Skip to content

chore: harden pnpm installs #32

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brightiron merged 7 commits into from
May 14, 2026
Merged

chore: harden pnpm installs #32

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
dba3d63
chore: harden pnpm installs
0xJem May 12, 2026
70a34e3
chore: pin pnpm version in workflows
0xJem May 12, 2026
4c48daf
chore: fix pnpm audit findings
0xJem May 12, 2026
c7cbbb4
chore: fix pnpm audit findings
0xJem May 12, 2026
a076bb4
chore: fix pnpm audit findings
0xJem May 12, 2026
14223f0
chore: harden pnpm configuration
0xJem May 13, 2026
a50599c
chore: move pnpm config to workspace
0xJem May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,4 +64,6 @@ typings/
build

# Test build files
tests/.bin/
tests/.bin/

.pnpm-store/
3 changes: 0 additions & 3 deletions .npmrc
View file
Open in desktop

This file was deleted.

57 changes: 2 additions & 55 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,64 +33,11 @@
"prettier": "^2.6.2",
"typescript": "^4.6.4"
},
"packageManager": "[email protected]",
"engines": {
"node": ">=24",
"pnpm": "10.33.0",
"pnpm": ">=10.33.0",
"npm": "use-pnpm",
"yarn": "use-pnpm"
},
"pnpm": {
"overrides": {
"ajv": "6.14.0",
"axios": ">=1.15.0",
"brace-expansion": ">=1.1.13",
"braces": ">=3.0.3",
"cross-spawn": ">=7.0.5",
"ejs": ">=3.1.10",
"flatted": ">=3.4.2",
"follow-redirects": ">=1.15.6",
"glob": ">=11.1.0",
"immutable": ">=5.1.5",
"js-yaml": ">=4.1.1",
"lodash.trim": "4.18.0",
"lodash.trimend": "4.18.0",
"micromatch": ">=4.0.8",
"minimatch": ">=3.1.4",
"picomatch": ">=2.3.2",
"semver": ">=7.5.2",
"undici": ">=7.24.0",
"word-wrap": ">=1.2.4",
"yaml": ">=2.8.3",
"ajv@<6.14.0": "6.14.0",
"axios@<0.30.0": ">=0.30.0",
"axios@<=0.30.2": ">=0.30.3",
"axios@>=0.8.1 <0.28.0": ">=0.28.0",
"brace-expansion@<1.1.13": ">=1.1.13",
"brace-expansion@>=1.0.0 <=1.1.11": ">=1.1.12",
"braces@<3.0.3": ">=3.0.3",
"cross-spawn@>=7.0.0 <7.0.5": ">=7.0.5",
"ejs@<3.1.10": ">=3.1.10",
"flatted@<3.4.0": ">=3.4.0",
"flatted@<=3.4.1": ">=3.4.2",
"follow-redirects@<1.15.4": ">=1.15.4",
"follow-redirects@<=1.15.5": ">=1.15.6",
"glob@>=11.0.0 <11.1.0": ">=11.1.0",
"immutable@>=5.0.0 <5.1.5": ">=5.1.5",
"js-yaml@>=4.0.0 <4.1.1": ">=4.1.1",
"micromatch@<4.0.8": ">=4.0.8",
"minimatch@<3.1.3": ">=3.1.3",
"minimatch@<3.1.4": ">=3.1.4",
"picomatch@<2.3.2": ">=2.3.2",
"semver@>=7.0.0 <7.5.2": ">=7.5.2",
"tmp@<=0.2.3": ">=0.2.4",
"undici@>=7.0.0 <7.18.2": ">=7.18.2",
"undici@>=7.0.0 <7.24.0": ">=7.24.0",
"word-wrap@<1.2.4": ">=1.2.4",
"yaml@>=1.0.0 <1.10.3": ">=1.10.3",
"yaml@>=2.0.0 <2.8.3": ">=2.8.3",
"axios@<1.15.0": ">=1.15.0",
"apisauce>axios": ">=1.15.0"
}
}
"packageManager": "[email protected]"
Comment on lines +38 to +42
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

cat -n package.json | sed -n '35,45p'

Repository: OlympusDAO/bonds-subgraph

Length of output: 285

🌐 Web query:

Node.js Corepack packageManager field behavior exact version pin enforcement

💡 Result:

The Node.js Corepack packageManager field in package.json specifies the exact package manager (yarn, pnpm, or npm) and version to use for the project, in the format "name@version[+hash]", e.g., "[email protected]" or with an optional SHA hash for security like "[email protected]+sha224.953c8233f7a92884eee2de69a1b92d1f2ec1655e66d08071ba9a02fa" [1][2][3]. Corepack proxies (enabled via corepack enable) read the nearest package.json, download and run the pinned exact version if needed, ensuring reproducible installs across environments [4][5][1]. Version pinning is enforced strictly by default: Corepack aborts with an error (e.g., "UsageError: This project is configured to use npm because./package.json has a 'packageManager' field") if a mismatched package manager binary is invoked [6][7][8]. It runs the exact specified version (patch-level), not a range, downloading from the registry if absent from cache [4][9][10]. This strict enforcement is controlled by COREPACK_ENABLE_STRICT=1 (default). Set to 0 for "transparent" mode: matching PM uses the pinned version; mismatch falls back to system/global version without error [1][8][11][12]. Auto-pinning (Corepack adding/updating the field) is off by default (COREPACK_ENABLE_AUTO_PIN=0) but can be enabled [7][13][1]. Projects can override via .corepack.env [14][15]. npm support is partial (no shims by default, uses global npm) [4][5]. Use corepack use name@version to set/update the field [1][16]. As of 2026, behavior unchanged in recent Node docs [5][16].

Citations:

🌐 Web query:

pnpm 11 devEngines.packageManager support

💡 Result:

pnpm 11 fully supports devEngines.packageManager in package.json for specifying the required pnpm version, introduced in v11.0.0 [1][2]. This field allows semver ranges (unlike the legacy packageManager field), with the resolved version stored in pnpm-lock.yaml under packageManagerDependencies for reuse if it satisfies the range [3][1]. Example usage: json { "devEngines": { "packageManager": { "name": "pnpm", "version": ">=11.0.0", "onFail": "download" } } } onFail options: download (auto-download), error (default), warn, ignore [3][1]. It takes precedence over packageManager (with warning if both present) [3][4]. pnpm init now uses this field by default when init-package-manager is enabled [2]. Override onFail via pmOnFail setting [1]. Legacy packageManager derives onFail from configs like managePackageManagerVersions [3][2].

Citations:

packageManager pin negates the widened pnpm range.

"pnpm": ">=10.33.0" permits pnpm 11+, but "packageManager": "[email protected]" instructs Corepack to use exactly version 10.33.0 for this project. Corepack enforces this at patch-level precision by default, preventing pnpm 11 from being used even when the engines field allows it. This directly contradicts the PR objective to unpin pnpm from 10.33.0.

The compatible solutions are:

  1. Remove the packageManager field entirely to let the engines.pnpm range take effect.
  2. For pnpm 11+, use devEngines.packageManager with a range instead of the legacy packageManager field.
Suggested change (Option 1) 
   "engines": {
     "node": ">=24",
     "pnpm": ">=10.33.0",
     "npm": "use-pnpm",
     "yarn": "use-pnpm"
-  },
-  "packageManager": "[email protected]"
+  }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"pnpm": ">=10.33.0",
"npm": "use-pnpm",
"yarn": "use-pnpm"
},
"pnpm": {
"overrides": {
"ajv": "6.14.0",
"axios": ">=1.15.0",
"brace-expansion": ">=1.1.13",
"braces": ">=3.0.3",
"cross-spawn": ">=7.0.5",
"ejs": ">=3.1.10",
"flatted": ">=3.4.2",
"follow-redirects": ">=1.15.6",
"glob": ">=11.1.0",
"immutable": ">=5.1.5",
"js-yaml": ">=4.1.1",
"lodash.trim": "4.18.0",
"lodash.trimend": "4.18.0",
"micromatch": ">=4.0.8",
"minimatch": ">=3.1.4",
"picomatch": ">=2.3.2",
"semver": ">=7.5.2",
"undici": ">=7.24.0",
"word-wrap": ">=1.2.4",
"yaml": ">=2.8.3",
"ajv@<6.14.0": "6.14.0",
"axios@<0.30.0": ">=0.30.0",
"axios@<=0.30.2": ">=0.30.3",
"axios@>=0.8.1 <0.28.0": ">=0.28.0",
"brace-expansion@<1.1.13": ">=1.1.13",
"brace-expansion@>=1.0.0 <=1.1.11": ">=1.1.12",
"braces@<3.0.3": ">=3.0.3",
"cross-spawn@>=7.0.0 <7.0.5": ">=7.0.5",
"ejs@<3.1.10": ">=3.1.10",
"flatted@<3.4.0": ">=3.4.0",
"flatted@<=3.4.1": ">=3.4.2",
"follow-redirects@<1.15.4": ">=1.15.4",
"follow-redirects@<=1.15.5": ">=1.15.6",
"glob@>=11.0.0 <11.1.0": ">=11.1.0",
"immutable@>=5.0.0 <5.1.5": ">=5.1.5",
"js-yaml@>=4.0.0 <4.1.1": ">=4.1.1",
"micromatch@<4.0.8": ">=4.0.8",
"minimatch@<3.1.3": ">=3.1.3",
"minimatch@<3.1.4": ">=3.1.4",
"picomatch@<2.3.2": ">=2.3.2",
"semver@>=7.0.0 <7.5.2": ">=7.5.2",
"tmp@<=0.2.3": ">=0.2.4",
"undici@>=7.0.0 <7.18.2": ">=7.18.2",
"undici@>=7.0.0 <7.24.0": ">=7.24.0",
"word-wrap@<1.2.4": ">=1.2.4",
"yaml@>=1.0.0 <1.10.3": ">=1.10.3",
"yaml@>=2.0.0 <2.8.3": ">=2.8.3",
"axios@<1.15.0": ">=1.15.0",
"apisauce>axios": ">=1.15.0"
}
}
"packageManager": "[email protected]"
"pnpm": ">=10.33.0",
"npm": "use-pnpm",
"yarn": "use-pnpm"
}
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 38 - 42, The packageManager field is pinned to
[email protected] which overrides the widened "engines.pnpm": ">=10.33.0" range;
either remove the packageManager entry so Corepack will respect the engines.pnpm
range, or replace it by adding a devEngines.packageManager with a range (e.g.,
"pnpm@>=10.33.0") so the project allows pnpm 11+ while preserving Corepack
behavior; update the package.json by removing "packageManager": "[email protected]"
or adding "devEngines.packageManager" and ensure no conflicting packageManager
remains, referencing the packageManager, engines.pnpm,
devEngines.packageManager, and Corepack behavior when making the change.

}
Loading
Loading