pnpm 12.4.1 → 12.5.0

package/CHANGELOG.md

@@ -1,5 +1,292 @@
 # pnpm
 
+## 12.5.0
+
+pnpm 12.5.0 makes Python a first-class ecosystem, accepts Package URLs in `pnpm add`, names whole platforms in `supportedArchitectures`, and gives tasks machine-wide concurrency limits. It also fixes an install that could reuse one package's downloaded tarball for another.
+
+### Minor Changes
+
+#### Installing packages
+
+- `pnpm add` accepts a [Package URL](https://github.com/package-url/purl-spec) in place of a package name. `pnpm add pkg:npm/express@4.18.2` saves `express` to `package.json`. `pnpm add pkg:cargo/serde@1.0.188` saves `serde` to `Cargo.toml`. `pnpm add pkg:pypi/requests@2.31.0` saves `requests` to `pyproject.toml`. `pkg` is now a reserved specifier prefix, whatever case it is written in, so a named registry can no longer be called `pkg`.
+
+- A `registries` entry can now name the ecosystem it serves.
+
+  ```yaml
+  registries:
+    https://internal.example/simple/:
+      ecosystem: pypi
+    https://pypi.org/simple/:
+      ecosystem: pypi
+    https://index.crates.io/:
+      ecosystem: cargo
+  ```
+
+  `ecosystem` accepts `npm`, `cargo` and `pypi`. An entry that does not name one serves npm, as every entry did before.
+
+  An ecosystem with several indexes searches them in the order they are declared. The first index that has a package supplies it, so the one declared last answers what none before it had.
+
+  A `registries` entry may not carry credentials. pnpm reads them from `.npmrc`, matched by origin, for a PyPI index as for every other package source.
+
+#### Configuring pnpm
+
+- `supportedArchitectures` now accepts a list of platforms, in place of the `os`, `cpu` and `libc` axes.
+
+  ```yaml
+  supportedArchitectures:
+    - linux-x64
+    - darwin-arm64
+    - win32-x64
+  ```
+
+  An install prepares for the platforms the list names, and for those only. A platform reads as `<os>-<cpu>`, with a C library on Linux, as in `linux-x64-musl` or `linux-x64-manylinux_2_28`. The Rust target triple of the same machine is accepted too, so `x86_64-unknown-linux-gnu` names the platform `linux-x64` names. A Linux platform that names no C library is the glibc platform. `current` is the platform the install runs on.
+
+  The `os`, `cpu` and `libc` mapping keeps working and keeps its meaning.
+
+- Added concurrency groups for tasks. A task in `pnpm-workspace.yaml` can name a `concurrencyGroup`. The new `concurrencyGroups` setting gives each group a limit. At most that many tasks of the group run at once on the machine, counted across every pnpm process, `pnpm pipeline` included. A task past the limit waits for a running one to finish. A script that calls `pnpm run` for a task of the same group runs under the slot its parent holds.
+
+  ```yaml
+  tasks:
+    test:rust:
+      concurrencyGroup: cargo
+  concurrencyGroups:
+    cargo: 2
+  ```
+
+- `tools` names the programs pnpm downloads, and `mirror` says where each one comes from.
+
+  ```yaml
+  tools:
+    node:
+      mirror: https://mirror.example.com/node/download
+      channels:
+        nightly: https://nightly.example.com/
+    bun:
+      mirror: https://mirror.example.com/bun
+    python:
+      mirror: https://mirror.example.com/python-build-standalone/releases
+  ```
+
+  `node`, `bun` and `python` can be named. Any other tool is refused.
+
+  `mirror` is the base a tool's own layout hangs off.
+
+  `channels` sends one release channel elsewhere. A channel neither it nor `node-mirror:<channel>` names is left to `mirror`. Only `node` publishes channels, so naming them for another tool is refused.
+
+  Set it in the global `config.yaml` or in `PNPM_CONFIG_TOOLS`. A `pnpm-workspace.yaml` that names a tool mirror is ignored.
+
+  `pnpm pack-app` downloads the Node.js it embeds through `tools.node`. `node-mirror:<channel>` keeps working and names the same thing as an entry under `channels`.
+
+#### Python interpreters and environments
+
+- `pnpm install` now chooses a Python interpreter for each project instead of installing every project with one interpreter [#14945](https://github.com/pnpm/pnpm/issues/14945). A project is installed with the first interpreter on the machine that its `requires-python` accepts, so a workspace can hold projects that support different Python versions. pnpm reads `.python-version` too, and prefers the version it asks for. Set `python.executable` in `pnpm-workspace.yaml` to name one interpreter for every project.
+
+- `pnpm install` now installs a Python interpreter when no interpreter on the machine fits the project [#14945](https://github.com/pnpm/pnpm/issues/14945). The builds are [python-build-standalone](https://github.com/astral-sh/python-build-standalone)'s, which uv and rye install too. One interpreter is shared by every project on the machine, and a later install uses it without downloading anything. `runtimeOnFail` decides what an install with no interpreter that fits does, the way it does for a Node.js runtime. `error` reports the project instead of installing one. `warn` and `ignore` install with an interpreter the machine has that the project's `requires-python` rejects. `tools.python.mirror` names a mirror.
+
+- Python environments now live in the store. Each project keeps only its `.venv` link, which points at the project's current environment generation under `python-envs` in the store. A repository with many Python projects no longer holds a `.pnpm/python-envs` directory in each of them. The next install relinks a `.venv` that an earlier release published. The old `.pnpm/python-envs` directory is left in place, since a running program may still use it, and can be deleted once none does. With `frozenStore` set, pnpm writes nothing to the store, so environments stay in the project's `.pnpm/python-envs` [#15014](https://github.com/pnpm/pnpm/issues/15014).
+
+- Python environments now use `packageImportMethod` to import wheel files from the store. Use `clone-or-copy` for copy-on-write clones with a copy fallback, or `copy` for independent files. Hardlinked files share writes with the store and other environments.
+
+  Isolated Python build environments keep backend writes private with copy-on-write clones or copies.
+
+#### Python projects and workspaces
+
+- `pnpm install` now installs a Python project's own package, so the project can be imported and the commands in `[project.scripts]` run right after an install [#14945](https://github.com/pnpm/pnpm/issues/14945). The installed package points at the source tree, so an edit to a module takes effect without another install. pnpm installs the package of a project that declares a `[build-system]`. `tool.uv.package` overrides that either way.
+
+- `pnpm install` now installs a Python project in the workspace from its own source. Declare it under `[tool.uv.sources]`, as `shared = { workspace = true }` or `shared = { path = "../shared", editable = true }`. pnpm builds the project with the backend it declares. It installs the build editable, so an edit to the project takes effect without another install.
+
+  Approve the build backend under `allowBuilds` in `pnpm-workspace.yaml` as a Package URL, as `pkg:pypi/hatchling: true`. An install that has not approved a backend does not build the projects that need it. The message names the key to add.
+
+  `pnpm install` now refuses a requirement that names a project in the workspace when nothing declares where it comes from. It used to take that name from the index.
+
+- The members of a uv workspace can now share one Python environment. Set `shared-environment = true` under `[tool.pnpm.python]` in the `pyproject.toml` that declares `[tool.uv.workspace]`. `pnpm install` then resolves every member as one graph into one `pylock.toml` and one `.venv` at the workspace root. Two members that require versions of a distribution no release satisfies at once are refused with an error naming both. Each project still gets an environment of its own by default [#15015](https://github.com/pnpm/pnpm/issues/15015).
+
+- Python projects can now select extras and dependency groups through `[tool.pnpm.python]` in `pyproject.toml` [#14945](https://github.com/pnpm/pnpm/issues/14945). Workspace `python.extras` and `python.groups` defaults now skip names a project does not define.
+
+- `pnpm install` now reads dynamic Python project metadata from the build backend [#14945](https://github.com/pnpm/pnpm/issues/14945). Projects with only a `requirements.txt` file now get a Python environment and lockfile.
+
+#### Python dependencies and lockfiles
+
+- pnpm can now resolve `pylock.toml` for several platforms and Python versions at once. `supportedArchitectures` names the platforms to lock for and `python.versions` the versions. Every platform is paired with every version. One committed lockfile then serves Linux CI and macOS or Windows contributors [#14945](https://github.com/pnpm/pnpm/issues/14945).
+
+  ```yaml
+  supportedArchitectures:
+    - linux-x64-manylinux_2_28
+    - darwin-arm64
+    - win32-x64
+  python:
+    enabled: true
+    versions: ['3.12', '3.13']
+  ```
+
+  The lockfile pins the wheel each environment takes for a distribution. It marks a package only some environments install. `pnpm install` takes the packages and wheels of the environment its interpreter matches, and refuses an interpreter none of them stand for. pnpm resolves a project that declares environments itself, not through the server `pnprServer` names. Naming neither setting locks for the interpreter running the install.
+
+- `python.overrides` and `python.constraints` pin the versions a Python resolution may pick [#14945](https://github.com/pnpm/pnpm/issues/14945). pnpm reads uv's own overrides and constraints from `pyproject.toml` too.
+
+- `pnpm install` now supports Python dependencies from Git repositories [#14945](https://github.com/pnpm/pnpm/issues/14945). Direct wheel URLs are also supported. Sources can be declared in `[tool.uv.sources]`. Git dependencies require `allowBuilds` approval.
+
+- `pnpm install` can install a Python release that publishes no wheel this interpreter accepts, by building the source distribution the index serves beside it [#14945](https://github.com/pnpm/pnpm/issues/14945). The archive is pinned in `pylock.toml` by name and SHA-256. A later install replays it from the store, offline included. Building a source distribution runs the release's own build backend. Approve it with `pkg:pypi/<distribution>: true` under `allowBuilds`.
+
+  A resolution that finds no version of a distribution now says why. It tells apart a distribution no index publishes, one whose releases publish nothing this interpreter can install, and one whose versions the project's requirements exclude.
+
+### Patch Changes
+
+#### Installing packages
+
+- pnpm no longer reuses one package's downloaded tarball for another package whose resolution pins a different integrity hash to the same URL [#15021](https://github.com/pnpm/pnpm/issues/15021).
+
+- `pnpm install` and `pnpm add` now report an error when `package.json`, `pnpm-lock.yaml`, `pyproject.toml` or another file they snapshot before installing is a named pipe or a device. The command used to wait forever for something to write to it.
+
+- `pnpm install --prod` and `pnpm install --dev` now record every dependency group in `pnpm-lock.yaml`. `node_modules` still holds only the groups the filter selects. They used to write the filter into the lockfile, so a later `pnpm install --frozen-lockfile` rejected it. `pnpm prune --prod`, `pnpm prune --dev`, and `pnpm prune --no-optional` behave the same way [#14912](https://github.com/pnpm/pnpm/issues/14912).
+
+- POSIX bin shims now convert a Windows-form path such as `C:\node_modules\.bin\tsc` correctly. The shim mangled the backslashes in such a path and could not reach the package it runs. Installing again replaces the shims already in `node_modules` [#14867](https://github.com/pnpm/pnpm/issues/14867).
+
+- Two pnpm processes installing one workspace at the same time no longer fail on Windows with "Access is denied" while writing `node_modules/.pnpm-workspace-state-v1.json`. The write now retries the transient lock the other process holds, as pnpm's other file writes do.
+
+- pnpm now reads the manifest from the tarball when a pnpmfile `resolvers` hook returns a resolution without one. Such a package installed alone, with none of its own dependencies and no warning [#15000](https://github.com/pnpm/pnpm/issues/15000).
+
+- `pnpm install` now merges Git conflict markers in `pnpm-lock.yaml`. It parses both sides of the conflict and keeps the versions they locked. A conflict in the config dependencies recorded at the top of the lockfile is merged too [#14880](https://github.com/pnpm/pnpm/issues/14880).
+
+#### Cargo projects
+
+- `pnpm install` can now generate `Cargo.lock` for workspaces with path or Git `[patch]` and `[replace]` overrides. Adding, removing, and updating crates also preserve these overrides [#14950](https://github.com/pnpm/pnpm/issues/14950).
+
+  Cargo lockfile resolution blocks unsupported Git transport helpers declared by transitive dependencies.
+
+- `pnpm install` now vendors recursive Git submodules for Cargo dependencies at their pinned commits. Cargo builds can use these sources offline. Set Git's `protocol.file.allow` to `always` to fetch local file submodules. pnpm fetches cached Git crates again on the first online install [#14951](https://github.com/pnpm/pnpm/issues/14951).
+
+- `pnpm install` now generates `Cargo.lock` for workspaces with Git dependencies, including a dependency that omits a package version. It also downloads the Rust standard library's dependencies when Cargo configuration enables `build-std` [#14944](https://github.com/pnpm/pnpm/issues/14944).
+
+- `pnpm install` now handles weak Cargo features, written `crate?/feature`. Resolution failed when one dependency turned on an optional crate and another asked for a weak feature of it [#14960](https://github.com/pnpm/pnpm/issues/14960). The generated `Cargo.lock` now also includes the dependencies weak features reference, which Cargo rejected with `--locked` for crates such as `uuid` [#14978](https://github.com/pnpm/pnpm/issues/14978).
+
+- `pnpm install` now generates `Cargo.lock` when a crate version it considers depends on a release the registry carries only as yanked. pnpm rules that version out and resolves the rest of the graph. Resolution failed with an error such as `no non-yanked version of napi-build satisfies ^3.0.0-beta` [#14952](https://github.com/pnpm/pnpm/issues/14952).
+
+- `pnpm install` now falls back to an older semver-incompatible version of a crate when the newest one a dependency range allows cannot be resolved. Ranges such as `>=1, <3` span several of them [#14962](https://github.com/pnpm/pnpm/issues/14962).
+
+#### Python projects
+
+- `pnpm install` now honors uv workspace members when discovering Python projects. When no uv workspace declares a project, pnpm skips projects under conventional example, demo, documentation, template, `test`, `tests`, and test fixture directories [#15058](https://github.com/pnpm/pnpm/issues/15058).
+
+- `pnpm install --filter <selector>` now installs only the Python projects the selection asks for. A Python project that shares a directory with an npm workspace project is selected with that project. A Python project in a directory of its own is selected by the distribution it declares, by its path, or through the `[tool.uv.sources]` entries that reach it. Under `--fail-if-no-match`, a selector that names only a Python project is a match. `pnpm add --filter <selector> pypi:<package>` writes the requirement to every selected project [#14945](https://github.com/pnpm/pnpm/issues/14945).
+
+- `pnpm install` now installs wheels whose `RECORD` hashes disagree with their contents. The wheel archive's locked SHA-256 hash remains verified. pnpm writes correct hashes to the installed `RECORD` [#15061](https://github.com/pnpm/pnpm/issues/15061).
+
+- `pnpm install` now installs a Python wheel whose `WHEEL` file lists tags that differ from the ones in its filename. A wheel whose filename tags were changed after the build, such as `mysql-connector-python`, was rejected [#14945](https://github.com/pnpm/pnpm/issues/14945).
+
+- A Python release whose wheel metadata declares a requirement pnpm cannot read no longer fails the install. pnpm now resolves the project against the other releases of that package, and reports the unreadable requirement when none of them works.
+
+- `pnpm install` no longer fails when a Python index lists a file pnpm cannot use, such as a release with no SHA-256 digest or an unreadable wheel filename. That file is left out and the project resolves against the remaining releases.
+
+- `pnpm add pypi:<package>` in a directory that has no `pyproject.toml` now names the missing file and says where to run the command. It used to fail with a bare `No such file or directory (os error 2)` [#14945](https://github.com/pnpm/pnpm/issues/14945).
+
+#### Performance
+
+- `pnpm audit` no longer hangs on dependency graphs with many shared dependencies [#15005](https://github.com/pnpm/pnpm/issues/15005).
+
+- Sped up `pnpm install` in Python workspaces with many projects. Projects now prepare concurrently. Projects with identical registry requirements also share fresh dependency resolutions [#14945](https://github.com/pnpm/pnpm/issues/14945).
+
+- Repeat installs through the Node-API bindings now return "Already up to date" when the project manifests still match `pnpm-lock.yaml`. Before, every such install reinstalled the whole tree. An install also no longer reinstalls when `pnpm-lock.yaml` differs from the installed dependencies only by packages no project depends on or by top-level keys pnpm does not define.
+
+#### Other commands
+
+- `pnpm deploy` now links commands exposed by workspace dependencies into the deployed project's `node_modules/.bin` directory [#14899](https://github.com/pnpm/pnpm/issues/14899).
+
+- `pnpm dlx` and `pnx` now prompt to approve dependency build scripts in interactive terminals [#14943](https://github.com/pnpm/pnpm/issues/14943). Cached packages with pending builds also prompt for approval. Without an interactive terminal, use `--allow-build` to allow the required builds.
+
+- `pnpm add -g` and `pnpm update -g` now ignore incomplete unrelated global package groups when every command from the replaced group is retained. Operations that could remove a global command still require complete ownership information.
+
+- `pnpm pack` now writes tarball entries grouped by file extension and file name, the order npm uses. Packages that ship many same-named files, such as template collections, pack much smaller [#14766](https://github.com/pnpm/pnpm/issues/14766).
+
+- `pnpm outdated --long` fills the Details column with the package homepage again [#14886](https://github.com/pnpm/pnpm/issues/14886).
+
+## 12.4.2
+
+pnpm 12.4.2 includes security fixes for executable shims and GitHub Actions links, more reliable installs, faster peer dependency checks in workspaces, and Python lockfiles that work across compatible targets.
+
+### Patch Changes
+
+#### Security
+
+- Dependency executables can no longer take over another package's POSIX bin shim through its shell helpers. Reinstall dependencies to replace existing shims [#14837](https://github.com/pnpm/pnpm/issues/14837).
+
+  On Cygwin, MSYS2, and WSL, shims still use `PATH` for Windows path conversion, so dependency executables can still redirect them there.
+
+- GitHub Actions homepage links no longer expose server credentials. GitHub server URLs now require HTTPS, with HTTP allowed only for loopback hosts.
+
+#### Installing packages
+
+- pnpm no longer crashes at startup on FreeBSD and other Unix-like platforms. Platforms other than Windows and macOS use `~/.local/share/pnpm/store` by default [#14859](https://github.com/pnpm/pnpm/issues/14859).
+
+- `pnpm install` on Windows no longer fails with `ERR_PNPM_PACKAGE_MANAGER_REMOVE_MODULES_DIR` when clearing `node_modules` containing linked dependencies, such as when changing `nodeLinker` [#14790](https://github.com/pnpm/pnpm/issues/14790).
+
+- `pnpm install <pkg>` now accepts `--prod` and `--dev`, including `--prod=false` [#14868](https://github.com/pnpm/pnpm/issues/14868).
+
+- `pnpm install` and `pnpm update` now honor `--ignore-workspace` in nested projects excluded from the surrounding workspace. The flag also skips that workspace's settings during the `packageManager` check [#14809](https://github.com/pnpm/pnpm/issues/14809).
+
+- `pnpm install` on macOS no longer reuses stale files for `file:` tarball or git-hosted tarball dependencies.
+
+- `pnpm install` in a single-project directory now detects `package.json` edits made while the previous install was finishing [#14890](https://github.com/pnpm/pnpm/issues/14890).
+
+- `pnpm install --frozen-lockfile` now removes packages no longer reachable from any project in `pnpm-lock.yaml`. This also prevents repeated lifecycle script execution and unnecessary installs before `pnpm run` and `pnpm exec` with `verifyDepsBeforeRun` [#14891](https://github.com/pnpm/pnpm/issues/14891).
+
+#### Resolving and updating dependencies
+
+- Node.js runtime resolution now reports network failures from unofficial-builds.nodejs.org. These failures previously omitted musl builds from `pnpm-lock.yaml`, making its contents depend on network access [#14813](https://github.com/pnpm/pnpm/issues/14813).
+
+- `pnpm install` now rejects invalid `peerDependencies` specifiers with `ERR_PNPM_INVALID_PEER_DEPENDENCY_SPECIFICATION`. A value such as `"foo": "foo@1.0.0"` previously created a broken directory link [#14791](https://github.com/pnpm/pnpm/issues/14791).
+
+- `pnpm deploy` now writes plain registry versions in the deployed `package.json`, without peer dependency suffixes. The lockfile retains peer bindings, and npm aliases retain their target package names [#14873](https://github.com/pnpm/pnpm/issues/14873).
+
+- `pnpm add <git repository>` now names repositories without a `package.json` as `@owner/repo`, allowing dependencies on equally named repositories from different owners [#14870](https://github.com/pnpm/pnpm/issues/14870).
+
+- Peer dependency resolution now deduplicates packages whose child dependency resolves an optional peer in only some workspace projects, such as `next` with `styled-jsx`'s optional `babel-plugin-macros` peer [#14800](https://github.com/pnpm/pnpm/issues/14800).
+
+- `pnpm update` now settles the lockfile in one run when an upgrade removes the package providing an optional peer dependency [#14895](https://github.com/pnpm/pnpm/issues/14895).
+
+- `pnpm update --no-save` now preserves override-applied specifiers for dependencies it is not updating, preventing subsequent frozen installs from failing with `ERR_PNPM_OUTDATED_LOCKFILE` [#14836](https://github.com/pnpm/pnpm/issues/14836).
+
+- `pnpm update --no-save` now succeeds under `minimumReleaseAgeStrict` when every resolved version is old enough [#14835](https://github.com/pnpm/pnpm/issues/14835).
+
+#### Performance
+
+- Workspace installs and `pnpm peers check` are faster when projects depend on each other, fixing a slowdown introduced in 12.3.0. Unmet peer dependencies of workspace packages are now reported only under projects that link them directly [#14906](https://github.com/pnpm/pnpm/issues/14906).
+
+- Hoisted installs use less memory when packages are cached. Frozen-lockfile hoisted installs on macOS are also faster when reusable package directories are cached.
+
+#### Python projects
+
+- `pnpm install --frozen-lockfile` now reuses `pylock.toml` across compatible Python targets, including after kernel updates. Reuse requires unchanged requirements, index, and `requires-python`, compatible wheels, and a locked dependency graph matching the target's markers [#14843](https://github.com/pnpm/pnpm/issues/14843).
+
+  The lockfile's `environments` marker now includes only the interpreter version and marker variables used by the dependency graph. Without `--frozen-lockfile`, pnpm warns and resolves again when the locked graph no longer matches the target.
+
+- Python resolution no longer fails on malformed `Requires-Python` values, such as the trailing comma in `openpyxl` 3.0.x. pnpm treats these releases as declaring no interpreter range [#14910](https://github.com/pnpm/pnpm/issues/14910).
+
+- `pnpm add pypi:...` now rejects unsupported `--save-prefix` values before editing the manifest or resolving dependencies.
+
+#### Workspaces and scripts
+
+- Scripts listed in `syncInjectedDepsAfterScripts` no longer fail with `ERR_PNPM_INJECTED_DEPS_SYNC_READ_DIR` when the lockfile contains an injected package copy that no project depends on.
+
+- `shellEmulator` now expands `${VAR}`, `${VAR:-default}`, and `${VAR:+alternative}` in scripts [#14814](https://github.com/pnpm/pnpm/issues/14814).
+
+- Cargo and Python project discovery now honors `!` exclusions in `pnpm-workspace.yaml` `packages`, skipping both parsing and generated source configuration for excluded projects [#14844](https://github.com/pnpm/pnpm/issues/14844).
+
+- `pnpm --filter "./packages/{app,lib}"` now selects either alternative. Brace alternatives can nest, span path separators, and combine with other wildcards.
+
+- GitHub Actions updates now stop if an action reference changes during version resolution, and preserve unrelated workflow edits.
+
+#### CLI and output
+
+- `pn`, `pnpx`, and `pnx` now run the pnpm installed alongside them, even when that directory is absent from `PATH` or another pnpm comes first [#14803](https://github.com/pnpm/pnpm/issues/14803).
+
+- `pnpm --version` now reports failures to install or record a project's pinned pnpm, then prints the running CLI's version. It also honors `--store-dir` and `--store` [#14831](https://github.com/pnpm/pnpm/issues/14831).
+
+- `pnpm self-update` no longer reinstalls the active version when it was installed by the standalone installation script [#14823](https://github.com/pnpm/pnpm/issues/14823).
+
+- `pnpm t` and `pnpm tst` work again as aliases for `pnpm test`.
+
+- `pnpm sbom` now emits valid repository URLs in CycloneDX `externalReferences[].url` and SPDX `homepage`. Shorthands such as `vercel/ms` become `git+https` URLs, embedded credentials are removed, and invalid repository values are omitted [#14773](https://github.com/pnpm/pnpm/issues/14773).
+
 ## 12.4.1
 
 pnpm 12.4.1 fixes installs that failed on filesystems refusing hard links or clones, on Android, and under `nodeLinker: hoisted`. Repeat installs are faster.

package/dist/node_modules/.bin/get-pnpm

@@ -1,22 +1,35 @@
 #!/bin/sh
 # Resolve $0 through symlinks so basedir is the shim's real directory.
 # Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
+#
+# A shim runs with node_modules/.bin at the front of PATH, so readlink, sed, and
+# uname go through `command -p`, which searches the system default path instead.
+# A dependency's bin cannot stand in for one of them and take over the shim
+# before it reaches its target. Directories come from `${link%/*}`, which needs
+# no helper at all.
 link="$0"
+# `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
+# and stands for a file in the current directory.
+case "$link" in
+  */*|*\\*) ;;
+  *) link="./$link" ;;
+esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(readlink "$link")
+  target=$(command -p readlink "$link")
   case "$target" in
     /*) link="$target" ;;
-    *)  link="$(dirname "$link")/$target" ;;
+    *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
+basedir=$(echo "$link" | command -p sed -e 's,\\,/,g')
+basedir="${basedir%/*}"
 basedir_win="$basedir"
 exe=""
 msys=""
 
-case `uname -a` in
+case `command -p uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if command -v cygpath > /dev/null 2>&1; then
       basedir_win=`cygpath -w "$basedir"`

package/dist/node_modules/.bin/node-gyp

@@ -1,22 +1,35 @@
 #!/bin/sh
 # Resolve $0 through symlinks so basedir is the shim's real directory.
 # Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
+#
+# A shim runs with node_modules/.bin at the front of PATH, so readlink, sed, and
+# uname go through `command -p`, which searches the system default path instead.
+# A dependency's bin cannot stand in for one of them and take over the shim
+# before it reaches its target. Directories come from `${link%/*}`, which needs
+# no helper at all.
 link="$0"
+# `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
+# and stands for a file in the current directory.
+case "$link" in
+  */*|*\\*) ;;
+  *) link="./$link" ;;
+esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(readlink "$link")
+  target=$(command -p readlink "$link")
   case "$target" in
     /*) link="$target" ;;
-    *)  link="$(dirname "$link")/$target" ;;
+    *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
+basedir=$(echo "$link" | command -p sed -e 's,\\,/,g')
+basedir="${basedir%/*}"
 basedir_win="$basedir"
 exe=""
 msys=""
 
-case `uname -a` in
+case `command -p uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if command -v cygpath > /dev/null 2>&1; then
       basedir_win=`cygpath -w "$basedir"`

package/dist/node_modules/.bin/node-which

@@ -1,22 +1,35 @@
 #!/bin/sh
 # Resolve $0 through symlinks so basedir is the shim's real directory.
 # Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
+#
+# A shim runs with node_modules/.bin at the front of PATH, so readlink, sed, and
+# uname go through `command -p`, which searches the system default path instead.
+# A dependency's bin cannot stand in for one of them and take over the shim
+# before it reaches its target. Directories come from `${link%/*}`, which needs
+# no helper at all.
 link="$0"
+# `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
+# and stands for a file in the current directory.
+case "$link" in
+  */*|*\\*) ;;
+  *) link="./$link" ;;
+esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(readlink "$link")
+  target=$(command -p readlink "$link")
   case "$target" in
     /*) link="$target" ;;
-    *)  link="$(dirname "$link")/$target" ;;
+    *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
+basedir=$(echo "$link" | command -p sed -e 's,\\,/,g')
+basedir="${basedir%/*}"
 basedir_win="$basedir"
 exe=""
 msys=""
 
-case `uname -a` in
+case `command -p uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if command -v cygpath > /dev/null 2>&1; then
       basedir_win=`cygpath -w "$basedir"`

package/dist/node_modules/.bin/nopt

@@ -1,22 +1,35 @@
 #!/bin/sh
 # Resolve $0 through symlinks so basedir is the shim's real directory.
 # Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
+#
+# A shim runs with node_modules/.bin at the front of PATH, so readlink, sed, and
+# uname go through `command -p`, which searches the system default path instead.
+# A dependency's bin cannot stand in for one of them and take over the shim
+# before it reaches its target. Directories come from `${link%/*}`, which needs
+# no helper at all.
 link="$0"
+# `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
+# and stands for a file in the current directory.
+case "$link" in
+  */*|*\\*) ;;
+  *) link="./$link" ;;
+esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(readlink "$link")
+  target=$(command -p readlink "$link")
   case "$target" in
     /*) link="$target" ;;
-    *)  link="$(dirname "$link")/$target" ;;
+    *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
+basedir=$(echo "$link" | command -p sed -e 's,\\,/,g')
+basedir="${basedir%/*}"
 basedir_win="$basedir"
 exe=""
 msys=""
 
-case `uname -a` in
+case `command -p uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if command -v cygpath > /dev/null 2>&1; then
       basedir_win=`cygpath -w "$basedir"`

package/dist/node_modules/.bin/semver

@@ -1,22 +1,35 @@
 #!/bin/sh
 # Resolve $0 through symlinks so basedir is the shim's real directory.
 # Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
+#
+# A shim runs with node_modules/.bin at the front of PATH, so readlink, sed, and
+# uname go through `command -p`, which searches the system default path instead.
+# A dependency's bin cannot stand in for one of them and take over the shim
+# before it reaches its target. Directories come from `${link%/*}`, which needs
+# no helper at all.
 link="$0"
+# `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
+# and stands for a file in the current directory.
+case "$link" in
+  */*|*\\*) ;;
+  *) link="./$link" ;;
+esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(readlink "$link")
+  target=$(command -p readlink "$link")
   case "$target" in
     /*) link="$target" ;;
-    *)  link="$(dirname "$link")/$target" ;;
+    *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
+basedir=$(echo "$link" | command -p sed -e 's,\\,/,g')
+basedir="${basedir%/*}"
 basedir_win="$basedir"
 exe=""
 msys=""
 
-case `uname -a` in
+case `command -p uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if command -v cygpath > /dev/null 2>&1; then
       basedir_win=`cygpath -w "$basedir"`

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,9 +1,9 @@
 {
-  "lastValidatedTimestamp": 1789057805684,
+  "lastValidatedTimestamp": 1789748282784,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.4.1"
+      "version": "12.5.0"
     }
   },
   "pnpmfiles": [],
@@ -48,7 +48,7 @@
         "@pnpm/tabtab": "^0.5.4",
         "@pnpm/tgz-fixtures": "0.0.0",
         "@reflink/reflink": "0.1.19",
-        "@rushstack/worker-pool": "0.7.26",
+        "@rushstack/worker-pool": "0.7.27",
         "@stylistic/eslint-plugin": "^5.10.0",
         "@types/adm-zip": "^0.5.8",
         "@types/archy": "0.0.36",
@@ -94,12 +94,11 @@
         "@yarnpkg/lockfile": "^1.1.0",
         "@yarnpkg/nm": "4.1.1",
         "@yarnpkg/pnp": "^4.1.7",
-        "@zkochan/cmd-shim": "^9.0.7",
         "@zkochan/retry": "^0.2.0",
         "@zkochan/rimraf": "^4.0.0",
         "@zkochan/table": "^2.0.1",
-        "adm-zip": "^0.6.0",
-        "amaro": "^1.1.11",
+        "adm-zip": "^0.6.1",
+        "amaro": "^1.2.0",
         "ansi-diff": "^1.2.0",
         "archy": "^1.0.0",
         "better-path-resolve": "2.0.0",
@@ -142,7 +141,7 @@
         "fast-glob": "^3.3.3",
         "fs-extra": "^11.4.0",
         "fuse-native": "^2.2.6",
-        "get-pnpm": "^0.0.3",
+        "get-pnpm": "^0.0.5",
         "get-port": "^7.2.0",
         "ghooks": "2.0.4",
         "graceful-fs": "^4.2.11",
@@ -172,6 +171,7 @@
         "lru-cache": "^11.5.2",
         "make-empty-dir": "^4.0.0",
         "mdast-util-to-string": "^4.0.0",
+        "memfs": "^4.78.0",
         "memoize": "^11.0.0",
         "micromatch": "^4.0.8",
         "msgpackr": "2.1.0",
@@ -184,7 +184,7 @@
         "npm-packlist": "10.0.4",
         "npm-registry-fetch": "^19.0.0",
         "object-hash": "3.0.0",
-        "open": "^11.0.2",
+        "open": "^11.0.4",
         "openpgp": "^6.3.1",
         "p-defer": "^4.0.1",
         "p-every": "^2.0.0",
@@ -259,7 +259,7 @@
         "write-json5-file": "^4.0.0",
         "write-package": "7.2.0",
         "write-yaml-file": "^6.0.0",
-        "yaml": "^2.9.0",
+        "yaml": "^2.9.1",
         "yaml-tag": "1.1.0"
       }
     },
@@ -311,15 +311,13 @@
       "write-ini-file",
       "write-json5-file",
       "write-yaml-file",
-      "http-proxy-middleware@3.0.7",
-      "get-pnpm@0.0.3"
+      "http-proxy-middleware@3.0.7"
     ],
     "minimumReleaseAgeIgnoreMissingTime": true,
     "minimumReleaseAgeStrict": true,
     "nodeLinker": "hoisted",
     "optional": true,
     "patchedDependencies": {
-      "adm-zip@0.6.0": "../../../../__patches__/adm-zip@0.6.0.patch",
       "graceful-fs@4.2.11": "../../../../__patches__/graceful-fs@4.2.11.patch",
       "normalize-registry-url@2.0.1": "../../../../__patches__/normalize-registry-url@2.0.1.patch"
     },

package/dist/node_modules/get-pnpm/lib/downloadExecutable.js

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { extractTarballMember } from './extractTarballMember.js';
 import { isMusl, platformPackageName } from './platformPackageName.js';
-import { downloadTarball, fetchVersionMeta, normalizeRegistry } from './registry.js';
+import { downloadTarball, fetchVersionMeta, normalizeRegistry, useProxyFromEnv } from './registry.js';
 import { majorVersion } from './resolveVersion.js';
 import { sameFileContents } from './sameFileContents.js';
 import { verifyRegistrySignature } from './verifySignature.js';
@@ -31,14 +31,23 @@ function executableName() {
  * @returns the package the executable came from.
  */
 export async function downloadPnpmExecutable(opts) {
-    const { version, destPath } = opts;
     const registry = normalizeRegistry(opts.registry);
     const packageName = platformPackageName({
-        major: majorVersion(version),
+        major: majorVersion(opts.version),
         platform: process.platform,
         arch: process.arch,
         musl: isMusl(),
     });
+    const restoreProxy = useProxyFromEnv();
+    try {
+        return await fetchExecutable({ ...opts, registry, packageName });
+    }
+    finally {
+        restoreProxy();
+    }
+}
+async function fetchExecutable(opts) {
+    const { version, destPath, registry, packageName } = opts;
     const meta = await fetchVersionMeta(registry, packageName, version, opts.headers);
     if (!meta.dist.integrity) {
         throw new Error(`The npm registry published no checksum for ${packageName}@${version}, so it cannot be verified.`);

package/dist/node_modules/get-pnpm/lib/index.js

@@ -4,13 +4,13 @@ import os from 'node:os';
 import path from 'node:path';
 import { extractTarball } from './extractTarball.js';
 import { isMusl, platformPackageName } from './platformPackageName.js';
-import { downloadTarball, fetchPackument, fetchVersionMeta, registryFromEnv } from './registry.js';
+import { downloadTarball, fetchPackument, fetchVersionMeta, registryFromEnv, useProxyFromEnv } from './registry.js';
 import { majorVersion, resolveVersion } from './resolveVersion.js';
 import { verifyRegistrySignature } from './verifySignature.js';
 export { downloadPnpmExecutable } from './downloadExecutable.js';
 export { extractTarballMember } from './extractTarballMember.js';
 export { isMusl, platformPackageName } from './platformPackageName.js';
-export { DEFAULT_REGISTRY, registryFromEnv } from './registry.js';
+export { DEFAULT_REGISTRY, registryFromEnv, useProxyFromEnv } from './registry.js';
 export { majorVersion, resolveVersion } from './resolveVersion.js';
 export { verifyRegistrySignature } from './verifySignature.js';
 /**
@@ -37,6 +37,9 @@ Environment variables:
   PNPM_VERSION           Version to install when no argument is given.
   PNPM_HOME              Directory to install pnpm into.
   npm_config_registry    Registry to download pnpm from.
+  HTTPS_PROXY            Proxy to download through (HTTP_PROXY for an http://
+                         registry); NO_PROXY names hosts to reach directly.
+                         Node 24.14 or later.
 `;
 export async function runCli(argv) {
     const positional = [];
@@ -113,6 +116,15 @@ export async function installPnpm(opts) {
  * @returns the version installed and the path to the executable.
  */
 export async function downloadPnpm(opts) {
+    const restoreProxy = useProxyFromEnv();
+    try {
+        return await fetchPnpm(opts);
+    }
+    finally {
+        restoreProxy();
+    }
+}
+async function fetchPnpm(opts) {
     const packument = await fetchPackument(opts.registry, CLI_PKG_NAME);
     const version = resolveVersion(packument, opts.versionSpec);
     const major = majorVersion(version);

package/dist/node_modules/get-pnpm/lib/platformPackageName.js

@@ -1,3 +1,11 @@
+const V12_ONLY_TARGETS = new Set([
+    'android-arm64',
+    'android-x64',
+    'freebsd-x64',
+    'linux-ppc64',
+    'linux-riscv64',
+    'linux-s390x',
+]);
 /**
  * Name of the npm package that carries the pnpm executable for `target`.
  *
@@ -6,15 +14,22 @@
  * publishes `@pnpm/exe.<process.platform>-<arch>[-musl]`, while v11 and older
  * publish `@pnpm/<macos|win|linux|linuxstatic>-<arch>`.
  *
- * @throws if pnpm publishes no binary for the host — either because the
- * architecture was never supported, or because of the v11-only Intel macOS gap.
+ * @throws if pnpm publishes no binary for the host — because the host is not
+ * built for at all, because the binary arrived in v12 and an older major was
+ * asked for, or because of the v11-only Intel macOS gap.
  */
 export function platformPackageName({ major, platform, arch, musl }) {
-    if (arch !== 'x64' && arch !== 'arm64') {
-        throw new Error('Sorry! pnpm currently only provides pre-built binaries for x86_64/arm64 architectures.');
+    const target = `${platform}-${arch}`;
+    if (V12_ONLY_TARGETS.has(target)) {
+        if (major >= 12)
+            return `@pnpm/exe.${target}`;
+        throw new Error(`pnpm v${major} does not provide a pre-built binary for ${target}. pnpm 12 does:
+
+  npx get-pnpm 12`);
     }
-    if (platform !== 'darwin' && platform !== 'linux' && platform !== 'win32') {
-        throw new Error(`Sorry! pnpm does not provide a pre-built binary for ${platform}.`);
+    if ((arch !== 'x64' && arch !== 'arm64') ||
+        (platform !== 'darwin' && platform !== 'linux' && platform !== 'win32')) {
+        throw new Error(`Sorry! pnpm does not provide a pre-built binary for ${target}.`);
     }
     if (platform === 'darwin' && arch === 'x64' && major === 11) {
         throw new Error(`pnpm v11 does not provide a working binary for Intel macOS (darwin-x64) due to an upstream Node.js SEA bug.

package/dist/node_modules/get-pnpm/lib/registry.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { createWriteStream } from 'node:fs';
+import http from 'node:http';
 import { pipeline } from 'node:stream/promises';
 const ABBREVIATED_PACKUMENT = 'application/vnd.npm.install-v1+json';
 export const DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
@@ -16,6 +17,48 @@ export function registryFromEnv() {
 export function normalizeRegistry(registry) {
     return registry.endsWith('/') ? registry : `${registry}/`;
 }
+const PROXY_VARS = ['https_proxy', 'HTTPS_PROXY', 'http_proxy', 'HTTP_PROXY'];
+/**
+ * Routes every request made until the returned function is called through the
+ * proxy the environment names in `HTTPS_PROXY`/`HTTP_PROXY`, honouring
+ * `NO_PROXY`. A no-op when the environment names none.
+ *
+ * `fetch` reads those variables only when Node was started with
+ * `NODE_USE_ENV_PROXY=1`, which nothing that embeds this package controls:
+ * Corepack starts the process that runs pnpm's launcher. On a network that
+ * allows no other route out, the download then fails with a bare
+ * `fetch failed`, while everything before it went through the proxy fine,
+ * Corepack's own download of the `pnpm` package included.
+ *
+ * Node before 24.14 has no way to apply the proxy after startup, so the
+ * request goes direct there, as it always has.
+ *
+ * The setting is process-global, so overlapping downloads share one
+ * activation: the first call applies the proxy and the last of the returned
+ * functions to run puts the agents back, never one in the middle.
+ */
+export function useProxyFromEnv() {
+    if (!PROXY_VARS.some((name) => process.env[name]))
+        return () => { };
+    const { setGlobalProxyFromEnv } = http;
+    if (setGlobalProxyFromEnv == null)
+        return () => { };
+    // Counted only once the activation took: a call that threw on a malformed
+    // proxy URL holds nothing to release, and a retry after a fix has to activate.
+    if (proxyUsers === 0)
+        restoreProxy = setGlobalProxyFromEnv(process.env);
+    proxyUsers++;
+    let released = false;
+    return () => {
+        if (released)
+            return;
+        released = true;
+        if (--proxyUsers === 0)
+            restoreProxy();
+    };
+}
+let proxyUsers = 0;
+let restoreProxy = () => { };
 // Node's fetch applies no timeout of its own: a registry that accepts the
 // connection and then stalls would hang the install with no output. Metadata is
 // small and quick; the tarball budget has to survive a slow connection carrying

package/dist/node_modules/get-pnpm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "get-pnpm",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "Installs pnpm as a standalone executable",
   "keywords": [
     "pnpm",

package/package.json

@@ -9,7 +9,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.4.1",
+  "version": "12.5.0",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -46,20 +46,20 @@
     "THIRD-PARTY-NOTICES.md"
   ],
   "optionalDependencies": {
-    "@pnpm/exe.win32-x64": "12.4.1",
-    "@pnpm/exe.win32-arm64": "12.4.1",
-    "@pnpm/exe.darwin-x64": "12.4.1",
-    "@pnpm/exe.darwin-arm64": "12.4.1",
-    "@pnpm/exe.linux-x64": "12.4.1",
-    "@pnpm/exe.linux-arm64": "12.4.1",
-    "@pnpm/exe.linux-riscv64": "12.4.1",
-    "@pnpm/exe.linux-ppc64": "12.4.1",
-    "@pnpm/exe.linux-s390x": "12.4.1",
-    "@pnpm/exe.linux-x64-musl": "12.4.1",
-    "@pnpm/exe.linux-arm64-musl": "12.4.1",
-    "@pnpm/exe.freebsd-x64": "12.4.1",
-    "@pnpm/exe.android-arm64": "12.4.1",
-    "@pnpm/exe.android-x64": "12.4.1"
+    "@pnpm/exe.win32-x64": "12.5.0",
+    "@pnpm/exe.win32-arm64": "12.5.0",
+    "@pnpm/exe.darwin-x64": "12.5.0",
+    "@pnpm/exe.darwin-arm64": "12.5.0",
+    "@pnpm/exe.linux-x64": "12.5.0",
+    "@pnpm/exe.linux-arm64": "12.5.0",
+    "@pnpm/exe.linux-riscv64": "12.5.0",
+    "@pnpm/exe.linux-ppc64": "12.5.0",
+    "@pnpm/exe.linux-s390x": "12.5.0",
+    "@pnpm/exe.linux-x64-musl": "12.5.0",
+    "@pnpm/exe.linux-arm64-musl": "12.5.0",
+    "@pnpm/exe.freebsd-x64": "12.5.0",
+    "@pnpm/exe.android-arm64": "12.5.0",
+    "@pnpm/exe.android-x64": "12.5.0"
   },
   "scripts": {
     "preinstall": "node install.js",

package/pn

@@ -1,2 +1,36 @@
 #!/bin/sh
-exec pnpm "$@"
+# `pn` is `pnpm`. The pnpm it hands over to is the one installed alongside it,
+# found relative to this file: a `PATH` lookup would run whatever other pnpm
+# comes first there, and would find nothing at all when the directory holding
+# these bins is not on `PATH`.
+#
+# $0 is whatever shim or symlink `pn` was launched through, so walk to the file
+# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
+# hang the script. Directories come from `${self%/*}` and `readlink` runs through
+# `command -p`, so the caller's `PATH` decides nothing here.
+self=$0
+# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(command -p readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=${self%/*}/$link ;;
+  esac
+done
+# The walk has to end at a regular file. Running out of hops leaves $self a
+# symlink; a chain that changed under us can leave it dangling or a directory, and
+# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
+# wrong directory — the substitution this script exists to prevent.
+if [ -L "$self" ] || [ ! -f "$self" ]; then
+  echo "pn: could not resolve $0 to a regular file within 40 symlink hops." >&2
+  exit 1
+fi
+
+exec "${self%/*}/pnpm" "$@"

package/pnpm

@@ -24,15 +24,25 @@ fi
 # $0 is whatever shim or symlink pnpm was launched through; ./bin/pnpm.mjs is
 # found relative to this file. The hop cap matches the kernel's ELOOP limit, so
 # a cycle cannot hang the script.
+#
+# `readlink` runs through `command -p`, which searches the system default path,
+# and directories come from `${self%/*}`, which runs nothing at all. The caller's
+# PATH therefore decides only which `node` runs, which is what it is for.
 self=$0
+# `${self%/*}` needs a slash to strip. A bare name came from a PATH lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
 hops=0
 while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops + 1))
-  link=$(readlink "$self")
+  link=$(command -p readlink "$self")
   case $link in
     /*) self=$link ;;
-    *) self=$(dirname "$self")/$link ;;
+    *) self=${self%/*}/$link ;;
   esac
 done
 
-exec node "$(dirname "$self")/bin/pnpm.mjs" "$@"
+exec node "${self%/*}/bin/pnpm.mjs" "$@"

package/pnpx

@@ -1,2 +1,36 @@
 #!/bin/sh
-exec pnpm dlx "$@"
+# `pnpx` is `pnpm dlx`. The pnpm it hands over to is the one installed alongside
+# it, found relative to this file: a `PATH` lookup would run whatever other pnpm
+# comes first there, and would find nothing at all when the directory holding
+# these bins is not on `PATH`.
+#
+# $0 is whatever shim or symlink `pnpx` was launched through, so walk to the file
+# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
+# hang the script. Directories come from `${self%/*}` and `readlink` runs through
+# `command -p`, so the caller's `PATH` decides nothing here.
+self=$0
+# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(command -p readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=${self%/*}/$link ;;
+  esac
+done
+# The walk has to end at a regular file. Running out of hops leaves $self a
+# symlink; a chain that changed under us can leave it dangling or a directory, and
+# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
+# wrong directory — the substitution this script exists to prevent.
+if [ -L "$self" ] || [ ! -f "$self" ]; then
+  echo "pnpx: could not resolve $0 to a regular file within 40 symlink hops." >&2
+  exit 1
+fi
+
+exec "${self%/*}/pnpm" dlx "$@"

package/pnx

@@ -1,2 +1,36 @@
 #!/bin/sh
-exec pnpm dlx "$@"
+# `pnx` is `pnpm dlx`. The pnpm it hands over to is the one installed alongside
+# it, found relative to this file: a `PATH` lookup would run whatever other pnpm
+# comes first there, and would find nothing at all when the directory holding
+# these bins is not on `PATH`.
+#
+# $0 is whatever shim or symlink `pnx` was launched through, so walk to the file
+# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
+# hang the script. Directories come from `${self%/*}` and `readlink` runs through
+# `command -p`, so the caller's `PATH` decides nothing here.
+self=$0
+# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(command -p readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=${self%/*}/$link ;;
+  esac
+done
+# The walk has to end at a regular file. Running out of hops leaves $self a
+# symlink; a chain that changed under us can leave it dangling or a directory, and
+# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
+# wrong directory — the substitution this script exists to prevent.
+if [ -L "$self" ] || [ ! -f "$self" ]; then
+  echo "pnx: could not resolve $0 to a regular file within 40 symlink hops." >&2
+  exit 1
+fi
+
+exec "${self%/*}/pnpm" dlx "$@"

package/dist/node_modules/.package-map.json

@@ -1 +0,0 @@
-{"packages":{".":{"url":"..","dependencies":{"get-pnpm":"get-pnpm","node-gyp":"node-gyp","pacquet":"."}},"@isaacs/fs-minipass":{"url":"./@isaacs/fs-minipass","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","minipass":"minipass"}},"abbrev":{"url":"./abbrev","dependencies":{"abbrev":"abbrev"}},"chownr":{"url":"./chownr","dependencies":{"chownr":"chownr"}},"env-paths":{"url":"./env-paths","dependencies":{"env-paths":"env-paths"}},"exponential-backoff":{"url":"./exponential-backoff","dependencies":{"exponential-backoff":"exponential-backoff"}},"fdir":{"url":"./fdir","dependencies":{"fdir":"fdir","picomatch":"picomatch"}},"get-pnpm":{"url":"./get-pnpm","dependencies":{"get-pnpm":"get-pnpm"}},"graceful-fs":{"url":"./graceful-fs","dependencies":{"graceful-fs":"graceful-fs"}},"isexe":{"url":"./isexe","dependencies":{"isexe":"isexe"}},"minipass":{"url":"./minipass","dependencies":{"minipass":"minipass"}},"minizlib":{"url":"./minizlib","dependencies":{"minipass":"minipass","minizlib":"minizlib"}},"node-gyp":{"url":"./node-gyp","dependencies":{"env-paths":"env-paths","exponential-backoff":"exponential-backoff","graceful-fs":"graceful-fs","node-gyp":"node-gyp","nopt":"nopt","proc-log":"proc-log","semver":"semver","tar":"tar","tinyglobby":"tinyglobby","undici":"undici","which":"which"}},"nopt":{"url":"./nopt","dependencies":{"abbrev":"abbrev","nopt":"nopt"}},"picomatch":{"url":"./picomatch","dependencies":{"picomatch":"picomatch"}},"proc-log":{"url":"./proc-log","dependencies":{"proc-log":"proc-log"}},"semver":{"url":"./semver","dependencies":{"semver":"semver"}},"tar":{"url":"./tar","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","chownr":"chownr","minipass":"minipass","minizlib":"minizlib","tar":"tar","yallist":"yallist"}},"tinyglobby":{"url":"./tinyglobby","dependencies":{"fdir":"fdir","picomatch":"picomatch","tinyglobby":"tinyglobby"}},"undici":{"url":"./undici","dependencies":{"undici":"undici"}},"which":{"url":"./which","dependencies":{"isexe":"isexe","which":"which"}},"yallist":{"url":"./yallist","dependencies":{"yallist":"yallist"}}}}