pnpm 12.3.2 → 12.3.4

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # pnpm
 
+## 12.3.4
+
+### Patch Changes
+
+- Sped up dependency resolution in large workspaces [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- pnpm 12 now accepts the boolean settings as command-line flags on every command that takes them in pnpm 11, for example `pnpm install --unsafe-perm`, `pnpm add foo --offline`, and `pnpm install --dangerously-allow-all-builds`. pnpm 12 rejected them with `unexpected argument`, which failed every install on Vercel, whose build runs `pnpm install --unsafe-perm` [#14346](https://github.com/pnpm/pnpm/issues/14346).
+
+  `pnpm remove` now accepts `--unsafe-perm`, the same flag `pnpm install`, `pnpm add`, and `pnpm update` take.
+
+## 12.3.3
+
+### Patch Changes
+
+- Fixed concurrent installs sharing a store occasionally failing with an ENOENT error while importing a package file [#14353](https://github.com/pnpm/pnpm/issues/14353).
+
+- Sped up writing the lockfile in large workspaces [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- Sped up dependency resolution in large workspaces [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- pnpm now runs through Node.js when it was installed by a tool that skips build scripts, such as Vercel's `packageManager` provisioning, Bun, Deno, or `npm install --ignore-scripts`. Those installs previously failed with `syntax error near unexpected token ')'`. They still cannot run pnpm on Windows. On macOS only a shell can start it [#14346](https://github.com/pnpm/pnpm/issues/14346).
+
 ## 12.3.2
 
 ### Patch Changes

package/bin/pnpm.mjs

@@ -3,14 +3,17 @@
 // `./bin/pnpx.mjs` for every pnpm >=11 (see its `config.json`) and loads them
 // into its own Node.js process, which a native executable cannot be loaded into.
 //
-// Only Corepack reaches this file: `package.json#bin` still points at the native
-// binary, so an ordinary `npm install -g pnpm` never pays for a Node.js startup.
+// The `pnpm` placeholder bin runs it too, on Unix, when the install script that
+// replaces it with the native binary did not (build scripts blocked). An
+// ordinary `npm install -g pnpm` never pays for a Node.js startup:
+// `package.json#bin` points at the native binary.
 //
 // Corepack installs no dependencies and runs no lifecycle scripts, so the
 // `@pnpm/exe.<target>` package that carries the binary is absent and
 // `install.js` never ran. The binary is therefore downloaded on first use and
 // kept next to this wrapper — where the native binary also finds the `dist/`
-// payload it ships node-gyp in.
+// payload it ships node-gyp in. The placeholder's installs usually do carry
+// that package, and the binary is taken from there.
 //
 // The download itself is `get-pnpm`, the package behind https://get.pnpm.io,
 // which already knows how to verify one; it travels in that same `dist/`

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,9 +1,9 @@
 {
-  "lastValidatedTimestamp": 1788478744905,
+  "lastValidatedTimestamp": 1788529665777,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.3.2"
+      "version": "12.3.4"
     }
   },
   "pnpmfiles": [],
@@ -28,7 +28,7 @@
         "@commitlint/prompt-cli": "^21.2.2",
         "@cyclonedx/cyclonedx-library": "10.2.0",
         "@eslint/js": "^10.0.1",
-        "@inquirer/prompts": "^8.7.0",
+        "@inquirer/prompts": "^8.7.1",
         "@jest/globals": "30.4.1",
         "@npm/types": "^2.1.0",
         "@openpgp/web-stream-tools": "0.3.1",
@@ -227,7 +227,7 @@
         "semver-utils": "^1.1.4",
         "shlex": "^3.0.0",
         "shx": "^0.4.0",
-        "socks": "^2.8.9",
+        "socks": "^2.8.10",
         "sort-keys": "^6.0.1",
         "split-cmd": "^1.1.0",
         "split2": "^4.2.0",

package/install.js

@@ -6,8 +6,8 @@
 // the native binary at the same path. npm's global Windows shims still target
 // the extensionless path after the `bin` rewrite, so postinstall asks npm to
 // regenerate them against `pnpm.exe`. When lifecycle scripts are blocked
-// (`--ignore-scripts`, pnpm/Bun default), the placeholder remains and pnpm
-// cannot run.
+// (`--ignore-scripts`, pnpm/Bun default), the placeholder remains and runs pnpm
+// through Node.js wherever a shell reaches it (see the `pnpm` file).
 //
 // `pn`/`pnpx`/`pnx` are committed `#!/bin/sh` scripts on Unix (so only `pnpm` is
 // relinked); on Windows the native binary is hardlinked onto each and

package/package.json

@@ -9,7 +9,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.3.2",
+  "version": "12.3.4",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -46,14 +46,14 @@
     "THIRD-PARTY-NOTICES.md"
   ],
   "optionalDependencies": {
-    "@pnpm/exe.win32-x64": "12.3.2",
-    "@pnpm/exe.win32-arm64": "12.3.2",
-    "@pnpm/exe.darwin-x64": "12.3.2",
-    "@pnpm/exe.darwin-arm64": "12.3.2",
-    "@pnpm/exe.linux-x64": "12.3.2",
-    "@pnpm/exe.linux-arm64": "12.3.2",
-    "@pnpm/exe.linux-x64-musl": "12.3.2",
-    "@pnpm/exe.linux-arm64-musl": "12.3.2"
+    "@pnpm/exe.win32-x64": "12.3.4",
+    "@pnpm/exe.win32-arm64": "12.3.4",
+    "@pnpm/exe.darwin-x64": "12.3.4",
+    "@pnpm/exe.darwin-arm64": "12.3.4",
+    "@pnpm/exe.linux-x64": "12.3.4",
+    "@pnpm/exe.linux-arm64": "12.3.4",
+    "@pnpm/exe.linux-x64-musl": "12.3.4",
+    "@pnpm/exe.linux-arm64-musl": "12.3.4"
   },
   "scripts": {
     "preinstall": "node install.js",

package/pnpm

@@ -1,4 +1,38 @@
-This is a placeholder. pnpm's native binary replaces this file during
-installation (see ./install.js). If you are reading this, the install/build
-script did not run — reinstall with build scripts enabled (e.g. allow-list
-pnpm's build under pnpm or Bun, or drop --ignore-scripts).
+# pnpm's native binary replaces this file during installation (see
+# ./install.js). Until then this hands over to ./bin/pnpm.mjs, which finds the
+# installed binary or downloads one and spawns it.
+#
+# Shebang-less on purpose, and therefore an `sh` script: a bin shim generated
+# from a shebang records that interpreter, and pnpm 11 generates the shim before
+# it puts the native binary at this path.
+#
+# Something has to retry this file under a shell, because the kernel answers
+# ENOEXEC for it. A bin shim and a shell both do, and so does glibc's `execvp`.
+# Apple's libc does not, so on macOS a program that spawns this path itself gets
+# ENOEXEC; Windows has neither and cannot reach it at all.
+if ! command -v node > /dev/null 2>&1; then
+  echo "pnpm's native binary was not installed, and there is no Node.js to run pnpm without it." >&2
+  echo "Reinstall pnpm with build scripts enabled (allow-list pnpm's build under pnpm or Bun, or drop --ignore-scripts)." >&2
+  exit 1
+fi
+
+if [ -t 2 ]; then
+  echo "pnpm is running through Node.js because the script that installs its native binary was skipped." >&2
+  echo "Reinstall pnpm with its build scripts allowed to run the binary directly." >&2
+fi
+
+# $0 is whatever shim or symlink pnpm was launched through; ./bin/pnpm.mjs is
+# found relative to this file. The hop cap matches the kernel's ELOOP limit, so
+# a cycle cannot hang the script.
+self=$0
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=$(dirname "$self")/$link ;;
+  esac
+done
+
+exec node "$(dirname "$self")/bin/pnpm.mjs" "$@"