[Bug 36682] New: Replace yarn with pnpm
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 Bug ID: 36682 Summary: Replace yarn with pnpm Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: me@paulderscheid.xyz QA Contact: testopia@bugs.koha-community.org The idea is to deprecate yarn in favor of pnpm as it offers - better disk space efficiency - speed (compared to yarn) - deterministic installs - stricter dependency isolation -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 Paul Derscheid <me@paulderscheid.xyz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |me@paulderscheid.xyz Version|unspecified |Main -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |paul.derscheid@lmscloud.de Assignee|koha-bugs@lists.koha-commun |paul.derscheid@lmscloud.de |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #1 from David Cook <dcook@prosentient.com.au> --- Sounds interesting. It looks like we use the Debian packaged "yarn" atm, but there is no package for "pnpm". Guessing that's part of why we're on yarn 1.x and not yarn 2.x as well... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- Also, if it stores the modules somewhere than in ./node_modules, then maybe I wouldn't have to chronically be typing "grep --exclude-dir=node_modules" haha. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |victor@tuxayo.net --- Comment #3 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Updating Yarn and using the Yarn PnP strategy (default for new projects) doesn't look bad either: https://github.com/pnpm/pnpm?tab=readme-ov-file#benchmark https://yarnpkg.com/features/pnp https://yarnpkg.com/blog/release/4.0#performances Ultimately both are fast and well maintained. So whichever someone motivated to attempt to make it happen finds easier to migrate to or find differentiating features for our daily use. Thanks for opening the topic! :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #4 from Victor Grousset/tuxayo <victor@tuxayo.net> --- (In reply to David Cook from comment #1)
It looks like we use the Debian packaged "yarn" atm, but there is no package for "pnpm".
Guessing that's part of why we're on yarn 1.x and not yarn 2.x as well...
We install from a repo. Otherwise the D13/trixie build would be on yarn 4 and likely blow up ^^ That's part of why yarn isn't a production dependency I think. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 Eric Phetteplace <ephetteplace@cca.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ephetteplace@cca.edu -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #5 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Created attachment 202144 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202144&action=edit Bug 36682: Adapt lockfile test for pnpm The existing test uses `yarn check` to validate yarn.lock and the installed node_modules tree. It therefore contains special handling for ktd's shared dependency directory and Yarn cache. pnpm provides a lockfile-only frozen installation mode. This validates that package.json and pnpm-lock.yaml agree without linking dependencies, running build scripts, or modifying ktd's shared node_modules tree. Rename the test for pnpm and replace the Yarn- and ktd-specific logic with `pnpm install --lockfile-only --frozen-lockfile`. Test plan: 1. Start ktd before applying the patches: ktd up -d 2. Install pnpm in the running container: ktd --root --shell --run \ 'npm install --global pnpm@10.34.5' 3. Apply only this patch. 4. Run: prove xt/verify-pnpm-lock.t 5. Confirm the test fails because pnpm-lock.yaml does not exist yet. 6. Apply the following pnpm migration patch. 7. Generate the pnpm lockfile: pnpm import pnpm install --lockfile-only 8. Run the test again. 9. Confirm it passes. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #6 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Created attachment 202145 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202145&action=edit Bug 36682: Replace Yarn with pnpm Koha currently uses Yarn Classic, installed in ktd from Yarn's external Debian repository. Modern Yarn removes commands and options used by Koha and ktd and would require a broader migration of the existing build environment. Replace Yarn with pnpm 10.34.5. pnpm supports frozen installations and read-only lockfile validation directly, while providing deterministic dependency resolution, a content-addressed package store, and stricter dependency isolation. Preserve the existing dependency resolutions as pnpm overrides so the RM-generated pnpm lockfile retains the required security constraints. Explicitly allow the dependency build scripts required by Koha. Declare pnpm 10.34.5 as the supported package-manager version. Use pnpm's default isolated linker. ktd continues installing dependencies under /kohadevbox/node_modules, outside the bind-mounted Koha checkout. No checkout-local node_modules or hoisted compatibility configuration is required. Update the resource build, formatting tools, documentation, templates, mock templates, and installation mapping to use pnpm. The lockfile transition is deliberately deferred to the RM. Supported containers must: - use Node.js 18.12 or newer; - install pnpm 10.34.5 globally through npm; - remove the Yarn repository and Yarn Classic package; - install gulp-cli globally through npm; - copy package.json and pnpm-lock.yaml to /kohadevbox; - run `pnpm install --frozen-lockfile` from /kohadevbox; - retain the existing Cypress cache handling. Test plan: 1. Start ktd before applying the patches: ktd up -d 2. Install pnpm in the running container: ktd --root --shell --run \ 'npm install --global pnpm@10.34.5' 3. Apply both patches. 4. Generate the pnpm lockfile from the existing Yarn lockfile: cd /kohadevbox/koha pnpm import pnpm install --lockfile-only 5. Enter a root ktd shell and recreate the shared dependency tree: ktd --root --shell cp /kohadevbox/koha/package.json \ /kohadevbox/koha/pnpm-lock.yaml \ /kohadevbox/ cd /kohadevbox rm -rf node_modules pnpm install --frozen-lockfile 6. Confirm the required dependency build scripts complete successfully. 7. Enter ktd as the normal user: ktd --shell cd /kohadevbox/koha 8. Confirm the expected pnpm version and dependency layout: pnpm --version test ! -e node_modules test -d /kohadevbox/node_modules/.pnpm The version should be 10.34.5 and both test commands should succeed. 9. Verify the lockfile test: prove xt/verify-pnpm-lock.t 10. Build the production assets: pnpm build:prod 11. Verify the development tools: pnpm --silent exec prettier --version pnpm cypress verify 12. Confirm the lockfile test, production build, Prettier, and Cypress checks succeed. Existing asset-size and dependency deprecation warnings are expected. @RM: pnpm-lock.yaml is deliberately not included in this patch and yarn.lock is deliberately not removed. Install the pinned pnpm version globally inside ktd: ktd --root --shell --run \ 'npm install --global pnpm@10.34.5' After applying both patches, generate the replacement lockfile from the root of the Koha checkout: pnpm import pnpm install --lockfile-only prove xt/verify-pnpm-lock.t Include the lockfile transition when pushing the series: git add pnpm-lock.yaml git rm yarn.lock The corresponding koha-testing-docker change and updated images must be available before this is pushed. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com, | |martin.renvoize@openfifth.c | |o.uk, | |pedro.amorim@openfifth.co.u | |k, tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #7 from Paul Derscheid <paul.derscheid@lmscloud.de> --- I have a branch at github dot com/pders01/Koha/tree/wip/yarn4 with the yarn v4 migration path which I tried first. The yarn one would involve much more churn, while the pnpm switch was suprisingly painless. I would recommend we switch to pnpm. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #202144|0 |1 is obsolete| | Attachment #202145|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #8 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 202504 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202504&action=edit Bug 36682: Adapt lockfile test for pnpm The existing test uses `yarn check` to validate yarn.lock and the installed node_modules tree. It therefore contains special handling for ktd's shared dependency directory and Yarn cache. pnpm provides a lockfile-only frozen installation mode. This validates that package.json and pnpm-lock.yaml agree without linking dependencies, running build scripts, or modifying ktd's shared node_modules tree. Rename the test for pnpm and replace the Yarn- and ktd-specific logic with `pnpm install --lockfile-only --frozen-lockfile`. Test plan: 1. Start ktd before applying the patches: ktd up -d 2. Install pnpm in the running container: ktd --root --shell --run \ 'npm install --global pnpm@10.34.5' 3. Apply only this patch. 4. Run: prove xt/verify-pnpm-lock.t 5. Confirm the test fails because pnpm-lock.yaml does not exist yet. 6. Apply the following pnpm migration patch. 7. Generate the pnpm lockfile: pnpm import pnpm install --lockfile-only 8. Run the test again. 9. Confirm it passes. Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #9 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 202505 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202505&action=edit Bug 36682: Replace Yarn with pnpm Koha currently uses Yarn Classic, installed in ktd from Yarn's external Debian repository. Modern Yarn removes commands and options used by Koha and ktd and would require a broader migration of the existing build environment. Replace Yarn with pnpm 10.34.5. pnpm supports frozen installations and read-only lockfile validation directly, while providing deterministic dependency resolution, a content-addressed package store, and stricter dependency isolation. Preserve the existing dependency resolutions as pnpm overrides so the RM-generated pnpm lockfile retains the required security constraints. Explicitly allow the dependency build scripts required by Koha. Declare pnpm 10.34.5 as the supported package-manager version. Use pnpm's default isolated linker. ktd continues installing dependencies under /kohadevbox/node_modules, outside the bind-mounted Koha checkout. No checkout-local node_modules or hoisted compatibility configuration is required. Update the resource build, formatting tools, documentation, templates, mock templates, and installation mapping to use pnpm. The lockfile transition is deliberately deferred to the RM. Supported containers must: - use Node.js 18.12 or newer; - install pnpm 10.34.5 globally through npm; - remove the Yarn repository and Yarn Classic package; - install gulp-cli globally through npm; - copy package.json and pnpm-lock.yaml to /kohadevbox; - run `pnpm install --frozen-lockfile` from /kohadevbox; - retain the existing Cypress cache handling. Test plan: 1. Start ktd before applying the patches: ktd up -d 2. Install pnpm in the running container: ktd --root --shell --run \ 'npm install --global pnpm@10.34.5' 3. Apply both patches. 4. Generate the pnpm lockfile from the existing Yarn lockfile: cd /kohadevbox/koha pnpm import pnpm install --lockfile-only 5. Enter a root ktd shell and recreate the shared dependency tree: ktd --root --shell cp /kohadevbox/koha/package.json \ /kohadevbox/koha/pnpm-lock.yaml \ /kohadevbox/ cd /kohadevbox rm -rf node_modules pnpm install --frozen-lockfile 6. Confirm the required dependency build scripts complete successfully. 7. Enter ktd as the normal user: ktd --shell cd /kohadevbox/koha 8. Confirm the expected pnpm version and dependency layout: pnpm --version test ! -e node_modules test -d /kohadevbox/node_modules/.pnpm The version should be 10.34.5 and both test commands should succeed. 9. Verify the lockfile test: prove xt/verify-pnpm-lock.t 10. Build the production assets: pnpm build:prod 11. Verify the development tools: pnpm --silent exec prettier --version pnpm cypress verify 12. Confirm the lockfile test, production build, Prettier, and Cypress checks succeed. Existing asset-size and dependency deprecation warnings are expected. @RM: pnpm-lock.yaml is deliberately not included in this patch and yarn.lock is deliberately not removed. Install the pinned pnpm version globally inside ktd: ktd --root --shell --run \ 'npm install --global pnpm@10.34.5' After applying both patches, generate the replacement lockfile from the root of the Koha checkout: pnpm import pnpm install --lockfile-only prove xt/verify-pnpm-lock.t Include the lockfile transition when pushing the series: git add pnpm-lock.yaml git rm yarn.lock The corresponding koha-testing-docker change and updated images must be available before this is pushed. Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #10 from Owen Leonard <oleonard@myacpl.org> --- I don't have an opinion about the technical aspects of these patches but they seem to work well! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #11 from Jonathan Druart <jonathan.druart@gmail.com> --- What's needed to make it ready for a push? Adjust koha-testing-docker, koha-misc4dev, wiki. What else? Do we backport to all stable branches at the same time? If not we will have to make koha-testing-docker and koha-misc4dev handle both correctly depending on the version of Koha. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #12 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Still trying to think of more places where something would need to be updated. I think a simultaneous backport would be good. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #202504|0 |1 is obsolete| | Attachment #202505|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #13 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Created attachment 202890 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202890&action=edit Bug 36682: Adapt lockfile test for pnpm The existing test uses `yarn check` to validate yarn.lock and the installed node_modules tree. It therefore contains special handling for ktd's shared dependency directory and Yarn cache. pnpm provides a lockfile-only frozen installation mode. This validates that package.json and pnpm-lock.yaml agree without linking dependencies, running build scripts, or modifying ktd's shared node_modules tree. Rename the test for pnpm and replace the Yarn- and ktd-specific logic with `pnpm install --lockfile-only --frozen-lockfile`. Test plan: 1. Start ktd before applying the patches: ktd up -d 2. Install pnpm in the running container: ktd --root --shell --run \ 'npm install --global pnpm@10.34.5' 3. Apply only this patch. 4. Run: prove xt/verify-pnpm-lock.t 5. Confirm the test fails because pnpm-lock.yaml does not exist yet. 6. Apply the following pnpm migration patch. 7. Generate the pnpm lockfile: pnpm import pnpm install --lockfile-only 8. Run the test again. 9. Confirm it passes. Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #14 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Created attachment 202891 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202891&action=edit Bug 36682: Replace Yarn with pnpm Koha currently uses Yarn Classic, installed in ktd from Yarn's external Debian repository. Modern Yarn removes commands and options used by Koha and ktd and would require a broader migration of the existing build environment. Replace Yarn with pnpm 10.34.5. pnpm supports frozen installations and read-only lockfile validation directly, while providing deterministic dependency resolution, a content-addressed package store, and stricter dependency isolation. Preserve the existing dependency resolutions as pnpm overrides so the RM-generated pnpm lockfile retains the required security constraints. Explicitly allow the dependency build scripts required by Koha. Declare pnpm 10.34.5 as the supported package-manager version. Use pnpm's default isolated linker. ktd continues installing dependencies under /kohadevbox/node_modules, outside the bind-mounted Koha checkout. No checkout-local node_modules or hoisted compatibility configuration is required. Update the resource build, formatting tools, documentation, templates, mock templates, and installation mapping to use pnpm. The lockfile transition is deliberately deferred to the RM. Supported containers must: - use Node.js 18.12 or newer; - install pnpm 10.34.5 globally through npm; - remove the Yarn repository and Yarn Classic package; - install gulp-cli globally through npm; - copy package.json and pnpm-lock.yaml to /kohadevbox; - run `pnpm install --frozen-lockfile` from /kohadevbox; - retain the existing Cypress cache handling. Test plan: 1. Start ktd before applying the patches: ktd up -d 2. Install pnpm in the running container: ktd --root --shell --run \ 'npm install --global pnpm@10.34.5' 3. Apply both patches. 4. Generate the pnpm lockfile from the existing Yarn lockfile: cd /kohadevbox/koha pnpm import pnpm install --lockfile-only 5. Enter a root ktd shell and recreate the shared dependency tree: ktd --root --shell cp /kohadevbox/koha/package.json \ /kohadevbox/koha/pnpm-lock.yaml \ /kohadevbox/ cd /kohadevbox rm -rf node_modules pnpm install --frozen-lockfile 6. Confirm the required dependency build scripts complete successfully. 7. Enter ktd as the normal user: ktd --shell cd /kohadevbox/koha 8. Confirm the expected pnpm version and dependency layout: pnpm --version test ! -e node_modules test -d /kohadevbox/node_modules/.pnpm The version should be 10.34.5 and both test commands should succeed. 9. Verify the lockfile test: prove xt/verify-pnpm-lock.t 10. Build the production assets: pnpm build:prod 11. Verify the development tools: pnpm --silent exec prettier --version pnpm cypress verify 12. Confirm the lockfile test, production build, Prettier, and Cypress checks succeed. Existing asset-size and dependency deprecation warnings are expected. @RM: pnpm-lock.yaml is deliberately not included in this patch and yarn.lock is deliberately not removed. Install the pinned pnpm version globally inside ktd: ktd --root --shell --run \ 'npm install --global pnpm@10.34.5' After applying both patches, generate the replacement lockfile from the root of the Koha checkout: pnpm import pnpm install --lockfile-only prove xt/verify-pnpm-lock.t Include the lockfile transition when pushing the series: git add pnpm-lock.yaml git rm yarn.lock The corresponding koha-testing-docker change and updated images must be available before this is pushed. Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #15 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Thanks a lot for having found differentiators between Modern Yarn and pnpm and going for it! :D It works, here is a second signoff. ----- More testing: If running pnpm install from /kohadevbox/koha it will (as with our current Yarn) redownload and duplicate the dependencies in /kohadevbox/koha. If I do some sabotage with `mv node_modules/prettier node_modules/prettier-fail/` `pnpm exec prettier --version` will fail, so it confirms this is the version used. These dependencies will get old and cause weird bugs as the dependencies shipped with the ktd image will diverge. I don't think there is a reason to worry more about that than with the current setup. Then, to recover from such a situation, I deleted node_modules and .pnpm-store (now full, it was only containing empty dirs after the test plan). And then `pnpm exec prettier --version` worked. It still manages to find the dependencies in the parent directory. It's because of the $PATH containing /kohadevbox/koha/node_modules/.bin/:/kohadevbox/node_modules/.bin/ Weird finding: `pnpm store path` ↓↓ /kohadevbox/koha/.pnpm-store/v10 (which doesn't exist, or was full of empty dirs before my experiment) I don't if that can be and issue. I don't know if there something else to check for when someone inevitably accidently run `pnpm install` from /kohadevbox/koha ? ---- Currently, the clean way to install the dependencies from the lock file is: sudo yarn install --modules-folder /kohadevbox/node_modules (add package name to install it instead) And now it's cd /kohadevbox sudo pnpm install Is that correct? At some point running yarn as root wasn't needed anymore so I the migration to pnpm would change that. But no, yarn as root is how it works currently so with pnpm it's not changing. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #16 from Victor Grousset/tuxayo <victor@tuxayo.net> ---
And now it's cd /kohadevbox sudo pnpm install
Is that correct?
Wait, won't we need to cp package.json & pnpm-lock.yaml in /kohadevbox to update them? Or maybe KTD will have a symlink or something? ----- In internationalization.md "Install the build tools first" I think, as written it's indeed ok to just tell people to run pnpm install, because if the tools are not here, then they are not using KTD so it's specifics don't apply. And for KTD users, they won't need to use that section. So only in case of mistakes the duplication of JS deps would happen. Same as in main. Doc seems good for yarn and will stay good for pnpm. 👍 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 --- Comment #17 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Thanks Victor, these are good catches. The checkout-local `.pnpm-store` is expected because pnpm keeps its store on the same filesystem as the installation so that it can use hardlinks. In this case the checkout is a separate bind-mounted filesystem. This is documented in pnpm's FAQ: pnpm dot io/10.x/faq#does-pnpm-work-across-multiple-drives-or-filesystems The store is only relevant to the checkout-local installation. After removing that installation it can be pruned or removed to reclaim the cache space. --- Yes, updating the shared tree still requires root: ``` sudo pnpm --dir /kohadevbox install --frozen-lockfile ``` And you are right that the manifests in `/kohadevbox` need to stay synchronized. Copying them only at container startup is not sufficient after changing branches or dependencies. I tested symlinking them to the checkout with pnpm 10.34.5, and pnpm still installs into `/kohadevbox/node_modules`. However, your point about someone inevitably running `pnpm install` from the checkout is more important. That is the natural command I would run, and the manifest symlinks do not prevent it from creating a second tree which shadows the one provided by ktd. I do not think documentation alone is a good enough solution here. The ktd setup should make an install from the checkout either use the shared dependency tree or fail with a clear explanation instead of silently creating a local one. I need to adjust that part of the ktd setup before settling on the symlink approach. --- I agree about `internationalization.md`: that section is for installations where the build tools are not already supplied by ktd, so `pnpm install` from the repository is appropriate there. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682 Eric Phetteplace <ephetteplace@cca.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|ephetteplace@cca.edu | -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org