fix: drop only-allow preinstall from the published package#464
Merged
Conversation
`preinstall: npx only-allow pnpm` is a contributor guard, but it ships in the published `impit` package and therefore runs on every consumer install. It forces a network `npx only-allow` fetch during install, which breaks downstream installs when that fetch flakes (corrupted npm cache / ENOENT) — e.g. it fails `yarn install` in dependents. impit ships prebuilt native binaries, so consumers need no install/build scripts at all.
github-actions
Bot
added
the
t-tooling
Member
Author
|
@barjin let's ship a new patch version with this, it breaks usage with other package managers downstream |
Member
|
Release is running here |
B4nan
added a commit
to apify/crawlee
that referenced
this pull request
May 29, 2026
impit 0.14.1 removes the `preinstall: npx only-allow pnpm` that shipped in the published package and intermittently broke `yarn install` in CI (apify/impit#464). impit + its platform binaries (`impit-*`) are added to `npmPreapprovedPackages` so the freshly-published 0.14.1 isn't held back by the 24h `npmMinimalAgeGate` — consistent with the other first-party packages (`apify`, `crawlee`, `got-scraping`) already on that list. camoufox-js's impit `0.13.1` is untouched (it has no preinstall). --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
preinstall: npx only-allow pnpminimpit-node/package.jsonis a contributor guard, but it's published in theimpitpackage, so it runs on every consumer install. It forces a networknpx only-allowfetch during install, which breaks downstream installs whenever that fetch flakes (corrupted npm cache / ENOENT) — e.g. it intermittently failsyarn installin apify/crawlee CI.impit ships prebuilt native binaries (
optionalDependencies: impit-*), so consumers need no install/build scripts. Removing the publishedpreinstallfixes it for all downstreams.If the pnpm guard is still wanted for local development, it belongs at the (non-published) repo root rather than inside the published
impit-nodepackage.