pnpm 11.28.1 → 11.28.2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # pnpm
 
+## 11.28.2
+
+pnpm 11.28.2 fixes `pnpm install` skipping every workspace project whose common ancestor is the filesystem root, and stops `pnpm run` from reinstalling or installing when nothing needs it.
+
+### Patch Changes
+
+- `pnpm install` reported success without installing anything when the workspace projects' common ancestor was the filesystem root, such as `/` or a drive root like `C:\`. It now installs these projects [#16328](https://github.com/pnpm/pnpm/issues/16328).
+
+- `verifyDepsBeforeRun` no longer reports dependencies as outdated after a filtered install just because `pnpm-lock.yaml` has a newer modification time. It checks the lockfile against the packages that install put in place. Before, `pnpm run` reinstalled the whole workspace with lifecycle scripts on, for example after a Docker `COPY` brought in a lockfile with a newer mtime [#16322](https://github.com/pnpm/pnpm/issues/16322).
+
+  After a filtered install, `verifyDepsBeforeRun` now also checks that the install put the selected projects' dependencies in place. A `node_modules` directory alone no longer counts as proof.
+
+- `pnpm run` and `pnpm exec` no longer install a project that has never been installed and has nothing to install. Such a project declares no dependencies, no peer dependencies that `autoInstallPeers` would fetch, and no install lifecycle scripts. The command now runs without writing `node_modules` or `pnpm-lock.yaml` [#16313](https://github.com/pnpm/pnpm/issues/16313).
+
 ## 11.28.1
 
 pnpm 11.28.1 makes `pnpm install` work in StackBlitz WebContainers, repairs lockfiles whose patch hashes disagree with `patchedDependencies`, and fixes many bugs in Windows command shims, injected workspace dependencies, and `pnpm deploy`.

package/dist/pnpm.mjs

@@ -223,7 +223,7 @@ var init_lib = __esm({
     init_selfEntry();
     defaultManifest = {
       name: true ? "pnpm" : "pnpm",
-      version: true ? "11.28.1" : "0.0.0"
+      version: true ? "11.28.2" : "0.0.0"
     };
     pkgJson = defaultManifest;
     packageManager = {
@@ -7157,20 +7157,24 @@ var init_better_path_resolve = __esm({
   }
 });
 
-// ../../../../../setup-pnpm/store/v11/links/@/is-subdir/2.0.0/86b3cd44735afb9f459dad7b43ddfc23f1a21495323a3fb38b9ab590c29f23ce/node_modules/is-subdir/index.js
+// ../../../../../setup-pnpm/store/v11/links/@/is-subdir/2.0.1/930a5285b376d962304fd10a15f6382f59e4b31eb7c98b5f184535f0320114ee/node_modules/is-subdir/index.js
 import path8 from "node:path";
 function isSubdir(parentDir, subdir) {
-  const rParent = `${betterPathResolve(parentDir)}${path8.sep}`;
-  const rDir = `${betterPathResolve(subdir)}${path8.sep}`;
+  const rParent = resolveWithTrailingSep(parentDir);
+  const rDir = resolveWithTrailingSep(subdir);
   return rDir.startsWith(rParent);
 }
 function strict(parentDir, subdir) {
-  const rParent = `${betterPathResolve(parentDir)}${path8.sep}`;
-  const rDir = `${betterPathResolve(subdir)}${path8.sep}`;
+  const rParent = resolveWithTrailingSep(parentDir);
+  const rDir = resolveWithTrailingSep(subdir);
   return rDir !== rParent && rDir.startsWith(rParent);
 }
+function resolveWithTrailingSep(dir) {
+  const resolved = betterPathResolve(dir);
+  return resolved.endsWith(path8.sep) ? resolved : `${resolved}${path8.sep}`;
+}
 var init_is_subdir = __esm({
-  "../../../../../setup-pnpm/store/v11/links/@/is-subdir/2.0.0/86b3cd44735afb9f459dad7b43ddfc23f1a21495323a3fb38b9ab590c29f23ce/node_modules/is-subdir/index.js"() {
+  "../../../../../setup-pnpm/store/v11/links/@/is-subdir/2.0.1/930a5285b376d962304fd10a15f6382f59e4b31eb7c98b5f184535f0320114ee/node_modules/is-subdir/index.js"() {
     init_better_path_resolve();
   }
 });
@@ -219768,7 +219772,7 @@ var init_resolvePeers = __esm({
   }
 });
 
-// ../../../../../setup-pnpm/store/v11/links/@/is-inner-link/5.0.0/72b7eb44d56e1666d7ca026d99a5fb2fb1b7840dde1a66e0e9ee7e333683e310/node_modules/is-inner-link/index.js
+// ../../../../../setup-pnpm/store/v11/links/@/is-inner-link/5.0.0/cce13b91443927cfbdb861aaaa9ef4ad3c89350d4dca46d5b1dafb56bb24e74a/node_modules/is-inner-link/index.js
 import path150 from "node:path";
 async function isInnerLink(parent, relativePathToLink) {
   const linkPath = path150.resolve(parent, relativePathToLink);
@@ -219779,7 +219783,7 @@ async function isInnerLink(parent, relativePathToLink) {
   };
 }
 var init_is_inner_link = __esm({
-  "../../../../../setup-pnpm/store/v11/links/@/is-inner-link/5.0.0/72b7eb44d56e1666d7ca026d99a5fb2fb1b7840dde1a66e0e9ee7e333683e310/node_modules/is-inner-link/index.js"() {
+  "../../../../../setup-pnpm/store/v11/links/@/is-inner-link/5.0.0/cce13b91443927cfbdb861aaaa9ef4ad3c89350d4dca46d5b1dafb56bb24e74a/node_modules/is-inner-link/index.js"() {
     init_is_subdir();
     init_resolve_link_target();
   }
@@ -230477,7 +230481,7 @@ var init_lib147 = __esm({
 });
 
 // ../deps/status/lib/assertLockfilesEqual.js
-function assertLockfilesEqual(currentLockfile, wantedLockfile, wantedLockfileDir) {
+function assertLockfilesEqual(currentLockfile, wantedLockfile, opts3) {
   if (!currentLockfile) {
     for (const [name, snapshot] of Object.entries(wantedLockfile.importers)) {
       if (!equals_default(snapshot.specifiers, {})) {
@@ -230486,12 +230490,17 @@ function assertLockfilesEqual(currentLockfile, wantedLockfile, wantedLockfileDir
         });
       }
     }
-  } else if (!equals_default(currentLockfile, wantedLockfile)) {
-    throw new PnpmError("RUN_CHECK_DEPS_OUTDATED_DEPS", `The installed dependencies in the modules directory is not up-to-date with the lockfile in ${wantedLockfileDir}.`, {
+  } else if (!equals_default(currentLockfile, wantedLockfile) && !(opts3.filteredInstall === true && recordsSubsetOfPackages(currentLockfile, wantedLockfile))) {
+    throw new PnpmError("RUN_CHECK_DEPS_OUTDATED_DEPS", `The installed dependencies in the modules directory is not up-to-date with the lockfile in ${opts3.wantedLockfileDir}.`, {
       hint: "Run `pnpm install` to update dependencies."
     });
   }
 }
+function recordsSubsetOfPackages(currentLockfile, wantedLockfile) {
+  const { packages: currentPackages, ...currentRest } = currentLockfile;
+  const { packages: wantedPackages, ...wantedRest } = wantedLockfile;
+  return equals_default(currentRest, wantedRest) && Object.entries(currentPackages ?? {}).every(([depPath, pkg]) => equals_default(pkg, wantedPackages?.[depPath]));
+}
 var init_assertLockfilesEqual = __esm({
   "../deps/status/lib/assertLockfilesEqual.js"() {
     "use strict";
@@ -230860,6 +230869,16 @@ async function _checkDepsStatus(opts3, workspaceState) {
           workspaceState
         };
       }
+      if (selectedProjectDirs != null) {
+        const notInstalled = await findProjectMissingFromCurrentLockfile(allProjects.filter((project) => selectedProjectDirs.has(path184.resolve(project.rootDir)) && declaresDependencies(project)), createCurrentLockfileLocator({ ...opts3, workspaceDir }));
+        if (notInstalled != null) {
+          return {
+            upToDate: false,
+            issue: `Workspace package ${notInstalled.manifest.name ?? notInstalled.rootDir} has dependencies but was not installed`,
+            workspaceState
+          };
+        }
+      }
     }
     const issue = await patchesOrHooksAreModified({
       patchedDependencies,
@@ -230914,7 +230933,10 @@ async function _checkDepsStatus(opts3, workspaceState) {
         if (modifiedAtOrAfter(wantedLockfileStats, workspaceState.lastValidatedTimestamp)) {
           const currentLockfile = await readCurrentLockfile(path184.join(workspaceDir, "node_modules/.pnpm"), { ignoreIncompatible: false });
           const wantedLockfile = await wantedLockfilePromise ?? throwLockfileNotFound(workspaceDir);
-          assertLockfilesEqual(currentLockfile, wantedLockfile, workspaceDir);
+          assertLockfilesEqual(currentLockfile, wantedLockfile, {
+            wantedLockfileDir: workspaceDir,
+            filteredInstall: workspaceState.filteredInstall
+          });
         }
         readWantedLockfileAndDir = async () => ({
           wantedLockfile: await wantedLockfilePromise ?? throwLockfileNotFound(workspaceDir),
@@ -230934,7 +230956,10 @@ async function _checkDepsStatus(opts3, workspaceState) {
         if (modifiedAtOrAfter(wantedLockfileStats, workspaceState.lastValidatedTimestamp)) {
           const currentLockfile = await readCurrentLockfile(path184.join(wantedLockfileDir, "node_modules/.pnpm"), { ignoreIncompatible: false });
           const wantedLockfile = await wantedLockfilePromise ?? throwLockfileNotFound(wantedLockfileDir);
-          assertLockfilesEqual(currentLockfile, wantedLockfile, wantedLockfileDir);
+          assertLockfilesEqual(currentLockfile, wantedLockfile, {
+            wantedLockfileDir,
+            filteredInstall: workspaceState.filteredInstall
+          });
         }
         return {
           wantedLockfile: await wantedLockfilePromise ?? throwLockfileNotFound(wantedLockfileDir),
@@ -231042,7 +231067,7 @@ async function _checkDepsStatus(opts3, workspaceState) {
     if (!wantedLockfileIsMissing && currentLockfileStats && modifiedAtOrAfter(wantedLockfileStats, currentLockfileStats.mtime.valueOf())) {
       const currentLockfile = await currentLockfilePromise;
       const wantedLockfile = await wantedLockfilePromise ?? throwLockfileNotFound(rootProjectManifestDir);
-      assertLockfilesEqual(currentLockfile, wantedLockfile, rootProjectManifestDir);
+      assertLockfilesEqual(currentLockfile, wantedLockfile, { wantedLockfileDir: rootProjectManifestDir });
     }
     if (!manifestStats) {
       throw new Error(`Cannot find one of ${MANIFEST_BASE_NAMES.join(", ")} in ${rootProjectManifestDir}`);
@@ -231357,6 +231382,42 @@ function missingModulesDirIssue(project) {
   const id2 = project.manifest.name ?? project.rootDir;
   return `Workspace package ${id2} has dependencies but does not have a modules directory`;
 }
+function declaresDependencies(project) {
+  return DEPENDENCIES_FIELDS.some((field) => !isEmpty_default(project.manifest[field] ?? {}));
+}
+function createCurrentLockfileLocator(opts3) {
+  if (opts3.sharedWorkspaceLockfile) {
+    const lockfileDir = opts3.lockfileDir ?? opts3.workspaceDir;
+    const virtualStoreDir = path184.join(path184.resolve(lockfileDir, opts3.modulesDir ?? "node_modules"), ".pnpm");
+    return (project) => ({ virtualStoreDir, importerId: getLockfileImporterId(lockfileDir, project.rootDir) });
+  }
+  const modulesDirOf2 = createProjectModulesDirResolver(opts3);
+  return (project) => ({
+    virtualStoreDir: path184.join(path184.resolve(project.rootDir, modulesDirOf2(project.manifest.name) ?? "node_modules"), ".pnpm"),
+    importerId: "."
+  });
+}
+async function findProjectMissingFromCurrentLockfile(projects, locateCurrentLockfile) {
+  const currentLockfiles = /* @__PURE__ */ new Map();
+  for (const project of projects) {
+    const { virtualStoreDir, importerId } = locateCurrentLockfile(project);
+    if (!currentLockfiles.has(virtualStoreDir)) {
+      currentLockfiles.set(virtualStoreDir, readCurrentLockfile(virtualStoreDir, { ignoreIncompatible: false }));
+    }
+    const currentLockfile = await currentLockfiles.get(virtualStoreDir);
+    const importer = currentLockfile?.importers[importerId];
+    if (importer == null || !directDependenciesRecorded(importer, currentLockfile?.packages ?? {})) {
+      return project;
+    }
+  }
+  return void 0;
+}
+function directDependenciesRecorded(importer, packages) {
+  return DEPENDENCIES_FIELDS.every((field) => Object.entries(importer[field] ?? {}).every(([alias, ref]) => {
+    const depPath = refToRelative(ref, alias);
+    return depPath == null || packages[depPath] != null;
+  }));
+}
 function selectProjectDirs(opts3) {
   if (opts3.selectedProjectsGraph != null) {
     return new Set(Object.keys(opts3.selectedProjectsGraph).map((dir) => path184.resolve(dir)));
@@ -231376,6 +231437,7 @@ var init_checkDepsStatus = __esm({
     init_lib85();
     init_lib2();
     init_lib90();
+    init_lib43();
     init_lib3();
     init_lib138();
     init_lib114();
@@ -305837,6 +305899,7 @@ var init_hiddenScripts = __esm({
 });
 
 // ../exec/commands/lib/runDepsStatusCheck.js
+import { existsSync as existsSync6 } from "node:fs";
 import fs139 from "node:fs/promises";
 import os22 from "node:os";
 import path230 from "node:path";
@@ -305844,7 +305907,7 @@ async function runDepsStatusCheck(opts3) {
   const ignoredWorkspaceStateSettings = ["dev", "optional", "production"];
   opts3.ignoredWorkspaceStateSettings = ignoredWorkspaceStateSettings;
   const { upToDate, issue, workspaceState } = await checkDepsStatus(opts3);
-  if (!needsInstall(upToDate, opts3))
+  if (await installNotRequired(opts3, upToDate, workspaceState))
     return;
   const command = ["install", ...createInstallArgs(workspaceState?.settings), ...createFilterArgs(opts3)];
   const install2 = lockedInstall.bind(null, opts3, command);
@@ -305903,6 +305966,55 @@ function needsInstall(upToDate, opts3) {
     return false;
   return upToDate === false || opts3.allProjects != null || opts3.rootProjectManifest != null;
 }
+async function installNotRequired(opts3, upToDate, workspaceState) {
+  if (!needsInstall(upToDate, opts3))
+    return true;
+  if (workspaceState != null)
+    return false;
+  return projectsHaveNothingToInstall(opts3);
+}
+async function projectsHaveNothingToInstall(opts3) {
+  if (opts3.pnpmfile.length > 0 || lockfileDirIsPinned(opts3))
+    return false;
+  try {
+    return await coveredProjectsHaveNothingToInstall(opts3);
+  } catch {
+    return false;
+  }
+}
+function lockfileDirIsPinned(opts3) {
+  if (opts3.lockfileDir == null)
+    return false;
+  const defaultLockfileDir = opts3.sharedWorkspaceLockfile === false ? opts3.dir : opts3.workspaceDir ?? opts3.dir;
+  return path230.resolve(opts3.lockfileDir) !== path230.resolve(defaultLockfileDir);
+}
+async function coveredProjectsHaveNothingToInstall(opts3) {
+  if (opts3.sharedWorkspaceLockfile === false && opts3.workspaceDir != null && opts3.allProjects == null) {
+    const manifest = await safeReadProjectManifestOnly(opts3.dir);
+    return manifest == null || !(projectHasInstallWork(opts3.dir, manifest, opts3) || path230.resolve(opts3.dir) === path230.resolve(opts3.workspaceDir) && runsScript(manifest, "pnpm:devPreinstall", opts3));
+  }
+  const root = opts3.rootProjectManifest;
+  if (root != null && opts3.rootProjectManifestDir != null && (projectHasInstallWork(opts3.rootProjectManifestDir, root, opts3) || runsScript(root, "pnpm:devPreinstall", opts3)))
+    return false;
+  const projects = opts3.allProjects ?? (opts3.workspaceDir == null ? [] : await findWorkspaceProjectsNoCheck(opts3.workspaceDir, {
+    patterns: opts3.workspacePackagePatterns ?? ["."],
+    modulesDir: opts3.modulesDir,
+    modulesDirsByProjectName: opts3.modulesDirsByProjectName
+  }));
+  return projects.every(({ rootDir, manifest }) => !projectHasInstallWork(rootDir, manifest, opts3));
+}
+function projectHasInstallWork(rootDir, manifest, opts3) {
+  return [manifest.dependencies, manifest.devDependencies, manifest.optionalDependencies].some((group) => group != null && Object.keys(group).length > 0) || opts3.autoInstallPeers === true && hasRequiredPeers(manifest) || PROJECT_LIFECYCLE_STAGES.some((stage) => runsScript(manifest, stage, opts3)) || !opts3.ignoreScripts && hasImplicitGypBuild(rootDir, manifest);
+}
+function hasRequiredPeers(manifest) {
+  return Object.keys(manifest.peerDependencies ?? {}).some((name) => manifest.peerDependenciesMeta?.[name]?.optional !== true);
+}
+function runsScript(manifest, stage, opts3) {
+  return !opts3.ignoreScripts && manifest.scripts?.[stage] != null;
+}
+function hasImplicitGypBuild(rootDir, manifest) {
+  return manifest.gypfile !== false && existsSync6(path230.join(rootDir, "binding.gyp"));
+}
 async function lockedInstall(opts3, command) {
   refuseInstallDroppingIgnoredSettings(opts3);
   const root = opts3.workspaceDir ?? opts3.dir;
@@ -305922,7 +306034,7 @@ async function lockedInstall(opts3, command) {
   try {
     if (waited) {
       const { upToDate, workspaceState } = await checkDepsStatus(opts3);
-      if (!needsInstall(upToDate, opts3))
+      if (await installNotRequired(opts3, upToDate, workspaceState))
         return;
       command = ["install", ...createInstallArgs(workspaceState?.settings), ...createFilterArgs(opts3)];
     }
@@ -305975,9 +306087,12 @@ var init_runDepsStatusCheck = __esm({
     init_lib42();
     init_lib148();
     init_lib3();
+    init_lib27();
     init_lib178();
     init_lib115();
     init_lib4();
+    init_lib18();
+    init_lib61();
     init_realpath_missing();
     INSTALL_LOCK_NAMESPACE = "pnpm-verify-deps-install-locks";
     INSTALL_LOCK_WAIT_MS = 5 * 6e4;

package/dist/worker.js

@@ -11538,13 +11538,17 @@ import crypto4 from "node:crypto";
 import fs8, {} from "node:fs";
 import path8 from "node:path";
 
-// ../../../../../setup-pnpm/store/v11/links/@/is-subdir/2.0.0/86b3cd44735afb9f459dad7b43ddfc23f1a21495323a3fb38b9ab590c29f23ce/node_modules/is-subdir/index.js
+// ../../../../../setup-pnpm/store/v11/links/@/is-subdir/2.0.1/930a5285b376d962304fd10a15f6382f59e4b31eb7c98b5f184535f0320114ee/node_modules/is-subdir/index.js
 import path6 from "node:path";
 function isSubdir(parentDir, subdir) {
-  const rParent = `${betterPathResolve(parentDir)}${path6.sep}`;
-  const rDir = `${betterPathResolve(subdir)}${path6.sep}`;
+  const rParent = resolveWithTrailingSep(parentDir);
+  const rDir = resolveWithTrailingSep(subdir);
   return rDir.startsWith(rParent);
 }
+function resolveWithTrailingSep(dir) {
+  const resolved = betterPathResolve(dir);
+  return resolved.endsWith(path6.sep) ? resolved : `${resolved}${path6.sep}`;
+}
 
 // ../../../../../setup-pnpm/store/v11/links/@/strip-bom/5.0.0/c5abc9f591760d7581de2026bc6da7f255db82a0b75d02fcc6cebf460005b3e6/node_modules/strip-bom/index.js
 function stripBom(string) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pnpm",
-  "version": "11.28.1",
+  "version": "11.28.2",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",