Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .github/pnpm-workspace.yaml
Original file line number Diff line number Diff line change
@@ -1,3 +1,21 @@
packages:
- 'actions/*'
injectWorkspacePackages: true
blockExoticSubdeps: true
minimumReleaseAge: 2880 # 48 hrs
minimumReleaseAgeExclude:
- '@next/*'
- '@turbo/*'
- '@vercel/*'
- '@workflow/*'
- babel-plugin-react-compiler
- next
- react
- react-dom
- react-dom-*
- react-experimental-builtin
- react-is
- react-is-builtin
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this work on aliases? This would be odd since you could effectively defeat the minimumReleaseAgeExclude by aliasing a malicious package to a trusted alias.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it applies after resolution of aliases. At least that's what deepwiki claimed when I asked it.

Copy link
Copy Markdown
Member

@eps1lon eps1lon Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it applies after resolution, why list the *-builtin ones? Those are aliases not real npm packages.

Copy link
Copy Markdown
Member Author

@bgw bgw Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe I'm not explaining this right. https://deepwiki.com/search/does-minimumreleaseageexclude_37cce44b-8975-4a63-a862-087b133fa393

Based on the codebase, minimumReleaseAgeExclude does use alias names if the package.json defines an alias for a package. The dependency resolution process resolves aliases before applying rules, so the exclusion logic works with the resolved (aliased) module names.

That implies that we must list the *-builtin package names.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's not how it works though:

ERR_PNPM_NO_MATURE_MATCHING_VERSION  Version 0.28.0-canary-404b38c7-20260408 (released 4 minutes ago) of scheduler-builtin does not meet the minimumReleaseAge constraint
-- https://github.com/vercel/next.js/actions/runs/24153975697/job/70488293803#step:7:41

Otherwise you could bypass it with an aliased install.

Fixing in #92535

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure why you used deepwiki. Is this some AI summary? pnpm docs are pretty clear:

The exclusion works by package name and applies to all versions of that package.

-- https://pnpm.io/settings#minimumreleaseageexclude

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I meant dependency resolution by the package manager. The model used by deepwiki thought we were talking about module resolution at runtime.

- react-server-dom-*
- scheduler-*
- turbo
18 changes: 18 additions & 0 deletions pnpm-workspace.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -29,3 +29,21 @@ ignoredBuiltDependencies:
- ssh2
- unrs-resolver
- wasm-pack
blockExoticSubdeps: true
minimumReleaseAge: 2880 # 48 hrs
minimumReleaseAgeExclude:
- '@next/*'
- '@turbo/*'
- '@vercel/*'
- '@workflow/*'
- babel-plugin-react-compiler
- next
- react
- react-dom
- react-dom-*
- react-experimental-builtin
- react-is
- react-is-builtin
- react-server-dom-*
- scheduler-*
- turbo
2 changes: 1 addition & 1 deletion rspack/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"type": "git",
"url": "git+https://github.com/vercel/next.js.git"
},
"packageManager": "pnpm@10.13.1",
"packageManager": "pnpm@10.33.0",
"main": "lib/index.js",
"types": "lib/index.d.ts",
"exports": {
Expand Down
7 changes: 7 additions & 0 deletions rspack/pnpm-workspace.yaml
Original file line number Diff line number Diff line change
@@ -1,3 +1,10 @@
packages:
- 'crates/binding'
- '.'

blockExoticSubdeps: true
minimumReleaseAge: 2880 # 48 hrs
minimumReleaseAgeExclude:
- '@next/*'
- 'next'
- '@rspack/*'
Loading