Repository navigation
build: pin lerna 10 instead of inheriting it transitively - #627
Merged
Merged
Conversation
lerna is not declared in this repo. It arrives as a transitive dependency of
@versini/dev-dependencies-common and is reachable only because shamefullyHoist
lifts it to the root.
So the lerna running `lerna run build/lint/test` here, and `lerna publish
from-package` in CI, is versioned by a shared config-preset package this repo
never asked for a build tool from.
Declare it directly, at 10.0.0.
Going straight to 10 rather than first pinning the inherited 9.0.7: lerna 10's
publish path is already proven in this fleet. The dev-dependencies release job
has no install step, so its `npx lerna` fetches the latest from the registry —
which means @versini/dev-dependencies-{common,client} 13.0.2/14.0.2 (Jul 30)
and 13.0.3/14.0.3 (Jul 31) were published by lerna 10.0.0 on Node 22.x, using
the same `publish from-package --no-push --no-private --yes` invocation used
here.
None of lerna 10's breaking changes apply:
- EBEHIND-in-CI is gated behind `requiresGit` (false for `from-package`) and
`pushToRemote` (false under `--no-push`), so it cannot fire.
- The conventional-changelog rewrite only affects `lerna version`, unused here.
- ESM-only is irrelevant; nothing imports lerna programmatically.
- The Node floor moves to >=22.13. Every runner is on 22.x (which resolves to
latest 22) or 24.x. Note there is no engine-strict, so a local machine on
22.0-22.12 would fail at runtime rather than at install.
Unlike a 9.0.7 pin, this is not a lockfile no-op: it adds ~45 packages, almost
all of it nx 22.7.x -> 23.1.1 with its platform binaries plus the new
conventional-changelog stack. Nothing is removed — dev-dependencies-common
still depends on lerna 9.0.7, so both majors sit in the tree until lerna is
dropped from that package. `node_modules/.bin/lerna` resolves to 10.0.0, and
pnpm links nx 23.1.1 inside the lerna@10 instance regardless of which nx wins
the root hoist.
Verified `npx --no-install lerna --version` resolves 10.0.0 (--no-install
proves local resolution rather than a registry fetch), then `pnpm build` (14
projects) and `pnpm test` (12 projects, 75 tests), both exit 0. `lerna run` is
the surface nx 23 actually changes, so those runs are the check that matters.
Next: drop lerna from dev-dependencies-common, after which lerna 9 and nx 22
leave this tree entirely, and stop being installed in clubroad, episodia and
auth0-thin, which never run lerna at all.
Claude-Session: https://claude.ai/code/session_018rggC8Ucw8LWiXkeTjX91R
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
aversini
force-pushed
the
build/pin-lerna-explicitly
branch
from
August 2, 2026 17:19
faa6b5b to
0d3ca87
Compare
aversini
changed the title
aversini
added a commit
that referenced
this pull request
Aug 2, 2026
@versini/dev-dependencies-common 14.0.0 drops lerna from the bundle (versini-org/dev-dependencies#883). Removing it is the only difference between 13.0.3 and 14.0.0 — confirmed by set-diffing the two published manifests: one dependency removed, none added, none changed. lerna is still available here: this repo pins it directly at 10.0.0 (#627). What leaves the tree is the inherited lerna 9.0.7 and its nx 22 — the lockfile now carries lerna@10.0.0 and nothing else. Verified `pnpm build` (14 projects) and `pnpm test` (12 projects) pass, both driven by `lerna run`. Claude-Session: https://claude.ai/code/session_018rggC8Ucw8LWiXkeTjX91R Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pin
lernaexplicitly at 10.0.0 instead of inheriting 9.0.7 transitively.Why
lerna is not declared in this repo. It arrives as a transitive dependency of
@versini/dev-dependencies-commonand is reachable only becauseshamefullyHoistlifts it to the root.So the lerna running
lerna run build/lint/testhere, andlerna publish from-packagein CI, is versioned by a shared config-preset package this repo never asked for a build tool from.Changes
package.json— add"lerna": "10.0.0"todevDependenciespnpm-lock.yaml— regeneratedWhy 10 directly, rather than pinning the inherited 9.0.7 first
lerna 10's publish path is already proven in this fleet. The
dev-dependenciesrelease job has no install step, so itsnpx lernafetches the latest from the registry — which means@versini/dev-dependencies-{common,client}13.0.2/14.0.2 (Jul 30) and 13.0.3/14.0.3 (Jul 31) were published by lerna 10.0.0 on Node 22.x, using the samepublish from-package --no-push --no-private --yesinvocation used here.None of lerna 10's breaking changes apply:
EBEHINDnow throws in CIrequiresGit(false forfrom-package) andpushToRemote(false under--no-push)lerna version, unused22.x(resolves to latest 22) or24.xengine-strictanywhere, so a local machine on Node 22.0–22.12 would fail at runtime rather than at install.Lockfile impact
Unlike a 9.0.7 pin, this is not a no-op: roughly 45 packages added, almost all of it nx 22.7.x → 23.1.1 with its platform binaries, plus the new conventional-changelog stack. Nothing is removed —
dev-dependencies-commonstill depends on lerna 9.0.7, so both majors sit in the tree until lerna is dropped from that package.node_modules/.bin/lernaresolves to 10.0.0, and pnpm links nx 23.1.1 inside the lerna@10 instance regardless of which nx wins the root hoist.Verification
npx --no-install lerna --version→10.0.0(--no-installproves local resolution, not a registry fetch)pnpm build— 14 projects ✅pnpm test— 12 projects, 75 tests ✅lerna runis the surface nx 23 actually changes, so those runs are the check that matters here.Notes
Part of decoupling lerna from
@versini/dev-dependencies-common. Once lerna is dropped there, lerna 9 and nx 22 leave this tree entirely, and stop being installed inclubroad,episodiaandauth0-thin, which never run lerna at all.No published package changes here — the root is private, and
build:does not trigger a release.🤖 Generated with Claude Code
https://claude.ai/code/session_018rggC8Ucw8LWiXkeTjX91R