver"}},"tar":{"url":"./tar","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","chownr":"chownr","minipass":"minipass","minizlib":"minizlib","tar":"tar","yallist":"yallist"}},"tinyglobby":{"url":"./tinyglobby","dependencies":{"fdir":"fdir","picomatch":"picomatch","tinyglobby":"tinyglobby"}},"undici":{"url":"./undici","dependencies":{"undici":"undici"}},"v8-compile-cache":{"url":"./v8-compile-cache","dependencies":{"v8-compile-cache":"v8-compile-cache"}},"which":{"url":"./which","dependencies":{"isexe":"isexe","which":"which"}},"yallist":{"url":"./yallist","dependencies":{"yallist":"yallist"}}}}

package/artifacts/exe/dist/node_modules/@isaacs/fs-minipass/LICENSE

@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) Isaac Z. Schlueter and Contributors
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.