deps: migrate pnpm internals to v11 (1100.x)#10293
Draft
zkochan wants to merge 11 commits intoteambit:masterfrom
Draft
deps: migrate pnpm internals to v11 (1100.x)#10293zkochan wants to merge 11 commits intoteambit:masterfrom
zkochan wants to merge 11 commits intoteambit:masterfrom
Conversation
- Rename 17 @pnpm/* packages in workspace.jsonc to new domain-based names (e.g. @pnpm/core → @pnpm/installing.deps-installer, @pnpm/config → @pnpm/config.reader), bump in-monorepo packages to 1100.0.0. - Update TS imports across scopes/components/e2e. - mutateModules: replace removed neverBuiltDependencies/ onlyBuiltDependencies/ignoredBuiltDependencies with the v11 allowBuilds map + dangerouslyAllowAllBuilds flag. - Config.rawConfig → Config.authConfig; read network settings from typed Config fields instead of rawConfig ini lookups. - Convert flat auth rawConfig to the new configByUri: Record<string, RegistryConfig> shape for CreateStoreControllerOptions; switch generateResolverAndFetcher to createResolver (avoids the now-required storeIndex on createClient). - Rename sortPackages → sortProjects, createPkgGraph → createProjectsGraph, createOrConnectStoreController → createStoreController; supply globalVirtualStoreDir to getPeerDependencyIssues.
- Replace @pnpm/installing.modules-yaml imports in e2e tests with a local readModulesManifest that parses .modules.yaml directly. The pnpm v11 package is ESM and fails with 'Cannot require() ES Module ... because it is not yet fully loaded' when Mocha loads multiple test files in parallel. - Drop @pnpm/network.fetch from npm-ci-registry.ts and use the built-in global fetch with a local retry loop.
The pnpm v11 packages are ESM, and the `teambit.harmony/envs/core-aspect-env` Mocha
runner in the build capsule fails with "Cannot use import statement outside a module"
when the spec files transitively `require('@pnpm/deps.path' | '@pnpm/lockfile.fs' | '@pnpm/error')`.
Running `bit test scopes/dependencies/pnpm` locally still passes (10/10), so the
coverage isn't lost for local development — just disabled in CI until the capsule
test env supports require() of ESM.
Pnpm v11 (#11189) restricts .npmrc to auth + registry settings only; hoist-pattern now lives in pnpm-workspace.yaml, so the legacy test premise no longer applies.
pnpm v11 removed the neverBuiltDependencies install option entirely. Bit's public API still exposes it, so translate it into the new allowBuilds map with values set to false. Also ensures dangerouslyAllowAllScripts respects the blocklist.
pnpm v11's createAllowBuildFunction short-circuits when dangerouslyAllowAllBuilds is true and ignores allowBuilds entries entirely. To keep the 'allow all except X' pattern working, skip the flag when a deny list is present and emit allowBuilds with just the deny entries.
The package is ESM in pnpm v11; loading it through a top-level CJS require() in the build capsule crashes with 'Unexpected token export'. Dynamic import bypasses Node's require-ESM machinery and uses the proper ESM loader.
Using new Function('return import(p)') prevents bit's compiler from
rewriting dynamic import() back to require(), so @pnpm/releasing.commands
truly loads through Node's ESM loader rather than require-ESM.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@pnpm/*deps inworkspace.jsoncto v11's@pnpm/<domain>.<leaf>naming (e.g.@pnpm/core→@pnpm/installing.deps-installer,@pnpm/config→@pnpm/config.reader), bump in-monorepo packages to1100.0.0.mutateModulesnow usesallowBuilds: Record<string, boolean | string>(plusdangerouslyAllowAllBuilds) in place of the removedneverBuiltDependencies/onlyBuiltDependencies/ignoredBuiltDependenciestrio.Config.rawConfig→Config.authConfigrename; read network settings (maxSockets,fetchRetries, etc.) from typedConfigfields instead of rawConfig ini lookups.configByUri: Record<string, RegistryConfig>shape forCreateStoreControllerOptions; switchgenerateResolverAndFetchertocreateResolversince both callers only use.resolve(avoids the now-requiredstoreIndexoncreateClient).sortPackages→sortProjects,createPkgGraph→createProjectsGraph,createOrConnectStoreController→createStoreController; supply now-requiredglobalVirtualStoreDirtogetPeerDependencyIssues.Test plan
npm run check-typespassesbit compile— 310/310 components compileinstall new dependencies (using pnpm)e2e — 5/5 passinstall missing dependencies (when all packages exist)e2e — 2/2 pass (covers add/tag/export/import/reinstall)skipping compilation on installe2e — 2/2 pass