pnpm 12.1.0 → 12.2.0

package/CHANGELOG.md

@@ -1,5 +1,70 @@
 # pnpm
 
+## 12.2.0
+
+### Minor Changes
+
+- Catalogs can now resolve workspace dependencies through the `workspace:` protocol.
+
+### Patch Changes
+
+- Fixed `pnpm audit --fix` failing with `ERR_PNPM_INVALID_FIX_OPTION` when used without a value, including when another flag follows it, as in `pnpm audit --fix --json` [#13261](https://github.com/pnpm/pnpm/issues/13261). Fixed `pnpm audit --fix=override` ignoring the `saveExact` and `savePrefix` settings when writing vulnerability overrides [#11523](https://github.com/pnpm/pnpm/issues/11523).
+
+- Authenticate Node.js runtime downloads from `nodeDownloadMirrors` with URL-scoped npm registry credentials, including bearer tokens, basic auth, and `tokenHelper` [pnpm/pnpm#14334](https://github.com/pnpm/pnpm/issues/14334).
+
+- Fixed detached child processes being terminated after successful commands on Windows.
+
+- Sped up installs in large workspaces by resolving each named `workspace:` dependency (`workspace:*`, `workspace:^`, `workspace:1.2.3`) once and reusing it across every project that declares it, instead of re-resolving it per project.
+
+- Fixed `pnpm install --fix-lockfile` to derive its repair and filtered-merge views from one lockfile snapshot.
+
+- Load pnpmfile `updateConfig` hooks before packing so hook-provided catalogs resolve in `pnpm pack`, `pnpm publish`, and `pnpm stage publish` [pnpm/pnpm#14377](https://github.com/pnpm/pnpm/issues/14377).
+
+- `pnpm deploy` no longer requires `injectWorkspacePackages` to be enabled. A linked workspace dependency is rewritten to a `file:` dependency in the dedicated deploy lockfile, and the peer dependencies it declares are bound to the deployed graph's own resolution.
+
+  When a peer resolves to more than one version in that graph the binding is ambiguous, and choosing between the candidates is exactly what injecting the package would have decided, so the deploy still fails — now with `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER`, which names the package, the peer, and the competing versions, instead of refusing every non-injected workspace up front, and suggests pinning the peer to one version with an `overrides` entry as the way to keep deploying without injection [#9386](https://github.com/pnpm/pnpm/issues/9386).
+
+- Fixed global virtual store hashes for dependency cycles. Every package that transitively depends on an allowed build now includes the engine in its store path, independent of traversal order [pnpm/pnpm#14341](https://github.com/pnpm/pnpm/issues/14341).
+
+- Fixed `ERR_PNPM_CMD_SHIM_CHMOD` when several installs run at once against a shared global virtual store. One install could remove a command shim while another was making it executable ([pnpm/pnpm#14353](https://github.com/pnpm/pnpm/issues/14353)).
+
+- Fixed the PowerShell shim generated by `npm install -g pnpm` on Windows so it invokes the native `pnpm.exe` binary [pnpm/pnpm#14362](https://github.com/pnpm/pnpm/issues/14362).
+
+- Fixed context-aware global shims on WSL2 so native Linux installations dispatch through the project runtime.
+
+- `pnpm install` no longer writes global `minimumReleaseAgeExclude` entries to the project's `pnpm-workspace.yaml` [pnpm/pnpm#14347](https://github.com/pnpm/pnpm/issues/14347).
+
+- Fixed `catalog:` ranges in workspace package peer dependencies being reported as unmet [pnpm/pnpm#14361](https://github.com/pnpm/pnpm/issues/14361).
+
+- `globalDir` and `globalBinDir` are honored wherever they are set, so `pnpm add -g` no longer fails with `ERR_PNPM_GLOBAL_BIN_DIR_NOT_IN_PATH` after `pnpm config set -g global-bin-dir` [#14336](https://github.com/pnpm/pnpm/issues/14336). The global `config.yaml` is read again, `PNPM_CONFIG_GLOBAL_DIR` / `PNPM_CONFIG_GLOBAL_BIN_DIR` reach the directories derived from them, and a leading `~/` is expanded before that derivation. A project's `pnpm-workspace.yaml` still cannot set either key.
+
+- Fixed the install progress line reporting `added 0` under `nodeLinker: hoisted`, even when packages were linked into `node_modules` [#14348](https://github.com/pnpm/pnpm/issues/14348).
+
+- An auto-installed optional peer is now resolved to a version its declared peer range accepts, even when the workspace root depends on that package at a version outside the range. Previously the root's version was used and then reported as an unmet optional peer [#13867](https://github.com/pnpm/pnpm/issues/13867).
+
+- Fixed `pnpm run "/pattern/"` running matching scripts one at a time in a single project. Matching scripts now run concurrently up to `workspaceConcurrency`, and their output is prefixed so concurrent lines remain distinguishable [pnpm discussion 14357](https://github.com/orgs/pnpm/discussions/14357).
+
+- Fixed a slowdown at the end of a resolving install in a large workspace. The peer-dependency report now inspects only the projects the resolution flagged, rather than every project in the lockfile ([pnpm/pnpm#14359](https://github.com/pnpm/pnpm/issues/14359)).
+
+- Speed up workspace discovery for literal directories and conventional trailing-star patterns.
+
+  Workspace patterns now follow the same dot-directory rule as pnpm 11: a wildcard no longer matches a dot-prefixed directory, so `packages/*` and `**` skip `packages/.cache` and `.git`. A pattern that names a dot-prefixed directory still matches it, as `packages/.cache` and `packages/.*` do.
+
+- `pnpm audit` now ends its output with a trailing newline, including the `--json`, `--fix`, and `--ignore` output.
+
+- Retry transient Windows file-lock errors while replacing hoisted packages during installation.
+  This fixes [pnpm/pnpm#14349](https://github.com/pnpm/pnpm/issues/14349).
+
+- Fixed command-line `--side-effects-cache` overrides being ignored when `pnpm-workspace.yaml` uses the object form of `sideEffectsCache` [pnpm/pnpm#14338](https://github.com/pnpm/pnpm/issues/14338).
+
+- Speed up workspace project discovery in large monorepos: workspace patterns are now probed concurrently and the discovered projects' `package.json` files are read in parallel [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- Fixed repeated `pnpm dedupe` runs alternating between peer resolutions when a peer is provided through an npm alias.
+
+- Fixed `pnpm repo <package>` and `pnpm docs <package>` resolving bare package names through the `latest` tag, and prevented malformed package ranges from crashing registry selection.
+
+- Fixed non-ASCII characters in configuration values being mangled during environment-variable substitution. Paths such as `storeDir: ./café-store` are now preserved [#14383](https://github.com/pnpm/pnpm/issues/14383).
+
 ## 12.1.0
 
 ### Minor Changes

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,15 +1,16 @@
 {
-  "lastValidatedTimestamp": 1788011580280,
+  "lastValidatedTimestamp": 1788219115260,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.1.0"
+      "version": "12.2.0"
     }
   },
   "pnpmfiles": [],
   "filteredInstall": false,
   "settings": {
     "allowBuilds": {
+      "@parcel/watcher": false,
       "core-js": false,
       "esbuild": true,
       "fuse-native": true,
@@ -131,7 +132,7 @@
         "escape-string-regexp": "^5.0.0",
         "eslint": "^10.9.1",
         "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jest": "^29.16.2",
+        "eslint-plugin-jest": "^29.16.5",
         "eslint-plugin-n": "^18.3.0",
         "eslint-plugin-promise": "^7.3.0",
         "eslint-plugin-regexp": "^3.1.1",
@@ -158,8 +159,8 @@
         "is-subdir": "^2.0.0",
         "is-windows": "^1.0.2",
         "isexe": "4.0.0",
-        "jest": "^30.4.2",
-        "jest-diff": "^30.4.1",
+        "jest": "30.4.2",
+        "jest-diff": "30.4.1",
         "js-yaml": "npm:@zkochan/js-yaml@0.0.11",
         "json5": "^2.2.3",
         "keyv": "5.6.0",
@@ -174,7 +175,7 @@
         "mdast-util-to-string": "^4.0.0",
         "memoize": "^11.0.0",
         "micromatch": "^4.0.8",
-        "msgpackr": "2.0.6",
+        "msgpackr": "2.1.0",
         "nm-prune": "^5.0.0",
         "node-gyp": "^12.3.0",
         "normalize-newline": "5.0.0",
@@ -184,7 +185,7 @@
         "npm-packlist": "10.0.4",
         "npm-registry-fetch": "^19.0.0",
         "object-hash": "3.0.0",
-        "open": "^11.0.1",
+        "open": "^11.0.2",
         "openpgp": "^6.3.1",
         "p-defer": "^4.0.1",
         "p-every": "^2.0.0",
@@ -199,8 +200,8 @@
         "path-temp": "^3.0.0",
         "pidtree": "^1.0.0",
         "preferred-pm": "^5.0.0",
-        "pretty-bytes": "^7.1.1",
-        "pretty-ms": "^9.3.0",
+        "pretty-bytes": "^7.1.2",
+        "pretty-ms": "^9.3.1",
         "promise-share": "^2.0.1",
         "proxyquire": "^2.1.3",
         "ps-list": "^9.0.0",
@@ -330,6 +331,7 @@
     "trustPolicyExclude": [
       "@pnpm/*",
       "@yarnpkg/libzip@3.2.2",
+      "fastq@1.20.2",
       "pnpm",
       "rxjs@7.8.2",
       "tinyexec@1.2.2",

package/install.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 // Preinstall for the pnpm v12 wrapper (shared verbatim by `pnpm` and
 // `@pnpm/exe`): replace the shebang-less placeholder bins with the host's native
-// binary so `pnpm` runs directly, no Node startup per call. A placeholder (not a
-// Node launcher) is required because the Windows shim is generated from the bin
-// file and npm won't re-read package.json after preinstall; the tradeoff is no
-// fallback when build scripts are blocked (`--ignore-scripts`, pnpm/Bun default).
+// binary so `pnpm` runs directly, no Node startup per call. The `.exe` suffix is
+// used on every platform because PowerShell cannot execute an extensionless
+// native binary through an explicit path. The placeholder makes the bin target
+// packable before preinstall replaces it; the tradeoff is no fallback when build
+// scripts are blocked (`--ignore-scripts`, pnpm/Bun default).
 //
 // `pn`/`pnpx`/`pnx` are committed `#!/bin/sh` scripts on Unix (so only `pnpm` is
 // relinked); on Windows the native binary is hardlinked onto each and
@@ -63,7 +64,7 @@ function setup () {
     }
     rewriteBin(newBin)
   } else {
-    placeBinary(nativeBinary, path.join(wrapperDir, 'pnpm'), 0o755)
+    placeBinary(nativeBinary, path.join(wrapperDir, 'pnpm.exe'), 0o755)
   }
 }
 

package/package.json

@@ -9,7 +9,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.1.0",
+  "version": "12.2.0",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -25,7 +25,7 @@
     "directory": "pnpm/npm/pnpm"
   },
   "bin": {
-    "pnpm": "pnpm",
+    "pnpm": "pnpm.exe",
     "pn": "pn",
     "pnpx": "pnpx",
     "pnx": "pnx"
@@ -35,7 +35,7 @@
     "node": ">=18.*"
   },
   "files": [
-    "pnpm",
+    "pnpm.exe",
     "pn",
     "pnpx",
     "pnx",
@@ -46,14 +46,14 @@
     "THIRD-PARTY-NOTICES.md"
   ],
   "optionalDependencies": {
-    "@pnpm/exe.win32-x64": "12.1.0",
-    "@pnpm/exe.win32-arm64": "12.1.0",
-    "@pnpm/exe.darwin-x64": "12.1.0",
-    "@pnpm/exe.darwin-arm64": "12.1.0",
-    "@pnpm/exe.linux-x64": "12.1.0",
-    "@pnpm/exe.linux-arm64": "12.1.0",
-    "@pnpm/exe.linux-x64-musl": "12.1.0",
-    "@pnpm/exe.linux-arm64-musl": "12.1.0"
+    "@pnpm/exe.win32-x64": "12.2.0",
+    "@pnpm/exe.win32-arm64": "12.2.0",
+    "@pnpm/exe.darwin-x64": "12.2.0",
+    "@pnpm/exe.darwin-arm64": "12.2.0",
+    "@pnpm/exe.linux-x64": "12.2.0",
+    "@pnpm/exe.linux-arm64": "12.2.0",
+    "@pnpm/exe.linux-x64-musl": "12.2.0",
+    "@pnpm/exe.linux-arm64-musl": "12.2.0"
   },
   "scripts": {
     "preinstall": "node install.js",