feat(pm): handle npm 12 blocked install scripts in create and approve-builds - #2336
Draft
fengmk2 wants to merge 1 commit into
Draft
feat(pm): handle npm 12 blocked install scripts in create and approve-builds#2336fengmk2 wants to merge 1 commit into
fengmk2 wants to merge 1 commit into
Conversation
…-builds npm 12 skips dependency install scripts that the allowScripts field in package.json does not cover, and stops running scripts on approval: only npm rebuild executes previously skipped scripts. - Parse the npm 12 blocked-scripts install warning and surface gated direct dependencies in vp create like pnpm/bun/yarn, approving via vp pm approve-builds followed by vp pm rebuild - Version-gate the vp pm approve-builds npm note: npm >= 12 points at vp pm rebuild, npm 11.16 - 11.x keeps the advisory wording - Add the command_pm_approve_builds_npm12 PTY fixture (npm@12.0.2) and re-record the npm11 fixture for the reworded note - Document the npm 12 allowScripts flow and the allow-git/allow-remote resolution defaults in the create and install guides Closes #1823
✅ Deploy Preview for viteplus-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
✅ Staging deployment successful! Preview: https://viteplus-staging.void.app/ |
Contributor
Native binary sizes (
|
| Artifact | Format | Base | PR | Change |
|---|---|---|---|---|
vp (Linux x64) |
Binary | 10.52 MiB | 10.52 MiB | 0 B (0.00%) |
vp (Linux x64) |
gzip -9 | 4.55 MiB | 4.55 MiB | +214 B (+0.00%) |
| NAPI (Linux x64) | Binary | 33.66 MiB | 33.66 MiB | 0 B (0.00%) |
| NAPI (Linux x64) | gzip -9 | 13.04 MiB | 13.05 MiB | +586 B (+0.00%) |
vp (macOS ARM64) |
Binary | 7.84 MiB | 7.84 MiB | 0 B (0.00%) |
vp (macOS ARM64) |
gzip -9 | 3.96 MiB | 3.96 MiB | +60 B (+0.00%) |
| NAPI (macOS ARM64) | Binary | 40.95 MiB | 40.95 MiB | 0 B (0.00%) |
| NAPI (macOS ARM64) | gzip -9 | 17.26 MiB | 17.26 MiB | +216 B (+0.00%) |
vp (Windows x64) |
Binary | 8.43 MiB | 8.43 MiB | 0 B (0.00%) |
vp (Windows x64) |
gzip -9 | 3.67 MiB | 3.67 MiB | +319 B (+0.01%) |
| NAPI (Windows x64) | Binary | 27.81 MiB | 27.81 MiB | +512 B (+0.00%) |
| NAPI (Windows x64) | gzip -9 | 10.88 MiB | 10.88 MiB | +343 B (+0.00%) |
| Trampoline (Windows x64) | Binary | 203.00 KiB | 203.00 KiB | 0 B (0.00%) |
| Trampoline (Windows x64) | gzip -9 | 97.91 KiB | 97.91 KiB | -3 B (-0.00%) |
| Installer (Windows x64) | Binary | 4.46 MiB | 4.46 MiB | 0 B (0.00%) |
| Installer (Windows x64) | gzip -9 | 2.09 MiB | 2.09 MiB | -1 B (-0.00%) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm 12 (now
latest) skips dependency install scripts that theallowScriptsfield in package.json does not cover; the install succeeds with a warning. Approval only records the allowlist: a reinstall short-circuits on the up-to-date tree, and onlynpm rebuildexecutes previously skipped scripts. npm 12 also stops resolving git and remote tarball dependencies by default (EALLOWGIT/EALLOWREMOTE).vp treated npm as "runs scripts by default", so
vp createwith npm 12 left native direct dependencies silently unbuilt. This PR:parseNpmBlockedScripts) and surfaces gated direct dependencies invp createlike pnpm/bun/yarn; approval runsvp pm approve-builds <pkg>thenvp pm rebuild <pkg>, and retry hints point at rebuild instead of reinstallvp pm approve-buildsnpm note: npm >= 12 explains the approve-then-rebuild two-step, npm 11.16 - 11.x keeps the advisory wording (allowlist recorded, scripts still run), denials get no notecommand_pm_approve_builds_npm12PTY fixture recorded against real npm 12.0.2 and re-records the npm11 fixture for the reworded noteallow-git/allow-remotedefaultsThe npm 11.x wording ("not yet covered") is deliberately not parsed: those versions still run scripts, so there is nothing to fix up.
Verified end-to-end against npm 12.0.2: install of a project with a gated direct dep detects it, auto-approval writes
allowScriptsand the rebuild runs its postinstall. 54 TS unit tests and 34 Rust tests pass; all three npm approve-builds snapshot fixtures pass.Audited but left as follow-ups:
vp install -ghas no--allow-scriptsplumbing (vp's own global installs have no scripts),vp migratepreserves git/remote specs that now fail under npm 12, and migrate installs do not surface gated builds (pre-existing, also true for pnpm).Closes #1823