From 05c3e56dba36512181a21be563dad5fc186c8c2b Mon Sep 17 00:00:00 2001 From: rob thijssen Date: Mon, 31 Aug 2026 13:18:08 +0300 Subject: [PATCH] fix(web): put the build-script allowlist where pnpm 10 actually reads it The previous attempt set pnpm.onlyBuiltDependencies in package.json. pnpm 10 does not read it from there -- `pnpm config get onlyBuiltDependencies` returns undefined -- so the runner failed exactly as before. It looked fixed locally because the pnpm store had already built both packages, so a reinstall printed no warning whether or not the allowlist was being read. "No warning" was not evidence; `pnpm config get` returning the values is, and it does now. Moves the allowlist to pnpm-workspace.yaml, which is where pnpm 10 takes its settings, and drops the inert package.json field rather than leave two places appearing to configure the same thing. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01XZG2i4AmfSqE97EJGBVb64 --- web/package.json | 6 ------ web/pnpm-workspace.yaml | 9 +++++++++ 2 files changed, 9 insertions(+), 6 deletions(-) create mode 100644 web/pnpm-workspace.yaml diff --git a/web/package.json b/web/package.json index 0bfde7b..a89b13c 100644 --- a/web/package.json +++ b/web/package.json @@ -32,11 +32,5 @@ "typescript": "^5.9.3", "typescript-eslint": "^8.46.2", "vite": "^7.2.2" - }, - "pnpm": { - "onlyBuiltDependencies": [ - "@swc/core", - "esbuild" - ] } } diff --git a/web/pnpm-workspace.yaml b/web/pnpm-workspace.yaml new file mode 100644 index 0000000..686c4ae --- /dev/null +++ b/web/pnpm-workspace.yaml @@ -0,0 +1,9 @@ +# pnpm 10 reads settings from here, not from package.json's `pnpm` field. +# +# An explicit allowlist of dependencies permitted to run install scripts. Both +# fetch a platform-native binary at install time and do not work without it; +# every other package in the tree is denied, which is the point — an install +# script is arbitrary code from a transitive dependency. +onlyBuiltDependencies: + - '@swc/core' + - esbuild