Skip to content

Commit db9ebd5

Browse files
penalosapenalosa
authored
Upgrade pnpm 9 → 10 with supply chain security hardening (cloudflare#13148)
1 parent 48d83ca commit db9ebd5

8 files changed

Lines changed: 284 additions & 146 deletions

File tree

‎.github/actions/install-dependencies/action.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@ runs:
1818
steps:
1919
- name: Install pnpm
2020
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
21-
with:
22-
version: 9.12.0
2321

2422
- name: Install Node.js ${{ inputs.node-version }}
2523
uses: actions/setup-node@v4

‎.github/workflows/auto-assign-issues.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,6 @@ jobs:
2323

2424
- name: Install pnpm
2525
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
26-
with:
27-
version: 9.12.0
2826

2927
- name: Install Dependencies
3028
run: pnpm i -F tools --frozen-lockfile

‎.github/workflows/c3-e2e.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,15 @@ jobs:
2222
filter: ["cli", "workers", "frameworks"]
2323
os: [{ name: ubuntu-latest, description: Linux }]
2424
pm:
25-
- { name: pnpm, version: "9.12.0" }
25+
- { name: pnpm, version: "10.33.0" }
2626
- { name: npm, version: "0.0.0" }
2727
# The yarn tests keep failing on Linux with out of space errors, with no clear reason why. Disabling for now.
2828
# - { name: yarn, version: "1.0.0" }
2929
include:
3030
- os: { name: windows-latest, description: Windows }
31-
pm: { name: pnpm, version: "9.12.0" }
31+
pm: { name: pnpm, version: "10.33.0" }
3232
- os: { name: ubuntu-latest, description: Linux }
33-
pm: { name: pnpm, version: "9.12.0" }
33+
pm: { name: pnpm, version: "10.33.0" }
3434
experimental: true
3535
runs-on: ${{ matrix.os.name }}
3636
steps:

‎.npmrc‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎package.json‎

Lines changed: 4 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -54,39 +54,12 @@
5454
"vitest": "catalog:default"
5555
},
5656
"engines": {
57-
"node": ">=18.20.0",
58-
"pnpm": "^9.12.0"
57+
"node": ">=20.0.0",
58+
"pnpm": "^10.33.0"
5959
},
6060
"volta": {
6161
"node": "20.19.3",
62-
"pnpm": "9.12.0"
62+
"pnpm": "10.33.0"
6363
},
64-
"packageManager": "pnpm@9.12.0",
65-
"pnpm": {
66-
"peerDependencyRules": {
67-
"allowedVersions": {
68-
"react": "18",
69-
"react-dom": "18",
70-
"@types/react": "18",
71-
"@types/react-dom": "18"
72-
}
73-
},
74-
"overrides": {
75-
"@types/react-dom@18>@types/react": "^18",
76-
"@types/react-tabs>@types/react": "^18",
77-
"@types/react-transition-group>@types/react": "^18",
78-
"@cloudflare/elements>@types/react": "^18",
79-
"@types/node": "$@types/node",
80-
"@types/node>undici-types": "catalog:default"
81-
},
82-
"patchedDependencies": {
83-
"@cloudflare/component-listbox@1.10.6": "patches/@cloudflare__component-listbox@1.10.6.patch",
84-
"toucan-js@4.0.0": "patches/toucan-js@4.0.0.patch",
85-
"postal-mime": "patches/postal-mime.patch",
86-
"youch@4.1.0-beta.10": "patches/youch@4.1.0-beta.10.patch",
87-
"@netlify/build-info": "patches/@netlify__build-info.patch",
88-
"buffer-equal-constant-time@1.0.1": "patches/buffer-equal-constant-time@1.0.1.patch",
89-
"undici@7.24.4": "patches/undici@7.24.4.patch"
90-
}
91-
}
64+
"packageManager": "pnpm@10.33.0"
9265
}

‎packages/vitest-pool-workers/test/global-setup.ts‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,13 @@ async function createTestProject() {
5555
},
5656
};
5757
await fs.writeFile(packageJsonPath, JSON.stringify(packageJson));
58+
// pnpm 10 blocks lifecycle scripts by default. The transitive deps
59+
// (workerd, esbuild) need their postinstall to download platform binaries.
60+
const workspaceYamlPath = path.join(projectPath, "pnpm-workspace.yaml");
61+
await fs.writeFile(
62+
workspaceYamlPath,
63+
["allowBuilds:", " esbuild: true", " workerd: true", ""].join("\n")
64+
);
5865
return projectPath;
5966
}
6067

‎pnpm-lock.yaml‎

Lines changed: 203 additions & 102 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pnpm-workspace.yaml‎

Lines changed: 67 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,72 @@ packages:
1515
# Node update | Every 2 years | Bump node dependency in workers-sdk
1616
# Quick Editor update | Every quarter | Update VSCode dependency and patches
1717

18+
# ──────────────────────────────────────────────────────────────────────────────
19+
# Settings (migrated from .npmrc in pnpm 10)
20+
# ──────────────────────────────────────────────────────────────────────────────
21+
22+
gitChecks: false
23+
24+
# ──────────────────────────────────────────────────────────────────────────────
25+
# Supply chain security
26+
# See: https://pnpm.io/supply-chain-security
27+
# ──────────────────────────────────────────────────────────────────────────────
28+
29+
# Prevent transitive dependencies from pulling code from git repos or tarball
30+
# URLs. Only direct dependencies may use exotic sources.
31+
blockExoticSubdeps: true
32+
33+
# ──────────────────────────────────────────────────────────────────────────────
34+
# Build scripts
35+
# pnpm 10 blocks lifecycle scripts by default. Only the packages listed here
36+
# are allowed to run install/postinstall scripts.
37+
# ──────────────────────────────────────────────────────────────────────────────
38+
39+
allowBuilds:
40+
esbuild: true
41+
workerd: true
42+
sharp: true
43+
playwright-chromium: true
44+
prisma: true
45+
# Explicitly silence warnings for packages whose postinstall scripts are not
46+
# required for correct operation.
47+
protobufjs: false # version-scheme diagnostic warning only
48+
msw: false # copies mockServiceWorker.js to msw.workerDirectory — unused in this repo
49+
core-js: false # telemetry
50+
core-js-pure: false # telemetry
51+
52+
# ──────────────────────────────────────────────────────────────────────────────
53+
# Dependency resolution (migrated from package.json "pnpm" field in pnpm 10)
54+
# ──────────────────────────────────────────────────────────────────────────────
55+
56+
overrides:
57+
"@types/react-dom@18>@types/react": "^18"
58+
"@types/react-tabs>@types/react": "^18"
59+
"@types/react-transition-group>@types/react": "^18"
60+
"@cloudflare/elements>@types/react": "^18"
61+
"@types/node": "$@types/node"
62+
"@types/node>undici-types": "catalog:default"
63+
64+
peerDependencyRules:
65+
allowedVersions:
66+
react: "18"
67+
react-dom: "18"
68+
"@types/react": "18"
69+
"@types/react-dom": "18"
70+
71+
patchedDependencies:
72+
"@cloudflare/component-listbox@1.10.6": "patches/@cloudflare__component-listbox@1.10.6.patch"
73+
"toucan-js@4.0.0": "patches/toucan-js@4.0.0.patch"
74+
"postal-mime": "patches/postal-mime.patch"
75+
"youch@4.1.0-beta.10": "patches/youch@4.1.0-beta.10.patch"
76+
"@netlify/build-info": "patches/@netlify__build-info.patch"
77+
"buffer-equal-constant-time@1.0.1": "patches/buffer-equal-constant-time@1.0.1.patch"
78+
"undici@7.24.4": "patches/undici@7.24.4.patch"
79+
80+
# ──────────────────────────────────────────────────────────────────────────────
81+
# Catalog
82+
# ──────────────────────────────────────────────────────────────────────────────
83+
1884
catalog:
1985
"@hey-api/openapi-ts": "^0.94.0"
2086
"@types/node": "^22.10.1"
@@ -36,7 +102,7 @@ catalog:
36102
workerd: "1.20260401.1"
37103
jsonc-parser: "^3.2.0"
38104
smol-toml: "^1.5.2"
39-
msw: "2.12.4"
105+
msw: 2.12.4
40106
"tree-kill": "^1.2.2"
41107
"capnp-es": "^0.0.14"
42108
"capnweb": "^0.5.0"

0 commit comments

Comments
 (0)