From 372ea3be9452510d1c6a124357ab32bc80adae09 Mon Sep 17 00:00:00 2001 From: John McLear Date: Thu, 16 Apr 2026 15:20:00 +0100 Subject: [PATCH] fix: downgrade ERR_PNPM_IGNORED_BUILDS to a warning (#7527) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Plugin CI is still failing on ERR_PNPM_IGNORED_BUILDS even with the build-script policy declared in both pnpm-workspace.yaml (#7523) and package.json (#7525). pnpm's strict-dep-builds defaults to true in 10+, so any transitive dep with an unrecognized postinstall fails the build. For etherpad-lite — and especially for downstream plugin repos that pull this codebase as their core install — that's a footgun: the moment some new transitive ships a postinstall, every plugin's CI explodes. Set strictDepBuilds: false in pnpm-workspace.yaml AND strict-dep-builds=false in .npmrc as a defensive layer, so unknown postinstalls become a warning instead of a hard failure. The allow/ignore lists still control what actually runs. Co-authored-by: Claude Opus 4.6 (1M context) --- .npmrc | 1 + pnpm-workspace.yaml | 4 ++++ 2 files changed, 5 insertions(+) create mode 100644 .npmrc diff --git a/.npmrc b/.npmrc new file mode 100644 index 000000000..1a99418bf --- /dev/null +++ b/.npmrc @@ -0,0 +1 @@ +strict-dep-builds=false diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index e035e34e3..c906e975a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -11,3 +11,7 @@ onlyBuiltDependencies: # encountered as transitive deps (e.g. scarf pulled in via swagger-ui-dist). ignoredBuiltDependencies: - '@scarf/scarf' +# Belt-and-suspenders: even if a fresh transitive dep slips through with a +# postinstall script, downgrade to a warning so CI doesn't break for +# downstream plugin repos that pull etherpad-lite as their core install. +strictDepBuilds: false