# @pnpm/pick-fetcher

## 1100.1.3

### Patch Changes

- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).

- Updated dependencies:
  - @pnpm/error@1100.1.0
  - @pnpm/fetching.fetcher-base@1100.2.4
  - @pnpm/hooks.types@1100.2.3
  - @pnpm/resolving.resolver-base@1100.5.4
  - @pnpm/store.cafs-types@1100.0.2

## 1100.1.2

### Patch Changes

- Updated dependencies:
  - @pnpm/fetching.fetcher-base@1100.2.3
  - @pnpm/hooks.types@1100.2.2
  - @pnpm/resolving.resolver-base@1100.5.3

## 1100.1.1

### Patch Changes

- Updated dependencies:
  - @pnpm/fetching.fetcher-base@1100.2.2
  - @pnpm/hooks.types@1100.2.1
  - @pnpm/resolving.resolver-base@1100.5.2

## 1100.1.0

### Minor Changes

- a897ef7: Custom fetchers exported from a pnpmfile can now delegate by returning a `{ delegate: <resolution> }` envelope: pnpm rewrites the package's resolution to the delegated shape and runs the built-in fetcher on it. This is the portable delegation form that also works in pacquet, where `cafs` and `fetchers` cannot be passed to the hook. Related to [pnpm/pnpm#11685](https://github.com/pnpm/pnpm/issues/11685).

### Patch Changes

- Updated dependencies [a897ef7]
  - @pnpm/hooks.types@1100.2.0

## 1100.0.14

### Patch Changes

- Updated dependencies [dcabb78]
  - @pnpm/resolving.resolver-base@1100.5.1
  - @pnpm/fetching.fetcher-base@1100.2.1
  - @pnpm/hooks.types@1100.1.1

## 1100.0.13

### Patch Changes

- bae694f: Some registries generate tarballs on-demand and cannot provide an integrity checksum in their package metadata. In that case pnpm now computes the integrity from the downloaded tarball and stores it in the lockfile, so the entry is verifiable on subsequent installs instead of being written without an integrity (which would fail the next install). This also applies to `--lockfile-only`: the tarball is downloaded so its integrity can be computed. A lockfile entry that is still missing its integrity is rejected as a `ERR_PNPM_MISSING_TARBALL_INTEGRITY` lockfile verification violation (the install fails closed) rather than being silently re-fetched.
- Updated dependencies [bae694f]
- Updated dependencies [852d537]
  - @pnpm/resolving.resolver-base@1100.5.0
  - @pnpm/fetching.fetcher-base@1100.2.0
  - @pnpm/hooks.types@1100.1.0
  - @pnpm/error@1100.0.1

## 1100.0.12

### Patch Changes

- @pnpm/fetching.fetcher-base@1100.1.9
- @pnpm/hooks.types@1100.0.12
- @pnpm/resolving.resolver-base@1100.4.2
- @pnpm/store.cafs-types@1100.0.1

## 1100.0.11

### Patch Changes

- @pnpm/fetching.fetcher-base@1100.1.8
- @pnpm/hooks.types@1100.0.11
- @pnpm/resolving.resolver-base@1100.4.1
- @pnpm/store.cafs-types@1100.0.1

## 1100.0.10

### Patch Changes

- Updated dependencies [6d17b66]
  - @pnpm/resolving.resolver-base@1100.4.0
  - @pnpm/fetching.fetcher-base@1100.1.7
  - @pnpm/hooks.types@1100.0.10
  - @pnpm/store.cafs-types@1100.0.1

## 1100.0.9

### Patch Changes

- @pnpm/fetching.fetcher-base@1100.1.6
- @pnpm/hooks.types@1100.0.9
- @pnpm/resolving.resolver-base@1100.3.1
- @pnpm/store.cafs-types@1100.0.1

## 1100.0.8

### Patch Changes

- Updated dependencies [1627943]
  - @pnpm/resolving.resolver-base@1100.3.0
  - @pnpm/fetching.fetcher-base@1100.1.5
  - @pnpm/hooks.types@1100.0.8
  - @pnpm/store.cafs-types@1100.0.1

## 1100.0.7

### Patch Changes

- Updated dependencies [4195766]
- Updated dependencies [31538bf]
  - @pnpm/resolving.resolver-base@1100.2.0
  - @pnpm/fetching.fetcher-base@1100.1.4
  - @pnpm/hooks.types@1100.0.7

## 1100.0.6

### Patch Changes

- @pnpm/fetching.fetcher-base@1100.1.3
- @pnpm/hooks.types@1100.0.6
- @pnpm/resolving.resolver-base@1100.1.3
- @pnpm/store.cafs-types@1100.0.1

## 1100.0.5

### Patch Changes

- 27425d7: Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.

  A new `gitHosted: true` field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.

- Updated dependencies [27425d7]
  - @pnpm/resolving.resolver-base@1100.1.2
  - @pnpm/hooks.types@1100.0.5
  - @pnpm/fetching.fetcher-base@1100.1.2

## 1100.0.4

### Patch Changes

- 184ce26: Fix the package name in README.md.
- Updated dependencies [184ce26]
  - @pnpm/resolving.resolver-base@1100.1.1
  - @pnpm/fetching.fetcher-base@1100.1.1
  - @pnpm/store.cafs-types@1100.0.1
  - @pnpm/hooks.types@1100.0.4

## 1100.0.3

### Patch Changes

- Updated dependencies [421317c]
  - @pnpm/fetching.fetcher-base@1100.1.0
  - @pnpm/hooks.types@1100.0.3

## 1100.0.2

### Patch Changes

- Updated dependencies [72c1e05]
  - @pnpm/resolving.resolver-base@1100.1.0
  - @pnpm/fetching.fetcher-base@1100.0.2
  - @pnpm/hooks.types@1100.0.2

## 1100.0.1

### Patch Changes

- @pnpm/fetching.fetcher-base@1100.0.1
- @pnpm/hooks.types@1100.0.1
- @pnpm/resolving.resolver-base@1100.0.1
- @pnpm/store.cafs-types@1100.0.0

## 1002.0.0

### Major Changes

- 491a84f: This package is now pure ESM.
- 7d2fd48: Node.js v18, 19, 20, and 21 support discontinued.
- 38b8e35: Support for custom resolvers and fetchers.

### Patch Changes

- Updated dependencies [facdd71]
- Updated dependencies [e2e0a32]
- Updated dependencies [9b0a460]
- Updated dependencies [3bf5e21]
- Updated dependencies [491a84f]
- Updated dependencies [ba065f6]
- Updated dependencies [3bf5e21]
- Updated dependencies [7d2fd48]
- Updated dependencies [50fbeca]
- Updated dependencies [10bc391]
- Updated dependencies [38b8e35]
- Updated dependencies [831f574]
- Updated dependencies [9d3f00b]
- Updated dependencies [98a0410]
  - @pnpm/resolving.resolver-base@1006.0.0
  - @pnpm/store.cafs-types@1001.0.0
  - @pnpm/fetching.fetcher-base@1002.0.0
  - @pnpm/error@1001.0.0
  - @pnpm/hooks.types@1002.0.0

## 1001.0.0

### Major Changes

- d1edf73: Rename Resolution to AtomicResolution. Add support for binary resolution.

## 1000.1.0

### Minor Changes

- 1a07b8f: Added support for resolving and downloading the Node.js runtime specified in the [devEngines](https://github.com/openjs-foundation/package-metadata-interoperability-collab-space/issues/15) field of `package.json`.

  Usage example:

  ```json
  {
    "devEngines": {
      "runtime": {
        "name": "node",
        "version": "^24.4.0",
        "onFail": "download"
      }
    }
  }
  ```

  When running `pnpm install`, pnpm will resolve Node.js to the latest version that satisfies the specified range and install it as a dependency of the project. As a result, when running scripts, the locally installed Node.js version will be used.

  Unlike the existing options, `useNodeVersion` and `executionEnv.nodeVersion`, this new field supports version ranges, which are locked to exact versions during installation. The resolved version is stored in the pnpm lockfile, along with an integrity checksum for future validation of the Node.js content's validity.

  Related PR: [#9755](https://github.com/pnpm/pnpm/pull/9755).

## 1000.0.1

### Patch Changes

- 6acf819: Remove the blanket variant from the `Resolution` type, making it stricter and more useful.

## 3.0.0

### Major Changes

- 43cdd87: Node.js v16 support dropped. Use at least Node.js v18.12.

## 2.0.1

### Patch Changes

- f394cfccd: Don't update git-hosted dependencies when adding an unrelated dependency [#7008](https://github.com/pnpm/pnpm/issues/7008).

## 2.0.0

### Major Changes

- eceaa8b8b: Node.js 14 support dropped.

## 1.0.0

### Major Changes

- 7a17f99ab: Refactor `tarball-fetcher` and separate it into more specific fetchers, such as `localTarball`, `remoteTarball` and `gitHostedTarball`.

### Minor Changes

- 23984abd1: Add hook for adding custom fetchers.