fix(pm): fail on unsupported package manager options - #2775
Draft
jong-kyung wants to merge 29 commits into
Draft
jong-kyung wants to merge 29 commits into
jong-kyung wants to merge 29 commits into
Conversation
Retain supported JSON output, dependency filters, workspace selection, and Bun named catalogs before tightening unsupported-option handling. Related: voidzero-dev#2764
Aggregate fatal support diagnostics before lowering or execution, without hiding errors in silent output. Keep concise messages with spaced version operators and preserve supported forwarding, raw arguments, and managed-global behavior. Place execution-safety snapshots with the affected npm update, pack, and install fixtures. Related: voidzero-dev#2764
Map recursive and filter options to npm workspace flags, including npm fallbacks. Reject explicit non-dot targets with workspace selection because npm otherwise ignores the requested workspace scope.
Run dialect-specific diagnosis before lowering. Reject explicit Berry formats, Classic list output, and non-table Bun output while preserving defaults, supported translations, raw arguments, and managed-global formats. Related: voidzero-dev#2764
Use native staged publishing starting with Yarn 4.16.0 and fall back to npm on earlier versions. Reject unsupported named options before native Yarn execution while preserving options supported by npm fallbacks. Related: voidzero-dev#2764
Declare Yarn and Bun before 1.4 as unsupported for the named --fix option rather than reporting a successful Noop. Preserve native fix support and raw pass-through arguments. Related: voidzero-dev#2764
Reject explicit output and pruning options on unsupported package-manager paths while retaining the existing command-level Noop when no named options are requested. Preserve Classic list output, Bun 1.4 pruning, and managed global list formatting. Related: voidzero-dev#2764
Reject explicit registry selection for whoami, login, and logout, and reject Classic scope selection before executing commands or clearing credentials. Preserve Berry scope, raw selectors, and other package-manager translations. Related: voidzero-dev#2764
Declare --all unsupported for Yarn, npm before 11.16.0, and pnpm before 10.32.0 so rejection happens before lowering. Replace the separate pnpm version check with the common diagnostic while preserving supported mappings, optionless Noops, positional validation, and raw arguments. Related: voidzero-dev#2764
Reject Yarn depth and optional filtering, and npm dependency and workspace selectors whose semantics are not implemented. Aggregate diagnostics while preserving supported filters and raw arguments. Related: voidzero-dev#2764
Preserve Classic home configuration and reject project writes that would modify it. Route Berry user writes through --home, keep merged reads, and leave global behavior and precedence unchanged. Require Yarn 2.2 for user-scoped set and Yarn 3 for delete. Reject unsupported locations before execution, with concise version diagnostics and file-preservation snapshots. The official release changelog documents both native support boundaries: https://github.com/yarnpkg/berry/blob/01586a88806a2bebd7edb28d1bee3581b1fd3762/CHANGELOG.md#220 https://github.com/yarnpkg/berry/blob/01586a88806a2bebd7edb28d1bee3581b1fd3762/CHANGELOG.md#300 Related: voidzero-dev#2764
Reject named recursive unlink before execution on Yarn versions without the native --all command. Classic can misinterpret the package argument, while Yarn 2 can execute an unrelated project script named unlink. Preserve Yarn 3 and newer translations, raw arguments, and commands without the named option. Cover aliases, the version boundary, and script non-execution through both CLI flavors. The Yarn 3.0.0 release links to the changelog announcing the new unlink command: https://github.com/yarnpkg/berry/releases/tag/%40yarnpkg/cli/3.0.0 https://github.com/yarnpkg/berry/blob/01586a88806a2bebd7edb28d1bee3581b1fd3762/CHANGELOG.md#300 Related: voidzero-dev#2764
Declare --no-git-checks unsupported for npm, Yarn, and Bun instead of silently dropping the named option. Preserve pnpm forwarding and raw arguments after --. Cover rejection and prepack non-execution in each package-manager publish fixture without authentication setup. Related: voidzero-dev#2764
Reject named recursive and peer-exclusion options instead of silently discarding them. Preserve Berry translations and raw arguments, and cover both CLI flavors. Related: voidzero-dev#2764
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Forward --dev on Bun 1.4 and newer. Reject it on older versions before an update can change production or optional dependencies, while preserving raw argument passthrough. Cover the version boundary, aggregated errors, and dev-only updates through both local and global CLI snapshots.
Reject package-less install --dev before npm install or ci runs, and remove the invalid --omit=prod translation. Preserve install -D <package> through the add resolver and leave raw arguments unchanged. Cover aggregated errors, silent mode, existing file preservation, and dev dependency additions through both CLI flavors.
Reject package-less install --dev before Bun runs instead of silently installing production dependencies. Preserve install -D <package> through the add resolver and leave raw arguments unchanged. Cover regular and frozen installs, aggregated errors, and dev dependency additions through both CLI flavors.
Reject package-less install --dev before Yarn Classic or Berry runs instead of silently installing all dependencies. Preserve install -D <package> through the add resolver, raw arguments, and pnpm's existing support. Cover regular and frozen installs, aggregated errors, and dev dependency additions through both CLI flavors.
Reject npm and Yarn selectors that do not limit the updated dependencies. Support Bun production and optional selection from 1.4, excluding optional dependencies for production-only updates. Report Yarn Berry filter restrictions with the other unsupported options before lowering. Preserve raw arguments and existing pnpm behavior.
Reject save-dev, save-optional, and save-prod for npm, Yarn, and Bun before they remove packages from unintended dependency sections. Preserve pnpm selectors, raw arguments, and unqualified removals. Cover aggregated errors and unchanged manifests through both CLI flavors, including workspace removals.
Preserve Yarn Berry's range-aware recursive updates and no-save mode from Yarn 3, and use project-wide up for recursive latest updates. Reject incompatible interactive and version combinations before execution while preserving native raw arguments. Route Yarn Classic interactive updates through upgrade-interactive, reject unsupported workspace selections, and require Bun 1.4 for recursive updates. Cover workspace manifests, installed versions, lockfiles, and native interactive selection through both CLI flavors.
Reject Classic filtering and recursive removal, and reject Bun recursive removal regardless of filters or version. Use option declarations so unsupported-option errors aggregate before execution. Preserve native Bun 1.4 filtering without translating recursive removal into a filter-based workaround. Cover rejection without mutation, filtered removal from child directories, raw passthrough, and global routing before local manager validation.
Use npm's omit=dev option for production listings. Including prod and peer dependencies neither excludes dev dependencies nor respects exclude-peers. Reject dev-only listings because npm's include=dev does not restrict the output to development dependencies. Keep native flags available through raw passthrough and cover production exclusions and aggregated errors.
Declare Classic filter restrictions alongside the other unsupported add options so a filter error is not hidden by earlier validation failures. Remove the redundant resolver guard while preserving Berry filtering. Cover raw arguments and install-with-package dispatch to add validation.
Use a globstar for implicit range-preserving recursive selection so scoped packages are updated alongside unscoped dependencies. Preserve the latest mode wildcard, explicit package selection, and raw arguments. Extend workspace regressions to verify scoped versions and unchanged manifests through both CLI surfaces.
Move inline version gates into named dialect support methods and reuse the existing npm 12 helper. Preserve version boundaries, unknown npm behavior, and declarative option restrictions.
…options-error # Conflicts: # crates/vp_pm_cli/src/resolution/commands/add.rs
Aggregate install-mode and package-manager support errors before command lowering instead of warning and continuing after dropping mode-only options. Preserve supported install-to-add forwarding and raw pass-through arguments. Cover combined errors, early rejection, and unchanged project state through unit tests and local/global CLI snapshots, including silent mode.
Refresh the Yarn Classic workspace rejection snapshot for aggregated support errors. Keep the background upgrade notice checks reachable after a silent unsupported add fails, and verify a supported silent add still succeeds.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Vite+ now returns an error when package-manager support checks reject a named option, instead of dropping the option and running a different operation. Detected violations are reported together and remain fatal in silent and
machine-readable modes.
The command audit also corrects dependency selection and workspace update behavior where native equivalents exist. Raw arguments after
--, managed-global package operations, and intentional optionless no-ops and fallbacks retain their existing behavior.Closes #2764
Behavior decisions
--fix-lockfileand--resolution-onlywhen adding packages, and add-only--save-exact,--save-peer,--save-optional, and--save-catalogwithout package names. Aggregate these errors with manager-specific restrictions before lowering, including in silent mode.--omit dev, preserving optional and peer exclusions. Reject npm dev-only listing because--include=devdoes not restrict the output to dev dependencies.upgrade-interactive, but reject recursive updates, multiple workspace filters, and filtered interactive updates.up --recursivefor range-preserving recursive updates, including--no-save. Use project-wideupwith--latest, and reject unsupported version/mode combinations. Implicit all-package selection includes scoped dependencies without widening explicit or raw package patterns.publish --no-git-checkspnpm-only and reject unsupported authentication selectors,whyfilters, output formats, and named options on otherwise successful no-op paths.Version reference
Release notes establish the feature boundaries below. Source inspection and isolated native probes establish the option mappings, including manifest, lockfile, installed-version, and workspace effects where relevant.
--homeunset --home, range-preservingup --recursive, and native unlink--allapprove-builds --allNative probes of npm 10.9.4, 11.16.0, and 12.0.2 showed that
--includedoes not provide exclusive update or listselection. Yarn 3.6.0 and 4.16.0 probes showed that recursive
"*"skips scoped packages, while"**"includes them. CLI regressions check scoped and unscoped installed versions across workspaces while preserving manifest contents.