pnpm 12.9.1 → 12.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +104 -0
- package/dist/node_modules/.pnpm-workspace-state-v1.json +14 -13
- package/install.js +8 -4
- package/package.json +15 -15
- package/pn +76 -2
- package/pnpm +98 -2
- package/pnpx +76 -2
- package/pnx +76 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,109 @@
|
|
|
1
1
|
# pnpm
|
|
2
2
|
|
|
3
|
+
## 12.10.0
|
|
4
|
+
|
|
5
|
+
This release adds an experimental `loaded` node linker, lets `pnpm-lock.yaml` record resolution settings, and reads cached registry metadata faster. It also carries several security fixes, including one that stops a dependency version from writing files outside the global virtual store.
|
|
6
|
+
|
|
7
|
+
### Minor Changes
|
|
8
|
+
|
|
9
|
+
- Added experimental `nodeLinker: { type: loaded }` installation. Compatible dependencies load directly from the content-addressable store through an automatically registered Node.js loader. `nodeLinker.excluded` selects packages and their dependency trees to install in the global virtual store.
|
|
10
|
+
|
|
11
|
+
- `lockfile.includeResolutionSettings: true` makes `pnpm-lock.yaml` record `autoDedupe`, `dedupeInjectedDeps`, `dedupePeerDependents` and `linkWorkspacePackages`. Installs then treat a lockfile that records other values as outdated. A lockfile that records `autoDedupe` is reused by later installs on any machine, so `pnpm run` after `pnpm install --frozen-lockfile` no longer starts another install [#16583](https://github.com/pnpm/pnpm/issues/16583).
|
|
12
|
+
|
|
13
|
+
### Patch Changes
|
|
14
|
+
|
|
15
|
+
#### Security
|
|
16
|
+
|
|
17
|
+
- `pnpm install` now prevents dependency versions with path traversal from writing files outside the global virtual store.
|
|
18
|
+
|
|
19
|
+
- pnpm now verifies locked config dependencies against their registry before installing them. Config dependencies must come from an npm registry. The lockfile can no longer replace the integrity of a config dependency pinned with `version+integrity`.
|
|
20
|
+
|
|
21
|
+
- Lockfile verification now checks the tarballs inside a `variations` resolution against the registry. A `name@version` lockfile entry with an empty `variations` resolution is now rejected.
|
|
22
|
+
|
|
23
|
+
- `pnpm audit signatures` now verifies signatures against the integrity recorded in the lockfile. Packages without a recorded integrity cannot pass signature verification.
|
|
24
|
+
|
|
25
|
+
- `pnpm install` and `pnpm publish` now reject archive metadata larger than 64 MiB before reading it into memory. Publishing a pre-built tarball also rejects manifests and README files larger than 64 MiB.
|
|
26
|
+
|
|
27
|
+
- Two URL or local path dependencies no longer share a virtual store directory when one URL has `+`, `#`, `:`, or `?` where the other has `/`. Such dependencies, including git dependencies pinned with `#`, now get a hash suffix on their directory name.
|
|
28
|
+
|
|
29
|
+
- The warning about an ignored project `.npmrc` registry setting no longer prints the username and password of a URL-scoped key such as `//user:password@registry.example.com/${PATH}/:_authToken`.
|
|
30
|
+
|
|
31
|
+
#### Installing and resolving dependencies
|
|
32
|
+
|
|
33
|
+
- `pnpm install` now fails with `ERR_PNPM_UNSUPPORTED_PROTOCOL` when a dependency uses a specifier with a protocol pnpm does not support, such as Yarn's `patch:`. On Windows, such a specifier failed with `os error 123`. On other platforms, pnpm linked it to a directory that does not exist. Reading a `package.json` that fails now names the file [#16590](https://github.com/pnpm/pnpm/issues/16590).
|
|
34
|
+
|
|
35
|
+
- `pnpm install` now fails with `ERR_PNPM_PACKAGE_MANIFEST_INVALID_ATTRIBUTE` when a project declares a dependency whose specifier is not a string, such as `"is-positive": 42`. Before, the dependency was silently left out of the lockfile. A `readPackage` hook can still correct the specifier.
|
|
36
|
+
|
|
37
|
+
- Fixed `pnpm install` failing with `ERR_PNPM_CMD_SHIM_RESOLVE_PATH` when an executable's parent directory contains a dangling symlink.
|
|
38
|
+
|
|
39
|
+
- `pnpm install --frozen-lockfile` no longer fails with `ERR_PNPM_RESOLUTION_SHAPE_MISMATCH` when a `name@version` lockfile entry has a resolution served by a custom fetcher [pnpm/tasks#108](https://github.com/pnpm/tasks/issues/108).
|
|
40
|
+
|
|
41
|
+
- `pnpm install --fix-lockfile` repairs a lockfile whose importer references a package that has no snapshot entry, as left by a badly merged lockfile. It failed with `ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY` since 12.8.0 [#16618](https://github.com/pnpm/pnpm/issues/16618).
|
|
42
|
+
|
|
43
|
+
- When a dependency moves an exact dependency of its own to an older version, a peer dependency that pnpm installed automatically now moves with it. Before, `pnpm install` and `pnpm dedupe` kept the newer locked version of the peer, so the lockfile held two copies of it, for example two copies of `vue` [pnpm/tasks#61](https://github.com/pnpm/tasks/issues/61).
|
|
44
|
+
|
|
45
|
+
- `pnpm dedupe` now reads registry metadata for a dependency pinned to an exact version, as `pnpm install` does. If the registry metadata disagreed with the package's `package.json`, the lockfile it wrote depended on whether `minimumReleaseAge` was set [#16615](https://github.com/pnpm/pnpm/issues/16615).
|
|
46
|
+
|
|
47
|
+
#### Speed and size
|
|
48
|
+
|
|
49
|
+
- Dependency resolution reads cached registry metadata faster. The metadata cache moved to `<cache-dir>/v12/`, so the first install after upgrading downloads registry metadata again. A damaged cache entry is downloaded again, or reported as an error when `--offline` is set. `pnpm cache prune` also removes the metadata cache that older pnpm versions wrote under `<cache-dir>/v11/` [#13512](https://github.com/pnpm/pnpm/pull/13512).
|
|
50
|
+
|
|
51
|
+
- Package metadata requests no longer wait behind queued tarball downloads when `maxSockets` or a proxy limits the connections to a registry. Large installs resolve faster and print fewer `Request took` warnings.
|
|
52
|
+
|
|
53
|
+
- Sped up installs in large workspaces on macOS when the dependency links already exist. pnpm now keeps a link that already points at the right package without trying to create it first. Relinking the direct dependencies of 1,000 workspace projects took 45 ms, down from 116 ms [pnpm/tasks#65](https://github.com/pnpm/tasks/issues/65).
|
|
54
|
+
|
|
55
|
+
- Commands in a project that pins a different pnpm version start about 13 ms faster on macOS. pnpm now runs the pinned version's binary directly, without the shell script in front of it [pnpm/tasks#66](https://github.com/pnpm/tasks/issues/66).
|
|
56
|
+
|
|
57
|
+
- The pnpm binary is about 0.9 MB smaller, and the arm64 Linux binary is about 1 MB smaller still.
|
|
58
|
+
|
|
59
|
+
#### Running scripts and commands
|
|
60
|
+
|
|
61
|
+
- `pnpm run` no longer prints `[ELIFECYCLE] Command failed ...` after Ctrl+C ends the script. pnpm still exits the way the script's shell did: on Windows with the shell's exit code (`cmd` reports `-1073741510`, PowerShell `1`), on Unix by re-raising `SIGINT` [#16579](https://github.com/pnpm/pnpm/issues/16579).
|
|
62
|
+
|
|
63
|
+
- `pnpm run "/<regex>/"` now accepts JavaScript regular expression syntax such as lookahead and lookbehind. A selector like `"/^hello:(?!b).*$/"` failed with `ERR_PNPM_NO_SCRIPT` [#16604](https://github.com/pnpm/pnpm/issues/16604).
|
|
64
|
+
|
|
65
|
+
- `pnpm run` and `pnpm exec` now forward `--config.*` command-line flags to the install started by `verifyDepsBeforeRun` [pnpm/tasks#60](https://github.com/pnpm/tasks/issues/60).
|
|
66
|
+
|
|
67
|
+
- On Windows, a process started by `pnpm run` or `pnpm exec` can again start a child with `CREATE_BREAKAWAY_FROM_JOB`. That child keeps running after pnpm exits, even if the command fails [#16628](https://github.com/pnpm/pnpm/issues/16628).
|
|
68
|
+
|
|
69
|
+
- Empty `nodeOptions` values from command-line flags and environment variables now override lower-priority settings. Scripts retain `NODE_OPTIONS` from the parent environment or `extraEnv` when `nodeOptions` is empty.
|
|
70
|
+
|
|
71
|
+
- pnpm now reads the `failIfNoMatch` setting from `pnpm-workspace.yaml`, so a filter that matches no workspace project exits with code 1 when the setting is `true`. The new `--no-fail-if-no-match` flag turns the setting off for one command [#16577](https://github.com/pnpm/pnpm/issues/16577).
|
|
72
|
+
|
|
73
|
+
#### Configuration, setup, and pnpm versions
|
|
74
|
+
|
|
75
|
+
- `pnpm config get --global` and `pnpm config list --global` now show only the global configuration, also when run inside a project. Settings from the project's `pnpm-workspace.yaml` and `.npmrc` were included before. The same applies to `--location=global` [#16598](https://github.com/pnpm/pnpm/issues/16598).
|
|
76
|
+
|
|
77
|
+
- pnpm now prints config warnings, such as an unset environment variable in `.npmrc`, when loading the config fails.
|
|
78
|
+
|
|
79
|
+
- pnpm 11 releases older than 11.28.4 can run pnpm 12 again when the `packageManager` field pins it. Since 12.9.0 they failed with `SyntaxError: Invalid or unexpected token` [#16594](https://github.com/pnpm/pnpm/issues/16594).
|
|
80
|
+
|
|
81
|
+
- On Windows, `pnpm self-update` no longer runs the update a second time when it replaces a `pnpm.cmd` linked by pnpm 12.8 or older. cmd.exe read on in the replaced `pnpm.cmd`, printed an error about a command that is not recognized, and ran the new pnpm once more [#16573](https://github.com/pnpm/pnpm/issues/16573).
|
|
82
|
+
|
|
83
|
+
- `pnpm setup` now puts `$PNPM_HOME/bin` first on `PATH` in login shells that inherited it further down, such as the VS Code terminal on macOS. Before, another `node` took precedence over the one installed by `pnpm runtime set node -g`. Run `pnpm setup` again to update the block in your shell config [#16635](https://github.com/pnpm/pnpm/issues/16635).
|
|
84
|
+
|
|
85
|
+
- `pnpm setup` now names the shell config file even if it is already up to date [#16608](https://github.com/pnpm/pnpm/issues/16608).
|
|
86
|
+
|
|
87
|
+
#### Updating, auditing, and publishing
|
|
88
|
+
|
|
89
|
+
- `pnpm update --latest` now applies the `savePrefix` setting when it rewrites a dependency whose range has no operator of its own, such as `<2.0.0`.
|
|
90
|
+
|
|
91
|
+
- The interactive `pnpm audit --fix` picker now shows each patched version with the `saveExact` and `savePrefix` style that the override is written with [#13209](https://github.com/pnpm/pnpm/issues/13209).
|
|
92
|
+
|
|
93
|
+
- `pnpm unpublish <pkg>@<version>` now deletes the tarball under the registry's path when the registry is served under one, such as Gitea's npm registry. It used to send the delete to the host root and report success without removing the version [#16568](https://github.com/pnpm/pnpm/issues/16568). It also no longer mistakes a sibling path such as `/npm-mirror/` for the registry path `/npm/` [pnpm/tasks#94](https://github.com/pnpm/tasks/issues/94).
|
|
94
|
+
|
|
95
|
+
#### Output and messages
|
|
96
|
+
|
|
97
|
+
- A warning about a project's `devEngines` or `packageManager` pin is now printed to stderr. A command such as `pnpm cache path` or `pnpm list --json` keeps only its own output on stdout [#16584](https://github.com/pnpm/pnpm/issues/16584).
|
|
98
|
+
|
|
99
|
+
- `pnpm list` now reports the correct package paths when `nodeLinker` is `hoisted` [#9593](https://github.com/pnpm/pnpm/issues/9593).
|
|
100
|
+
|
|
101
|
+
- Resolution errors now name the failing dependency and its parent packages. Fatal errors appear as structured error records with their error codes when using `--reporter=ndjson`.
|
|
102
|
+
|
|
103
|
+
- The error for an invalid git repository in the lockfile now has the code `ERR_PNPM_INVALID_GIT_REPOSITORY`. Its message now lists every rejected form of the value.
|
|
104
|
+
|
|
105
|
+
- `pnpm runtime --help` and `pnpm help runtime` now name the `set` subcommand and the runtimes it accepts [#16580](https://github.com/pnpm/pnpm/issues/16580).
|
|
106
|
+
|
|
3
107
|
## 12.9.1
|
|
4
108
|
|
|
5
109
|
This release moves the WebContainer build into a separate `@pnpm/wasm` package, shrinks the `pnpm` package back to about 4 MB, and fixes `pnpm publish` with provenance from GitLab CI.
|
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
{
|
|
2
|
-
"lastValidatedTimestamp":
|
|
2
|
+
"lastValidatedTimestamp": 1791244929665,
|
|
3
3
|
"projects": {
|
|
4
4
|
"/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
|
|
5
5
|
"name": "pacquet",
|
|
6
|
-
"version": "12.
|
|
6
|
+
"version": "12.10.0",
|
|
7
7
|
"hasModulesDir": true
|
|
8
8
|
}
|
|
9
9
|
},
|
|
@@ -28,7 +28,7 @@
|
|
|
28
28
|
"@commitlint/config-conventional": "^21.2.3",
|
|
29
29
|
"@commitlint/prompt-cli": "^21.2.3",
|
|
30
30
|
"@cyclonedx/cyclonedx-library": "10.3.0",
|
|
31
|
-
"@emnapi/wasi-threads": "
|
|
31
|
+
"@emnapi/wasi-threads": "2.1.0",
|
|
32
32
|
"@eslint/js": "^10.0.1",
|
|
33
33
|
"@inquirer/prompts": "^8.7.2",
|
|
34
34
|
"@jest/globals": "30.4.1",
|
|
@@ -46,7 +46,7 @@
|
|
|
46
46
|
"@pnpm/tabtab": "^0.5.4",
|
|
47
47
|
"@pnpm/tgz-fixtures": "0.0.0",
|
|
48
48
|
"@reflink/reflink": "0.1.19",
|
|
49
|
-
"@rushstack/worker-pool": "0.7.
|
|
49
|
+
"@rushstack/worker-pool": "0.7.29",
|
|
50
50
|
"@stylistic/eslint-plugin": "^5.10.0",
|
|
51
51
|
"@tybys/wasm-util": "0.10.4",
|
|
52
52
|
"@types/adm-zip": "^0.5.8",
|
|
@@ -80,7 +80,7 @@
|
|
|
80
80
|
"@types/semver": "7.8.0",
|
|
81
81
|
"@types/spdx-expression-parse": "4.0.0",
|
|
82
82
|
"@types/ssri": "^7.1.5",
|
|
83
|
-
"@types/tar-stream": "^3.1.
|
|
83
|
+
"@types/tar-stream": "^3.1.5",
|
|
84
84
|
"@types/touch": "^3.1.5",
|
|
85
85
|
"@types/validate-npm-package-name": "^4.0.2",
|
|
86
86
|
"@types/which": "^3.0.4",
|
|
@@ -88,7 +88,7 @@
|
|
|
88
88
|
"@types/yarnpkg__lockfile": "^1.1.9",
|
|
89
89
|
"@types/yauzl": "^3.4.0",
|
|
90
90
|
"@types/zkochan__table": "npm:@types/table@6.3.2",
|
|
91
|
-
"@typescript-eslint/utils": "^8.
|
|
91
|
+
"@typescript-eslint/utils": "^8.71.0",
|
|
92
92
|
"@typescript/native-preview": "7.0.0-dev.20260707.2",
|
|
93
93
|
"@webcontainer/api": "^1.6.4",
|
|
94
94
|
"@yarnpkg/core": "4.9.1",
|
|
@@ -111,7 +111,6 @@
|
|
|
111
111
|
"bin-links": "^6.0.2",
|
|
112
112
|
"bole": "^5.0.29",
|
|
113
113
|
"boxen": "npm:@zkochan/boxen@5.1.2",
|
|
114
|
-
"bz2": "1.0.1",
|
|
115
114
|
"c8": "^12.0.0",
|
|
116
115
|
"camelcase": "^9.0.0",
|
|
117
116
|
"camelcase-keys": "^10.0.3",
|
|
@@ -135,10 +134,10 @@
|
|
|
135
134
|
"empathic": "^2.1.0",
|
|
136
135
|
"esbuild": "^0.28.2",
|
|
137
136
|
"escape-string-regexp": "^5.0.0",
|
|
138
|
-
"eslint": "^10.
|
|
137
|
+
"eslint": "^10.12.0",
|
|
139
138
|
"eslint-plugin-import-x": "^4.17.1",
|
|
140
139
|
"eslint-plugin-jest": "^29.16.6",
|
|
141
|
-
"eslint-plugin-n": "^18.4.
|
|
140
|
+
"eslint-plugin-n": "^18.4.1",
|
|
142
141
|
"eslint-plugin-promise": "^7.3.0",
|
|
143
142
|
"eslint-plugin-regexp": "^3.1.1",
|
|
144
143
|
"eslint-plugin-simple-import-sort": "^14.0.0",
|
|
@@ -180,7 +179,7 @@
|
|
|
180
179
|
"lru-cache": "^11.5.3",
|
|
181
180
|
"make-empty-dir": "^4.0.0",
|
|
182
181
|
"mdast-util-to-string": "^4.0.0",
|
|
183
|
-
"memfs": "^4.
|
|
182
|
+
"memfs": "^4.80.0",
|
|
184
183
|
"memoize": "^11.0.0",
|
|
185
184
|
"micromatch": "^4.0.8",
|
|
186
185
|
"msgpackr": "2.1.0",
|
|
@@ -232,6 +231,7 @@
|
|
|
232
231
|
"safe-execa": "^0.3.0",
|
|
233
232
|
"safe-promise-defer": "^2.0.0",
|
|
234
233
|
"sanitize-filename": "^1.6.4",
|
|
234
|
+
"seek-bzip": "2.0.0",
|
|
235
235
|
"semver": "^7.8.5",
|
|
236
236
|
"semver-range-intersect": "^0.3.1",
|
|
237
237
|
"semver-utils": "^1.1.4",
|
|
@@ -252,7 +252,7 @@
|
|
|
252
252
|
"strip-comments-strings": "1.2.0",
|
|
253
253
|
"symlink-dir": "^10.0.3",
|
|
254
254
|
"tar": "^7.5.22",
|
|
255
|
-
"tar-stream": "^3.2.
|
|
255
|
+
"tar-stream": "^3.2.2",
|
|
256
256
|
"tempy": "3.0.0",
|
|
257
257
|
"terminal-link": "^5.0.0",
|
|
258
258
|
"tinyglobby": "^0.2.17",
|
|
@@ -260,7 +260,7 @@
|
|
|
260
260
|
"tree-kill": "^1.2.2",
|
|
261
261
|
"ts-jest-resolver": "2.0.1",
|
|
262
262
|
"typescript": "6.0.3",
|
|
263
|
-
"typescript-eslint": "^8.
|
|
263
|
+
"typescript-eslint": "^8.71.0",
|
|
264
264
|
"uid-number": "0.0.6",
|
|
265
265
|
"undici": "^7.29.1",
|
|
266
266
|
"unified": "^11.0.5",
|
|
@@ -336,7 +336,8 @@
|
|
|
336
336
|
"patchedDependencies": {
|
|
337
337
|
"@tybys/wasm-util@0.10.4": "../../../../__patches__/@tybys__wasm-util@0.10.4.patch",
|
|
338
338
|
"graceful-fs@4.2.11": "../../../../__patches__/graceful-fs@4.2.11.patch",
|
|
339
|
-
"normalize-registry-url@2.0.1": "../../../../__patches__/normalize-registry-url@2.0.1.patch"
|
|
339
|
+
"normalize-registry-url@2.0.1": "../../../../__patches__/normalize-registry-url@2.0.1.patch",
|
|
340
|
+
"unrs-resolver@1.12.2": "../../../../__patches__/unrs-resolver@1.12.2.patch"
|
|
340
341
|
},
|
|
341
342
|
"peersSuffixMaxLength": 1000,
|
|
342
343
|
"preferWorkspacePackages": false,
|
package/install.js
CHANGED
|
@@ -1,7 +1,11 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
|
-
// Native installs replace
|
|
3
|
-
//
|
|
4
|
-
//
|
|
2
|
+
// Native installs replace every bin with the host binary, so `pnpm` runs with
|
|
3
|
+
// no Node.js startup per call. The bins it replaces are shebang-less for the
|
|
4
|
+
// reason ./pnpm gives. npm's Windows shims still target the extensionless path
|
|
5
|
+
// after the `bin` rewrite, so postinstall asks npm to regenerate them against
|
|
6
|
+
// `pnpm.exe`. Installs that block lifecycle scripts keep the placeholders,
|
|
7
|
+
// which reach pnpm through Node.js wherever a shell runs them. Corepack runs no
|
|
8
|
+
// lifecycle scripts and enters through `bin/pnpm.mjs`.
|
|
5
9
|
import console from 'node:console'
|
|
6
10
|
import { spawnSync } from 'node:child_process'
|
|
7
11
|
import fs from 'node:fs'
|
|
@@ -32,7 +36,7 @@ function setup () {
|
|
|
32
36
|
return
|
|
33
37
|
}
|
|
34
38
|
|
|
35
|
-
// The
|
|
39
|
+
// The placeholders stay in place there and point to `@pnpm/wasm`.
|
|
36
40
|
if ('webcontainer' in process.versions) {
|
|
37
41
|
return
|
|
38
42
|
}
|
package/package.json
CHANGED
|
@@ -9,7 +9,7 @@
|
|
|
9
9
|
"./dist/node_modules/node-gyp/gyp/gyp"
|
|
10
10
|
]
|
|
11
11
|
},
|
|
12
|
-
"version": "12.
|
|
12
|
+
"version": "12.10.0",
|
|
13
13
|
"description": "Fast, disk space efficient package manager",
|
|
14
14
|
"keywords": [
|
|
15
15
|
"pnpm",
|
|
@@ -46,20 +46,20 @@
|
|
|
46
46
|
"THIRD-PARTY-NOTICES.md"
|
|
47
47
|
],
|
|
48
48
|
"optionalDependencies": {
|
|
49
|
-
"@pnpm/exe.win32-x64": "12.
|
|
50
|
-
"@pnpm/exe.win32-arm64": "12.
|
|
51
|
-
"@pnpm/exe.darwin-x64": "12.
|
|
52
|
-
"@pnpm/exe.darwin-arm64": "12.
|
|
53
|
-
"@pnpm/exe.linux-x64": "12.
|
|
54
|
-
"@pnpm/exe.linux-arm64": "12.
|
|
55
|
-
"@pnpm/exe.linux-riscv64": "12.
|
|
56
|
-
"@pnpm/exe.linux-ppc64": "12.
|
|
57
|
-
"@pnpm/exe.linux-s390x": "12.
|
|
58
|
-
"@pnpm/exe.linux-x64-musl": "12.
|
|
59
|
-
"@pnpm/exe.linux-arm64-musl": "12.
|
|
60
|
-
"@pnpm/exe.freebsd-x64": "12.
|
|
61
|
-
"@pnpm/exe.android-arm64": "12.
|
|
62
|
-
"@pnpm/exe.android-x64": "12.
|
|
49
|
+
"@pnpm/exe.win32-x64": "12.10.0",
|
|
50
|
+
"@pnpm/exe.win32-arm64": "12.10.0",
|
|
51
|
+
"@pnpm/exe.darwin-x64": "12.10.0",
|
|
52
|
+
"@pnpm/exe.darwin-arm64": "12.10.0",
|
|
53
|
+
"@pnpm/exe.linux-x64": "12.10.0",
|
|
54
|
+
"@pnpm/exe.linux-arm64": "12.10.0",
|
|
55
|
+
"@pnpm/exe.linux-riscv64": "12.10.0",
|
|
56
|
+
"@pnpm/exe.linux-ppc64": "12.10.0",
|
|
57
|
+
"@pnpm/exe.linux-s390x": "12.10.0",
|
|
58
|
+
"@pnpm/exe.linux-x64-musl": "12.10.0",
|
|
59
|
+
"@pnpm/exe.linux-arm64-musl": "12.10.0",
|
|
60
|
+
"@pnpm/exe.freebsd-x64": "12.10.0",
|
|
61
|
+
"@pnpm/exe.android-arm64": "12.10.0",
|
|
62
|
+
"@pnpm/exe.android-x64": "12.10.0"
|
|
63
63
|
},
|
|
64
64
|
"scripts": {
|
|
65
65
|
"preinstall": "node install.js",
|
package/pn
CHANGED
|
@@ -1,2 +1,76 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
1
|
+
# Shebang-less for the reason ./pnpm gives: install.js puts the native binary
|
|
2
|
+
# at this path too.
|
|
3
|
+
#
|
|
4
|
+
# `pn` is `pnpm`. The pnpm it hands over to is the one installed alongside it,
|
|
5
|
+
# found relative to this file: a `PATH` lookup would run whatever other pnpm
|
|
6
|
+
# comes first there, and would find nothing at all when the directory holding
|
|
7
|
+
# these bins is not on `PATH`.
|
|
8
|
+
#
|
|
9
|
+
# $0 is whatever shim or symlink `pn` was launched through, so walk to the file
|
|
10
|
+
# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
|
|
11
|
+
# hang the script. Directories come from `${self%/*}` and `readlink` runs through
|
|
12
|
+
# `command -p`, so the caller's `PATH` decides nothing here.
|
|
13
|
+
#
|
|
14
|
+
# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
|
|
15
|
+
# instead, with node_modules and relative entries dropped from it.
|
|
16
|
+
caller_path_set=${PATH+set}
|
|
17
|
+
caller_path=${PATH-}
|
|
18
|
+
helper_path=
|
|
19
|
+
rest=$caller_path:
|
|
20
|
+
while [ -n "$rest" ]; do
|
|
21
|
+
dir=${rest%%:*}
|
|
22
|
+
rest=${rest#*:}
|
|
23
|
+
case "$dir" in
|
|
24
|
+
*/node_modules/*|*/node_modules) ;;
|
|
25
|
+
/*) helper_path=${helper_path:+$helper_path:}$dir ;;
|
|
26
|
+
esac
|
|
27
|
+
done
|
|
28
|
+
# An empty PATH searches the current directory.
|
|
29
|
+
PATH=${helper_path:-/}
|
|
30
|
+
# A helper comes from PATH only when the default path lacks it and PATH has it.
|
|
31
|
+
# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
|
|
32
|
+
run_helper() {
|
|
33
|
+
if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
|
|
34
|
+
}
|
|
35
|
+
self=$0
|
|
36
|
+
# MSYS and Cygwin can launch this with a native Windows path, which has no slash
|
|
37
|
+
# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
|
|
38
|
+
# backslash anywhere else is an ordinary character in a Unix file name, so the
|
|
39
|
+
# path is left alone. The separators are swapped in the shell rather than through
|
|
40
|
+
# `echo`, which mangles a `\t` or `\b` in a path under dash.
|
|
41
|
+
case $self in
|
|
42
|
+
[A-Za-z]:\\*|\\\\*)
|
|
43
|
+
while :; do
|
|
44
|
+
case $self in
|
|
45
|
+
*\\*) self=${self%%\\*}/${self#*\\} ;;
|
|
46
|
+
*) break ;;
|
|
47
|
+
esac
|
|
48
|
+
done
|
|
49
|
+
;;
|
|
50
|
+
esac
|
|
51
|
+
# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
|
|
52
|
+
# stands for a file in the current directory.
|
|
53
|
+
case $self in
|
|
54
|
+
*/*) ;;
|
|
55
|
+
*) self=./$self ;;
|
|
56
|
+
esac
|
|
57
|
+
hops=0
|
|
58
|
+
while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
|
|
59
|
+
hops=$((hops + 1))
|
|
60
|
+
link=$(run_helper readlink "$self")
|
|
61
|
+
case $link in
|
|
62
|
+
/*) self=$link ;;
|
|
63
|
+
*) self=${self%/*}/$link ;;
|
|
64
|
+
esac
|
|
65
|
+
done
|
|
66
|
+
if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
|
|
67
|
+
# The walk has to end at a regular file. Running out of hops leaves $self a
|
|
68
|
+
# symlink; a chain that changed under us can leave it dangling or a directory, and
|
|
69
|
+
# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
|
|
70
|
+
# wrong directory — the substitution this script exists to prevent.
|
|
71
|
+
if [ -L "$self" ] || [ ! -f "$self" ]; then
|
|
72
|
+
echo "pn: could not resolve $0 to a regular file within 40 symlink hops." >&2
|
|
73
|
+
exit 1
|
|
74
|
+
fi
|
|
75
|
+
|
|
76
|
+
exec "${self%/*}/pnpm" "$@"
|
package/pnpm
CHANGED
|
@@ -1,2 +1,98 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
1
|
+
# pnpm's native binary replaces this file during installation (see
|
|
2
|
+
# ./install.js). Until then this hands over to ./bin/pnpm.mjs, which finds the
|
|
3
|
+
# installed binary or downloads one and spawns it.
|
|
4
|
+
#
|
|
5
|
+
# Shebang-less on purpose, and therefore an `sh` script: a bin shim generated
|
|
6
|
+
# from a shebang records that interpreter, and keeps running the native binary
|
|
7
|
+
# through it once the binary takes this path. Every pnpm 11 release before
|
|
8
|
+
# 11.28.4 generates the shim first when it installs the pnpm that a
|
|
9
|
+
# `packageManager` field pins, and released versions cannot be fixed
|
|
10
|
+
# (https://github.com/pnpm/pnpm/issues/16594). test/install.test.mjs holds
|
|
11
|
+
# every bin to this.
|
|
12
|
+
#
|
|
13
|
+
# Something has to retry this file under a shell, because the kernel answers
|
|
14
|
+
# ENOEXEC for it. A bin shim and a shell both do, and so does glibc's `execvp`.
|
|
15
|
+
# Apple's libc does not, so on macOS a program that spawns this path itself gets
|
|
16
|
+
# ENOEXEC; Windows has neither and cannot reach it at all.
|
|
17
|
+
if ! command -v node > /dev/null 2>&1; then
|
|
18
|
+
echo "pnpm's native binary was not installed, and there is no Node.js to run pnpm without it." >&2
|
|
19
|
+
echo "Reinstall pnpm with build scripts enabled (allow-list pnpm's build under pnpm or Bun, or drop --ignore-scripts)." >&2
|
|
20
|
+
exit 1
|
|
21
|
+
fi
|
|
22
|
+
|
|
23
|
+
if [ -t 2 ]; then
|
|
24
|
+
echo "pnpm is running through Node.js because the script that installs its native binary was skipped." >&2
|
|
25
|
+
echo "Reinstall pnpm with its build scripts allowed to run the binary directly." >&2
|
|
26
|
+
fi
|
|
27
|
+
|
|
28
|
+
# $0 is whatever shim or symlink pnpm was launched through; ./bin/pnpm.mjs is
|
|
29
|
+
# found relative to this file. The hop cap matches the kernel's ELOOP limit, so
|
|
30
|
+
# a cycle cannot hang the script.
|
|
31
|
+
#
|
|
32
|
+
# `readlink` runs through `command -p`, which searches the system default path,
|
|
33
|
+
# and directories come from `${self%/*}`, which runs nothing at all. The caller's
|
|
34
|
+
# PATH therefore decides only which `node` runs, which is what it is for.
|
|
35
|
+
#
|
|
36
|
+
# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
|
|
37
|
+
# instead, with node_modules and relative entries dropped from it.
|
|
38
|
+
caller_path_set=${PATH+set}
|
|
39
|
+
caller_path=${PATH-}
|
|
40
|
+
helper_path=
|
|
41
|
+
rest=$caller_path:
|
|
42
|
+
while [ -n "$rest" ]; do
|
|
43
|
+
dir=${rest%%:*}
|
|
44
|
+
rest=${rest#*:}
|
|
45
|
+
case "$dir" in
|
|
46
|
+
*/node_modules/*|*/node_modules) ;;
|
|
47
|
+
/*) helper_path=${helper_path:+$helper_path:}$dir ;;
|
|
48
|
+
esac
|
|
49
|
+
done
|
|
50
|
+
# An empty PATH searches the current directory.
|
|
51
|
+
PATH=${helper_path:-/}
|
|
52
|
+
# A helper comes from PATH only when the default path lacks it and PATH has it.
|
|
53
|
+
# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
|
|
54
|
+
run_helper() {
|
|
55
|
+
if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
|
|
56
|
+
}
|
|
57
|
+
self=$0
|
|
58
|
+
# MSYS and Cygwin can launch this with a native Windows path, which has no slash
|
|
59
|
+
# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
|
|
60
|
+
# backslash anywhere else is an ordinary character in a Unix file name, so the
|
|
61
|
+
# path is left alone. The separators are swapped in the shell rather than through
|
|
62
|
+
# `echo`, which mangles a `\t` or `\b` in a path under dash.
|
|
63
|
+
case $self in
|
|
64
|
+
[A-Za-z]:\\*|\\\\*)
|
|
65
|
+
while :; do
|
|
66
|
+
case $self in
|
|
67
|
+
*\\*) self=${self%%\\*}/${self#*\\} ;;
|
|
68
|
+
*) break ;;
|
|
69
|
+
esac
|
|
70
|
+
done
|
|
71
|
+
;;
|
|
72
|
+
esac
|
|
73
|
+
# `${self%/*}` needs a slash to strip. A bare name came from a PATH lookup and
|
|
74
|
+
# stands for a file in the current directory.
|
|
75
|
+
case $self in
|
|
76
|
+
*/*) ;;
|
|
77
|
+
*) self=./$self ;;
|
|
78
|
+
esac
|
|
79
|
+
hops=0
|
|
80
|
+
while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
|
|
81
|
+
hops=$((hops + 1))
|
|
82
|
+
link=$(run_helper readlink "$self")
|
|
83
|
+
case $link in
|
|
84
|
+
/*) self=$link ;;
|
|
85
|
+
*) self=${self%/*}/$link ;;
|
|
86
|
+
esac
|
|
87
|
+
done
|
|
88
|
+
if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
|
|
89
|
+
# The walk has to end at a regular file. Running out of hops leaves $self a
|
|
90
|
+
# symlink; a chain that changed under us can leave it dangling or a directory, and
|
|
91
|
+
# a failed readlink leaves a trailing slash. Each case would take `bin/pnpm.mjs`
|
|
92
|
+
# from the wrong directory.
|
|
93
|
+
if [ -L "$self" ] || [ ! -f "$self" ]; then
|
|
94
|
+
echo "pnpm: could not resolve $0 to a regular file within 40 symlink hops." >&2
|
|
95
|
+
exit 1
|
|
96
|
+
fi
|
|
97
|
+
|
|
98
|
+
exec node "${self%/*}/bin/pnpm.mjs" "$@"
|
package/pnpx
CHANGED
|
@@ -1,2 +1,76 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
1
|
+
# Shebang-less for the reason ./pnpm gives: install.js puts the native binary
|
|
2
|
+
# at this path too.
|
|
3
|
+
#
|
|
4
|
+
# `pnpx` is `pnpm dlx`. The pnpm it hands over to is the one installed alongside
|
|
5
|
+
# it, found relative to this file: a `PATH` lookup would run whatever other pnpm
|
|
6
|
+
# comes first there, and would find nothing at all when the directory holding
|
|
7
|
+
# these bins is not on `PATH`.
|
|
8
|
+
#
|
|
9
|
+
# $0 is whatever shim or symlink `pnpx` was launched through, so walk to the file
|
|
10
|
+
# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
|
|
11
|
+
# hang the script. Directories come from `${self%/*}` and `readlink` runs through
|
|
12
|
+
# `command -p`, so the caller's `PATH` decides nothing here.
|
|
13
|
+
#
|
|
14
|
+
# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
|
|
15
|
+
# instead, with node_modules and relative entries dropped from it.
|
|
16
|
+
caller_path_set=${PATH+set}
|
|
17
|
+
caller_path=${PATH-}
|
|
18
|
+
helper_path=
|
|
19
|
+
rest=$caller_path:
|
|
20
|
+
while [ -n "$rest" ]; do
|
|
21
|
+
dir=${rest%%:*}
|
|
22
|
+
rest=${rest#*:}
|
|
23
|
+
case "$dir" in
|
|
24
|
+
*/node_modules/*|*/node_modules) ;;
|
|
25
|
+
/*) helper_path=${helper_path:+$helper_path:}$dir ;;
|
|
26
|
+
esac
|
|
27
|
+
done
|
|
28
|
+
# An empty PATH searches the current directory.
|
|
29
|
+
PATH=${helper_path:-/}
|
|
30
|
+
# A helper comes from PATH only when the default path lacks it and PATH has it.
|
|
31
|
+
# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
|
|
32
|
+
run_helper() {
|
|
33
|
+
if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
|
|
34
|
+
}
|
|
35
|
+
self=$0
|
|
36
|
+
# MSYS and Cygwin can launch this with a native Windows path, which has no slash
|
|
37
|
+
# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
|
|
38
|
+
# backslash anywhere else is an ordinary character in a Unix file name, so the
|
|
39
|
+
# path is left alone. The separators are swapped in the shell rather than through
|
|
40
|
+
# `echo`, which mangles a `\t` or `\b` in a path under dash.
|
|
41
|
+
case $self in
|
|
42
|
+
[A-Za-z]:\\*|\\\\*)
|
|
43
|
+
while :; do
|
|
44
|
+
case $self in
|
|
45
|
+
*\\*) self=${self%%\\*}/${self#*\\} ;;
|
|
46
|
+
*) break ;;
|
|
47
|
+
esac
|
|
48
|
+
done
|
|
49
|
+
;;
|
|
50
|
+
esac
|
|
51
|
+
# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
|
|
52
|
+
# stands for a file in the current directory.
|
|
53
|
+
case $self in
|
|
54
|
+
*/*) ;;
|
|
55
|
+
*) self=./$self ;;
|
|
56
|
+
esac
|
|
57
|
+
hops=0
|
|
58
|
+
while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
|
|
59
|
+
hops=$((hops + 1))
|
|
60
|
+
link=$(run_helper readlink "$self")
|
|
61
|
+
case $link in
|
|
62
|
+
/*) self=$link ;;
|
|
63
|
+
*) self=${self%/*}/$link ;;
|
|
64
|
+
esac
|
|
65
|
+
done
|
|
66
|
+
if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
|
|
67
|
+
# The walk has to end at a regular file. Running out of hops leaves $self a
|
|
68
|
+
# symlink; a chain that changed under us can leave it dangling or a directory, and
|
|
69
|
+
# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
|
|
70
|
+
# wrong directory — the substitution this script exists to prevent.
|
|
71
|
+
if [ -L "$self" ] || [ ! -f "$self" ]; then
|
|
72
|
+
echo "pnpx: could not resolve $0 to a regular file within 40 symlink hops." >&2
|
|
73
|
+
exit 1
|
|
74
|
+
fi
|
|
75
|
+
|
|
76
|
+
exec "${self%/*}/pnpm" dlx "$@"
|
package/pnx
CHANGED
|
@@ -1,2 +1,76 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
1
|
+
# Shebang-less for the reason ./pnpm gives: install.js puts the native binary
|
|
2
|
+
# at this path too.
|
|
3
|
+
#
|
|
4
|
+
# `pnx` is `pnpm dlx`. The pnpm it hands over to is the one installed alongside
|
|
5
|
+
# it, found relative to this file: a `PATH` lookup would run whatever other pnpm
|
|
6
|
+
# comes first there, and would find nothing at all when the directory holding
|
|
7
|
+
# these bins is not on `PATH`.
|
|
8
|
+
#
|
|
9
|
+
# $0 is whatever shim or symlink `pnx` was launched through, so walk to the file
|
|
10
|
+
# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
|
|
11
|
+
# hang the script. Directories come from `${self%/*}` and `readlink` runs through
|
|
12
|
+
# `command -p`, so the caller's `PATH` decides nothing here.
|
|
13
|
+
#
|
|
14
|
+
# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
|
|
15
|
+
# instead, with node_modules and relative entries dropped from it.
|
|
16
|
+
caller_path_set=${PATH+set}
|
|
17
|
+
caller_path=${PATH-}
|
|
18
|
+
helper_path=
|
|
19
|
+
rest=$caller_path:
|
|
20
|
+
while [ -n "$rest" ]; do
|
|
21
|
+
dir=${rest%%:*}
|
|
22
|
+
rest=${rest#*:}
|
|
23
|
+
case "$dir" in
|
|
24
|
+
*/node_modules/*|*/node_modules) ;;
|
|
25
|
+
/*) helper_path=${helper_path:+$helper_path:}$dir ;;
|
|
26
|
+
esac
|
|
27
|
+
done
|
|
28
|
+
# An empty PATH searches the current directory.
|
|
29
|
+
PATH=${helper_path:-/}
|
|
30
|
+
# A helper comes from PATH only when the default path lacks it and PATH has it.
|
|
31
|
+
# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
|
|
32
|
+
run_helper() {
|
|
33
|
+
if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
|
|
34
|
+
}
|
|
35
|
+
self=$0
|
|
36
|
+
# MSYS and Cygwin can launch this with a native Windows path, which has no slash
|
|
37
|
+
# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
|
|
38
|
+
# backslash anywhere else is an ordinary character in a Unix file name, so the
|
|
39
|
+
# path is left alone. The separators are swapped in the shell rather than through
|
|
40
|
+
# `echo`, which mangles a `\t` or `\b` in a path under dash.
|
|
41
|
+
case $self in
|
|
42
|
+
[A-Za-z]:\\*|\\\\*)
|
|
43
|
+
while :; do
|
|
44
|
+
case $self in
|
|
45
|
+
*\\*) self=${self%%\\*}/${self#*\\} ;;
|
|
46
|
+
*) break ;;
|
|
47
|
+
esac
|
|
48
|
+
done
|
|
49
|
+
;;
|
|
50
|
+
esac
|
|
51
|
+
# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
|
|
52
|
+
# stands for a file in the current directory.
|
|
53
|
+
case $self in
|
|
54
|
+
*/*) ;;
|
|
55
|
+
*) self=./$self ;;
|
|
56
|
+
esac
|
|
57
|
+
hops=0
|
|
58
|
+
while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
|
|
59
|
+
hops=$((hops + 1))
|
|
60
|
+
link=$(run_helper readlink "$self")
|
|
61
|
+
case $link in
|
|
62
|
+
/*) self=$link ;;
|
|
63
|
+
*) self=${self%/*}/$link ;;
|
|
64
|
+
esac
|
|
65
|
+
done
|
|
66
|
+
if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
|
|
67
|
+
# The walk has to end at a regular file. Running out of hops leaves $self a
|
|
68
|
+
# symlink; a chain that changed under us can leave it dangling or a directory, and
|
|
69
|
+
# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
|
|
70
|
+
# wrong directory — the substitution this script exists to prevent.
|
|
71
|
+
if [ -L "$self" ] || [ ! -f "$self" ]; then
|
|
72
|
+
echo "pnx: could not resolve $0 to a regular file within 40 symlink hops." >&2
|
|
73
|
+
exit 1
|
|
74
|
+
fi
|
|
75
|
+
|
|
76
|
+
exec "${self%/*}/pnpm" dlx "$@"
|