Write pnpm 11 patch metadata in native format - #211
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Legacy manifest metadata can survive pnpm 11 isolation, and required real-version install coverage is absent.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates patch metadata generation to use native pnpm 11+ lockfile and workspace formats.
Changes:
- Centralizes version-specific patch metadata generation.
- Writes hashes to pnpm 11+ lockfiles and paths to workspace YAML.
- Adds validation, integration coverage, and documentation.
File summaries
| File | Description |
|---|---|
src/lib/patches/pnpm-patched-dependencies.ts |
Defines version-specific metadata formats. |
src/lib/patches/pnpm-patched-dependencies.test.ts |
Tests format selection. |
src/lib/patches/copy-patches.ts |
Validates hashes before copying. |
src/lib/patches/copy-patches.test.ts |
Tests missing-hash rejection. |
src/lib/patches/write-isolate-pnpm-workspace.ts |
Writes pnpm 11+ patch paths. |
src/lib/patches/write-isolate-pnpm-workspace.test.ts |
Covers workspace generation and errors. |
src/lib/lockfile/helpers/generate-pnpm-lockfile.ts |
Emits version-appropriate lockfile entries. |
src/lib/lockfile/helpers/generate-pnpm-lockfile.test.ts |
Tests hash output and validation. |
src/lib/lockfile/helpers/generate-pnpm-lockfile.integration.test.ts |
Verifies serialized lockfile formats. |
src/isolate.ts |
Integrates patch metadata writers. |
src/isolate.integration.test.ts |
Tests isolation output across versions. |
docs/patched-dependencies.md |
Documents pnpm patch formats. |
Review details
- Files reviewed: 12/12 changed files
- Comments generated: 2
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The version boundary, validation, writers, documentation, and regression coverage are consistent and complete.
Review details
Files not reviewed (2)
- src/lib/lockfile/helpers/fixtures/pnpm-patched-dependencies-10/workspace/pnpm-lock.yaml: Generated file
- src/lib/lockfile/helpers/fixtures/pnpm-patched-dependencies-12/workspace/pnpm-lock.yaml: Generated file
- Files reviewed: 20/22 changed files
- Comments generated: 0 new
- Review effort level: Balanced
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The version boundary, metadata placement, validation, compatibility behavior, and regression coverage are consistent and complete.
Review details
Files not reviewed (2)
- src/lib/lockfile/helpers/fixtures/pnpm-patched-dependencies-10/workspace/pnpm-lock.yaml: Generated file
- src/lib/lockfile/helpers/fixtures/pnpm-patched-dependencies-12/workspace/pnpm-lock.yaml: Generated file
- Files reviewed: 20/22 changed files
- Comments generated: 0 new
- Review effort level: Balanced
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The version boundary, failure handling, metadata cleanup, and output formats are consistently implemented and comprehensively tested.
Review details
Files not reviewed (2)
- src/lib/lockfile/helpers/fixtures/pnpm-patched-dependencies-10/workspace/pnpm-lock.yaml: Generated file
- src/lib/lockfile/helpers/fixtures/pnpm-patched-dependencies-12/workspace/pnpm-lock.yaml: Generated file
- Files reviewed: 20/22 changed files
- Comments generated: 0 new
- Review effort level: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pnpm 11 and later now write bare patched-dependency hashes to
pnpm-lock.yamland copied relative patch paths topnpm-workspace.yaml. pnpm 9 and 10 retain their object lockfile entries and manifest paths.The patch metadata is decided in one version-aware helper, so lockfile, manifest, and workspace writers agree. The isolate also removes stale target-manifest metadata from pnpm 11+ output, verifies copied patch files and native lockfile references, and reports an unreadable pnpm lockfile separately from a missing patch hash.
Captured pnpm 10 and pnpm 12 patched-workspace fixtures keep the native output shapes under test. Manual pnpm 10 and pnpm 12 isolated installs both completed with
--frozen-lockfile.Decisions:
Follow-ups: #212
Closes #207
Scope: packages (isolate-package), docs
Visibility: user-facing
Implementer: codex:gpt-5.6-terra:xhigh