Skip to content

Use pnpm#176

Merged
dividat-jgu merged 7 commits into
dividat:mainfrom
knuton:use-pnpm
Jun 19, 2026
Merged

Use pnpm#176
dividat-jgu merged 7 commits into
dividat:mainfrom
knuton:use-pnpm

Conversation

@knuton

@knuton knuton commented Jun 6, 2026

Copy link
Copy Markdown
Member
  • Unify on nixpkgs from nixos-26.05 channel
  • Switch to pnpm from npm to derisk usage of libraries from npm registry

As it has before, pnpm proves to be a fragile beast, failing with an issue I did not find documented in pnpm issue tracker on macOS CI runners, when performing the advanced operation of pnpm install (Fix pnpm on macOS CI runners). Still the better bullet to bite compared with npm, unfortunately.

Checklist

@knuton knuton force-pushed the use-pnpm branch 2 times, most recently from dd16099 to 10efa07 Compare June 6, 2026 20:37
@knuton knuton marked this pull request as ready for review June 8, 2026 12:16
@knuton knuton added the dependencies Pull requests that update a dependency file label Jun 8, 2026
@dividat-jgu dividat-jgu self-requested a review June 18, 2026 14:50

@dividat-jgu dividat-jgu left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code change is looking good. This needs rebasing. I’ll test it out once it’s rebased.

Comment thread nix/crossBuild.nix Outdated
knuton added 6 commits June 18, 2026 17:18
When splitting nixpkgs dependencies into the "main" version for general
builds (24.11) and the forward version for macOS builds (25.05), the
motivation was that 24.11 did not work for macOS, but everything else
should stay in line with the driver's main environment PlayOS, which was
pinned to 24.11 at the time.

PlayOS has since been upgraded to 25.11 and may be further upgraded to
26.05 before the next release. Either way, unifying to a single 26.05
channel nixpkgs version from does not require significant changes to the
build definitions relative to 24.11. So we should not expect surprises
even when building in 25.11 in the context of PlayOS.

Moving everything to 26.05 unifies macOS and other cross-build targets
again, and allows us to bring in modern versions of developer tools.

In particular, we want to replace npm with pnpm v11.
This reference now throws with a warning, it seems advised to delete it
without replacement:

> You may see references to darwin.apple_sdk.frameworks. This is the
> legacy SDK pattern, and it is being phased out. All packages in
> darwin.apple_sdk, darwin.apple_sdk_11_0, and darwin.apple_sdk_12_3 have
> been removed. If your derivation references them, you should delete
> those references, as the default SDK should be enough to build your
> package.

https://nixos.org/manual/nixpkgs/stable/#sec-darwin-legacy-frameworks
I could not find this to be a known issue, but `pnpm install` seems to
fail on GitHub's macOS CI runners with pnpm v11.4.0.

    (node:6000) Warning: File descriptor 44 closed but not opened in unmanaged mode
    (node:6000) Warning: File descriptor 44 opened in unmanaged mode twice
    (node:6000) Warning: File descriptor 44 closed but not opened in unmanaged mode
    (node:6000) Warning: File descriptor 44 opened in unmanaged mode twice
    (node:6000) Warning: File descriptor 44 closed but not opened in unmanaged mode
    Progress: resolved 114, reused 0, downloaded 114, added 114, done

    dependencies:
    + bonjour 3.5.0
    + chai 4.3.4
    + mocha 10.8.2
    + ws 8.20.1

    devDependencies:
    + binary-split 1.0.5
    + commander 12.1.0

    make: *** [Makefile:37: test] Killed: 9
    Error: Process completed with exit code 2.

https://github.com/dividat/driver/actions/runs/27065072565/job/79888185694

Tried bumping NodeJS to current LTS. It didn't help the killed pnpm
process, but it's a good idea to use it anyway.
Maintainer is strategically refusing to publish a `4.0.x` patch release
with fixed provenance to get library users to update.

The latest stable mocha release (v11) still relies on `4.0.x`[^1], major
version v12 should bump to chokidar 5.0.0, no release date
announced[^2].

[^1]: https://github.com/mochajs/mocha/blob/v11.7.7/package.json
[^2]: mochajs/mocha#5357
This is just

    pnpm import
    rm package-lock.json
@knuton

knuton commented Jun 18, 2026

Copy link
Copy Markdown
Member Author

Rebased

@dividat-jgu

Copy link
Copy Markdown
Contributor

OK running Senso driver, but I’m getting an error running the replayer for Flex devices:

$ node tools/replay-flex --device v6 rec/flex/v6/zero.v6.ws.dat
…
Error: Cannot find module 'debug'

@dividat-jgu dividat-jgu added details needed Further information requested to better evaluate changes and removed dependencies Pull requests that update a dependency file labels Jun 19, 2026
Used in flex replay tool implementation, previously brought in as a
transitive dependency, but transitive dependency can no longer be
required with pnpm's isolated installs.
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​debug@​4.4.0 ⏵ 4.4.3100 +110010083100

View full report

@knuton knuton requested a review from dividat-jgu June 19, 2026 10:12
@knuton knuton added dependencies Pull requests that update a dependency file and removed details needed Further information requested to better evaluate changes labels Jun 19, 2026
@knuton

knuton commented Jun 19, 2026

Copy link
Copy Markdown
Member Author

Sorry for missing this, needed to make a dependency explicit: b7eece6

@dividat-jgu

Copy link
Copy Markdown
Contributor

I can now replay a Flex. 👌

@dividat-jgu dividat-jgu merged commit eff8a57 into dividat:main Jun 19, 2026
7 checks passed
@dividat-jgu dividat-jgu removed the dependencies Pull requests that update a dependency file label Jun 19, 2026
@knuton knuton deleted the use-pnpm branch June 19, 2026 10:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants