fix(lockfile): tolerate non-string pnpm engines values#419
Open
pullfrog[bot] wants to merge 1 commit into
Open
fix(lockfile): tolerate non-string pnpm engines values#419pullfrog[bot] wants to merge 1 commit into
pullfrog[bot] wants to merge 1 commit into
Conversation
A package's engines map can carry a non-string value (e.g. cordova-plugin-inappbrowser ships engines.cordovaDependencies as a nested map, which pnpm preserves verbatim in pnpm-lock.yaml). The pnpm lockfile parser deserialized engines as a strict BTreeMap<String, String> and failed the whole install with ERR_NUB_MANIFEST_PARSE. Apply aube_manifest::engines_tolerant, the same deserializer the npm lockfile parser already uses for the analogous array-shaped case: keep string ranges, drop non-string entries.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
nub installfailed to parse apnpm-lock.yamlwhen a package'senginesmap carried a non-string value:cordova-plugin-inappbrowser@6.0.0shipsengines.cordovaDependenciesas a nested map, which pnpm preserves verbatim in the lockfile. The pnpm lockfile parser deserializedenginesas a strictBTreeMap<String, String>, so the nested-map value tripped the whole parse and failed the install.Fix
Apply
aube_manifest::engines_tolerantto the pnpm parser'senginesfield — the same deserializer the npm lockfile parser already uses for the analogous array-shaped legacy case. It keeps ordinary string ranges (node,npm) and drops non-string entries. The fix covers both pnpm parse paths (the whole-file serde path and the subset-scanner fallback), since both funnel package bodies through the sameRawPackageInfostruct.A dropped nested value won't survive a subsequent lockfile re-write — the same accepted tradeoff npm's parser already makes, and aube never consumes those values.
Test
Added
parse_package_engines_tolerates_nested_map_values, a regression test built from the reported shape that asserts the ordinarynoderange survives and the nested-mapcordovaDependenciesentry is dropped. Fails before the fix, passes after. All 144 pnpm lockfile tests pass.Closes #417
Claude Opus｜ 𝕏