Commit Graph

7943 Commits

Author SHA1 Message Date
Zoltan Kochan
bbc3062a4e chore: fix security vulnerabilities in deps 2022-12-23 01:41:42 +02:00
Zoltan Kochan
5c75ff3ec6 fix: rebuild should print a better error message (#5819)
close #5815
2022-12-23 01:36:58 +02:00
Zoltan Kochan
d7ea8b486a chore(release): 7.19.0 v7.19.0 2022-12-21 12:55:30 +02:00
Zoltan Kochan
3360c9f4b0 perf: do not build the same dependency multiple times when node-linker is hoisted (#5814) 2022-12-21 12:29:59 +02:00
Zoltan Kochan
7030cc26e8 refactor: use Object.fromEntries instead of Ramda.fromPairs 2022-12-21 03:23:10 +02:00
Zoltan Kochan
c9d3970e33 fix: rebuild when node-linker is set to hoisted (#5811)
close #5560
2022-12-21 03:07:01 +02:00
NullVoxPopuli
e8aafe393c fix: patch should print instructions about how to commit the changes (#5809)
Co-authored-by: Zoltan Kochan <z@kochan.io>
2022-12-21 02:59:17 +02:00
await-ovo
b77651d14d feat: add pnpm.requiredScripts config (#5802)
close #5569

Co-authored-by: Zoltan Kochan <z@kochan.io>
2022-12-21 00:44:33 +02:00
Zoltan Kochan
2458741fab feat: store locations of deps when node-linker is set to hoisted (#5795)
Currently, when `node-linker=hoisted` is used and `node_modules` is not up-to-date, pnpm relinks all dependencies inside node_modules. This is not efficient, so with this optimisation pnpm will only relink what needs to be relinked.
2022-12-18 20:53:53 +02:00
Zoltan Kochan
bc18d33fe0 fix(deps): update @zkochan/cmd-shim 2022-12-14 02:39:56 +02:00
Zoltan Kochan
6b00a83256 fix: don't relink injected packages if they were not built (#5792) 2022-12-13 21:47:37 +02:00
Zoltan Kochan
90ec7fcf3f chore: release libs 2022-12-13 04:08:28 +02:00
Zoltan Kochan
313702d76b refactor: all packages should be in the @pnpm scope (#5785) 2022-12-13 03:46:56 +02:00
Zoltan Kochan
450e0b1d10 feat: add a new option to the hoister to ignore some deps (#5784) 2022-12-13 00:15:26 +02:00
Zoltan Kochan
234e9ebaec chore(release): 7.18.2 v7.18.2 2022-12-12 14:08:44 +02:00
chlorine
f5c377a8d0 fix: throw an error while missing script start or server.js (#5782) 2022-12-12 10:47:14 +00:00
await-ovo
2587011989 fix: print errors when --json option used (#5718) 2022-12-10 16:41:24 +02:00
Zoltan Kochan
73bb2a2ea3 ci: skip cache 2022-12-10 16:13:12 +02:00
Zoltan Kochan
aefb9f6f72 test: skip unreliable test on Windows 2022-12-10 16:12:29 +02:00
await-ovo
5d8f84520c fix(plugin-commands-publishing): output --json option in help info (#5773) 2022-12-09 22:21:47 +02:00
Weyert de Boer
5464e1da6e fix: improve license file reading logic (#5740)
* fix: improve license file reading logic

If the file index is of the appropriate type so we can leverage the contents of `PackageFileInfo`-type we try
to lookup the file mode to and pass it to the `readLicenseFileFromCafs`-function so it can be correctly
passed to the underlying `getFilePathByModeInCafs`-function responsible for fetching the file from
the PNPM store

* test: add integration test for the problematic `svgicons2svgfont`

Added a test to verify that the LICENSE files of the `svgicons2svgfont@5.0.2`-package
and similar packages can be read without errors

* refactor: license

* docs: add changesets

Co-authored-by: Weyert de Boer <weyert@innerfuse.biz>
Co-authored-by: Zoltan Kochan <z@kochan.io>
2022-12-09 22:02:16 +02:00
Zoltan Kochan
ef134a0055 refactor: license scanner 2022-12-09 21:41:32 +02:00
await-ovo
49f6c917fb fix: should not replace workspace:* when update (#5764)
close #5317
close #5303
close #5312
close #5726
2022-12-09 20:51:03 +02:00
Zoltan Kochan
28a99f43f9 chore(release): 7.18.1 v7.18.1 2022-12-06 11:41:39 +02:00
Zoltan Kochan
4947603888 fix(audit): don't skip vulnerabilities with no CVEs codes (#5756) 2022-12-06 11:37:42 +02:00
Zoltan Kochan
b11a8c363c fix: it should possible to use abolute file paths in overrides (#5757)
close #5754
2022-12-06 11:36:47 +02:00
Zoltan Kochan
3f644a514d fix(reporter): update notifier instructions (#5750)
ref #5747
2022-12-06 01:49:38 +02:00
Zoltan Kochan
568dc3ab21 fix(licenses): print help when no subcommand is specified (#5751)
close #5745
2022-12-05 12:13:56 +02:00
Zoltan Kochan
c5aea50ae1 fix(audit): ignore vulnerabilities listed in ignoreCves (#5752)
close #5734
2022-12-05 12:13:40 +02:00
Zoltan Kochan
bcf2d54135 fix: print a better error message on broken tarballs (#5746) 2022-12-04 23:41:49 +02:00
Zoltan Kochan
88600fb29a docs: update changelog 2022-12-04 00:34:16 +02:00
Zoltan Kochan
1240a6453e chore(release): 7.18.0 v7.18.0 2022-12-04 00:06:58 +02:00
Zoltan Kochan
30d611d769 docs: update changesets 2022-12-03 00:52:02 +02:00
await-ovo
f3bfa2aae6 feat: try adding local pre-release package in workspaces (#5733)
close #5316
2022-12-03 00:50:53 +02:00
chlorine
dd83e5974b fix: audit should work when the project's package.json has no version (#5731)
close #5728
2022-12-03 00:38:55 +02:00
Zoltan Kochan
a9d59d8bc2 fix(deps): update (#5711) 2022-12-01 03:43:03 +02:00
Homyee King
c245edf1b6 feat: update version when pinnedVersion is * (#5720)
close #5681
2022-12-01 00:00:49 +02:00
Zoltan Kochan
93558ce68f fix: exit with non-zero exit code when child process fails 2022-11-30 22:09:24 +02:00
Sviatoslav Sydorenko
a5690f4946 ci: introduce a centralized GHA check/gate job (#5723)
This patch is intended to lower the maintenance burden of having to
manually go through each matrix subjob name in the branch protection
repository settings. It allows to only include the check job in the
branch protection and it will robustly determine if the dependencies
have succeeded or not.

It is currently mostly serves the Python ecosystem in projects like
aiohttp, cryptography, open edX, pip etc. But I've also seen other
communities picking it up lately, like the AWS Rust SDK and even the
engine powering https://dev.to, to my surprise. Strictly speaking, it
is agnostic.

Ref: https://github.com/marketplace/actions/alls-green#why
2022-11-30 18:25:18 +02:00
await-ovo
924eca2937 fix(read-package-hook): resolve file overrides should relative to root directory (#5712)
close #5493
Co-authored-by: Zoltan Kochan <z@kochan.io>
2022-11-30 03:31:43 +02:00
thinkhalo
4097af6b5c feat: support $ in overrides instead of specific version #5703 (#5704)
Co-authored-by: Zoltan Kochan <z@kochan.io>
2022-11-29 02:32:03 +02:00
thinkhalo
b14a7fd5e7 style: eslint error extra semicolon (#5707) 2022-11-28 23:33:59 +02:00
Zoltan Kochan
8d7e37c8e2 chore(release): headless and dependents 2022-11-28 17:48:17 +02:00
Zoltan Kochan
32288715d3 fix: dedupe direct deps when headless install is used 2022-11-28 17:27:00 +02:00
Zoltan Kochan
510143083a chore(release): direct-dep-linker and dependents 2022-11-28 16:40:31 +02:00
Zoltan Kochan
13ce5b0315 fix: deduping direct deps on Windows 2022-11-28 03:37:54 +02:00
Zoltan Kochan
e2cc202319 fix: deduping direct deps 2022-11-28 02:05:04 +02:00
Zoltan Kochan
cf783fe9f8 chore(release): 7.17.1 v7.17.1 2022-11-27 03:43:44 +02:00
Glen Whitney
0d12d38fd1 feat(pkg-manifest): preserve comments in json5 manifests (#5677)
Use npm package `strip-comments-strings` to find all comments in any
  manifest file as it is read. Save them as part of the "file formatting"
  detected by the manifest reader, noting for each the text of the lines
  they are on, before, and after, and the line number as a fallback.

  When the manifest is written, attempt to place each comment back in
  the resulting JSON5 text, so that the text of the line it is on,
  before, or after (in that priority order) matches the text at time of
  reading. Otherwise, so that no comments are lost, replace the comment
  on the same line number, adding a notation that it may have been
  relocated (due to sorting dependencies, for example, it may no longer
  be in the same "logical position" in the file, even though it is on
  the same physical line number).

  When comments are in fairly ordinary positions and the manifest does
  not change too drastically (i.e. once the dependencies are sorted as
  pnpm prefers, and there are not many parameters added all at once),
  this strategy results in exact preservation of the comments, as a new
  test shows.

  The motivation for this commit is to take advantage of the feature of
  JSON5 that it allows human-readable comments. For this feature to be
  useful in the case of package.json5 manifests, those comments must be
  preserved across manifest changes.

  Partially resolves #2008. [That issue requests comment preservation
  also for YAML manifests, but I have no experience working with YAML,
  and it also requests that key order be preserved, but I did not
  address key order because current code in the the pnpm manifest
  reader/writer _explicitly_ reorders keys -- clearly deliberately --
  so I did not want to simply remove code that appeared to have been
  purposefully written and included.]

Co-authored-by: Zoltan Kochan <z@kochan.io>
2022-11-27 03:41:21 +02:00
Jordan
868f2fb163 fix: --lockfile-only and readPackage hook modifying workspace packages (#5678)
close #5670
2022-11-26 20:31:57 +02:00