fix: time-based resolution loses publishedAt on fast path by pgoldberg · Pull Request #11618 · pnpm/pnpm

pgoldberg · 2026-05-13T15:00:47Z

Fixes #11616

Summary by CodeRabbit

Bug Fixes
- Fixed installs failing when using time-based dependency resolution with minimumReleaseAge when lockfile time entries were incomplete or missing. The resolver now properly preserves publish timestamp metadata from the lockfile and gracefully falls back to fetching registry metadata when required data is unavailable.

welcome · 2026-05-13T15:00:52Z

💖 Thanks for opening this pull request! 💖
Please be patient and we will get back to you as soon as we can.

coderabbitai · 2026-05-13T15:01:13Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2588806e-00f8-4bd3-bda5-4c979c2d2850

📥 Commits

Reviewing files that changed from the base of the PR and between 94240bc and 8ca45a1.

📒 Files selected for processing (7)

.changeset/preserve-published-at-in-fast-path.md
installing/deps-installer/test/install/minimumReleaseAge.ts
installing/deps-resolver/src/resolveDependencies.ts
installing/package-requester/src/packageRequester.ts
resolving/npm-resolver/src/index.ts
resolving/resolver-base/src/index.ts
store/controller-types/src/index.ts

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (1)

**/*.{js,ts,tsx,jsx}

📄 CodeRabbit inference engine (AGENTS.md)

**/*.{js,ts,tsx,jsx}: Use trailing commas in code following Standard Style with modifications
Prefer functions over classes
Declare functions after they are used, relying on hoisting
Functions should have no more than two or three arguments; use a single options object for functions needing more parameters
Organize imports in order: standard libraries, external dependencies (sorted alphabetically), then relative imports

Files:

resolving/resolver-base/src/index.ts
store/controller-types/src/index.ts
installing/package-requester/src/packageRequester.ts
installing/deps-installer/test/install/minimumReleaseAge.ts
installing/deps-resolver/src/resolveDependencies.ts
resolving/npm-resolver/src/index.ts

🔇 Additional comments (7)

store/controller-types/src/index.ts (1)

104-104: LGTM!

resolving/resolver-base/src/index.ts (1)

216-216: LGTM!

.changeset/preserve-published-at-in-fast-path.md (1)

1-10: LGTM!

installing/deps-resolver/src/resolveDependencies.ts (1)

1335-1335: LGTM!

installing/package-requester/src/packageRequester.ts (1)

184-184: LGTM!

installing/deps-installer/test/install/minimumReleaseAge.ts (1)

3-3: LGTM!

Also applies to: 92-114

resolving/npm-resolver/src/index.ts (1)

322-323: LGTM!

Also applies to: 357-365, 385-385

📝 Walkthrough

Walkthrough

This PR extends the resolution pipeline to propagate publishedAt metadata from the lockfile's time block, enabling time-based minimumReleaseAge resolution to succeed when time entries exist, and fall back to registry metadata when they do not.

Changes

Publish time propagation for time-based resolution

Layer / File(s)	Summary
Type contracts for publishedAt field `store/controller-types/src/index.ts`, `resolving/resolver-base/src/index.ts`	Export types `RequestPackageOptions` and `ResolveOptions.currentPkg` extend to include optional `publishedAt?: string` field.
Resolution pipeline publishedAt propagation `installing/deps-resolver/src/resolveDependencies.ts`, `installing/package-requester/src/packageRequester.ts`, `resolving/npm-resolver/src/index.ts`	Deps-resolver reads `publishedAt` from lockfile `time` block and passes to store controller; package-requester carries it through resolve; npm-resolver fast path checks whether `publishedAt` is known before optimization and returns it in results.
Test and changelog for lockfile time repopulation `.changeset/preserve-published-at-in-fast-path.md`, `installing/deps-installer/test/install/minimumReleaseAge.ts`	Changelog documents that time-based `minimumReleaseAge` no longer fails when lockfile `time` entries are missing; regression test verifies `time` block is restored on re-install.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related issues

Missing lockfile time entry causes incorrect minimumReleaseAge failure when using time-based resolution #11616: This PR directly addresses the bug where missing lockfile time entries cause incorrect minimumReleaseAge failures. The fix propagates publishedAt from the lockfile so time-based resolution can access publish times via the fast path, with fallback to registry metadata when time data is unavailable.

Suggested reviewers

zkochan

Poem

🐰 Time flows through the lockfile's gentle stream,
No more lost entries in the resolver's dream!
PublishedAt now glides from store to fast-path bright,
And when the times run missing, the registry's insight
Makes whole what was broken—a hop toward the light! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the primary fix: restoring publishedAt preservation in the npm-resolver fast path for time-based resolution, which directly addresses the linked issue.
Linked Issues check	✅ Passed	The PR successfully addresses the root causes identified in `#11616`: it ensures publishedAt is sourced from the lockfile's time block and implements fallback logic when entries are missing.
Out of Scope Changes check	✅ Passed	All changes are focused on the fix: propagating publishedAt through the resolution chain, updating type definitions, and adding a regression test. No unrelated modifications detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

Generate code and open pull requests
Plan features and break down work
Investigate incidents and troubleshoot customer tickets together
Automate recurring tasks and respond to alerts with triggers
Summarize progress and report instantly

Built for teams:

Shared memory across your entire org—no repeating context
Per-thread sandboxes to safely plan and execute work
Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

mandarini · 2026-05-14T07:46:44Z

Cross-linking #11622 which fixes a related minimumReleaseAge + cached-abbreviated-metadata class of bug in pickPackage. Different code path from this one (cached fast paths in pickPackage vs the resolveNpm peek-from-store fast path here), no file overlap, both fixes are valuable independently.

welcome · 2026-05-14T09:20:55Z

Congrats on merging your first pull request! 🎉🎉🎉

fix: time-based resolution loses publishedAt on fast path

8ca45a1

pgoldberg requested a review from zkochan as a code owner May 13, 2026 15:00

coderabbitai Bot approved these changes May 13, 2026

View reviewed changes

mandarini mentioned this pull request May 13, 2026

fix(npm-resolver): minimumReleaseAge handling for cached abbreviated metadata #11622

Merged

zkochan approved these changes May 14, 2026

View reviewed changes

zkochan enabled auto-merge (squash) May 14, 2026 08:55

zkochan merged commit c2c2890 into pnpm:main May 14, 2026
10 checks passed

This was referenced May 16, 2026

fix: enforce minimumReleaseAge on existing lockfile entries #11583

Merged

feat: tighten minimumReleaseAge — auto-exclude, lockfile verification, and interactive prompt #11705

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: time-based resolution loses publishedAt on fast path#11618

fix: time-based resolution loses publishedAt on fast path#11618
zkochan merged 1 commit into
pnpm:mainfrom
pgoldberg:fix-time-based-bug

pgoldberg commented May 13, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

welcome Bot commented May 13, 2026

Uh oh!

coderabbitai Bot commented May 13, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

mandarini commented May 14, 2026

Uh oh!

Uh oh!

welcome Bot commented May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

pgoldberg commented May 13, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

welcome Bot commented May 13, 2026

Uh oh!

coderabbitai Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

mandarini commented May 14, 2026

Uh oh!

Uh oh!

welcome Bot commented May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

pgoldberg commented May 13, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 13, 2026 •

edited

Loading