moonrepo/proto v0.61.0

0.61.0

on GitHub

Release Notes

💥 Breaking

• Lockfiles
  • Added support for environment scoped lockfiles. When PROTO_ENV is set, a .prototools.<env> config is now locked to a sibling .protolock.<env> lockfile, instead of sharing the directory's .protolock with the base .prototools config.
    • Each lockfile only tracks tools with versions defined in its own config. A version overridden by an environment config is tracked in .protolock.<env>, while versions inherited from .prototools remain in .protolock. Ad-hoc installs are tracked by the base .prototools config.
    • Environment configs inherit the settings.lockfile setting from the .prototools config in the same directory, but can override it. Lockfiles for inactive environments are never loaded or modified.
    • Records for environment specific versions that were previously written to .protolock are no longer used, and will be re-created in .protolock.<env> on the next install.

🚀 Updates

• Added unstable Swift support: proto install swift.
• Increased the plugin cache duration from 30 days to 180 days (6 months) because of GitHub's unreliability.
• Checksums
  • Added support for verifying prebuilt downloads with GPG detached signatures (.sig and .asc) provided through checksum_url, using the plugin-provided checksum_public_key.
    • Public keyrings may contain multiple certificates in a single armored block or multiple concatenated armored blocks.
    • Signature files may contain multiple binary signatures, multiple signatures in one armored block, or multiple concatenated armored blocks. Verification succeeds when any signature matches a trusted key.
    • GPG verification streams the artifact from disk in a blocking worker and records only the verified signer fingerprint and artifact SHA256 in lockfiles, instead of the armored public keyring.
• Lockfiles
  • Added an --immutable-lockfile flag to proto install (and a PROTO_IMMUTABLE_LOCKFILE environment variable) that treats the lockfile as read-only. Versions are resolved from existing lockfile records, and the lockfile is never created, updated, or pruned.
    • If a tool being installed has no matching record, the install fails instead of resolving a fresh version, which is useful for reproducible installs in CI.
    • This flag cannot be combined with --update-lockfile or --pin.
  • Updated proto pin and proto unpin to always keep the lockfile of the modified config in sync, even when another config (like an environment config) takes precedence for the tool.
  • Updated proto install --pin to track the record of the installed version in the lockfile of the pinned config, even when another config (like an environment config) takes precedence for the tool.
  • Updated proto uninstall to remove records for the uninstalled version from all applicable lockfiles, as the version may be pinned in multiple configs (each of which is unpinned). When uninstalling all versions, the tool is removed from all applicable lockfiles.
  • Updated proto outdated --update to also update versions defined in environment scoped configs (.prototools.<env>), including the records in their lockfiles. Previously these versions were skipped with a warning.
  • Updated proto install and proto uninstall to prune orphaned records from lockfiles. A record is orphaned when its tool has a version defined in the config that owns the lockfile, but the record's spec no longer matches any of that config's specs, which typically happens when a config is modified outside of proto. Records for tools that the owning config does not define are ad-hoc installs, and are never pruned.
    • This is the same staleness that proto diagnose reports, so records it warns about are now removed by the next install or uninstall.
    • Only lockfiles that have been loaded are pruned, so lockfiles for inactive environments continue to be left untouched.
    • Pruning runs after the install or uninstall, against configs as they stand at that point. Installing an explicit version of a tool that is configured with a different version no longer leaves a record behind, unless the version is pinned with --pin.
• WASM API
  • Added a download_file host function, which downloads a file from a URL directly to a file on the host machine, without loading the contents into WASM memory. Requests are made with proto's HTTP client, respecting [settings.http] and .netrc configuration.
    • Added download and download_from_url functions, and a download_file! macro, to the PDK.
  • Added a method field to the send_request host function input (SendRequestInput), which supports GET (default) and POST.
  • Added a SendRequestInput::post() constructor for creating POST requests.
  • Added a ToolLockOptions.metadata field, which allows plugins to include additional metadata in lockfile records for the installed tool.

🛠️ Tools

• Ruby
  • Fixed build from source returning a prebuilt archive.

🐞 Fixes

• Fixed an issue where the internal fallback loop guard (PROTO_INTERNAL_RUN_FALLBACK) would leak into child processes and abort unrelated, nested invocations of the same tool (like npm scripts that spawn node) with a false fallback_loop error. The guard is now scoped to the process that performed the fallback, so only a genuine same-process re-entry is treated as a loop.
  • Proto now also skips any directory on PATH that contains a shims registry.json, so a foreign proto store (from a mismatched PROTO_HOME) is never selected as the global fallback and can't trigger a loop.
  • Reworded the fallback_loop error to describe the actual cause instead of incorrectly claiming the resolved binary is a proto shim.
• Fixed an issue where proto uninstall would fail when PROTO_ENV is set and an environment scoped .prototools.<env> config exists, as it would attempt to unpin the version from an invalid path.
• Fixed proto install <tool> not respecting the detect-strategy setting. It resolved a version by scanning the working directory for the tool's own version file before consulting .prototools, unlike proto run, proto status and a bare proto install, which all honour the setting. A repo pinning go = "1.26.7" with detect-strategy = "prefer-prototools" beside a go.work would install whatever the go directive's range resolved to, and proto run go would then fail with missing_tool. As a consequence, install now also detects ecosystem files by traversing the config file chain rather than only the working directory, and honours PROTO_<TOOL>_VERSION.
• Fixed virtual path conversion producing a path with a trailing separator when the path being converted is a virtual/real prefix itself (Path::join("") appends a separator). This surfaced in moon as $env.PWD contains trailing slashes errors from nushell when plugin commands ran at the workspace root.
• Fixed concurrent commands that write to a .prototools file erasing each other's changes. The config was read under a shared lock, the lock released, then an exclusive lock acquired to write, so 2 processes could both read the same content and the last writer would erase the entries added by the first. Running proto install <tool> --pin in parallel (or pin, unpin, alias, unalias, uninstall, plugin add, plugin remove) would silently drop tools from the config, surfacing much later as proto run failing to detect a version for a tool that had just installed successfully.
• Fixed an issue where an install that failed very early (before any progress output) could hang when not running in a TTY, as the non-TTY progress monitor could miss the exit signal.
• Fixed an issue where versions with a pre-release or build identifier that begins with a hyphen (like 1.0.6--canary.9.0c3f3b7.0) would fail to parse, even though they are valid semver. Such versions can appear in yarn.lock files transitively through published npm packages.

⚙️ Internal

• Updated Rust to v1.98.0.
• Updated dependencies.

Install proto_cli 0.61.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/moonrepo/proto/releases/download/v0.61.0/proto_cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/moonrepo/proto/releases/download/v0.61.0/proto_cli-installer.ps1 | iex"

Download proto_cli 0.61.0