From 8595529051e63ff15d00add9b9a0ce910651fd6f Mon Sep 17 00:00:00 2001 From: rob thijssen Date: Mon, 31 Aug 2026 13:11:31 +0300 Subject: [PATCH] fix(web): approve the two dependencies that need install scripts pnpm 10 refuses to silently run a dependency's build script. Locally that is a warning; on the runner it is ERR_PNPM_IGNORED_BUILDS and the job fails, so build-web broke on run 13 while everything passed here. @swc/core and esbuild both fetch a platform-native binary at install time and do not work without it, so they are allowlisted explicitly via pnpm.onlyBuiltDependencies. Everything else in the tree stays denied, which is the point of the feature -- an install script is arbitrary code from a transitive dependency. Also sets strict-dep-builds in web/.npmrc so a skipped build script is an error here too. Same reasoning as the release-age policy added earlier: a local install that passes where the runner fails is a difference only discoverable by pushing, and that is a slow way to find out. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01XZG2i4AmfSqE97EJGBVb64 --- web/.npmrc | 5 +++++ web/package.json | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/web/.npmrc b/web/.npmrc index f57faed..5202915 100644 --- a/web/.npmrc +++ b/web/.npmrc @@ -5,3 +5,8 @@ # # 1440 minutes = 24h, the runner's cutoff. minimum-release-age=1440 + +# Treat a dependency whose build script was skipped as an error, not a warning. +# The runner does; without this the local install passes, the runner fails, and +# the difference is only discoverable by pushing. +strict-dep-builds=true diff --git a/web/package.json b/web/package.json index a89b13c..0bfde7b 100644 --- a/web/package.json +++ b/web/package.json @@ -32,5 +32,11 @@ "typescript": "^5.9.3", "typescript-eslint": "^8.46.2", "vite": "^7.2.2" + }, + "pnpm": { + "onlyBuiltDependencies": [ + "@swc/core", + "esbuild" + ] } }