-
Notifications
You must be signed in to change notification settings - Fork 245
feat(install): support pnpm v12 native binary distribution #2289
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
fengmk2
merged 12 commits into
voidzero-dev:main
from
jong-kyung:fix/pnpm-v12-native-binary
Aug 3, 2026
Merged
Changes from all commits
Commits
Show all changes
12 commits
Select commit
Hold shift + click to select a range
891f54b
fix(install): support pnpm v12 native binary distribution
jong-kyung c8e25e0
fix(install): verify declared packageManager hash for pnpm >= 12
jong-kyung 228e3fb
test(install): drop pnpm v12 hash integration test
jong-kyung 9806216
docs(install): note the pnpm >= 12 platform tarball integrity limitation
jong-kyung 65e51a8
Merge branch 'main' into fix/pnpm-v12-native-binary
jong-kyung fdf50f5
Merge branch 'main' into fix/pnpm-v12-native-binary
jong-kyung 82ac24c
Merge branch 'main' into fix/pnpm-v12-native-binary
fengmk2 76664d9
feat(install): verify pnpm v12 platform tarball against dist.integrity
jong-kyung 4b3913c
refactor(install): verify SRI integrity without a decode-encode round…
jong-kyung 1171535
fix(install): accept SHA-384 SRI integrity
jong-kyung c1e92ae
Revert "fix(install): accept SHA-384 SRI integrity"
jong-kyung 5a5ecb9
Merge branch 'main' into fix/pnpm-v12-native-binary
fengmk2 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
5 changes: 5 additions & 0 deletions
5
crates/vite_cli_snapshots/tests/cli_snapshots/fixtures/command_add_pnpm12/package.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| { | ||
| "name": "command-add-pnpm12", | ||
| "version": "1.0.0", | ||
| "packageManager": "pnpm@12.0.0-beta.0" | ||
| } |
18 changes: 18 additions & 0 deletions
18
crates/vite_cli_snapshots/tests/cli_snapshots/fixtures/command_add_pnpm12/snapshots.toml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [[case]] | ||
| name = "command_add_pnpm12" | ||
| vp = "global" | ||
| skip-platforms = ["windows"] | ||
| steps = [ | ||
| { argv = ["vp", "add", "--help"], comment = "should show help", continue-on-failure = true }, | ||
| { argv = ["vp", "add"], comment = "should error because no packages specified", continue-on-failure = true }, | ||
| { argv = ["vp", "add", "testnpm2", "-D", "--", "--loglevel=verbose", "--verbose"], comment = "should add package as dev dependencies" }, | ||
| { argv = ["vpt", "print-file", "package.json"], continue-on-failure = true }, | ||
| { argv = ["vp", "add", "testnpm2", "test-vite-plus-install", "--allow-build=test-vite-plus-install"], comment = "should add packages to dependencies" }, | ||
| { argv = ["vpt", "print-file", "package.json"], continue-on-failure = true }, | ||
| { argv = ["vp", "install", "test-vite-plus-package@1.0.0", "--save-peer"], comment = "should install package alias for add" }, | ||
| { argv = ["vpt", "print-file", "package.json"], continue-on-failure = true }, | ||
| { argv = ["vp", "add", "test-vite-plus-package-optional", "-O"], comment = "should add package as optional dependencies" }, | ||
| { argv = ["vpt", "print-file", "package.json"], continue-on-failure = true }, | ||
| { argv = ["vp", "add", "test-vite-plus-package-optional", "--", "--loglevel=warn"], comment = "support pass through arguments" }, | ||
| { argv = ["vpt", "print-file", "package.json"], continue-on-failure = true }, | ||
| ] |
185 changes: 185 additions & 0 deletions
185
...tests/cli_snapshots/fixtures/command_add_pnpm12/snapshots/command_add_pnpm12.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,185 @@ | ||
| # command_add_pnpm12 | ||
|
|
||
| ## `vp add --help` | ||
|
|
||
| should show help | ||
|
|
||
| ``` | ||
| VITE+ - The Unified Toolchain for the Web | ||
|
|
||
| Usage: vp add [OPTIONS] <PACKAGES>... [-- <PASS_THROUGH_ARGS>...] | ||
|
|
||
| Add packages to dependencies | ||
|
|
||
| Arguments: | ||
| <PACKAGES>... Packages to add | ||
| [PASS_THROUGH_ARGS]... Additional arguments to pass through to the package manager | ||
|
|
||
| Options: | ||
| -P, --save-prod Save to `dependencies` (default) | ||
| -D, --save-dev Save to `devDependencies` | ||
| --save-peer Save to `peerDependencies` and `devDependencies` | ||
| -O, --save-optional Save to `optionalDependencies` | ||
| -E, --save-exact Save exact version rather than semver range | ||
| --save-catalog-name <CATALOG_NAME> Save the new dependency to the specified catalog name | ||
| --save-catalog Save the new dependency to the default catalog | ||
| --allow-build <NAMES> A list of package names allowed to run postinstall | ||
| --filter <PATTERN> Filter packages in monorepo (can be used multiple times) | ||
| -w, --workspace-root Add to workspace root | ||
| --workspace Only add if package exists in workspace (pnpm-specific) | ||
| -g, --global Install globally | ||
| --node <NODE> Node.js version to use for global installation (only with -g) | ||
| --concurrency <CONCURRENCY> Number of global package installs to run in parallel (only with -g) | ||
| -h, --help Print help | ||
|
|
||
| Documentation: https://viteplus.dev/guide/install | ||
| ``` | ||
|
|
||
| ## `vp add` | ||
|
|
||
| should error because no packages specified | ||
|
|
||
| **Exit code:** 2 | ||
|
|
||
| ``` | ||
| error: the following required arguments were not provided: | ||
| <PACKAGES>... | ||
|
|
||
| Usage: vp add <PACKAGES>... [-- <PASS_THROUGH_ARGS>...] | ||
|
|
||
| For more information, try '--help'. | ||
| ``` | ||
|
|
||
| ## `vp add testnpm2 -D -- --loglevel=verbose --verbose` | ||
|
|
||
| should add package as dev dependencies | ||
|
|
||
| **Exit code:** 2 | ||
|
|
||
| ``` | ||
| error: unexpected argument '--loglevel' found | ||
|
|
||
| tip: to pass '--loglevel' as a value, use '-- --loglevel' | ||
|
|
||
| Usage: pnpm add --save-dev <PACKAGE_NAMES>... | ||
|
|
||
| For more information, try '--help'. | ||
| ``` | ||
|
|
||
| *(skipped 1 step(s) to the next line boundary: step failed)* | ||
|
|
||
| ## `vp add testnpm2 test-vite-plus-install --allow-build=test-vite-plus-install` | ||
|
|
||
| should add packages to dependencies | ||
|
|
||
| ``` | ||
|
|
||
| dependencies: | ||
| test-vite-plus-install 1.0.0 | ||
| testnpm2 1.0.1 | ||
|
|
||
| Done in <duration> using pnpm <version> | ||
| ``` | ||
|
|
||
| ## `vpt print-file package.json` | ||
|
|
||
| ``` | ||
| { | ||
| "name": "command-add-pnpm12", | ||
| "version": "1.0.0", | ||
| "packageManager": "pnpm@12.0.0-beta.0", | ||
| "dependencies": { | ||
| "test-vite-plus-install": "^1.0.0", | ||
| "testnpm2": "^1.0.1" | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ## `vp install test-vite-plus-package@1.0.0 --save-peer` | ||
|
|
||
| should install package alias for add | ||
|
|
||
| ``` | ||
| VITE+ - The Unified Toolchain for the Web | ||
|
|
||
| ✓ Lockfile passes supply-chain policies (verified <duration> ago) | ||
|
|
||
| devDependencies: | ||
| test-vite-plus-package 1.0.0 | ||
|
|
||
| Done in <duration> using pnpm <version> | ||
| ``` | ||
|
|
||
| ## `vpt print-file package.json` | ||
|
|
||
| ``` | ||
| { | ||
| "name": "command-add-pnpm12", | ||
| "version": "1.0.0", | ||
| "packageManager": "pnpm@12.0.0-beta.0", | ||
| "dependencies": { | ||
| "test-vite-plus-install": "^1.0.0", | ||
| "testnpm2": "^1.0.1" | ||
| }, | ||
| "devDependencies": { | ||
| "test-vite-plus-package": "1.0.0" | ||
| }, | ||
| "peerDependencies": { | ||
| "test-vite-plus-package": "1.0.0" | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ## `vp add test-vite-plus-package-optional -O` | ||
|
|
||
| should add package as optional dependencies | ||
|
|
||
| ``` | ||
| ✓ Lockfile passes supply-chain policies (verified <duration> ago) | ||
|
|
||
| optionalDependencies: | ||
| test-vite-plus-package-optional 1.0.0 | ||
|
|
||
| Done in <duration> using pnpm <version> | ||
| ``` | ||
|
|
||
| ## `vpt print-file package.json` | ||
|
|
||
| ``` | ||
| { | ||
| "name": "command-add-pnpm12", | ||
| "version": "1.0.0", | ||
| "packageManager": "pnpm@12.0.0-beta.0", | ||
| "dependencies": { | ||
| "test-vite-plus-install": "^1.0.0", | ||
| "testnpm2": "^1.0.1" | ||
| }, | ||
| "devDependencies": { | ||
| "test-vite-plus-package": "1.0.0" | ||
| }, | ||
| "peerDependencies": { | ||
| "test-vite-plus-package": "1.0.0" | ||
| }, | ||
| "optionalDependencies": { | ||
| "test-vite-plus-package-optional": "^1.0.0" | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ## `vp add test-vite-plus-package-optional -- --loglevel=warn` | ||
|
|
||
| support pass through arguments | ||
|
|
||
| **Exit code:** 2 | ||
|
|
||
| ``` | ||
| error: unexpected argument '--loglevel' found | ||
|
|
||
|
jong-kyung marked this conversation as resolved.
|
||
| tip: to pass '--loglevel' as a value, use '-- --loglevel' | ||
|
|
||
| Usage: pnpm add [OPTIONS] <PACKAGE_NAMES>... | ||
|
|
||
| For more information, try '--help'. | ||
| ``` | ||
|
|
||
| *(skipped 1 step(s) to the next line boundary: step failed)* | ||
6 changes: 6 additions & 0 deletions
6
crates/vite_cli_snapshots/tests/cli_snapshots/fixtures/shim_pnpm12_native/package.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| { | ||
| "name": "shim-pnpm12-native", | ||
| "version": "1.0.0", | ||
| "private": true, | ||
| "packageManager": "pnpm@12.0.0-beta.0" | ||
| } |
12 changes: 12 additions & 0 deletions
12
crates/vite_cli_snapshots/tests/cli_snapshots/fixtures/shim_pnpm12_native/snapshots.toml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| [[case]] | ||
| name = "shim_pnpm12_native" | ||
| vp = "global" | ||
| local-registry = true | ||
| skip-platforms = ["windows"] | ||
| comment = "pnpm 12 ships a native binary via @pnpm/exe.* platform packages; the pnpm shim runs it directly and the pnpx shim injects the dlx subcommand." | ||
| steps = [ | ||
| { argv = ["vp", "install", "-g", "pnpm"], comment = "Expose the pnpm/pnpx shims", snapshot = false, continue-on-failure = true }, | ||
| { argv = ["vp", "env", "exec", "node", "--version"], comment = "Ensure Node.js is installed first", snapshot = false, continue-on-failure = true }, | ||
| { argv = ["pnpm", "--version"], comment = "pnpm shim downloads the native binary and resolves the pinned packageManager version (12.0.0-beta.0)", continue-on-failure = true }, | ||
| { argv = ["pnpx", "--silent", "cowsay", "hello"], comment = "pnpx shim injects dlx so the native binary runs the package", continue-on-failure = true }, | ||
| ] |
36 changes: 36 additions & 0 deletions
36
...tests/cli_snapshots/fixtures/shim_pnpm12_native/snapshots/shim_pnpm12_native.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| # shim_pnpm12_native | ||
|
|
||
| pnpm 12 ships a native binary via @pnpm/exe.* platform packages; the pnpm shim runs it directly and the pnpx shim injects the dlx subcommand. | ||
|
|
||
| ## `vp install -g pnpm` | ||
|
|
||
| Expose the pnpm/pnpx shims | ||
|
|
||
|
|
||
| ## `vp env exec node --version` | ||
|
|
||
| Ensure Node.js is installed first | ||
|
|
||
|
|
||
| ## `pnpm --version` | ||
|
|
||
| pnpm shim downloads the native binary and resolves the pinned packageManager version (12.0.0-beta.0) | ||
|
|
||
| ``` | ||
| 12.0.0-beta.0 | ||
| ``` | ||
|
|
||
| ## `pnpx --silent cowsay hello` | ||
|
|
||
| pnpx shim injects dlx so the native binary runs the package | ||
|
|
||
| ``` | ||
| _______ | ||
| < hello > | ||
| ------- | ||
| \ ^__^ | ||
| \ (oo)\_______ | ||
| (__)\ )\/\ | ||
| ||----w | | ||
| || || | ||
| ``` |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.