pnpm 12.8.0 → 12.8.2

package/CHANGELOG.md

@@ -1,5 +1,97 @@
 # pnpm
 
+## 12.8.2
+
+pnpm 12.8.2 fixes a startup crash on Linux ppc64le and `UnknownIssuer` errors on systems without CA certificates. `pnpm run` no longer installs before every script on CI when `autoDedupe` is enabled, and resolution and hoisted installs on macOS are faster.
+
+### Patch Changes
+
+#### Platforms and environments
+
+- Fixed pnpm crashing on startup on Linux ppc64le [#16380](https://github.com/pnpm/pnpm/issues/16380).
+
+- Fixed installs failing with `UnknownIssuer` on Linux systems without CA certificates, such as `node:24-slim`, when `NODE_EXTRA_CA_CERTS` is set. The extra certificates now extend the bundled CA roots [#16365](https://github.com/pnpm/pnpm/issues/16365).
+
+- pnpm now creates its store operation locks and other per-user lock files in `$XDG_RUNTIME_DIR` when it points to a directory only the user can write to. Otherwise, pnpm still uses `/tmp` on Linux and macOS. Sandboxes that block writes to `/tmp` can point `XDG_RUNTIME_DIR` at a writable directory [#16390](https://github.com/pnpm/pnpm/issues/16390).
+
+- POSIX bin shims and the `pnpm`, `pn`, `pnpx`, and `pnx` launchers now run inside a Nix build, where the system default path holds none of the utilities they call. Installing again replaces the shims already in `node_modules` [#16377](https://github.com/pnpm/pnpm/issues/16377).
+
+- In a project that pins another pnpm version, pnpm now passes a command with an option it does not know to the pinned version. Before, pnpm rejected the option before switching, so `pnpm install --auto-dedupe` failed with "Unknown option" even though the pinned pnpm supports it [#16353](https://github.com/pnpm/pnpm/issues/16353).
+
+#### Installing and resolving dependencies
+
+- `pnpm install --frozen-lockfile` now fails when `Cargo.lock` does not satisfy a dependency requirement in `Cargo.toml`. The error names the crate and the version the lockfile holds [#16355](https://github.com/pnpm/pnpm/issues/16355).
+
+- `pnpm install` returns "Already up to date" again in a workspace with injected workspace dependencies and a shared lockfile. Since 12.7.0 every repeat install in such a workspace ran the full install and copied the injected projects again.
+
+- With `injectWorkspacePackages: true`, a fresh `pnpm install` now records a workspace dependency as `link:` when its injected copy differs from the project only by an optional peer that peer-dependent dedupe merges. It was recorded as a peer-suffixed `file:` copy [#16354](https://github.com/pnpm/pnpm/issues/16354).
+
+- `pnpm dedupe --check` now passes right after `pnpm dedupe` when deduplication merges variants of a package that differ only in their peers. A lockfile key whose peer suffix named a merged variant now names the variant that replaced it [#16356](https://github.com/pnpm/pnpm/issues/16356).
+
+- When `minimumReleaseAge` hides the version that `latest` points to, pnpm now falls back to a prerelease of the same major before a stable version of an older major. A stable version of the same major is still preferred. Before, while a new `1.0.0` was too new, `latest` fell back to an old `0.0.1` even though `1.0.0-beta.4` had been `latest` until then [#16388](https://github.com/pnpm/pnpm/issues/16388).
+
+- Git-hosted dependencies now respect `pmOnFail`. If it is set to anything other than `download`, a git-hosted dependency that pins a pnpm version is prepared by the running pnpm, and pnpm does not download the pinned version [#16376](https://github.com/pnpm/pnpm/issues/16376).
+
+- pnpmfile hooks such as `readPackage` now run once for a dependency that several packages request at the same time. They could run twice for it before.
+
+- `childConcurrency` now defaults to 5, the documented value. It used to be capped at 4 and to follow the host's CPU count.
+
+#### Running scripts
+
+- `pnpm run` and `pnpm exec` no longer install dependencies before every script on CI when `autoDedupe` is enabled. `pnpm install --frozen-lockfile` now keeps the deduplication record left by an earlier install [#16374](https://github.com/pnpm/pnpm/issues/16374).
+
+- On macOS and Linux, lifecycle scripts and `pnpm run` now always get `PATH` from the `PATH` variable. When the environment also held a `Path` variable, a script sometimes got `Path`'s value, and failed with `node: not found` [#16308](https://github.com/pnpm/pnpm/issues/16308).
+
+- `pnpm run` now exits after a `SIGTERM` in a container where pnpm is PID 1 and the script runs pnpm again, as `"start": "pnpm serve"` does. Since 12.6.0 it kept waiting after the script had shut down, until the container runtime killed it.
+
+#### Other commands and settings
+
+- `pnpm config get globalShims`, `pnpm shim list`, and global installs no longer read `globalShims` from a project's `pnpm-workspace.yaml`. Only the global config file, the pnpm home's own `pnpm-workspace.yaml`, and `PNPM_CONFIG_GLOBAL_SHIMS` set it, so a repository cannot choose which globally installed packages get project-aware shims.
+
+- `pnpm config set --location=project` refuses a machine-level setting such as `stateDir` or `scope` with `ERR_PNPM_CONFIG_SET_NOT_A_PROJECT_SETTING`, which names where the setting belongs. `pnpm config delete` still clears such a key from a project's `pnpm-workspace.yaml`.
+
+- `pnpm deploy` no longer fails with `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER` in a workspace with `injectWorkspacePackages: true` when a workspace package lists its peer dependency as a dev dependency too [#16375](https://github.com/pnpm/pnpm/issues/16375).
+
+- `pnpm deploy` no longer copies the workspace root's `packageManager` and `devEngines.packageManager` fields into the deployed `package.json` [#16403](https://github.com/pnpm/pnpm/issues/16403).
+
+- `pnpm publish` now includes bare `README` files and README files with Markdown extensions such as `readme.markdown` in registry metadata [#12704](https://github.com/pnpm/pnpm/issues/12704).
+
+- `pnpm store prune` now removes the packages that only expired `pnpm dlx` cache entries used. They were left in the store until the next `pnpm store prune` [#16383](https://github.com/pnpm/pnpm/discussions/16383).
+
+#### Performance
+
+- Sped up dependency resolution in large workspaces, and when many dependencies request different ranges of the same package. Resolution also uses less memory.
+
+- Sped up `pnpm install` with `nodeLinker: hoisted` on macOS when the lockfile is re-resolved, such as with `autoDedupe` enabled [#16397](https://github.com/pnpm/pnpm/issues/16397).
+
+- Sped up extracting package tarballs.
+
+- `pnpm install` without `--frozen-lockfile` is faster on some machines in projects with a `pnpm-workspace.yaml`. Those installs linked with one worker thread per core, half of what a frozen install uses.
+
+- On Windows, warm `pnpm install --frozen-lockfile` runs are 4-5% faster on 4- and 8-core machines. pnpm now links with one worker thread per core on Windows, between 4 and 16. This changes frozen installs and installs in projects without a `pnpm-workspace.yaml` on machines with 3 to 15 cores.
+
+## 12.8.1
+
+pnpm 12.8.1 fixes `pnpm install --frozen-lockfile` rejecting lockfiles with injected workspace packages that have peers, restores the executable bit on files of local directory dependencies, makes `pnpm dedupe` converge, and uses less CPU on many-core machines.
+
+### Patch Changes
+
+- `pnpm install --frozen-lockfile` no longer rejects a freshly generated lockfile when an injected workspace package has peer dependencies [#16332](https://github.com/pnpm/pnpm/issues/16332).
+
+- Executable files in a `file:` directory dependency or an injected workspace package keep their executable bit again. Since 12.8.0, pnpm installed these files without the permissions they have in their project.
+
+- `pnpm dedupe` now reaches a stable lockfile when a package's peer suffix is long enough to be hashed. Before, each run could switch that package's key between the hashed and the spelled-out suffix, so `pnpm dedupe --check` always failed [#16331](https://github.com/pnpm/pnpm/issues/16331).
+
+- `pnpm install --frozen-lockfile`, the default in CI, now uses less CPU on machines with more than 8 cores. Warm installs on many-core Windows machines got up to 10% faster. Frozen installs now link with at most 16 worker threads.
+
+- `verifyDepsBeforeRun` no longer reports dependencies as outdated after a filtered install just because `pnpm-lock.yaml` has a newer modification time. It checks the lockfile against the packages that install put in place. Before, `pnpm run` reinstalled the whole workspace with lifecycle scripts on, for example after a Docker `COPY` brought in a lockfile with a newer mtime [#16322](https://github.com/pnpm/pnpm/issues/16322).
+
+  After a filtered install, `verifyDepsBeforeRun` now also checks that the install put the selected projects' dependencies in place. A `node_modules` directory alone no longer counts as proof.
+
+- `pnpm run` and `pnpm exec` no longer install a project that has never been installed and has nothing to install. Such a project declares no dependencies, no peer dependencies that `autoInstallPeers` would fetch, and no install lifecycle scripts. The command now runs without writing `node_modules` or `pnpm-lock.yaml` [#16313](https://github.com/pnpm/pnpm/issues/16313).
+
+- `pnpm update -g --latest` now upgrades globally installed packages beyond their saved version ranges [#16320](https://github.com/pnpm/pnpm/issues/16320).
+
 ## 12.8.0
 
 pnpm 12.8.0 warns when `pnpm pack` or `pnpm publish` would ship a `.env` file that `files` does not list, installs `sharedWorkspaceLockfile: false` workspaces concurrently, applies every setting passed as `--config.<name>=<value>`, and no longer leaves the Windows terminal stuck after Ctrl+C in a script.

package/dist/node_modules/.bin/get-pnpm

@@ -43,6 +43,8 @@ while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
 done
 basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
+basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
+basedir="$basedir_abs"
 basedir_win="$basedir"
 exe=""
 msys=""
@@ -73,11 +75,12 @@ case `command -p uname -a` in
 esac
 if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
-basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
   exec "$basedir/node.exe"  "$basedir_win/../get-pnpm/bin/get-pnpm.js" "$@"
 elif [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir_abs/../get-pnpm/bin/get-pnpm.js" "$@"
+elif [ -n "$msys" ] && command -v node >/dev/null 2>&1; then
+  exec node  "$basedir_win/../get-pnpm/bin/get-pnpm.js" "$@"
 elif command -v node >/dev/null 2>&1; then
   exec node  "$basedir_abs/../get-pnpm/bin/get-pnpm.js" "$@"
 elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then

package/dist/node_modules/.bin/node-gyp

@@ -43,6 +43,8 @@ while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
 done
 basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
+basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
+basedir="$basedir_abs"
 basedir_win="$basedir"
 exe=""
 msys=""
@@ -73,11 +75,12 @@ case `command -p uname -a` in
 esac
 if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
-basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
   exec "$basedir/node.exe"  "$basedir_win/../node-gyp/bin/node-gyp.js" "$@"
 elif [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir_abs/../node-gyp/bin/node-gyp.js" "$@"
+elif [ -n "$msys" ] && command -v node >/dev/null 2>&1; then
+  exec node  "$basedir_win/../node-gyp/bin/node-gyp.js" "$@"
 elif command -v node >/dev/null 2>&1; then
   exec node  "$basedir_abs/../node-gyp/bin/node-gyp.js" "$@"
 elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then

package/dist/node_modules/.bin/node-which

@@ -43,6 +43,8 @@ while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
 done
 basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
+basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
+basedir="$basedir_abs"
 basedir_win="$basedir"
 exe=""
 msys=""
@@ -73,11 +75,12 @@ case `command -p uname -a` in
 esac
 if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
-basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
   exec "$basedir/node.exe"  "$basedir_win/../which/bin/which.js" "$@"
 elif [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir_abs/../which/bin/which.js" "$@"
+elif [ -n "$msys" ] && command -v node >/dev/null 2>&1; then
+  exec node  "$basedir_win/../which/bin/which.js" "$@"
 elif command -v node >/dev/null 2>&1; then
   exec node  "$basedir_abs/../which/bin/which.js" "$@"
 elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then

package/dist/node_modules/.bin/nopt

@@ -43,6 +43,8 @@ while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
 done
 basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
+basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
+basedir="$basedir_abs"
 basedir_win="$basedir"
 exe=""
 msys=""
@@ -73,11 +75,12 @@ case `command -p uname -a` in
 esac
 if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
-basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
   exec "$basedir/node.exe"  "$basedir_win/../nopt/bin/nopt.js" "$@"
 elif [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir_abs/../nopt/bin/nopt.js" "$@"
+elif [ -n "$msys" ] && command -v node >/dev/null 2>&1; then
+  exec node  "$basedir_win/../nopt/bin/nopt.js" "$@"
 elif command -v node >/dev/null 2>&1; then
   exec node  "$basedir_abs/../nopt/bin/nopt.js" "$@"
 elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then

package/dist/node_modules/.bin/semver

@@ -43,6 +43,8 @@ while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
 done
 basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
+basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
+basedir="$basedir_abs"
 basedir_win="$basedir"
 exe=""
 msys=""
@@ -73,11 +75,12 @@ case `command -p uname -a` in
 esac
 if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
 
-basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
   exec "$basedir/node.exe"  "$basedir_win/../semver/bin/semver.js" "$@"
 elif [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir_abs/../semver/bin/semver.js" "$@"
+elif [ -n "$msys" ] && command -v node >/dev/null 2>&1; then
+  exec node  "$basedir_win/../semver/bin/semver.js" "$@"
 elif command -v node >/dev/null 2>&1; then
   exec node  "$basedir_abs/../semver/bin/semver.js" "$@"
 elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,9 +1,10 @@
 {
-  "lastValidatedTimestamp": 1790578965103,
+  "lastValidatedTimestamp": 1790728888790,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.8.0"
+      "version": "12.8.2",
+      "hasModulesDir": true
     }
   },
   "pnpmfiles": [],
@@ -87,6 +88,7 @@
         "@types/zkochan__table": "npm:@types/table@6.3.2",
         "@typescript-eslint/utils": "^8.70.1",
         "@typescript/native-preview": "7.0.0-dev.20260707.2",
+        "@webcontainer/api": "^1.6.4",
         "@yarnpkg/core": "4.9.1",
         "@yarnpkg/extensions": "2.0.7",
         "@yarnpkg/fslib": "^3.1.5",
@@ -112,7 +114,7 @@
         "camelcase-keys": "^10.0.3",
         "can-link": "^3.0.0",
         "can-write-to-dir": "^2.0.0",
-        "chalk": "^6.0.0",
+        "chalk": "^6.0.1",
         "ci-info": "^4.4.0",
         "cli-truncate": "^6.1.1",
         "cmd-extension": "^2.0.0",
@@ -133,7 +135,7 @@
         "eslint": "^10.11.0",
         "eslint-plugin-import-x": "^4.17.1",
         "eslint-plugin-jest": "^29.16.6",
-        "eslint-plugin-n": "^18.3.0",
+        "eslint-plugin-n": "^18.4.0",
         "eslint-plugin-promise": "^7.3.0",
         "eslint-plugin-regexp": "^3.1.1",
         "eslint-plugin-simple-import-sort": "^14.0.0",
@@ -149,8 +151,8 @@
         "graceful-fs": "^4.2.11",
         "graph-cycles": "3.0.0",
         "hosted-git-info": "npm:@pnpm/hosted-git-info@1.0.0",
-        "http-proxy-agent": "^7.0.2",
-        "https-proxy-agent": "^7.0.6",
+        "http-proxy-agent": "^9.1.0",
+        "https-proxy-agent": "^9.1.0",
         "https-proxy-server-express": "0.1.2",
         "human-id": "^4.2.1",
         "husky": "^9.1.7",
@@ -158,7 +160,7 @@
         "ini": "6.0.0",
         "is-gzip": "2.0.0",
         "is-inner-link": "^5.0.0",
-        "is-subdir": "^2.0.0",
+        "is-subdir": "^2.0.1",
         "is-windows": "^1.0.2",
         "isexe": "4.0.0",
         "jest": "30.4.2",
@@ -189,7 +191,7 @@
         "npm-registry-fetch": "^19.0.0",
         "object-hash": "3.0.0",
         "open": "^11.0.4",
-        "openpgp": "^6.3.1",
+        "openpgp": "^6.3.2",
         "p-defer": "^4.0.1",
         "p-every": "^2.0.0",
         "p-filter": "^4.1.0",
@@ -202,8 +204,9 @@
         "path-name": "^1.0.0",
         "path-temp": "^3.0.0",
         "pidtree": "^1.0.0",
+        "playwright-core": "^1.63.0",
         "preferred-pm": "^5.0.1",
-        "pretty-bytes": "^7.1.3",
+        "pretty-bytes": "^7.2.0",
         "pretty-ms": "^9.3.1",
         "promise-share": "^2.0.1",
         "proxy": "^4.1.0",
@@ -233,7 +236,7 @@
         "shx": "^0.4.0",
         "signal-exit": "^4.1.0",
         "socks": "^2.8.10",
-        "socks-proxy-agent": "^8.0.5",
+        "socks-proxy-agent": "^10.1.0",
         "sort-keys": "^6.0.1",
         "spdx-expression-parse": "5.0.0",
         "split-cmd": "^1.1.0",
@@ -241,7 +244,7 @@
         "ssri": "13.0.1",
         "stacktracey": "^2.2.0",
         "string-length": "^7.0.1",
-        "string-width": "^8.2.2",
+        "string-width": "^8.3.0",
         "strip-bom": "^5.0.0",
         "strip-comments-strings": "1.2.0",
         "symlink-dir": "^10.0.3",
@@ -256,7 +259,7 @@
         "typescript": "6.0.3",
         "typescript-eslint": "^8.70.1",
         "uid-number": "0.0.6",
-        "undici": "^7.29.0",
+        "undici": "^7.29.1",
         "unified": "^11.0.5",
         "validate-npm-package-name": "7.0.2",
         "version-selector-type": "^3.0.0",

package/dist/node_modules/undici/lib/core/request.js

@@ -263,11 +263,77 @@ class Request {
     }
   }
 
-  onUpgrade (statusCode, headers, socket) {
+  /**
+   * @param {number|null} statusCode
+   * @param {Buffer[]|null} headers
+   * @param {import('node:stream').Duplex} socket
+   * @param {string} [statusText]
+   */
+  onUpgrade (statusCode, headers, socket, statusText = '') {
+    this.onFinally()
+
     assert(!this.aborted)
     assert(!this.completed)
 
-    return this[kHandler].onUpgrade(statusCode, headers, socket)
+    if (statusCode !== null) {
+      this.#publishUpgradeHeaders(statusCode, headers, statusText)
+    }
+
+    const result = this[kHandler].onUpgrade(statusCode, headers, socket)
+
+    if (!this.aborted) {
+      this.completed = true
+      if (statusCode !== null) {
+        this.#publishUpgradeTrailers()
+      }
+    }
+
+    return result
+  }
+
+  /**
+   * @param {number} statusCode
+   * @param {import('node:http2').IncomingHttpHeaders} headers
+   * @param {(headers: import('node:http2').IncomingHttpHeaders) => Buffer[]} parseHeaders
+   * @param {string} [statusText]
+   */
+  onUpgradeResponse (statusCode, headers, parseHeaders, statusText = '') {
+    assert(!this.aborted)
+    assert(this.completed)
+
+    if (channels.headers.hasSubscribers) {
+      this.#publishUpgradeHeaders(statusCode, parseHeaders(headers), statusText)
+    }
+    this.#publishUpgradeTrailers()
+  }
+
+  /**
+   * @param {Error} error
+   */
+  onUpgradeError (error) {
+    assert(!this.aborted)
+    assert(this.completed)
+
+    if (channels.error.hasSubscribers) {
+      channels.error.publish({ request: this, error })
+    }
+  }
+
+  /**
+   * @param {number} statusCode
+   * @param {Buffer[]} headers
+   * @param {string} statusText
+   */
+  #publishUpgradeHeaders (statusCode, headers, statusText) {
+    if (channels.headers.hasSubscribers) {
+      channels.headers.publish({ request: this, response: { statusCode, headers, statusText } })
+    }
+  }
+
+  #publishUpgradeTrailers () {
+    if (channels.trailers.hasSubscribers) {
+      channels.trailers.publish({ request: this, trailers: [] })
+    }
   }
 
   onComplete (trailers) {

package/dist/node_modules/undici/lib/dispatcher/client-h1.js

@@ -432,7 +432,7 @@ class Parser {
   }
 
   onUpgrade (head) {
-    const { upgrade, client, socket, headers, statusCode } = this
+    const { upgrade, client, socket, headers, statusCode, statusText } = this
 
     assert(upgrade)
     assert(client[kSocket] === socket)
@@ -467,9 +467,10 @@ class Parser {
     client.emit('disconnect', client[kUrl], [client], new InformationalError('upgrade'))
 
     try {
-      request.onUpgrade(statusCode, headers, socket)
-    } catch (err) {
-      util.destroy(socket, err)
+      request.onUpgrade(statusCode, headers, socket, statusText)
+    } catch (error) {
+      util.errorRequest(client, request, error)
+      util.destroy(socket, error)
     }
 
     client[kResume]()
@@ -1050,12 +1051,22 @@ function writeH1 (client, request) {
   const socket = client[kSocket]
   clearIdleSocketValidation(socket)
 
-  const abort = (err) => {
-    if (request.aborted || request.completed) {
+  /**
+   * @param {Error} [error]
+   */
+  const abort = (error) => {
+    if (request.aborted) {
+      return
+    }
+
+    if (request.completed) {
+      if (request.upgrade || request.method === 'CONNECT') {
+        util.destroy(socket, new InformationalError('aborted'))
+      }
       return
     }
 
-    util.errorRequest(client, request, err || new RequestAbortedError())
+    util.errorRequest(client, request, error || new RequestAbortedError())
 
     util.destroy(body)
     util.destroy(socket, new InformationalError('aborted'))

package/dist/node_modules/undici/lib/dispatcher/client-h2.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const assert = require('node:assert')
+const { errorMonitor } = require('node:events')
 const { pipeline } = require('node:stream')
 const util = require('../core/util.js')
 const {
@@ -77,6 +78,15 @@ function parseH2Headers (headers) {
   return result
 }
 
+/**
+ * @param {import('node:http2').IncomingHttpHeaders} headers
+ * @returns {Buffer[]}
+ */
+function parseH2ResponseHeaders (headers) {
+  const { [HTTP2_HEADER_STATUS]: _statusCode, ...realHeaders } = headers
+  return parseH2Headers(realHeaders)
+}
+
 async function connectH2 (client, socket) {
   client[kSocket] = socket
 
@@ -297,22 +307,32 @@ function writeH2 (client, request) {
   headers[HTTP2_HEADER_AUTHORITY] = host || `${hostname}${port ? `:${port}` : ''}`
   headers[HTTP2_HEADER_METHOD] = method
 
-  const abort = (err) => {
-    if (request.aborted || request.completed) {
+  /**
+   * @param {Error} [error]
+   */
+  const abort = (error) => {
+    if (request.aborted) {
+      return
+    }
+
+    if (request.completed) {
+      if (method === 'CONNECT' && stream != null) {
+        util.destroy(stream, error || new RequestAbortedError())
+      }
       return
     }
 
-    err = err || new RequestAbortedError()
+    error = error || new RequestAbortedError()
 
-    util.errorRequest(client, request, err)
+    util.errorRequest(client, request, error)
 
     if (stream != null) {
-      util.destroy(stream, err)
+      util.destroy(stream, error)
     }
 
     // We do not destroy the socket as we can continue using the session
     // the stream get's destroyed and the session remains to create new streams
-    util.destroy(body, err)
+    util.destroy(body, error)
     client[kQueue][client[kRunningIdx]++] = null
     client[kResume]()
   }
@@ -331,25 +351,57 @@ function writeH2 (client, request) {
 
   if (method === 'CONNECT') {
     session.ref()
-    // We are already connected, streams are pending, first request
-    // will create a new stream. We trigger a request to create the stream and wait until
-    // `ready` event is triggered
     // We disabled endStream to allow the user to write to the stream
     stream = session.request(headers, { endStream: false, signal })
+    let upgradeResponseFinished = false
+
+    /**
+     * @param {import('node:http2').IncomingHttpHeaders} headers
+     */
+    const onResponse = (headers) => {
+      upgradeResponseFinished = true
+      stream.off(errorMonitor, onUpgradeError)
+      request.onUpgradeResponse(Number(headers[HTTP2_HEADER_STATUS]), headers, parseH2ResponseHeaders)
+    }
 
-    if (stream.id && !stream.pending) {
-      request.onUpgrade(null, null, stream)
-      ++session[kOpenStreams]
-      client[kQueue][client[kRunningIdx]++] = null
-    } else {
-      stream.once('ready', () => {
+    /**
+     * @param {Error} error
+     */
+    const onUpgradeError = (error) => {
+      upgradeResponseFinished = true
+      stream.off('response', onResponse)
+      request.onUpgradeError(error)
+    }
+
+    const onReady = () => {
+      try {
         request.onUpgrade(null, null, stream)
-        ++session[kOpenStreams]
-        client[kQueue][client[kRunningIdx]++] = null
-      })
+      } catch (error) {
+        stream.off('response', onResponse)
+        abort(error)
+        return
+      }
+
+      if (request.aborted) {
+        return
+      }
+
+      stream.off('error', abort)
+      stream.once(errorMonitor, onUpgradeError)
+      client[kQueue][client[kRunningIdx]++] = null
     }
 
+    stream.once('response', onResponse)
+    stream.once('error', abort)
+    ++session[kOpenStreams]
+    onReady()
+
     stream.once('close', () => {
+      if (!upgradeResponseFinished && request.completed) {
+        stream.off('response', onResponse)
+        stream.off(errorMonitor, onUpgradeError)
+        request.onUpgradeError(new InformationalError(`HTTP/2: "stream error" received - code ${stream.rstCode}`))
+      }
       session[kOpenStreams] -= 1
       if (session[kOpenStreams] === 0) session.unref()
     })

package/dist/node_modules/undici/lib/handler/retry-handler.js

@@ -205,7 +205,10 @@ class RetryHandler {
     this.retryCount += 1
 
     if (statusCode >= 300) {
-      if (this.retryOpts.statusCodes.includes(statusCode) === false) {
+      // Only expose a response if no earlier attempt has reached the caller.
+      // Otherwise abort this attempt so the error settles the existing body
+      // instead of replacing it with a new response.
+      if (!this.headersSent && this.retryOpts.statusCodes.includes(statusCode) === false) {
         this.headersSent = true
         this.checkpointResponseEnd(headers, resume)
         return this.handler.onHeaders(

package/dist/node_modules/undici/package.json

@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "6.28.1",
+  "version": "6.29.0",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {

package/package.json

@@ -9,7 +9,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.8.0",
+  "version": "12.8.2",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -17,7 +17,7 @@
     "rust"
   ],
   "license": "MIT",
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm",
+  "homepage": "https://pnpm.io",
   "bugs": "https://github.com/pnpm/pnpm/issues",
   "repository": {
     "type": "git",
@@ -46,20 +46,20 @@
     "THIRD-PARTY-NOTICES.md"
   ],
   "optionalDependencies": {
-    "@pnpm/exe.win32-x64": "12.8.0",
-    "@pnpm/exe.win32-arm64": "12.8.0",
-    "@pnpm/exe.darwin-x64": "12.8.0",
-    "@pnpm/exe.darwin-arm64": "12.8.0",
-    "@pnpm/exe.linux-x64": "12.8.0",
-    "@pnpm/exe.linux-arm64": "12.8.0",
-    "@pnpm/exe.linux-riscv64": "12.8.0",
-    "@pnpm/exe.linux-ppc64": "12.8.0",
-    "@pnpm/exe.linux-s390x": "12.8.0",
-    "@pnpm/exe.linux-x64-musl": "12.8.0",
-    "@pnpm/exe.linux-arm64-musl": "12.8.0",
-    "@pnpm/exe.freebsd-x64": "12.8.0",
-    "@pnpm/exe.android-arm64": "12.8.0",
-    "@pnpm/exe.android-x64": "12.8.0"
+    "@pnpm/exe.win32-x64": "12.8.2",
+    "@pnpm/exe.win32-arm64": "12.8.2",
+    "@pnpm/exe.darwin-x64": "12.8.2",
+    "@pnpm/exe.darwin-arm64": "12.8.2",
+    "@pnpm/exe.linux-x64": "12.8.2",
+    "@pnpm/exe.linux-arm64": "12.8.2",
+    "@pnpm/exe.linux-riscv64": "12.8.2",
+    "@pnpm/exe.linux-ppc64": "12.8.2",
+    "@pnpm/exe.linux-s390x": "12.8.2",
+    "@pnpm/exe.linux-x64-musl": "12.8.2",
+    "@pnpm/exe.linux-arm64-musl": "12.8.2",
+    "@pnpm/exe.freebsd-x64": "12.8.2",
+    "@pnpm/exe.android-arm64": "12.8.2",
+    "@pnpm/exe.android-x64": "12.8.2"
   },
   "scripts": {
     "preinstall": "node install.js",

package/pn

@@ -9,9 +9,8 @@
 # hang the script. Directories come from `${self%/*}` and `readlink` runs through
 # `command -p`, so the caller's `PATH` decides nothing here.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -26,6 +25,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 self=$0
 # MSYS and Cygwin can launch this with a native Windows path, which has no slash
 # for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
@@ -51,7 +55,7 @@ esac
 hops=0
 while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops + 1))
-  link=$(command -p readlink "$self")
+  link=$(run_helper readlink "$self")
   case $link in
     /*) self=$link ;;
     *) self=${self%/*}/$link ;;

package/pnpm

@@ -29,9 +29,8 @@ fi
 # and directories come from `${self%/*}`, which runs nothing at all. The caller's
 # PATH therefore decides only which `node` runs, which is what it is for.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -46,6 +45,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 self=$0
 # MSYS and Cygwin can launch this with a native Windows path, which has no slash
 # for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
@@ -71,7 +75,7 @@ esac
 hops=0
 while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops + 1))
-  link=$(command -p readlink "$self")
+  link=$(run_helper readlink "$self")
   case $link in
     /*) self=$link ;;
     *) self=${self%/*}/$link ;;

package/pnpx

@@ -9,9 +9,8 @@
 # hang the script. Directories come from `${self%/*}` and `readlink` runs through
 # `command -p`, so the caller's `PATH` decides nothing here.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -26,6 +25,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 self=$0
 # MSYS and Cygwin can launch this with a native Windows path, which has no slash
 # for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
@@ -51,7 +55,7 @@ esac
 hops=0
 while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops + 1))
-  link=$(command -p readlink "$self")
+  link=$(run_helper readlink "$self")
   case $link in
     /*) self=$link ;;
     *) self=${self%/*}/$link ;;

package/pnx

@@ -9,9 +9,8 @@
 # hang the script. Directories come from `${self%/*}` and `readlink` runs through
 # `command -p`, so the caller's `PATH` decides nothing here.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -26,6 +25,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 self=$0
 # MSYS and Cygwin can launch this with a native Windows path, which has no slash
 # for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
@@ -51,7 +55,7 @@ esac
 hops=0
 while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops + 1))
-  link=$(command -p readlink "$self")
+  link=$(run_helper readlink "$self")
   case $link in
     /*) self=$link ;;
     *) self=${self%/*}/$link ;;