pnpm 12.4.0 → 12.4.2

package/CHANGELOG.md

@@ -1,5 +1,195 @@
 # pnpm
 
+## 12.4.2
+
+pnpm 12.4.2 includes security fixes for executable shims and GitHub Actions links, more reliable installs, faster peer dependency checks in workspaces, and Python lockfiles that work across compatible targets.
+
+### Patch Changes
+
+#### Security
+
+- Dependency executables can no longer take over another package's POSIX bin shim through its shell helpers. Reinstall dependencies to replace existing shims [#14837](https://github.com/pnpm/pnpm/issues/14837).
+
+  On Cygwin, MSYS2, and WSL, shims still use `PATH` for Windows path conversion, so dependency executables can still redirect them there.
+
+- GitHub Actions homepage links no longer expose server credentials. GitHub server URLs now require HTTPS, with HTTP allowed only for loopback hosts.
+
+#### Installing packages
+
+- pnpm no longer crashes at startup on FreeBSD and other Unix-like platforms. Platforms other than Windows and macOS use `~/.local/share/pnpm/store` by default [#14859](https://github.com/pnpm/pnpm/issues/14859).
+
+- `pnpm install` on Windows no longer fails with `ERR_PNPM_PACKAGE_MANAGER_REMOVE_MODULES_DIR` when clearing `node_modules` containing linked dependencies, such as when changing `nodeLinker` [#14790](https://github.com/pnpm/pnpm/issues/14790).
+
+- `pnpm install <pkg>` now accepts `--prod` and `--dev`, including `--prod=false` [#14868](https://github.com/pnpm/pnpm/issues/14868).
+
+- `pnpm install` and `pnpm update` now honor `--ignore-workspace` in nested projects excluded from the surrounding workspace. The flag also skips that workspace's settings during the `packageManager` check [#14809](https://github.com/pnpm/pnpm/issues/14809).
+
+- `pnpm install` on macOS no longer reuses stale files for `file:` tarball or git-hosted tarball dependencies.
+
+- `pnpm install` in a single-project directory now detects `package.json` edits made while the previous install was finishing [#14890](https://github.com/pnpm/pnpm/issues/14890).
+
+- `pnpm install --frozen-lockfile` now removes packages no longer reachable from any project in `pnpm-lock.yaml`. This also prevents repeated lifecycle script execution and unnecessary installs before `pnpm run` and `pnpm exec` with `verifyDepsBeforeRun` [#14891](https://github.com/pnpm/pnpm/issues/14891).
+
+#### Resolving and updating dependencies
+
+- Node.js runtime resolution now reports network failures from unofficial-builds.nodejs.org. These failures previously omitted musl builds from `pnpm-lock.yaml`, making its contents depend on network access [#14813](https://github.com/pnpm/pnpm/issues/14813).
+
+- `pnpm install` now rejects invalid `peerDependencies` specifiers with `ERR_PNPM_INVALID_PEER_DEPENDENCY_SPECIFICATION`. A value such as `"foo": "foo@1.0.0"` previously created a broken directory link [#14791](https://github.com/pnpm/pnpm/issues/14791).
+
+- `pnpm deploy` now writes plain registry versions in the deployed `package.json`, without peer dependency suffixes. The lockfile retains peer bindings, and npm aliases retain their target package names [#14873](https://github.com/pnpm/pnpm/issues/14873).
+
+- `pnpm add <git repository>` now names repositories without a `package.json` as `@owner/repo`, allowing dependencies on equally named repositories from different owners [#14870](https://github.com/pnpm/pnpm/issues/14870).
+
+- Peer dependency resolution now deduplicates packages whose child dependency resolves an optional peer in only some workspace projects, such as `next` with `styled-jsx`'s optional `babel-plugin-macros` peer [#14800](https://github.com/pnpm/pnpm/issues/14800).
+
+- `pnpm update` now settles the lockfile in one run when an upgrade removes the package providing an optional peer dependency [#14895](https://github.com/pnpm/pnpm/issues/14895).
+
+- `pnpm update --no-save` now preserves override-applied specifiers for dependencies it is not updating, preventing subsequent frozen installs from failing with `ERR_PNPM_OUTDATED_LOCKFILE` [#14836](https://github.com/pnpm/pnpm/issues/14836).
+
+- `pnpm update --no-save` now succeeds under `minimumReleaseAgeStrict` when every resolved version is old enough [#14835](https://github.com/pnpm/pnpm/issues/14835).
+
+#### Performance
+
+- Workspace installs and `pnpm peers check` are faster when projects depend on each other, fixing a slowdown introduced in 12.3.0. Unmet peer dependencies of workspace packages are now reported only under projects that link them directly [#14906](https://github.com/pnpm/pnpm/issues/14906).
+
+- Hoisted installs use less memory when packages are cached. Frozen-lockfile hoisted installs on macOS are also faster when reusable package directories are cached.
+
+#### Python projects
+
+- `pnpm install --frozen-lockfile` now reuses `pylock.toml` across compatible Python targets, including after kernel updates. Reuse requires unchanged requirements, index, and `requires-python`, compatible wheels, and a locked dependency graph matching the target's markers [#14843](https://github.com/pnpm/pnpm/issues/14843).
+
+  The lockfile's `environments` marker now includes only the interpreter version and marker variables used by the dependency graph. Without `--frozen-lockfile`, pnpm warns and resolves again when the locked graph no longer matches the target.
+
+- Python resolution no longer fails on malformed `Requires-Python` values, such as the trailing comma in `openpyxl` 3.0.x. pnpm treats these releases as declaring no interpreter range [#14910](https://github.com/pnpm/pnpm/issues/14910).
+
+- `pnpm add pypi:...` now rejects unsupported `--save-prefix` values before editing the manifest or resolving dependencies.
+
+#### Workspaces and scripts
+
+- Scripts listed in `syncInjectedDepsAfterScripts` no longer fail with `ERR_PNPM_INJECTED_DEPS_SYNC_READ_DIR` when the lockfile contains an injected package copy that no project depends on.
+
+- `shellEmulator` now expands `${VAR}`, `${VAR:-default}`, and `${VAR:+alternative}` in scripts [#14814](https://github.com/pnpm/pnpm/issues/14814).
+
+- Cargo and Python project discovery now honors `!` exclusions in `pnpm-workspace.yaml` `packages`, skipping both parsing and generated source configuration for excluded projects [#14844](https://github.com/pnpm/pnpm/issues/14844).
+
+- `pnpm --filter "./packages/{app,lib}"` now selects either alternative. Brace alternatives can nest, span path separators, and combine with other wildcards.
+
+- GitHub Actions updates now stop if an action reference changes during version resolution, and preserve unrelated workflow edits.
+
+#### CLI and output
+
+- `pn`, `pnpx`, and `pnx` now run the pnpm installed alongside them, even when that directory is absent from `PATH` or another pnpm comes first [#14803](https://github.com/pnpm/pnpm/issues/14803).
+
+- `pnpm --version` now reports failures to install or record a project's pinned pnpm, then prints the running CLI's version. It also honors `--store-dir` and `--store` [#14831](https://github.com/pnpm/pnpm/issues/14831).
+
+- `pnpm self-update` no longer reinstalls the active version when it was installed by the standalone installation script [#14823](https://github.com/pnpm/pnpm/issues/14823).
+
+- `pnpm t` and `pnpm tst` work again as aliases for `pnpm test`.
+
+- `pnpm sbom` now emits valid repository URLs in CycloneDX `externalReferences[].url` and SPDX `homepage`. Shorthands such as `vercel/ms` become `git+https` URLs, embedded credentials are removed, and invalid repository values are omitted [#14773](https://github.com/pnpm/pnpm/issues/14773).
+
+## 12.4.1
+
+pnpm 12.4.1 fixes installs that failed on filesystems refusing hard links or clones, on Android, and under `nodeLinker: hoisted`. Repeat installs are faster.
+
+### Patch Changes
+
+#### Installing packages
+
+- `pnpm install` no longer fails with `Operation not permitted` when the filesystem refuses a hard link or a copy-on-write clone [#14722](https://github.com/pnpm/pnpm/issues/14722). Under `packageImportMethod: auto` and `clone-or-copy`, pnpm copies the file instead. EdenFS checkouts, which have no hard links, and rootless containers, which refuse the clone syscall, both hit this. An explicit `packageImportMethod: hardlink` or `clone` still reports the error.
+
+  pnpm also copies a package file whose store entry has reached the filesystem's limit on names for one file, 1024 on NTFS and 65000 on ext4. Such a file failed the install under `packageImportMethod: hardlink`, and under `auto` it stopped pnpm hard linking for the rest of the install.
+
+- `pnpm install` no longer writes a package file through a symlink left at the path it is importing to. Copying such a file overwrote whatever the link pointed at, and created that file when the link pointed nowhere. An executable package file also made the link's target executable.
+
+- Fixed `pnpm install` and `pnpm dlx` on Android. Registry requests crashed because pnpm found no system CA certificates, so pnpm uses bundled ones there [#14777](https://github.com/pnpm/pnpm/issues/14777). Imports also failed with "Permission denied" on filesystems that deny hard links and reflinks, and now fall back to copying [#14780](https://github.com/pnpm/pnpm/issues/14780).
+
+- `pnpm install` no longer fails with "Invalid cross-device link" while preserving a package's nested `node_modules` directory during a Docker build [#14758](https://github.com/pnpm/pnpm/issues/14758).
+
+- `pnpm install` no longer fails on a package tarball that carries a file at the archive root, such as the `._*` entries macOS `tar` adds [#14701](https://github.com/pnpm/pnpm/issues/14701). The file is installed at the root of the package.
+
+  A `file:` tarball packed without the usual `package/` directory is now recorded under the name and version from its own `package.json`. It was recorded under the alias the dependency was given, at version 0.0.0.
+
+- Under `nodeLinker: hoisted`, `pnpm install` no longer re-imports packages that are already in place. A repeat install replaced the whole `node_modules` tree and reported `Packages: +N`. A package is still imported when its directory is missing, when its `package.json` no longer carries the installed version, when it is a `file:` dependency, and when it is patched. Lifecycle scripts no longer run again for a package left in place, and `pnpm rebuild` and a change to `allowBuilds` still reach it.
+
+- `pnpm install` now runs a dependency's build scripts again when its side-effects cache entry has no files to restore [#14717](https://github.com/pnpm/pnpm/issues/14717). Such builds were skipped and nothing was put in their place, so a script whose whole effect lands outside its own package directory, such as a git hook installer, never took effect. pnpm no longer publishes empty artifacts to the shared side-effects cache either.
+
+#### Resolving and linking dependencies
+
+- `pnpm install`, `pnpm add`, and `pnpm dedupe` now apply `ignoredOptionalDependencies` [#14729](https://github.com/pnpm/pnpm/issues/14729). Matching optional dependencies are left out of the lockfile and are not installed. pnpm 12 installed them whenever it resolved dependencies from scratch.
+
+- `pnpm install` no longer links a transitive dependency to a workspace package when `linkWorkspacePackages` is `true` and the dependency is declared with a plain version range [#14781](https://github.com/pnpm/pnpm/issues/14781). Enabling `preferWorkspacePackages` does not change this. Set `linkWorkspacePackages: deep` to link them.
+
+- `pnpm install` no longer leaves dangling dependency links in workspace packages located above the workspace root [#14726](https://github.com/pnpm/pnpm/issues/14726).
+
+- `pnpm install` and `pnpm add` no longer leave a dangling symlink in `node_modules` when a project starts depending directly on a package that the lockfile holds only as a transitive dependency with resolved peer dependencies [#14714](https://github.com/pnpm/pnpm/issues/14714).
+
+- `pnpm dedupe` now keeps a compatible auto-installed peer when another workspace project depends on a newer major [#14697](https://github.com/pnpm/pnpm/issues/14697). Repeated runs alternated between compatible and incompatible peer versions.
+
+- `pnpm peers check` no longer reports a peer dependency declared as `workspace:^`, `workspace:~`, or a bare `workspace:` as unmet [#14770](https://github.com/pnpm/pnpm/issues/14770). pnpm reported these as unmet whatever version the linked workspace project supplied.
+
+#### Performance
+
+- Sped up repeat installs [#14540](https://github.com/pnpm/pnpm/issues/14540). pnpm checks the store's files only for the packages it links into `node_modules`, instead of every package in the lockfile. Creating the command shims in `node_modules/.bin` makes about 1,500 fewer filesystem calls in a 76 project workspace. Installs that use the global virtual store read their slot paths from the cache directory instead of deriving them every time. Verifying a large lockfile also allocates less memory.
+
+- Sped up `pnpm install` in Cargo workspaces with many member crates. Repeated installs reuse verified Cargo checksum metadata.
+
+- Installing several packages from the same Git repository and commit now downloads the source once per install [#14725](https://github.com/pnpm/pnpm/issues/14725). Each package still runs its prepare scripts in its own copy of the checkout.
+
+#### Running scripts and tasks
+
+- pnpm now passes Ctrl+C on to the script or command it started and waits for it to shut down [#14723](https://github.com/pnpm/pnpm/issues/14723). pnpm exited first, so a script that was still writing landed on the shell prompt.
+
+- `pnpm run "/pattern/" --no-bail` now lets every matched script finish after one of them fails [#14718](https://github.com/pnpm/pnpm/issues/14718). The command exits with `ERR_PNPM_RUN_FAILED`, and its message lists the scripts that failed in the order they were selected.
+
+- `pnpm pipeline` no longer fails on a project that tracks a symlink, such as a `CLAUDE.md` pointing at `AGENTS.md` [#14692](https://github.com/pnpm/pnpm/issues/14692). Changing a symlinked input's target invalidates that task's cache, and `pnpm pipeline --no-cache` no longer hashes task inputs.
+
+#### Commands
+
+- `pnpm add -g`, `pnpm update -g`, and `pnpm remove -g` no longer change global bins or install directories after reading only part of an installed package group [#13796](https://github.com/pnpm/pnpm/issues/13796). If any declared package manifest is missing, malformed, or unreadable, pnpm now fails before it activates or removes anything and leaves the existing global installation intact.
+
+- `pnpm dedupe` now processes every workspace project by default, including workspaces that keep a separate lockfile per project [#14732](https://github.com/pnpm/pnpm/issues/14732). Workspace filters select which projects it processes, and `--fail-if-no-match` exits with an error when no project matches.
+
+- `pnpm update <name>@<version>` now keeps the range operator the manifest declares [#14745](https://github.com/pnpm/pnpm/issues/14745). Running `pnpm update react@19.3.0` on `"react": "^19.2.8"` writes `"react": "^19.3.0"`. A `jsr:` entry keeps its `jsr:` prefix, and a plain `pnpm update` now moves a `jsr:` range the way it moves an npm range.
+
+- `pnpm --filter` directory selectors now support `?` wildcards and character classes such as `[ab]`. A `*` or `?` wildcard no longer selects a directory whose name starts with a dot, as on pnpm 11.
+
+- `pnpm deploy --legacy` now prefers the dependency versions pinned in the source workspace lockfile when they still satisfy the deployed project's range [#13857](https://github.com/pnpm/pnpm/issues/13857).
+
+- `pnpm sbom` now leaves out a package's author field when the manifest author name is empty or contains only whitespace [#14685](https://github.com/pnpm/pnpm/issues/14685). In a filtered or split workspace run, only a project with no `author` field inherits the workspace root's author.
+
+  `pnpm sbom --sbom-format spdx` now writes `creationInfo.created` with whole seconds, such as `2026-09-08T10:38:21Z` [#14684](https://github.com/pnpm/pnpm/issues/14684). The fractional seconds it carried were rejected by strict SPDX consumers.
+
+#### Configuration
+
+- The `updateConfig` pnpmfile hook now receives the resolved configuration, including settings that came from `.npmrc`, the command line, or a default [#14676](https://github.com/pnpm/pnpm/issues/14676). Scoped registries are reported under `registriesByScope`, and a hook may rewrite that map to change where packages are fetched from. Registry credentials are reported under `configByUri`, as pnpm 11 reports them. An unset setting is left out rather than reported as `null`.
+
+- `pnpm audit --fix` and the `minimumReleaseAgeStrict` approval prompt now keep the comments in `minimumReleaseAgeExclude` when they append an entry to it in `pnpm-workspace.yaml`. The rest of the list is left as written, and the `trustPolicyExcludePrune` and `minimumReleaseAgeExcludePrune` cleanups keep the comments of the entries they retain.
+
+  `pnpm install` and `pnpm dedupe` now run those cleanups too [#14759](https://github.com/pnpm/pnpm/issues/14759). Only `pnpm add`, `pnpm update`, and `pnpm remove` pruned the entries that the freshly written lockfile no longer resolves.
+
+- `pnpm config set --global node-download-mirrors` no longer rejects the key [#13611](https://github.com/pnpm/pnpm/issues/13611). The global config file already accepted `nodeDownloadMirrors`, but the command refused to write it.
+
+- `NO_PROXY` entries that start with a dot, such as `.npmjs.org`, now bypass the proxy for the domain and its subdomains [#14686](https://github.com/pnpm/pnpm/issues/14686).
+
+- pnpm no longer creates a project `pnpm-lock.yaml` when `devEngines.packageManager.onFail` is `download` and lockfile writing is off through `lockfile: false` or `--no-lockfile` [#14728](https://github.com/pnpm/pnpm/issues/14728). pnpm still switches to the pinned version.
+
+- pnpm now writes `node_modules/.package-map.json` only when `nodeExperimentalPackageMap` is enabled. Nothing reads the file without that setting, and an install that stops writing the map removes the one a previous install left.
+
+#### Windows
+
+- `pnpm pipeline` no longer fails with intermittent access denied errors when concurrent tasks save their cache entries on Windows.
+
+- Windows filesystem operations now retry permission errors for up to one second [#14682](https://github.com/pnpm/pnpm/issues/14682). A permanent permission error delayed the failure by a minute. Sharing and lock violations keep their one minute retry budget.
+
+#### Messages and output
+
+- pnpm now warns when the root `package.json` declares a non-empty `workspaces` array and the project has no `pnpm-workspace.yaml` [#2255](https://github.com/pnpm/pnpm/issues/2255). Such an install linked no project and said nothing about why.
+
+- `ERR_PNPM_PACKAGE_MANAGER_REMOVE_MODULES_DIR` now names the file or directory in `node_modules` that pnpm could not clean up. It reported only the underlying OS error, such as "Access is denied (os error 5)".
+
+- `pnpm --help` no longer describes pnpm as experimental.
+
 ## 12.4.0
 
 ### Minor Changes

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,9 +1,9 @@
 {
-  "lastValidatedTimestamp": 1788864536446,
+  "lastValidatedTimestamp": 1789466800429,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.4.0"
+      "version": "12.4.2"
     }
   },
   "pnpmfiles": [],
@@ -28,7 +28,7 @@
         "@commitlint/prompt-cli": "^21.2.2",
         "@cyclonedx/cyclonedx-library": "10.2.0",
         "@eslint/js": "^10.0.1",
-        "@inquirer/prompts": "^8.7.1",
+        "@inquirer/prompts": "^8.7.2",
         "@jest/globals": "30.4.1",
         "@npm/types": "^2.1.0",
         "@openpgp/web-stream-tools": "0.3.1",
@@ -48,7 +48,7 @@
         "@pnpm/tabtab": "^0.5.4",
         "@pnpm/tgz-fixtures": "0.0.0",
         "@reflink/reflink": "0.1.19",
-        "@rushstack/worker-pool": "0.7.25",
+        "@rushstack/worker-pool": "0.7.26",
         "@stylistic/eslint-plugin": "^5.10.0",
         "@types/adm-zip": "^0.5.8",
         "@types/archy": "0.0.36",
@@ -87,14 +87,13 @@
         "@types/write-file-atomic": "^4.0.3",
         "@types/yarnpkg__lockfile": "^1.1.9",
         "@types/zkochan__table": "npm:@types/table@6.3.2",
-        "@typescript-eslint/utils": "^8.69.0",
+        "@typescript-eslint/utils": "^8.70.0",
         "@typescript/native-preview": "7.0.0-dev.20260707.2",
         "@yarnpkg/core": "4.9.1",
         "@yarnpkg/extensions": "2.0.7",
         "@yarnpkg/lockfile": "^1.1.0",
         "@yarnpkg/nm": "4.1.1",
         "@yarnpkg/pnp": "^4.1.7",
-        "@zkochan/cmd-shim": "^9.0.7",
         "@zkochan/retry": "^0.2.0",
         "@zkochan/rimraf": "^4.0.0",
         "@zkochan/table": "^2.0.1",
@@ -142,7 +141,7 @@
         "fast-glob": "^3.3.3",
         "fs-extra": "^11.4.0",
         "fuse-native": "^2.2.6",
-        "get-pnpm": "^0.0.3",
+        "get-pnpm": "^0.0.4",
         "get-port": "^7.2.0",
         "ghooks": "2.0.4",
         "graceful-fs": "^4.2.11",
@@ -172,6 +171,7 @@
         "lru-cache": "^11.5.2",
         "make-empty-dir": "^4.0.0",
         "mdast-util-to-string": "^4.0.0",
+        "memfs": "^3.5.3",
         "memoize": "^11.0.0",
         "micromatch": "^4.0.8",
         "msgpackr": "2.1.0",
@@ -246,7 +246,7 @@
         "tree-kill": "^1.2.2",
         "ts-jest-resolver": "2.0.1",
         "typescript": "6.0.3",
-        "typescript-eslint": "^8.69.0",
+        "typescript-eslint": "^8.70.0",
         "undici": "^7.29.0",
         "unified": "^11.0.5",
         "validate-npm-package-name": "7.0.2",
@@ -311,8 +311,7 @@
       "write-ini-file",
       "write-json5-file",
       "write-yaml-file",
-      "http-proxy-middleware@3.0.7",
-      "get-pnpm@0.0.3"
+      "http-proxy-middleware@3.0.7"
     ],
     "minimumReleaseAgeIgnoreMissingTime": true,
     "minimumReleaseAgeStrict": true,
@@ -330,10 +329,8 @@
     "trustPolicyExclude": [
       "@pnpm/*",
       "@yarnpkg/libzip@3.2.2",
-      "fastq@1.20.2",
       "pnpm",
       "rxjs@7.8.2",
-      "tinyexec@1.2.2",
       "undici-types@6.21.0"
     ],
     "trustPolicyIgnoreAfter": 10080

package/dist/node_modules/get-pnpm/lib/platformPackageName.js

@@ -1,3 +1,11 @@
+const V12_ONLY_TARGETS = new Set([
+    'android-arm64',
+    'android-x64',
+    'freebsd-x64',
+    'linux-ppc64',
+    'linux-riscv64',
+    'linux-s390x',
+]);
 /**
  * Name of the npm package that carries the pnpm executable for `target`.
  *
@@ -6,15 +14,22 @@
  * publishes `@pnpm/exe.<process.platform>-<arch>[-musl]`, while v11 and older
  * publish `@pnpm/<macos|win|linux|linuxstatic>-<arch>`.
  *
- * @throws if pnpm publishes no binary for the host — either because the
- * architecture was never supported, or because of the v11-only Intel macOS gap.
+ * @throws if pnpm publishes no binary for the host — because the host is not
+ * built for at all, because the binary arrived in v12 and an older major was
+ * asked for, or because of the v11-only Intel macOS gap.
  */
 export function platformPackageName({ major, platform, arch, musl }) {
-    if (arch !== 'x64' && arch !== 'arm64') {
-        throw new Error('Sorry! pnpm currently only provides pre-built binaries for x86_64/arm64 architectures.');
+    const target = `${platform}-${arch}`;
+    if (V12_ONLY_TARGETS.has(target)) {
+        if (major >= 12)
+            return `@pnpm/exe.${target}`;
+        throw new Error(`pnpm v${major} does not provide a pre-built binary for ${target}. pnpm 12 does:
+
+  npx get-pnpm 12`);
     }
-    if (platform !== 'darwin' && platform !== 'linux' && platform !== 'win32') {
-        throw new Error(`Sorry! pnpm does not provide a pre-built binary for ${platform}.`);
+    if ((arch !== 'x64' && arch !== 'arm64') ||
+        (platform !== 'darwin' && platform !== 'linux' && platform !== 'win32')) {
+        throw new Error(`Sorry! pnpm does not provide a pre-built binary for ${target}.`);
     }
     if (platform === 'darwin' && arch === 'x64' && major === 11) {
         throw new Error(`pnpm v11 does not provide a working binary for Intel macOS (darwin-x64) due to an upstream Node.js SEA bug.

package/dist/node_modules/get-pnpm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "get-pnpm",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "description": "Installs pnpm as a standalone executable",
   "keywords": [
     "pnpm",

package/package.json

@@ -9,7 +9,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.4.0",
+  "version": "12.4.2",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -46,20 +46,20 @@
     "THIRD-PARTY-NOTICES.md"
   ],
   "optionalDependencies": {
-    "@pnpm/exe.win32-x64": "12.4.0",
-    "@pnpm/exe.win32-arm64": "12.4.0",
-    "@pnpm/exe.darwin-x64": "12.4.0",
-    "@pnpm/exe.darwin-arm64": "12.4.0",
-    "@pnpm/exe.linux-x64": "12.4.0",
-    "@pnpm/exe.linux-arm64": "12.4.0",
-    "@pnpm/exe.linux-riscv64": "12.4.0",
-    "@pnpm/exe.linux-ppc64": "12.4.0",
-    "@pnpm/exe.linux-s390x": "12.4.0",
-    "@pnpm/exe.linux-x64-musl": "12.4.0",
-    "@pnpm/exe.linux-arm64-musl": "12.4.0",
-    "@pnpm/exe.freebsd-x64": "12.4.0",
-    "@pnpm/exe.android-arm64": "12.4.0",
-    "@pnpm/exe.android-x64": "12.4.0"
+    "@pnpm/exe.win32-x64": "12.4.2",
+    "@pnpm/exe.win32-arm64": "12.4.2",
+    "@pnpm/exe.darwin-x64": "12.4.2",
+    "@pnpm/exe.darwin-arm64": "12.4.2",
+    "@pnpm/exe.linux-x64": "12.4.2",
+    "@pnpm/exe.linux-arm64": "12.4.2",
+    "@pnpm/exe.linux-riscv64": "12.4.2",
+    "@pnpm/exe.linux-ppc64": "12.4.2",
+    "@pnpm/exe.linux-s390x": "12.4.2",
+    "@pnpm/exe.linux-x64-musl": "12.4.2",
+    "@pnpm/exe.linux-arm64-musl": "12.4.2",
+    "@pnpm/exe.freebsd-x64": "12.4.2",
+    "@pnpm/exe.android-arm64": "12.4.2",
+    "@pnpm/exe.android-x64": "12.4.2"
   },
   "scripts": {
     "preinstall": "node install.js",

package/pn

@@ -1,2 +1,36 @@
 #!/bin/sh
-exec pnpm "$@"
+# `pn` is `pnpm`. The pnpm it hands over to is the one installed alongside it,
+# found relative to this file: a `PATH` lookup would run whatever other pnpm
+# comes first there, and would find nothing at all when the directory holding
+# these bins is not on `PATH`.
+#
+# $0 is whatever shim or symlink `pn` was launched through, so walk to the file
+# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
+# hang the script. Directories come from `${self%/*}` and `readlink` runs through
+# `command -p`, so the caller's `PATH` decides nothing here.
+self=$0
+# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(command -p readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=${self%/*}/$link ;;
+  esac
+done
+# The walk has to end at a regular file. Running out of hops leaves $self a
+# symlink; a chain that changed under us can leave it dangling or a directory, and
+# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
+# wrong directory — the substitution this script exists to prevent.
+if [ -L "$self" ] || [ ! -f "$self" ]; then
+  echo "pn: could not resolve $0 to a regular file within 40 symlink hops." >&2
+  exit 1
+fi
+
+exec "${self%/*}/pnpm" "$@"

package/pnpm

@@ -24,15 +24,25 @@ fi
 # $0 is whatever shim or symlink pnpm was launched through; ./bin/pnpm.mjs is
 # found relative to this file. The hop cap matches the kernel's ELOOP limit, so
 # a cycle cannot hang the script.
+#
+# `readlink` runs through `command -p`, which searches the system default path,
+# and directories come from `${self%/*}`, which runs nothing at all. The caller's
+# PATH therefore decides only which `node` runs, which is what it is for.
 self=$0
+# `${self%/*}` needs a slash to strip. A bare name came from a PATH lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
 hops=0
 while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops + 1))
-  link=$(readlink "$self")
+  link=$(command -p readlink "$self")
   case $link in
     /*) self=$link ;;
-    *) self=$(dirname "$self")/$link ;;
+    *) self=${self%/*}/$link ;;
   esac
 done
 
-exec node "$(dirname "$self")/bin/pnpm.mjs" "$@"
+exec node "${self%/*}/bin/pnpm.mjs" "$@"

package/pnpx

@@ -1,2 +1,36 @@
 #!/bin/sh
-exec pnpm dlx "$@"
+# `pnpx` is `pnpm dlx`. The pnpm it hands over to is the one installed alongside
+# it, found relative to this file: a `PATH` lookup would run whatever other pnpm
+# comes first there, and would find nothing at all when the directory holding
+# these bins is not on `PATH`.
+#
+# $0 is whatever shim or symlink `pnpx` was launched through, so walk to the file
+# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
+# hang the script. Directories come from `${self%/*}` and `readlink` runs through
+# `command -p`, so the caller's `PATH` decides nothing here.
+self=$0
+# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(command -p readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=${self%/*}/$link ;;
+  esac
+done
+# The walk has to end at a regular file. Running out of hops leaves $self a
+# symlink; a chain that changed under us can leave it dangling or a directory, and
+# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
+# wrong directory — the substitution this script exists to prevent.
+if [ -L "$self" ] || [ ! -f "$self" ]; then
+  echo "pnpx: could not resolve $0 to a regular file within 40 symlink hops." >&2
+  exit 1
+fi
+
+exec "${self%/*}/pnpm" dlx "$@"

package/pnx

@@ -1,2 +1,36 @@
 #!/bin/sh
-exec pnpm dlx "$@"
+# `pnx` is `pnpm dlx`. The pnpm it hands over to is the one installed alongside
+# it, found relative to this file: a `PATH` lookup would run whatever other pnpm
+# comes first there, and would find nothing at all when the directory holding
+# these bins is not on `PATH`.
+#
+# $0 is whatever shim or symlink `pnx` was launched through, so walk to the file
+# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
+# hang the script. Directories come from `${self%/*}` and `readlink` runs through
+# `command -p`, so the caller's `PATH` decides nothing here.
+self=$0
+# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(command -p readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=${self%/*}/$link ;;
+  esac
+done
+# The walk has to end at a regular file. Running out of hops leaves $self a
+# symlink; a chain that changed under us can leave it dangling or a directory, and
+# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
+# wrong directory — the substitution this script exists to prevent.
+if [ -L "$self" ] || [ ! -f "$self" ]; then
+  echo "pnx: could not resolve $0 to a regular file within 40 symlink hops." >&2
+  exit 1
+fi
+
+exec "${self%/*}/pnpm" dlx "$@"

package/dist/node_modules/.package-map.json

@@ -1 +0,0 @@
-{"packages":{".":{"url":"..","dependencies":{"get-pnpm":"get-pnpm","node-gyp":"node-gyp","pacquet":"."}},"@isaacs/fs-minipass":{"url":"./@isaacs/fs-minipass","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","minipass":"minipass"}},"abbrev":{"url":"./abbrev","dependencies":{"abbrev":"abbrev"}},"chownr":{"url":"./chownr","dependencies":{"chownr":"chownr"}},"env-paths":{"url":"./env-paths","dependencies":{"env-paths":"env-paths"}},"exponential-backoff":{"url":"./exponential-backoff","dependencies":{"exponential-backoff":"exponential-backoff"}},"fdir":{"url":"./fdir","dependencies":{"fdir":"fdir","picomatch":"picomatch"}},"get-pnpm":{"url":"./get-pnpm","dependencies":{"get-pnpm":"get-pnpm"}},"graceful-fs":{"url":"./graceful-fs","dependencies":{"graceful-fs":"graceful-fs"}},"isexe":{"url":"./isexe","dependencies":{"isexe":"isexe"}},"minipass":{"url":"./minipass","dependencies":{"minipass":"minipass"}},"minizlib":{"url":"./minizlib","dependencies":{"minipass":"minipass","minizlib":"minizlib"}},"node-gyp":{"url":"./node-gyp","dependencies":{"env-paths":"env-paths","exponential-backoff":"exponential-backoff","graceful-fs":"graceful-fs","node-gyp":"node-gyp","nopt":"nopt","proc-log":"proc-log","semver":"semver","tar":"tar","tinyglobby":"tinyglobby","undici":"undici","which":"which"}},"nopt":{"url":"./nopt","dependencies":{"abbrev":"abbrev","nopt":"nopt"}},"picomatch":{"url":"./picomatch","dependencies":{"picomatch":"picomatch"}},"proc-log":{"url":"./proc-log","dependencies":{"proc-log":"proc-log"}},"semver":{"url":"./semver","dependencies":{"semver":"semver"}},"tar":{"url":"./tar","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","chownr":"chownr","minipass":"minipass","minizlib":"minizlib","tar":"tar","yallist":"yallist"}},"tinyglobby":{"url":"./tinyglobby","dependencies":{"fdir":"fdir","picomatch":"picomatch","tinyglobby":"tinyglobby"}},"undici":{"url":"./undici","dependencies":{"undici":"undici"}},"which":{"url":"./which","dependencies":{"isexe":"isexe","which":"which"}},"yallist":{"url":"./yallist","dependencies":{"yallist":"yallist"}}}}