#10287)

* fix(tarball-resolver): add integrity hash to HTTP tarball dependencies

* Refactor to download tarball just once

* Fix tests

* fix: only calc hash when it is not passed in to the fetcher

* docs: update changesets

… unless allowed (#10288)

* fix(git-fetcher): block git dependencies from running prepare scripts unless allowed

* Update exec/prepare-package/src/index.ts

Co-authored-by: Zoltan Kochan <[email protected]>

* Also implement in gitHostedTarballFetcher

* refactor: move allowBuild function creation to the store manager

* refactor: pass allowBuild function to fetch function directly

* refactor: revert not needed changes and update changesets

* test: fix

* fix: implemented CR suggestions

* test: fix

* test: fix

---------

Co-authored-by: Zoltan Kochan <[email protected]>

…ources in subdeps (#10265)

* feat(core): add onlyRegistryDependencies option to disallow non-registry subdependencies

* fix: onlyRegistryDependencies=>registrySubdepsOnly

* fix: allow resolution from custom resolver

* fix: add registry-subdeps-only to types

* docs: update changesets

* refactor: registry-only

* refactor: registrySubdepsOnly=>blockExoticSubdeps

* fix: trust runtime deps

* refactor: remove comment

---------

Co-authored-by: Zoltan Kochan <[email protected]>

)

* fix: normalize tarball URLs by removing default HTTP/HTTPS ports

closes #6725

* feat: refactor, add test and changeset

---------

Co-authored-by: Zoltan Kochan <[email protected]>

close #9802

---------

Co-authored-by: Zoltan Kochan <[email protected]>

close #10301

…es (#10294)

* fix(deploy): omit inject workspace packages setting in deploy lockfiles

When the deploy command creates a new lockfile, create the deployment
lockfile without the setting to inject workspace packages, because it
has already been applied when creating the lockfile and the deployment
is not, itself, a workspace.

* docs: add changesets

---------

Co-authored-by: Zoltan Kochan <[email protected]>

close #8658

ref #10235