From 7246649a7473512314ed3b36b6e1bf204245fa23 Mon Sep 17 00:00:00 2001 From: Hakula Chen Date: Tue, 18 Aug 2026 17:41:53 +0800 Subject: [PATCH] chore: drop the packageManager pin and relocate pnpm overrides `packageManager` made pnpm self-manage its own version: every invocation downloaded pnpm 10.30.3 from the registry and re-exec'd into it, so the pnpm that ran was never the one the flake provided. Offline that fails outright, and there is no opt-out. Removing the pin moves the project onto the flake's pnpm 11, which no longer reads the `pnpm` field in package.json. The DoS overrides from the js-yaml and markdown-it advisories move to pnpm-workspace.yaml, where both pnpm 10 and 11 read them. --- package.json | 7 ------- pnpm-workspace.yaml | 3 +++ 2 files changed, 3 insertions(+), 7 deletions(-) create mode 100644 pnpm-workspace.yaml diff --git a/package.json b/package.json index b675ac3a..3710ee04 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,5 @@ { "private": true, - "packageManager": "pnpm@10.30.3", "scripts": { "lint": "markdownlint-cli2 \"**/*.md\"", "spellcheck": "cspell --no-progress \"**/*\"" @@ -8,11 +7,5 @@ "devDependencies": { "cspell": "^10.0.1", "markdownlint-cli2": "^0.22.1" - }, - "pnpm": { - "overrides": { - "js-yaml@<=4.1.1": "^4.2.0", - "markdown-it@<=14.1.1": "^14.2.0" - } } } diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml new file mode 100644 index 00000000..a98191b2 --- /dev/null +++ b/pnpm-workspace.yaml @@ -0,0 +1,3 @@ +overrides: + js-yaml@<=4.1.1: ^4.2.0 + markdown-it@<=14.1.1: ^14.2.0