"@pnpm/lockfile.preferred-versions": patch

"@pnpm/installing.deps-resolver": patch

"pnpm": patch

Fixed a prototype-pollution hazard when seeding preferred versions: a dependency named `__proto__` in a manifest or in `pnpm-lock.yaml` could write through `Object.prototype` (or crash the install) while the preferred-versions map was being built. The maps are now null-prototype objects, so crafted package names land as plain keys.

"@pnpm/resolving.npm-resolver": patch

"@pnpm/resolving.resolver-base": patch

"@pnpm/store.controller-types": patch

"@pnpm/installing.deps-resolver": patch

"pnpm": patch

Fixed `pnpm up <pkg>` producing a different result than a fresh install of the same manifests would. The resolver now distinguishes `updateRequested` (true only for packages that match the user's update target) from the broader `update` flag, and for the targeted package ignores only its own lockfile-derived preferred-version pins — so the target re-resolves exactly as if its lockfile entries were deleted and `pnpm install` ran. Preferred versions a fresh install applies (manifest pins, versions propagated down the dependency chain, and the vulnerability-avoidance penalties of `pnpm audit --fix`) stay in effect, so an update never installs duplicate versions that a reinstall from scratch would not reproduce. When a preferred version holds the update target below the newest version its range admits, pnpm now prints a warning explaining that reaching the newer version everywhere requires an override.

"@pnpm/installing.commands": patch

"pnpm": patch

`pnpm update <dep>@<version>` now prints a warning when `<dep>` is only present as a transitive dependency: the requested version cannot be applied there (updates resolve the target the way a fresh install would), and the warning recommends adding the version to `pnpm.overrides` instead, which is the mechanism that does pin transitive dependencies. Closes pnpm/pnpm#12744.

__typecheck__/

/pnpm/

fn update_transitive_ignores_requested_version() {

let (root, workspace, anchor) = setup();

// Pin the transitive dep-of-pkg-with-1-dep at 100.0.0 (via a direct

// exact entry), then drop it to a pure transitive of pkg-with-1-dep.

write_manifest(&workspace, &format!(r#"{{ "{PARENT}": "100.0.0", "{DEP}": "100.0.0" }}"#));

pacquet(&workspace, ["install"]).assert().success();

eprintln!("virtual store contents: {:?}", list_virtual_store(&workspace));

assert!(virtual_store_has(&workspace, "@[email protected]"));

write_manifest(&workspace, &format!(r#"{{ "{PARENT}": "100.0.0" }}"#));

// The update requests 100.0.0, but the version part of a

// transitive-only selector is ignored: the target re-resolves to the

// highest version in pkg-with-1-dep's ^100.0.0 range (100.1.0),

// exactly as a fresh install with the target's lockfile entries

// deleted would.

pacquet(&workspace, ["update", &format!("{DEP}@100.0.0")]).assert().success();

eprintln!("virtual store contents: {:?}", list_virtual_store(&workspace));

// Only presence is asserted: the update does not prune the previous

// version's now-orphaned virtual-store directory.

assert!(

virtual_store_has(&workspace, "@[email protected]"),

"the target should re-resolve to highest-in-range, like a fresh install",

);

let lock = fs::read_to_string(workspace.join("pnpm-lock.yaml")).expect("read pnpm-lock.yaml");

assert!(

!lock.contains("[email protected]"),

"the ignored requested version must not pin the target in the lockfile",

);

drop((root, anchor));

// With no manifest entry to write the version into, and

// update results always matching what a fresh install

// would resolve, the selector's version part cannot take

// effect — say so and point at the mechanism that does

// pin transitive dependencies. The recommended override

// is scoped to the dependents' declared range so it

// cannot violate any consumer's range; the range itself

// is not known at this layer (it lives in the

// dependents' manifests), hence the placeholder.

for sel in &selectors {

let Some(version) = sel.version.as_deref() else { continue };

tracing::warn!(

target: "pacquet_package_manager::update",

pattern = sel.pattern,

version,

r#""{}" is not a direct dependency, so the requested version "{version}" is ignored — "{}" is updated to what a fresh install would resolve. To force a version of a transitive dependency, add an override scoped to the range its dependents declare to pnpm-workspace.yaml, e.g.: overrides: {{ "{}@<declared range>": "{version}" }}"#,

sel.pattern,

sel.pattern,

sel.pattern,

);

}

if let Some(real_name) = real_package_name_of(wanted)

&& !names.iter().any(|name| name == real_name.as_ref())

names.push(real_name.into_owned());

// Combine two per-package opts adjustments into one clone. The

// `update_requested` flag is scoped per wanted-dependency — true only

// when the package's real name (parsed from `bare_specifier` for

// npm-aliases, folded from the jsr specifier for jsr deps) is in the

// update target list — so the picker's held-back-update warning fires

// only for the packages the user actually asked to update.

let needs_overlay = !cache_key.8.is_empty();

let update_target = is_update_target(&ctx.workspace.update_reuse_scope, wanted);

let needs_update = update_target != opts.update_requested;

let owned_opts;

let opts = if needs_overlay || needs_update {

if needs_overlay {

owned.preferred_versions_overlay = pick_overlay.map(Arc::clone);

}

if needs_update {

owned.update_requested = update_target;

}

owned_opts = owned;

&owned_opts

} else {

opts

fn update_excludes(scope: &UpdateReuseScope, name: &str) -> bool {

UpdateReuseScope::Except(names) => names.contains(name),

}

fn real_package_name_of(wanted: &WantedDependency) -> Option<Cow<'_, str>> {

let bare = wanted.bare_specifier.as_deref()?;

if let Some(rest) = bare.strip_prefix("npm:") {

// `npm:<range>` form: the body is a semver range, not a name,

// so the install alias IS the real package name.

let alias_keeps_name = wanted

.alias

.as_deref()

.is_some_and(|alias| !alias.is_empty() && rest.parse::<node_semver::Range>().is_ok());

if !alias_keeps_name {

// `npm:<name>@<range>` or `npm:<name>`: parse the real name

// out of `bare_specifier` because `wanted.alias` keeps the

// local install name. Split at the last `@` to separate the

// real name from the version range. When there is no `@`,

// the whole `rest` is the name (default-tag form `npm:bar`).

let last_at =

rest.bytes().enumerate().rev().find_map(|(i, b)| (b == b'@').then_some(i));

let name = match last_at {

Some(idx) if idx >= 1 => &rest[..idx],

_ => rest,

};

return (!name.is_empty()).then_some(Cow::Borrowed(name));

}

}

if bare.starts_with("jsr:") {

// An unparsable `jsr:` specifier carries no recoverable real

// name — return `None` rather than falling back to the install

// alias, which could accidentally match an update target and

// mark the broken dep as a targeted update.

let spec = pacquet_resolving_jsr_specifier_parser::parse_jsr_specifier(

bare,

wanted.alias.as_deref(),

)

.ok()

.flatten()?;

return Some(Cow::Owned(spec.npm_pkg_name));

}

// Plain dep, workspace dep, or `npm:<range>` form: the install

// alias is the real name.

wanted.alias.as_deref().map(Cow::Borrowed)

fn is_update_target(scope: &UpdateReuseScope, wanted: &WantedDependency) -> bool {

match scope {

UpdateReuseScope::All | UpdateReuseScope::None => false,

UpdateReuseScope::Except(_) => {

real_package_name_of(wanted).is_some_and(|n| update_excludes(scope, n.as_ref()))

}

let name = key.name.to_string();

let reusable = !update_excludes(&ctx.workspace.update_reuse_scope, &name)

&& synthesize_reused_result(lockfile, key, &name).is_some()