Repository navigation
fix: bundle dependencies so npm installs the tested tree @W-24750342@ - #3013
Merged
Merged
Conversation
npm 12 no longer reads or writes npm-shrinkwrap.json, so npm installs of the CLI float every transitive dependency and ignore our yarn resolutions. Bundle every dependency instead: the published tarball contains the exact node_modules tree that was tested in nightly/rc. Changes: - add explicit bundleDependencies (all dependencies; not `true`, which breaks yarn v1 consumers) - remove prepublishOnly npm shrinkwrap - add a unit test that keeps bundleDependencies in sync with dependencies
Contributor
|
Should we add the test back that ensures all deps are also in the bundled list? |
…4750342@ - fix @inquirer/select typo in bundleDependencies - check every @salesforce/@oclif dependency is bundled and every bundled name is a dependency
iowillhoit
approved these changes
Nov 3, 2026
5 of 6 tasks
WillieRuemmele
added a commit
that referenced
this pull request
Nov 3, 2026
…#3013) * fix: bundle dependencies so npm installs the tested tree @W-24750342@ npm 12 no longer reads or writes npm-shrinkwrap.json, so npm installs of the CLI float every transitive dependency and ignore our yarn resolutions. Bundle every dependency instead: the published tarball contains the exact node_modules tree that was tested in nightly/rc. Changes: - add explicit bundleDependencies (all dependencies; not `true`, which breaks yarn v1 consumers) - remove prepublishOnly npm shrinkwrap - add a unit test that keeps bundleDependencies in sync with dependencies * chore: manual changes * chore: restore ansis/inquierer * test: verify bundleDependencies covers our plugins and libraries @W-24750342@ - fix @inquirer/select typo in bundleDependencies - check every @salesforce/@oclif dependency is bundled and every bundled name is a dependency
WillieRuemmele
added a commit
that referenced
this pull request
Nov 3, 2026
* chore(release): bump to 2.157.8 * fix: bundle dependencies so npm installs the tested tree @W-24750342@ (#3013) * fix: bundle dependencies so npm installs the tested tree @W-24750342@ npm 12 no longer reads or writes npm-shrinkwrap.json, so npm installs of the CLI float every transitive dependency and ignore our yarn resolutions. Bundle every dependency instead: the published tarball contains the exact node_modules tree that was tested in nightly/rc. Changes: - add explicit bundleDependencies (all dependencies; not `true`, which breaks yarn v1 consumers) - remove prepublishOnly npm shrinkwrap - add a unit test that keeps bundleDependencies in sync with dependencies * chore: manual changes * chore: restore ansis/inquierer * test: verify bundleDependencies covers our plugins and libraries @W-24750342@ - fix @inquirer/select typo in bundleDependencies - check every @salesforce/@oclif dependency is bundled and every bundled name is a dependency --------- Co-authored-by: Willie Ruemmele <william.ruemmele@salesforce.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Work Item
@W-24750342@
Summary
npm 12 (now
npm@latest) no longer reads or writesnpm-shrinkwrap.json, sonpm install -g @salesforce/clifloats every transitive dependency and ignores our yarnresolutions. That breaks the guarantee that what we tested for two weeks in nightly/RC is what ships tolatest. Today npm users get, for example,basic-ftp@5.3.1(vulnerable to GHSA-c475-qrg2-pj4r) instead of the resolved 6.2.5, plus duplicate@opentelemetry/*copies.This PR bundles every dependency (
bundleDependencies), so the published tarball contains the exactnode_modulestree that yarn installed and that we tested. npm installs bundled trees as-is and never re-resolves them.Changes
bundleDependencieslist containing every dependency. It isn'ttrue, because yarn v1 crashes (TypeError: true is not iterable!) when installing a package that depends on one withbundleDependencies: true.prepublishOnly: npm shrinkwrap(npm 12 has noshrinkwrapcommand).Files Changed
package.jsontest/package.test.tsTest Plan
npm pack(npm 12.2.1) from a full yarn install, dev deps included: 38.0 MB tarball (was ~112 KB) containing exactly the 830-package prod closure at the same paths and versions as yarn's tree, with no dev-only packagesnpm i -g <tarball>on npm 12.2.1 and npm 11.21.1: identical tree,sf --versionworks, singlebasic-ftp@6.2.5,@opentelemetry/core@3.0.0, SDR and core, install about 22ssf plugins install @salesforce/plugin-community(JIT) works on the bundled installoclif pack:tarballs --targets darwin-arm64: installernode_modulesis identical to one built frommain(951 packages, 0 differences)yarn add <tarball>installs and runsyarn test(76 passing) andyarn lintnpm i -g @salesforce/cli@nightlysmoke test on macOS, Linux and WindowsNotes / trade-offs
overridesornpm dedupe. Transitive CVE fixes ship through a CLI release (on npm 12 the shrinkwrap already didn't help here).yarn install --frozen-lockfilein the github-workflows publish job; JIT plugins.