From 67ae9a8817298daf335bbc2443a36368c756bccf Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Sun, 9 Aug 2026 12:21:31 -0700 Subject: [PATCH] chore(pnpm): pin pnpm@10.34.5 and move pnpm.* settings to workspace/policy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pnpm 11 no longer reads the `pnpm` field in package.json: [WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides" It warns rather than fails, so all four key groups here silently stop applying while the install still exits 0. The overrides are the whole Graphile v5 stack resolved as a set — grafast, graphile-build*, @dataplan/* must agree, and the `graphql: 16.13.0` pin is what keeps a second copy of graphql out of the tree (two copies produce "Cannot use GraphQLSchema from another module or realm" at runtime). `@smithy/node-http-handler: <4.5.0` pins away from a bad release. - overrides / publicHoistPattern / packageExtensions → pnpm-workspace.yaml. pnpm 10 already honours them there, so this is correct now and forward-compatible with 11 — no flag day when we upgrade. - onlyBuiltDependencies → pnpm-policy.yaml `allowBuilds`, regenerated with `pnpm-policy generate` rather than hand-written, since that key is generated. - packageManager pinned; workflows moved v2 → v4 and their `version: 10` dropped. A bare major floats to the newest 10.x at run time, and v2 ignores packageManager entirely, so CI and local dev could not agree. v4 reads packageManager when no version input is given — one field for both. The lockfile is deliberately untouched: `pnpm install --frozen-lockfile` passes against it with the new config, and its `overrides:` block is byte-identical, so resolution is unchanged. (A full re-resolve also prunes ~1530 stale package entries; that is real but unrelated, and belongs in its own change rather than buried here.) Verified on 10.34.5: install succeeds, `pnpm-policy check` reports the workspace matches the policy, and the lockfile records all 16 overrides plus a packageExtensionsChecksum — the pins are in force, not merely present. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01V6watrJsLurfsr3uhnqibB --- .github/workflows/examples-integration.yaml | 4 +-- .github/workflows/run-tests.yaml | 24 ++++--------- package.json | 35 +------------------ pnpm-policy.yaml | 4 ++- pnpm-workspace.yaml | 37 +++++++++++++++++++++ 5 files changed, 48 insertions(+), 56 deletions(-) diff --git a/.github/workflows/examples-integration.yaml b/.github/workflows/examples-integration.yaml index 45d10e3fbe..6a94c03740 100644 --- a/.github/workflows/examples-integration.yaml +++ b/.github/workflows/examples-integration.yaml @@ -18,9 +18,7 @@ jobs: - uses: actions/setup-node@v4 with: node-version: '22' - - uses: pnpm/action-setup@v2 - with: - version: 10 + - uses: pnpm/action-setup@v4 - run: pnpm install - name: Build codegen and dependencies run: pnpm run build diff --git a/.github/workflows/run-tests.yaml b/.github/workflows/run-tests.yaml index 5fb8f87002..123e36964c 100644 --- a/.github/workflows/run-tests.yaml +++ b/.github/workflows/run-tests.yaml @@ -59,9 +59,7 @@ jobs: uses: actions/checkout@v4 - name: Setup pnpm - uses: pnpm/action-setup@v2 - with: - version: 10 + uses: pnpm/action-setup@v4 - name: Setup Node.js uses: actions/setup-node@v4 @@ -133,9 +131,7 @@ jobs: run: tar -xzf workspace.tar.gz && rm workspace.tar.gz - name: Setup pnpm - uses: pnpm/action-setup@v2 - with: - version: 10 + uses: pnpm/action-setup@v4 - name: Setup Node.js uses: actions/setup-node@v4 @@ -179,9 +175,7 @@ jobs: uses: actions/checkout@v4 - name: Setup pnpm - uses: pnpm/action-setup@v2 - with: - version: 10 + uses: pnpm/action-setup@v4 - name: Setup Node.js uses: actions/setup-node@v4 @@ -294,9 +288,7 @@ jobs: git config --global user.email "ci@example.com" - name: Setup pnpm - uses: pnpm/action-setup@v2 - with: - version: 10 + uses: pnpm/action-setup@v4 - name: Setup Node.js uses: actions/setup-node@v4 @@ -416,9 +408,7 @@ jobs: git config --global user.email "ci@example.com" - name: Setup pnpm - uses: pnpm/action-setup@v2 - with: - version: 10 + uses: pnpm/action-setup@v4 - name: Setup Node.js uses: actions/setup-node@v4 @@ -502,9 +492,7 @@ jobs: git config --global user.email "ci@example.com" - name: Setup pnpm - uses: pnpm/action-setup@v2 - with: - version: 10 + uses: pnpm/action-setup@v4 - name: Setup Node.js uses: actions/setup-node@v4 diff --git a/package.json b/package.json index 98f2fa1e97..fd40a5aae9 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,7 @@ { "name": "constructive", "version": "2.0.0", + "packageManager": "pnpm@10.34.5", "author": "Constructive ", "private": true, "repository": { @@ -54,39 +55,5 @@ }, "overrides": { "graphql": "^16.9.0" - }, - "pnpm": { - "overrides": { - "grafast": "1.1.1", - "grafserv": "1.0.1", - "graphile-build": "5.1.1", - "graphile-build-pg": "5.1.3", - "graphile-config": "1.1.0", - "graphile-utils": "5.0.3", - "postgraphile": "5.1.3", - "pg-sql2": "5.0.1", - "pg-introspection": "1.0.1", - "tamedevil": "0.1.1", - "@dataplan/pg": "1.1.1", - "@dataplan/json": "1.0.1", - "@graphile/lru": "5.0.0", - "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2", - "graphql": "16.13.0", - "@smithy/node-http-handler": "<4.5.0" - }, - "publicHoistPattern": [ - "@jest/test-sequencer" - ], - "packageExtensions": { - "jest-config@*": { - "dependencies": { - "@jest/test-sequencer": "^29.7.0" - } - } - }, - "onlyBuiltDependencies": [ - "@launchql/protobufjs", - "core-js-pure" - ] } } diff --git a/pnpm-policy.yaml b/pnpm-policy.yaml index 94eeffcbab..32fdf2441b 100644 --- a/pnpm-policy.yaml +++ b/pnpm-policy.yaml @@ -60,7 +60,9 @@ intersect: true # nx, protobufjs and unrs-resolver install without their scripts and the build # works. An install script is arbitrary code at install time, so each addition is # a deliberate decision and the value is the reason. -allowBuilds: [] +allowBuilds: + '@launchql/protobufjs': true + core-js-pure: true # Escape hatch for third-party packages that cannot wait — an urgent security # release, typically. A reason is required, and `until` makes the waiver expire diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 037090353b..dc23df289e 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -77,3 +77,40 @@ minimumReleaseAgeExclude: # Off: transitive dependencies may resolve from git or a URL. blockExoticSubdeps: false + +# Moved from package.json `pnpm.*` — pnpm 11 no longer reads that field, and +# pnpm 10 already honours these keys here, so this works on both majors. + +# The Graphile v5 stack is resolved as a set: grafast, graphile-build* and +# @dataplan/* must agree, and a second copy of graphql produces +# "Cannot use GraphQLSchema from another module or realm" at runtime. +overrides: + grafast: 1.1.1 + grafserv: 1.0.1 + graphile-build: 5.1.1 + graphile-build-pg: 5.1.3 + graphile-config: 1.1.0 + graphile-utils: 5.0.3 + postgraphile: 5.1.3 + pg-sql2: 5.0.1 + pg-introspection: 1.0.1 + tamedevil: 0.1.1 + '@dataplan/pg': 1.1.1 + '@dataplan/json': 1.0.1 + '@graphile/lru': 5.0.0 + '@graphile-contrib/pg-many-to-many': 2.0.0-rc.2 + graphql: 16.13.0 + '@smithy/node-http-handler': <4.5.0 + +publicHoistPattern: + - '@jest/test-sequencer' + +packageExtensions: + 'jest-config@*': + dependencies: + '@jest/test-sequencer': ^29.7.0 + +# The only dependencies permitted to run install scripts. +allowBuilds: + "@launchql/protobufjs": true + core-js-pure: true