Skip to content

fix(pm): skip unavailable commands and reject unsupported options - #3286

Open
jong-kyung wants to merge 6 commits into
voidzero-dev:mainfrom
jong-kyung:fix/pm-command-version-gates
Open

jong-kyung wants to merge 6 commits into
voidzero-dev:mainfrom
jong-kyung:fix/pm-command-version-gates

Conversation

@jong-kyung

@jong-kyung jong-kyung commented Oct 30, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

Prevent Vite+ from forwarding commands and named options to package manager versions that do not support them.

  • Warn and skip unavailable commands with exit code 0, following the existing unsupported-command policy.
  • Reject unsupported pnpm dlx and pack options before execution while keeping the base commands available.
  • Preserve Yarn Classic behavior, unknown-npm handling, and existing npm fallback paths.

Version Reference

Capability Minimum version Reference
npm stage 11.15.0 Release notes
pnpm stage 11.3.0 Release notes
pnpm approve-builds 10.1.0 Release notes
pnpm patch and patch-commit 7.4.0 Release notes
pnpm dlx --shell-mode 7.21.0 Release notes
pnpm pack --out 10.0.0 Source
pnpm pack --json 9.14.0 Changelog
pnpm pack --pack-gzip-level 8.3.0 Release notes
Yarn Modern unlink and patch-commit --save 3.0.0 Changelog
Yarn Modern npm audit 2.4.0 Changelog

@jong-kyung jong-kyung self-assigned this Oct 30, 2026
Warn and skip commands unavailable in the selected package manager version,
and reject unsupported pnpm pack options before execution.

Preserve Yarn Classic behavior and existing npm fallback semantics. Cover
version boundaries and prereleases in unit tests and existing CLI snapshots.
Leave dlx compatibility and Yarn optional-plugin detection out of scope.
@jong-kyung
jong-kyung force-pushed the fix/pm-command-version-gates branch from 00354ad to 26dce19 Compare October 30, 2026 06:13
Reject --shell-mode before pnpm 7.21.0 while preserving ordinary dlx.
Cover older releases, the boundary prerelease, and the first supported
stable version, with rejection snapshots for local and global CLIs.

Leave npm-backed dlx behavior unchanged.
@jong-kyung
jong-kyung marked this pull request as ready for review October 30, 2026 07:32
@jong-kyung
jong-kyung requested a review from fengmk2 October 30, 2026 07:32
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ⚠️ Failed 2026-10-30T07:33:43.353109Z
We couldn’t complete this review. Comment @codex review to try again.
0ff08d1 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@jong-kyung jong-kyung changed the title fix(pm): enforce minimum package manager versions fix(pm): skip unavailable commands and reject unsupported options Oct 30, 2026
impl Resolve<UnlinkArgs> for Yarn {
fn resolve(&self, args: &UnlinkArgs, _diag: &mut Diagnostics) -> CommandResolution {
fn resolve(&self, args: &UnlinkArgs, diag: &mut Diagnostics) -> CommandResolution {
if self.is_berry() && !self.supports_v3_commands() {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P2] Use the effective Yarn version before skipping commands

With packageManager: "yarn@2.4.2" and yarnPath pointing to Yarn 3.8.7, the downloaded Yarn 2 launcher delegates to Yarn 3, but this check uses 2.4.2 and skips a supported unlink command. I reproduced the PR's production dispatcher returning exit code 0 while retaining the portal: resolution; running the same Yarn launcher directly removed it. Please determine the effective version in the project, respecting yarnPath and ignorePath, before applying this gate, and add coverage where the launcher and effective versions differ. The new patch-commit --save guard has the same issue.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've implemented a fix, but it requires spawning a process to check the effective Yarn version, which adds some overhead to each command. Could you review whether this trade-off is acceptable? 🙇‍♂️

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a better way? If not, this issue can be left unaddressed for now.

Query the selected Yarn launcher before resolving commands so yarnPath and
ignorePath determine the version used by command and option gates.

Cover delegated unlink and patch saving, version overrides, and query
failures with real Yarn CLI snapshots.
A user preload that prints to stdout made the Yarn version query
unparseable, so every Yarn command failed. Remove NODE_OPTIONS from the
query the same way the npm version query already does.

Cover the case with a snapshot step that runs a printing preload.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants