Skip to content

fix(pm): enforce package manager option compatibility - #3122

Merged
fengmk2 merged 7 commits into
voidzero-dev:mainfrom
jong-kyung:fix/pm-option-version-guards
Oct 19, 2026
Merged

fengmk2 merged 7 commits into
voidzero-dev:mainfrom
jong-kyung:fix/pm-option-version-guards

Conversation

@jong-kyung

@jong-kyung jong-kyung commented Oct 19, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

Reject options that the selected package manager version cannot honor. Older versions can silently ignore these options, including npm versions that attempt to publish despite --dry-run and pnpm versions that omit requested JSON output.

  • Check command-specific version requirements for npm workspace operations and pnpm build, catalog, pack, and finder options. Keep package names required for vp why, including when using --find-by.
  • Reject npm publish requests using --dry-run or --provenance when the npm version is unknown, because Vite+ cannot establish that npm will honor those options. Ordinary publish remains available.
  • Preserve Yarn Classic script skipping. Use --skip-builds for Yarn 2.4 installs and --mode skip-build for Yarn 3 and later. Yarn Modern add commands require Yarn 3 or later for script skipping.
  • Require Bun 1.4 for production and optional dependency update selection. Remove the older --omit optional translation because it excludes installation but still changes optional dependency versions in package.json.
  • Require Bun 1.4 for recursive and filtered updates in both interactive and noninteractive modes. Vite+ uses one version floor for both modes, even though some older interactive workspace filtering works.

Version Reference

Capability Supported version Reference
npm publish --dry-run 5.10.0 stable minimum Changelog
npm publish --provenance 9.5.0 Release notes
npm pack workspace selection 7.9.0 Release notes
npm publish workspace selection 7.13.0 Release notes
npm install, add, remove, update, list, outdated, and explain workspace selection 7.14.0 Release notes
npm --include-workspace-root 8.1.0 Release notes
npm pack --pack-destination 7.18.0 Release notes
pnpm add --allow-build 10.4.0 Changelog
pnpm add --save-catalog and --save-catalog-name 10.12.0 10.12.1 release notes, with the boundary verified against 10.12.0
pnpm recursive and filtered pack 10.11.0 Release notes
pnpm list and why --find-by 10.16.0 Release notes
pnpm publish --json Reject versions from 11.0.0 up to, but excluding, 11.0.7 Release notes
Yarn install --refresh-lockfile, used by vp install --fix-lockfile 4.0.0 Release notes
Yarn install --skip-builds 2.4.0 through 2.x Changelog
Yarn install and add --mode skip-build 3.0.0 Changelog, with add support checked against 2.4.3 and 3.0.0
Bun update --production as a dependency-group selector 1.4.0 Bun 1.4 blog, which describes the changed meaning of --production and --prod
Bun update --no-optional 1.4.0 Bun 1.4 blog for release context. The option-specific boundary was verified against 1.3.14 and 1.4.0.
Bun noninteractive recursive and filtered update 1.4.0 Bun 1.4 blog

Reject unsupported npm, pnpm, Yarn, and Bun options before execution.
Use the supported Yarn script-skipping flags and preserve older Bun
workspace filtering in interactive updates. Allow pnpm why finders
without positional package names.

Update existing resolver tests and CLI snapshots for the corrected behavior.
Add local and global regression snapshots for unsupported options and
the pnpm publish JSON regression. Keep the publish fixture private.
@jong-kyung

Copy link
Copy Markdown
Collaborator Author

@codex review

@jong-kyung jong-kyung self-assigned this Oct 19, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 19, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-19T14:31:59.535571Z e412e7d Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Remove the pnpm-only exception for --find-by from the shared argument parser. Restore the required positional argument in help output and cover the rejection in CLI snapshots.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: adb8f7b251

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread crates/vp_pm_cli/src/resolution/commands/update.rs Outdated
Extend the related command fixtures instead of maintaining a separate version-guard fixture. Reuse existing pnpm add coverage and set packageManager in temporary manifests so local and global commands use the intended versions.

Keep the npm publication probes private and cover why's required package names in its existing snapshots.
Apply the same minimum version to recursive and filtered updates in both interactive and noninteractive modes. Remove the interactive exception and use the shared option guards.

Cover stable and prerelease rejection in resolver tests and update the existing Bun command snapshots.

Reference: https://bun.com/blog/bun-v1.4
@jong-kyung

Copy link
Copy Markdown
Collaborator Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 3bc8c22d58

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@jong-kyung
jong-kyung marked this pull request as ready for review October 19, 2026 14:24
@jong-kyung
jong-kyung requested a review from fengmk2 October 19, 2026 14:26
@fengmk2
fengmk2 merged commit f5e525f into voidzero-dev:main Oct 19, 2026
74 checks passed
@jong-kyung
jong-kyung deleted the fix/pm-option-version-guards branch October 19, 2026 18:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants