pnpm 11.28.2 → 11.28.4

package/CHANGELOG.md

@@ -1,5 +1,164 @@
 # pnpm
 
+## 11.28.4
+
+pnpm 11.28.4 fixes two ways credentials could leak, makes `pnpm install --frozen-lockfile` accept several lockfiles it rejected, warns when an optional dependency cannot be fetched, and stops `pnpm self-update` from installing a second pnpm next to a Homebrew one.
+
+### Patch Changes
+
+- `pnpm login` no longer forwards credentials in its request body to another origin during redirects.
+
+- The error for a tarball that fails its integrity check no longer prints credentials, query strings, or fragments from the tarball URL.
+
+#### Installing packages
+
+- `pnpm install --frozen-lockfile` now succeeds in a project with no dependencies when `pnpm-lock.yaml` records only the pinned pnpm version. Other commands write such a lockfile when they run before the first install. A lockfile missing the `---` line after that section is accepted too [#16477](https://github.com/pnpm/pnpm/issues/16477).
+
+- `pnpm install --frozen-lockfile` again succeeds when a workspace project recorded in `pnpm-lock.yaml` has no directory, such as a project left out of a Docker build context. It still fails if the project's directory exists without a `package.json` [#16453](https://github.com/pnpm/pnpm/issues/16453).
+
+- `pnpm install --frozen-lockfile` no longer fails with `ERR_PNPM_OUTDATED_LOCKFILE` for a workspace project that declares `dependenciesMeta` and whose dependencies are all workspace links. pnpm now records that project's `dependenciesMeta` in `pnpm-lock.yaml` [#16457](https://github.com/pnpm/pnpm/issues/16457).
+
+- Fixed frozen installs replacing a hoisted dependency with a workspace package of the same name. A later `pnpm dedupe` then removed the hoisted link [#16485](https://github.com/pnpm/pnpm/issues/16485).
+
+- With `enableGlobalVirtualStore` on, scripts can run entry points that a CommonJS require hook loads again, such as `ts-node index.ts`. They failed with `ERR_UNKNOWN_FILE_EXTENSION` on Node.js versions without built-in TypeScript support [#16436](https://github.com/pnpm/pnpm/issues/16436).
+
+#### Optional dependencies
+
+- `pnpm install` now prints a warning with the error when an optional dependency cannot be fetched and is skipped. The skipped package is no longer linked into `node_modules` as a broken symlink or listed among the added dependencies. The `pnpm:skipped-optional-dependency` log reports the skip with the `fetch_failure` reason [#16514](https://github.com/pnpm/pnpm/issues/16514).
+
+- When an optional dependency fails to build, pnpm now removes its link from `node_modules`. A repeat `pnpm install` then reports "Already up to date" and no longer reruns the failing build [#16468](https://github.com/pnpm/pnpm/issues/16468).
+
+- Fixed frozen installs creating symlinks to the working directory for skipped optional dependencies and unresolved peer dependencies [#16454](https://github.com/pnpm/pnpm/issues/16454).
+
+#### Hoisted node_modules
+
+- With `nodeLinker: hoisted`, a filtered install now keeps the packages of the workspace projects an earlier install put in `node_modules`. This also covers the install that `pnpm --filter <selector> run` and `pnpm --filter <selector> exec` start before the command. Before, these installs removed every package that only the unselected projects needed [#16483](https://github.com/pnpm/pnpm/issues/16483).
+
+  A filtered install of a workspace project also no longer fails with `ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY` after a filtered install of another project.
+
+- `pnpm install` with `nodeLinker: hoisted` now refreshes directories supplied by custom fetchers when reinstalling.
+
+#### Speed and network
+
+- pnpm now revalidates cached registry metadata with a conditional request, so the registry can answer `304 Not Modified`. Before, pnpm downloaded the whole document again for registries whose responses forbid caching, such as `Cache-Control: no-store` [#16528](https://github.com/pnpm/pnpm/issues/16528), and for packages published within `minimumReleaseAge` [#16506](https://github.com/pnpm/pnpm/issues/16506).
+
+- A fetch timeout while other downloads from the same host are still running now lowers concurrency for that host to one connection. Retries of that request, and later downloads from that host, use the lower concurrency. Other hosts keep the configured concurrency [#12791](https://github.com/pnpm/pnpm/issues/12791).
+
+#### Running scripts
+
+- Scripts run without a terminal no longer start a second `sh` each. One watchdog per pnpm command now ends every script's process group if pnpm is killed, so `pnpm -r run` across many projects starts half as many processes [#16489](https://github.com/pnpm/pnpm/issues/16489).
+
+- `pnpm run` and `pnpm exec` now warn and run the command when the install that `verifyDepsBeforeRun` starts fails. This lets scripts run in sandboxes where pnpm cannot install, such as containers with a read-only store or no network [#15173](https://github.com/pnpm/pnpm/issues/15173).
+
+- A filtered `pnpm run` or `pnpm exec` now finds dependencies out of date when a workspace dependency of a selected project has no `node_modules` directory, as after a filtered install. With `verifyDepsBeforeRun: install`, pnpm installs that dependency before running the command [pnpm/tasks#45](https://github.com/pnpm/tasks/issues/45).
+
+- `pnpm rebuild` and `pnpm approve-builds` refresh command launchers when a build changes a command's interpreter or replaces it with a native executable. Dependent packages' build scripts use the refreshed launchers.
+
+#### Updating pnpm
+
+- `pnpm self-update` now fails for Homebrew-installed pnpm and prints the `brew upgrade` command for the installed formula, such as `brew upgrade pnpm` or `brew upgrade pnpm@11`. It used to install a second copy of pnpm that the Homebrew one kept shadowing [#16547](https://github.com/pnpm/pnpm/issues/16547).
+
+- On Windows, `pnpm self-update` now replaces a `pnpm.exe` left in `PNPM_HOME` or in `PNPM_HOME\bin`. In `PNPM_HOME`, that executable kept running the old version after a successful update. In `PNPM_HOME\bin`, the update failed with `EPERM`. If the executable was in `PNPM_HOME`, `self-update` now asks you to run `pnpm setup` [#9094](https://github.com/pnpm/pnpm/issues/9094).
+
+- pnpm can now switch to a `packageManager` version below 11 on x64 musl Linux, such as Alpine [#16467](https://github.com/pnpm/pnpm/issues/16467).
+
+- A `devEngines.packageManager` range now records the running pnpm in `pnpm-lock.yaml` only if it meets `minimumReleaseAge`. Otherwise pnpm records the newest version in the range that meets it. If no version in the range does, pnpm still records the running pnpm [#16431](https://github.com/pnpm/pnpm/issues/16431).
+
+#### Filtering, settings, and other commands
+
+- The `[<since>]` filter selector works again with Git 2.24 through 2.27 [#16561](https://github.com/pnpm/pnpm/issues/16561). With Git older than 2.24, the selector now fails with an error that names the required Git version.
+
+- Package-name filters now support `?` to match one character [#2817](https://github.com/pnpm/pnpm/issues/2817).
+
+- `pnpm -r pkg get` now reports every selected project when several share a package name. Projects with the same name are keyed by their directory relative to the workspace root. Before, only one of them appeared in the output.
+
+- pnpm now reports an `INVALID_SETTING` error when `allowUnusedPatches` in `pnpm-workspace.yaml` is not a boolean, or when `ignoredOptionalDependencies` or `requiredScripts` is not an array of strings. A quoted `allowUnusedPatches` value such as `"false"` was treated as `true`.
+
+- `pnpm store path`, `pnpm store status`, and other commands that look up the default store no longer fail when the current directory is not writable. pnpm now uses the store in the pnpm home directory in that case [#16554](https://github.com/pnpm/pnpm/issues/16554).
+
+## 11.28.3
+
+pnpm 11.28.3 updates `undici` to clear a security advisory, fixes "database disk image is malformed" errors when several pnpm processes share a store, and makes packages, catalogs, projects, and commands named like `constructor` work.
+
+### Patch Changes
+
+#### Installing packages
+
+- pnpm now ships `undici` 7.29.1, so security scans of pnpm no longer report [GHSA-3wwx-pv8p-q78v](https://github.com/advisories/GHSA-3wwx-pv8p-q78v).
+
+- pnpm no longer fails with "database disk image is malformed" or reads stale store entries while another pnpm process writes to the same store.
+
+- Names that match built-in JavaScript object properties, such as `constructor`, `toString`, or `__proto__`, now work like any other name. pnpm crashed, wrote a wrong lockfile, or silently skipped such names in:
+
+  - `pnpm add`, `pnpm install`, and `pnpm import`, for dependencies, peer dependencies, and `file:` dependencies that point to a directory named `constructor`.
+  - Catalog entries and catalog names. Pruning unused entries crashed, and a new catalog named `toString` was not written.
+  - Workspace projects, project directories, and files inside injected packages.
+  - Registry prefixes and override version references such as `$toString`.
+  - Hoisting, `pnpm list`, and `pnpm why`.
+  - Command names. `pnpm constructor` runs the `constructor` script like any other unknown command, and `pnpm help constructor` no longer crashes.
+  - Resolving through a pnpr server when a project lives in a directory named `constructor`.
+
+- `pnpm install` no longer re-resolves an up-to-date lockfile on every run when a patched package is a peer in a peer cycle [#16418](https://github.com/pnpm/pnpm/issues/16418).
+
+- POSIX bin shims and the `pnpm`, `pn`, `pnpx`, and `pnx` launchers now run inside a Nix build, where the system default path holds none of the utilities they call. Installing again replaces the shims already in `node_modules` [#16377](https://github.com/pnpm/pnpm/issues/16377).
+
+- In a project that pins another pnpm version, pnpm now passes a command with an option it does not know to the pinned version. Before, `pnpm install --auto-dedupe` failed with "Unknown option" even though the pinned pnpm supports it [#16353](https://github.com/pnpm/pnpm/issues/16353).
+
+- pnpm now fails with `ERR_PNPM_INVALID_ALLOW_BUILDS` when `allowBuilds` is not an object or one of its values is not `true`, `false`, or a string. Such values used to be ignored silently.
+
+- Removing a dependency whose bins are declared through `directories.bin` no longer leaves broken shims in `node_modules/.bin`.
+
+- A custom resolver's `shouldRefreshResolution` hook that rejects no longer crashes pnpm with an unhandled rejection when another hook has already asked for a refresh.
+
+#### Updating dependencies
+
+- When `minimumReleaseAge` hides the version that `latest` points to, pnpm now falls back to a prerelease of the same major before a stable version of an older major. A stable version of the same major is still preferred. For example, while a new `1.0.0` is too new, pnpm picks `1.0.0-beta.4` rather than an old `0.0.1` [#16388](https://github.com/pnpm/pnpm/issues/16388).
+
+- `pnpm --filter <project> update <pkg>` now fails with `ERR_PNPM_NO_PACKAGE_IN_DEPENDENCIES` when the selected projects do not depend on `<pkg>`, also in a workspace with a shared lockfile and a root project. It used to exit successfully.
+
+- `pnpm audit --fix` now updates vulnerable packages in a single project that sets `updateConfig.ignoreDependencies`. It used to leave them on the vulnerable version.
+
+- `pnpm update --global` now removes hard-linked executables from `PNPM_HOME` when migrating packages from the old global layout [#16420](https://github.com/pnpm/pnpm/issues/16420).
+
+- Updating a pinned GitHub Action now rewrites the version in its `# vX.Y.Z` comment even when the action name contains the same version text. The action name used to change while the comment kept the old version.
+
+#### Workspaces and deploy
+
+- `pnpm deploy` no longer fails with `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER` in a workspace with `injectWorkspacePackages: true` when a workspace package also lists its peer dependency as a dev dependency [#16375](https://github.com/pnpm/pnpm/issues/16375).
+
+- `pnpm deploy` no longer copies the workspace root's `packageManager` and `devEngines.packageManager` fields into the deployed `package.json` [#16403](https://github.com/pnpm/pnpm/issues/16403).
+
+- `--filter` fixes:
+
+  - A `...pkg...` selector combined with another dependents selector, such as `--filter ...a --filter ...b...`, no longer adds the dependencies of the other selector's dependents.
+  - `--filter "[<since>]"` now detects changes in projects whose directory names contain non-ASCII characters. The change used to be credited to the parent project.
+
+#### Running scripts
+
+- After relaying a signal to a script, pnpm keeps waiting for a process in the script's process group whose main thread has exited while its other threads still run. Linux reports such a process as a zombie, so the wait used to end before those threads finished [pnpm/tasks#56](https://github.com/pnpm/tasks/issues/56).
+
+- A lifecycle script run with `unsafePerm: false` now fails with an error when pnpm cannot create `node_modules/.tmp`. It used to hang.
+
+- `pnpm run` with `verifyDepsBeforeRun` no longer crashes with an unhandled rejection when a lockfile it did not need to compare fails to load.
+
+- `pnpm run -r` now closes the collapsible CI log section of a project whose script fails, so the output of later projects is no longer nested inside it.
+
+- `pnpm run --resume-from` no longer crashes when a saved run state file contains `null`.
+
+#### Store
+
+- `pnpm store prune` now removes the packages that only expired `pnpm dlx` cache entries used, as long as the store still has another registered project. They used to stay until the next `pnpm store prune` [#16383](https://github.com/pnpm/pnpm/discussions/16383).
+
+- `pnpm store prune` now stops with an error when it cannot read a project directory for a reason other than the directory missing, such as a permission error. It used to skip the directory.
+
+#### Publishing and registry output
+
+- `pnpm publish` now includes bare `README` files and README files with Markdown extensions such as `readme.markdown` in registry metadata [#12704](https://github.com/pnpm/pnpm/issues/12704).
+
+- `pnpm pack-app` now accepts an entry file or output directory inside the project whose name starts with two dots, such as `..build/entry.cjs`. It used to fail with `ERR_PNPM_PACK_APP_ENTRY_OUTSIDE_PROJECT`.
+
+- Registry error messages now always say "(response body truncated)" when pnpm cut the response body short. The marker was missing when the body was cut at exactly 64 KiB.
+
 ## 11.28.2
 
 pnpm 11.28.2 fixes `pnpm install` skipping every workspace project whose common ancestor is the filesystem root, and stops `pnpm run` from reinstalling or installing when nothing needs it.

package/dist/node_modules/.bin/node-gyp

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,19 +39,21 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
+basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
+basedir="$basedir_abs"
 basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"
@@ -73,11 +79,12 @@ case `command -p uname -a` in
 esac
 if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
-basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
   exec "$basedir/node.exe"  "$basedir_win/../node-gyp/bin/node-gyp.js" "$@"
 elif [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir_abs/../node-gyp/bin/node-gyp.js" "$@"
+elif [ -n "$msys" ] && command -v node >/dev/null 2>&1; then
+  exec node  "$basedir_win/../node-gyp/bin/node-gyp.js" "$@"
 elif command -v node >/dev/null 2>&1; then
   exec node  "$basedir_abs/../node-gyp/bin/node-gyp.js" "$@"
 elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then

package/dist/node_modules/.bin/node-which

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,19 +39,21 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
+basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
+basedir="$basedir_abs"
 basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"
@@ -73,11 +79,12 @@ case `command -p uname -a` in
 esac
 if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
-basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
   exec "$basedir/node.exe"  "$basedir_win/../which/bin/which.js" "$@"
 elif [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir_abs/../which/bin/which.js" "$@"
+elif [ -n "$msys" ] && command -v node >/dev/null 2>&1; then
+  exec node  "$basedir_win/../which/bin/which.js" "$@"
 elif command -v node >/dev/null 2>&1; then
   exec node  "$basedir_abs/../which/bin/which.js" "$@"
 elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then

package/dist/node_modules/.bin/nopt

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,19 +39,21 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
+basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
+basedir="$basedir_abs"
 basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"
@@ -73,11 +79,12 @@ case `command -p uname -a` in
 esac
 if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
-basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
   exec "$basedir/node.exe"  "$basedir_win/../nopt/bin/nopt.js" "$@"
 elif [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir_abs/../nopt/bin/nopt.js" "$@"
+elif [ -n "$msys" ] && command -v node >/dev/null 2>&1; then
+  exec node  "$basedir_win/../nopt/bin/nopt.js" "$@"
 elif command -v node >/dev/null 2>&1; then
   exec node  "$basedir_abs/../nopt/bin/nopt.js" "$@"
 elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then

package/dist/node_modules/.bin/semver

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,19 +39,21 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
+basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
+basedir="$basedir_abs"
 basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"
@@ -73,11 +79,12 @@ case `command -p uname -a` in
 esac
 if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
-basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
   exec "$basedir/node.exe"  "$basedir_win/../semver/bin/semver.js" "$@"
 elif [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir_abs/../semver/bin/semver.js" "$@"
+elif [ -n "$msys" ] && command -v node >/dev/null 2>&1; then
+  exec node  "$basedir_win/../semver/bin/semver.js" "$@"
 elif command -v node >/dev/null 2>&1; then
   exec node  "$basedir_abs/../semver/bin/semver.js" "$@"
 elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then

package/dist/node_modules/undici/lib/core/request.js

@@ -263,11 +263,77 @@ class Request {
     }
   }
 
-  onUpgrade (statusCode, headers, socket) {
+  /**
+   * @param {number|null} statusCode
+   * @param {Buffer[]|null} headers
+   * @param {import('node:stream').Duplex} socket
+   * @param {string} [statusText]
+   */
+  onUpgrade (statusCode, headers, socket, statusText = '') {
+    this.onFinally()
+
     assert(!this.aborted)
     assert(!this.completed)
 
-    return this[kHandler].onUpgrade(statusCode, headers, socket)
+    if (statusCode !== null) {
+      this.#publishUpgradeHeaders(statusCode, headers, statusText)
+    }
+
+    const result = this[kHandler].onUpgrade(statusCode, headers, socket)
+
+    if (!this.aborted) {
+      this.completed = true
+      if (statusCode !== null) {
+        this.#publishUpgradeTrailers()
+      }
+    }
+
+    return result
+  }
+
+  /**
+   * @param {number} statusCode
+   * @param {import('node:http2').IncomingHttpHeaders} headers
+   * @param {(headers: import('node:http2').IncomingHttpHeaders) => Buffer[]} parseHeaders
+   * @param {string} [statusText]
+   */
+  onUpgradeResponse (statusCode, headers, parseHeaders, statusText = '') {
+    assert(!this.aborted)
+    assert(this.completed)
+
+    if (channels.headers.hasSubscribers) {
+      this.#publishUpgradeHeaders(statusCode, parseHeaders(headers), statusText)
+    }
+    this.#publishUpgradeTrailers()
+  }
+
+  /**
+   * @param {Error} error
+   */
+  onUpgradeError (error) {
+    assert(!this.aborted)
+    assert(this.completed)
+
+    if (channels.error.hasSubscribers) {
+      channels.error.publish({ request: this, error })
+    }
+  }
+
+  /**
+   * @param {number} statusCode
+   * @param {Buffer[]} headers
+   * @param {string} statusText
+   */
+  #publishUpgradeHeaders (statusCode, headers, statusText) {
+    if (channels.headers.hasSubscribers) {
+      channels.headers.publish({ request: this, response: { statusCode, headers, statusText } })
+    }
+  }
+
+  #publishUpgradeTrailers () {
+    if (channels.trailers.hasSubscribers) {
+      channels.trailers.publish({ request: this, trailers: [] })
+    }
   }
 
   onComplete (trailers) {

package/dist/node_modules/undici/lib/dispatcher/client-h1.js

@@ -432,7 +432,7 @@ class Parser {
   }
 
   onUpgrade (head) {
-    const { upgrade, client, socket, headers, statusCode } = this
+    const { upgrade, client, socket, headers, statusCode, statusText } = this
 
     assert(upgrade)
     assert(client[kSocket] === socket)
@@ -467,9 +467,10 @@ class Parser {
     client.emit('disconnect', client[kUrl], [client], new InformationalError('upgrade'))
 
     try {
-      request.onUpgrade(statusCode, headers, socket)
-    } catch (err) {
-      util.destroy(socket, err)
+      request.onUpgrade(statusCode, headers, socket, statusText)
+    } catch (error) {
+      util.errorRequest(client, request, error)
+      util.destroy(socket, error)
     }
 
     client[kResume]()
@@ -1050,12 +1051,22 @@ function writeH1 (client, request) {
   const socket = client[kSocket]
   clearIdleSocketValidation(socket)
 
-  const abort = (err) => {
-    if (request.aborted || request.completed) {
+  /**
+   * @param {Error} [error]
+   */
+  const abort = (error) => {
+    if (request.aborted) {
+      return
+    }
+
+    if (request.completed) {
+      if (request.upgrade || request.method === 'CONNECT') {
+        util.destroy(socket, new InformationalError('aborted'))
+      }
       return
     }
 
-    util.errorRequest(client, request, err || new RequestAbortedError())
+    util.errorRequest(client, request, error || new RequestAbortedError())
 
     util.destroy(body)
     util.destroy(socket, new InformationalError('aborted'))