Pnpm build scripts approval warning

[vladshcherbin]

Hey 👋

When using with pnpm, a warning it shown:

To get rid of it, pnpm approve-builds needs to be executed with unrs-resolver manual approval.

Would be awesome if this step was not required.

[tagliala]

fortunately pnpm 10 prevents lifecycle script execution by default, because pnpm 9 runs them automatically, which is scary :(

node_modules/.pnpm/unrs-resolver@1.6.3/node_modules/unrs-resolver: Running postinstall script, done in 399ms

[voxpelli]

See #66 for the reason for the postinstall script

[vladshcherbin]

I've actually checked the issue before and personally don't want to add any approvals especially since everything was working perfectly fine before, without them. Seeing this warning is just annoying to say at least :)

If I understand correctly the bug is fixed in latest npm cli versions.

It's possible to just add a readme note with this linked issue and cli update suggestion instead of adding post-install script for everyone.

[voxpelli]

since everything was working perfectly fine before

The #56 begs to differ

If I understand correctly the bug is fixed in latest npm cli versions.

It's possible to just add a readme note with this linked issue and cli update suggestion instead of adding post-install script for everyone.

That would require all projects that rely on this module to also add a note to their readme (and to specify a minimum version of npm to be used).

One such cascading effect would be that:

1. This module is used by https://github.com/un-ts/eslint-plugin-import-x which then needs to add it
2. That module is used by https://github.com/neostandard/neostandard which then needs to add it
3. That module is used by https://github.com/fastify/fastify, https://github.com/nodejs/undici etc which then needs to add it

npm 10.x is the version used by default in all current LTS node.js release lines 18, 20 and 22 and npm 11.x will not start shipping with node.js until 24.0.0 is shipped any day now: nodejs/node#57609

Its a deal breaker for at least neostandard if the toolchain can not be installed out of the box with the default npm version.

[vladshcherbin]

I'm here with napi-rs/napi-rs#2569 (comment) - you just can't fix everything. The fix is quite questionable if users of non-bugged software have to deal with warnings and workarounds after it.

[voxpelli]

@vladshcherbin So your suggestion for us in neostandard is that we demand that people upgrade their npm before using us? Or that we should avoid packages that depend on unrs-resolver?

I think its reasonable to work out of the box with all the current LTS versions of Node.js (with v18 being the possibly one exception as it will soon leave LTS) and I think that's what most of the Node.js ecosystem agree with.

[vladshcherbin]

@voxpelli My suggestion is to not use bugged software and update to non-bugged versions if a bug is encountered (be it in neostandard or any other package). Basically how all software and fixes work. Users of non-bugged versions should not be punished.

Anyway, I'm just a simple guy who doesn't want to see warnings and give unnecessary approvals. I'm using eslint-plugin-import-x and currently have no other options 🤷‍♂️

[JounQin]

You can just ignore the warning if you're not using legacy npm versions.

Like or not, npm v11- will be there for a long time.

The warning also comes for esbuild, you can also safely disable them for pnpm.

[vladshcherbin]

@JounQin eslint-plugin-import-x is the only package I have with this warning. I'll just pin an old version without this script instead of seeing a warning on every pnpm command. Hopefully a better fix will be added in future.

Thank you

[JounQin]

@vladshcherbin

eslint-plugin-import-x is the only package I have with this warning. I'll just pin an old version without this script instead of seeing a warning on every pnpm command.

You can run pnpm approve-builds and disallow the postscript from unrs-resolver actually. :)

pnpm approve-builds is a bad name in this case, maybe check-builds would be more suitable.

Hopefully a better fix will be added in future.

That will never happen when npm 11- exists.

[karlhorky]

This is also shown as a (subtle) warning in Bun:

$ bun add unrs-resolver
bun add v1.3.0 (b0a6feca)

installed unrs-resolver@1.11.1

3 packages installed [403.00ms]

Blocked 1 postinstall. Run `bun pm untrusted` for details.