From 08380f8e10a9d5b28800140c98265ba67db1066f Mon Sep 17 00:00:00 2001 From: JPeer264 Date: Wed, 21 Oct 2026 20:38:56 +0200 Subject: [PATCH] chore: Pin pnpm 10 in Volta and remove .npmrc Volta cannot start pnpm 11 or newer, because it looks for `bin/pnpm.cjs`. So the Volta pin stays on pnpm 10, which switches to the `packageManager` version by default. The `.npmrc` setting `manage-package-manager-versions` was only needed for pnpm 9. This also fixes `pnpm test --watch` locally (pnpm 9 rejected the option before it switched) and removes the npm warning about the unknown project config. package.json and CONTRIBUTING.md now say that the Volta pin needs `VOLTA_FEATURE_PNPM=1` in the shell profile. Co-Authored-By: Claude Opus 5.5 --- .../fix-security-vulnerability/scripts/classify-alerts.mjs | 2 +- .npmrc | 3 --- CONTRIBUTING.md | 5 +++-- package.json | 6 +++++- 4 files changed, 9 insertions(+), 7 deletions(-) delete mode 100644 .npmrc diff --git a/.agents/skills/fix-security-vulnerability/scripts/classify-alerts.mjs b/.agents/skills/fix-security-vulnerability/scripts/classify-alerts.mjs index 9d516625709e..03723204cb62 100644 --- a/.agents/skills/fix-security-vulnerability/scripts/classify-alerts.mjs +++ b/.agents/skills/fix-security-vulnerability/scripts/classify-alerts.mjs @@ -69,7 +69,7 @@ function fetchOpenAlerts() { } // Resolve a dependency's installed directory, preferring the consumer's nested node_modules and -// falling back to the hoisted root node_modules (`node-linker=hoisted` in .npmrc hoists most deps to the root). +// falling back to the hoisted root node_modules (`nodeLinker: hoisted` in pnpm-workspace.yaml hoists most deps to the root). function resolveDepDir(name, baseDir) { const candidates = [join(baseDir, 'node_modules', name), join(REPO_ROOT, 'node_modules', name)]; return candidates.find(dir => existsSync(join(dir, 'package.json'))); diff --git a/.npmrc b/.npmrc deleted file mode 100644 index d2209a0ecc1b..000000000000 --- a/.npmrc +++ /dev/null @@ -1,3 +0,0 @@ -# Volta runs pnpm 9.15.9, because it cannot run newer versions. This setting makes pnpm 9 switch to the -# `packageManager` version of package.json. The pnpm settings are in pnpm-workspace.yaml. -manage-package-manager-versions=true diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c65ca5d97765..951352e7be99 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -14,8 +14,9 @@ Developer Documentation. ## Setting up an Environment -We use [Volta](https://volta.sh/) to ensure we use consistent versions of node and pnpm. Make sure to enable -[pnpm support in Volta](https://docs.volta.sh/advanced/pnpm). +We use [Volta](https://volta.sh/) to ensure we use consistent versions of node and pnpm. Volta manages pnpm only when +[pnpm support](https://docs.volta.sh/advanced/pnpm) is enabled, so add `export VOLTA_FEATURE_PNPM=1` to your shell +profile (for example `~/.zshrc`). `sentry-javascript` is a monorepo containing several packages, managed with pnpm workspaces and Nx. To get started, install all dependencies, and then perform an initial build, so TypeScript can read all of the linked type definitions. diff --git a/package.json b/package.json index f1a984aa9b49..2fd815f69e1d 100644 --- a/package.json +++ b/package.json @@ -49,9 +49,13 @@ "yalc:publish": "nx run-many -t yalc:publish" }, "packageManager": "pnpm@12.11.2", + "//_volta_comment": [ + "Volta cannot start pnpm 11 or newer (volta-cli/volta#2114). It starts this pnpm 10 version, which switches to the `packageManager` version.", + "Volta reads the pnpm version only when `VOLTA_FEATURE_PNPM=1` is set, see CONTRIBUTING.md." + ], "volta": { "node": "24.21.0", - "pnpm": "9.15.9" + "pnpm": "10.34.6" }, "//_workspaces_comment": [ "pnpm reads the workspace packages from pnpm-workspace.yaml. Deno and the repo scripts read this list.",