[rush] Relocate pnpm settings to pnpm-workspace.yaml for pnpm 11#5838
Open
brunojppb wants to merge 3 commits into
Open
[rush] Relocate pnpm settings to pnpm-workspace.yaml for pnpm 11#5838brunojppb wants to merge 3 commits into
brunojppb wants to merge 3 commits into
Conversation
pnpm 11 no longer reads the "pnpm" field of package.json, so the settings Rush serialized there were silently ignored. Relocate globalOverrides, globalPackageExtensions, globalPeerDependencyRules, globalAllowedDeprecatedVersions, and globalPatchedDependencies to the generated common/temp/pnpm-workspace.yaml for pnpm >= 11.0.0, mirroring the allowBuilds relocation from microsoft#5817. Behavior for older pnpm is unchanged. Fixes microsoft#5837
Author
|
@microsoft-github-policy-service agree |
Two fixes from adversarial review of the pnpm 11 settings relocation:
1. rush-pnpm patch-commit / patch-remove read patchedDependencies from
common/temp/package.json, which pnpm 11 no longer populates. They now read
patchedDependencies from common/temp/pnpm-workspace.yaml for pnpm >= 11
(mirroring the approve-builds allowBuilds path), preserving the package.json
path for pnpm < 11 and the existing subspace + patches-folder logic.
2. Added integration coverage:
- InstallHelpers.generateCommonPackageJson omits the relocated settings from
package.json for pnpm 11 and still writes them for pnpm < 11.
- RushPnpmCommandLineParser reads patchedDependencies from pnpm-workspace.yaml
for pnpm 11 and from package.json for pnpm < 11.
Refs microsoft#5837
brunojppb
requested review from
apostolisms,
bmiddha,
dmichon-msft,
iclanton,
jxanthony and
octogonz
as code owners
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pnpm 11 stopped reading configuration from the
pnpmfield ofpackage.json. Those settings must now live inpnpm-workspace.yaml(see the pnpm 11 release notes and settings docs).Rush still serialized most of its
pnpm-config.jsonsettings into thepnpmfield of the generatedcommon/temp/package.json. After bumpingpnpmVersionto 11.x, those settings were silently dropped: pnpm prints a warning, but the install still reports success. The most consequential of them,globalOverridesandglobalPatchedDependencies, are commonly used to pin CVE remediations on transitive dependencies, so arush updatethat re-resolves can quietly revert them to vulnerable versions.#5817 already relocated
allowBuildstopnpm-workspace.yamlfor pnpm 11. This PR applies the same mechanism to the remaining affected settings.Changes
For pnpm >= 11.0.0, the following are now written to the generated
common/temp/pnpm-workspace.yamlinstead of thepackage.jsonpnpmfield:pnpm-config.jsonkeypnpm-workspace.yamlkeyglobalOverridesoverridesglobalPackageExtensionspackageExtensionsglobalPeerDependencyRulespeerDependencyRulesglobalAllowedDeprecatedVersionsallowedDeprecatedVersionsglobalPatchedDependenciespatchedDependenciesPnpmWorkspaceFile: added fields, setters, and serialization for the five settings.WorkspaceInstallManager: populates them on the workspace file whenpnpmVersion >= 11.0.0.InstallHelpers: skips writing the correspondingpackage.jsonpnpmentries whenpnpmVersion >= 11.0.0.Behavior for pnpm 10 and earlier is unchanged.
Out of scope
minimumReleaseAge(tracked in #5752 / #5798),trustPolicy*, andignoredOptionalDependenciesare also written to thepnpmfield but are left for follow-up PRs to keep this change focused.Could potentially include that here too if you folks want.