Conversation
irskep
force-pushed
the
pnpm12-allow-esbuild-build
branch
from
September 17, 2026 18:34
dccdd9d to
52179cb
Compare
pnpm 12 fails an install that skipped a dependency's build script, and esbuild has one. That broke `pnpm install` here, and broke installing Dependicus from git: pnpm builds a git dependency by running `prepare` in a nested install, which consumers can't pass --ignore-scripts to, so they got ERR_PNPM_PREPARE_PACKAGE with no way around it. esbuild isn't on the build path, since tsdown bundles with rolldown. The allowlist lives in a pnpm-workspace.yaml, which is also where pnpm 12 reads its config. The file declares the single package explicitly because `aube -r list` errors without a `packages` key, which is what the dependicus-* CI jobs run through the aube provider. The README's pnpm instructions were out of date too. pnpm 12 keys its build allowlist on the resolved package URL, commit included, and ignores the `onlyBuiltDependencies` name earlier versions took. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
irskep
force-pushed
the
pnpm12-allow-esbuild-build
branch
from
September 17, 2026 18:39
52179cb to
d25ea06
Compare
irskep
marked this pull request as ready for review
September 17, 2026 18:43
Collaborator
Author
|
@mblair sorry I didn't get it right in the last batch! |
mblair
approved these changes
Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pnpm installfails in a Dependicus checkout on pnpm 12, and so does installing Dependicus from git.pnpm 12 fails any install that skipped a dependency's build script. esbuild comes in transitively and has one, so the install stops with
ERR_PNPM_IGNORED_BUILDS. Anyone installing from git sees it asERR_PNPM_PREPARE_PACKAGEinstead: pnpm builds a git dependency by runningpreparein a nested install, and there is no way to pass--ignore-scriptsto that install or allowlist anything inside it.A
pnpm-workspace.yamlallowing esbuild's postinstall fixes both. esbuild isn't on the build path, since tsdown bundles with rolldown. The file also declares the single package explicitly:aube -r listerrors without apackageskey, and thedependicus-*jobs reach it through the aube provider.The README needed a correction too. pnpm 12 keys its build allowlist on the resolved package URL, commit included, and ignores the
onlyBuiltDependenciesname older versions accepted.Checked on pnpm 12.1.0 and aube 1.0.0-beta.9: install, build, test (930 passing), lint, format and typecheck here;
node dist/bin.mjs update --htmlacross all nine providers, which is what thedependicus-*jobs run; andpnpm add git+...from a separate project, which builds and installs a workingdependicus.🤖 Generated with Claude Code