fix: use pnpm instead of npm in updatePlugins.sh by JohnMcLear · Pull Request #7468 · ether/etherpad

JohnMcLear · 2026-04-05T18:27:58Z

Summary

updatePlugins.sh used npm outdated which doesn't work with pnpm workspaces, so it never detected outdated plugins
Also used pnpm install instead of pnpm update, which doesn't update existing packages

Test plan

Install an older version of a plugin, run bin/updatePlugins.sh, verify it updates
Run with all plugins up-to-date, verify "All plugins are up-to-date" message

🤖 Generated with Claude Code

The script used npm outdated which doesn't work with pnpm workspaces, and pnpm install which doesn't update existing packages. Changed to pnpm outdated and pnpm update respectively. Fixes #6670 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

qodo-free-for-open-source-projects · 2026-04-05T18:28:09Z

Review Summary by Qodo

Fix plugin update detection in pnpm workspaces

🐞 Bug fix

Walkthroughs

Description

• Replace npm outdated with pnpm outdated for workspace compatibility
• Change pnpm install to pnpm update for proper package updates
• Fixes plugin update detection in pnpm workspaces

Diagram

flowchart LR
  A["updatePlugins.sh"] -->|"npm outdated"| B["❌ Fails in pnpm workspaces"]
  A -->|"pnpm outdated"| C["✓ Detects outdated plugins"]
  D["pnpm install"] -->|"doesn't update"| E["❌ Packages unchanged"]
  F["pnpm update"] -->|"updates packages"| G["✓ Plugins updated"]

File Changes

1. bin/updatePlugins.sh 🐞 Bug fix +2/-2

Fix pnpm plugin update detection and installation

• Replaced npm outdated with pnpm outdated to properly detect outdated plugins in pnpm
 workspaces
• Changed pnpm install to pnpm update to actually update existing plugin packages
• Maintains existing error handling and filtering logic for plugin detection

bin/updatePlugins.sh

qodo-free-for-open-source-projects · 2026-04-05T18:28:10Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📎 Requirement gaps (0) 🎨 UX Issues (0)

1. updatePlugins.sh lacks regression test 📘 Rule violation ☼ Reliability

Description

This PR changes the plugin update logic but does not add or update any regression test to ensure the
bug fix remains verifiable. Without a test, a future change could revert the pnpm-based behavior
and reintroduce the failure to detect/upgrade plugins.

Code

bin/updatePlugins.sh[R5-11]

+OUTDATED=$(pnpm outdated --depth=0 | awk '{print $1}' | grep '^ep_') || {
echo "All plugins are up-to-date"
exit 0
}
set -- ${OUTDATED}
echo "Updating plugins: $*"
-exec pnpm install "$@"
+exec pnpm update "$@"

Evidence

PR Compliance ID 4 requires that bug fixes include a regression test that would fail if the fix were
reverted. The only changed code shown is the bug fix in bin/updatePlugins.sh, with no accompanying
test change in the provided PR diff.

bin/updatePlugins.sh[5-11]
Best Practice: Repository guidelines

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The fix in `bin/updatePlugins.sh` has no regression test to ensure outdated plugins are detected and upgraded (and to fail if the script is reverted back to the broken behavior).
## Issue Context
Add a test that simulates `pnpm outdated` output and asserts the script:
- prints `All plugins are up-to-date` when nothing matches `^ep_`
- invokes `pnpm update` with the expected `ep_*` plugin names when updates are available
## Fix Focus Areas
- bin/updatePlugins.sh[5-11]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. ~~Wrong pnpm project scope~~ ☑ 🐞 Bug ≡ Correctness

Description

bin/updatePlugins.sh runs pnpm outdated / pnpm update from the workspace root, but the root
package.json only depends on the linked ep_etherpad-lite package, so this script will not
detect/update plugins that are dependencies of the main src package. As a result it can
incorrectly report “All plugins are up-to-date” even when plugins used by Etherpad are outdated.

Code

bin/updatePlugins.sh[R4-5]

cd "${mydir}"/..
-OUTDATED=$(npm outdated --depth=0 | awk '{print $1}' | grep '^ep_') || {
+OUTDATED=$(pnpm outdated --depth=0 | awk '{print $1}' | grep '^ep_') || {

Evidence

The script cd’s to the repo root before running pnpm outdated. In this repo, the workspace root
manifest does not contain plugin dependencies (only ep_etherpad-lite), and other commands in the
repo explicitly scope pnpm operations to a workspace package (--filter) or all packages
(--recursive), implying this script should scope similarly to cover the actual package that would
depend on plugins.

bin/updatePlugins.sh[3-5]
package.json[15-38]
bin/installDeps.sh[36-43]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`updatePlugins.sh` runs pnpm at the workspace root, which (in this repo) does not list plugin dependencies, so `pnpm outdated` won’t surface outdated plugins used by the main app.
### Issue Context
- Workspace root `package.json` only depends on `ep_etherpad-lite` (link).
- Other repo scripts scope pnpm operations via `--filter` or `--recursive`.
### Fix Focus Areas
- bin/updatePlugins.sh[3-11]
### Suggested change
Update the script to run against the `ep_etherpad-lite` workspace project (or `cd src` before running pnpm), e.g.:
- `pnpm --filter ep_etherpad-lite outdated --depth=0 ...`
- `pnpm --filter ep_etherpad-lite update "$@"`
(keeping the rest of the logic the same).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. ~~Updates core package~~ ☑ 🐞 Bug ≡ Correctness

Description

The grep '^ep_' filter can include ep_etherpad-lite, which other plugin tooling explicitly
excludes; attempting to update the core workspace-linked package is not a plugin update and can fail
or block updating real plugins. This makes the update list incorrect and can cause the script to
behave unexpectedly.

Code

bin/updatePlugins.sh[5]

+OUTDATED=$(pnpm outdated --depth=0 | awk '{print $1}' | grep '^ep_') || {

Evidence
Other code paths that iterate over ep_* packages consistently exclude ep_etherpad-lite, but
updatePlugins.sh currently does not, so it can try to treat the core package as a plugin
candidate.
bin/updatePlugins.sh[5-5]
bin/plugins/updateCorePlugins.sh[5-8]
src/static/js/pluginfw/installer.ts[67-69]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`updatePlugins.sh` collects package names matching `^ep_` but doesn’t exclude `ep_etherpad-lite`, which is not a plugin and is explicitly skipped elsewhere.
### Issue Context
Other plugin management/update code filters out `ep_etherpad-lite`.
### Fix Focus Areas
- bin/updatePlugins.sh[5-5]
### Suggested change
Add an exclusion after the `grep '^ep_'` step, for example:
- `... | grep '^ep_' | grep -v '^ep_etherpad-lite$'`
(If you also implement workspace scoping, keep this exclusion as a safety guard.)

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

View more (1)

4. ~~Errors reported as up-to-date~~ ☑ 🐞 Bug ☼ Reliability

Description

Any failure in pnpm outdated (for example, pnpm execution errors) is treated the same as “no
outdated plugins” because the || { echo "All plugins are up-to-date"; exit 0; } handler triggers
on any non-zero pipeline exit. This can silently hide real problems and cause false success.

Code

bin/updatePlugins.sh[R5-8]

+OUTDATED=$(pnpm outdated --depth=0 | awk '{print $1}' | grep '^ep_') || {
echo "All plugins are up-to-date"
exit 0
}

Evidence

The script uses a pipeline inside command substitution and unconditionally reports success when the
pipeline exits non-zero, so command errors and the “no matches” case are indistinguishable.

bin/updatePlugins.sh[5-8]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The script currently prints "All plugins are up-to-date" for any non-zero exit status from the `pnpm outdated | awk | grep` pipeline, which includes actual command failures.
### Issue Context
POSIX `/bin/sh` does not reliably support `set -o pipefail`, so the fix should avoid relying on `pipefail`.
### Fix Focus Areas
- bin/updatePlugins.sh[5-8]
### Suggested change (POSIX sh compatible)
Restructure to:
1) Run `pnpm ... outdated` and fail hard if it fails.
2) Then parse the output; treat `grep` no-match as an empty list.
Example structure:

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

ⓘ The new review experience is currently in Beta. Learn more

qodo-free-for-open-source-projects · 2026-04-05T18:32:50Z

+OUTDATED=$(pnpm outdated --depth=0 | awk '{print $1}' | grep '^ep_') || {
  echo "All plugins are up-to-date"
  exit 0
 }
 set -- ${OUTDATED}
 echo "Updating plugins: $*"
-exec pnpm install "$@"
+exec pnpm update "$@"


1. updateplugins.sh lacks regression test 📘 Rule violation ☼ Reliability

This PR changes the plugin update logic but does not add or update any regression test to ensure the bug fix remains verifiable. Without a test, a future change could revert the pnpm-based behavior and reintroduce the failure to detect/upgrade plugins.

Agent Prompt

## Issue description The fix in `bin/updatePlugins.sh` has no regression test to ensure outdated plugins are detected and upgraded (and to fail if the script is reverted back to the broken behavior). ## Issue Context Add a test that simulates `pnpm outdated` output and asserts the script: - prints `All plugins are up-to-date` when nothing matches `^ep_` - invokes `pnpm update` with the expected `ep_*` plugin names when updates are available ## Fix Focus Areas - bin/updatePlugins.sh[5-11]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

- Use --filter ep_etherpad-lite so pnpm operates on the right workspace - Exclude ep_etherpad-lite from the plugin list - Handle pnpm outdated exit codes correctly (returns 1 when outdated) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

brunob · 2026-04-27T10:01:46Z

Hi @JohnMcLear, nice to see you back in there !

This PR doesn't seem to fix the bug. Running 2.7.2 i can see some plugins updates or available in admin panel :

But running bin/updatePlugins.sh just return All plugins are up-to-date. Running pnpm --filter ep_etherpad-lite outdated --depth=0 from the root folder o etherpad return only "internal packages" not plugins :

pnpm --filter ep_etherpad-lite outdated --depth=0
┌────────────────────┬─────────┬────────┬──────────────────┐
│ Package            │ Current │ Latest │ Dependents       │
├────────────────────┼─────────┼────────┼──────────────────┤
│ express-rate-limit │ 8.4.0   │ 8.4.1  │ ep_etherpad-lite │
├────────────────────┼─────────┼────────┼──────────────────┤
│ mysql2             │ 3.22.2  │ 3.22.3 │ ep_etherpad-lite │
├────────────────────┼─────────┼────────┼──────────────────┤
│ jsdom              │ 29.0.2  │ 29.1.0 │ ep_etherpad-lite │
└────────────────────┴─────────┴────────┴──────────────────┘

…oses #6670) (#7644) * fix(plugins): updatePlugins.sh actually updates installed plugins (#6670) bin/updatePlugins.sh detected outdated plugins by running `pnpm --filter ep_etherpad-lite outdated --depth=0`, but installed plugins are not registered in src/package.json — bin/plugins.ts adds them via linkInstaller.installPlugin which writes to src/plugin_packages/.versions/<name>@<version>/ and tracks the result in var/installed_plugins.json. pnpm has no view of them, so `outdated` returns empty and the script always reported "All plugins are up-to-date" even when newer versions existed on the registry. PR #7468 fixed npm→pnpm and install→update but kept the same broken detection mechanism, which is why the issue stayed open after that PR landed. Read the plugin list from var/installed_plugins.json instead, then re-invoke linkInstaller.installPlugin(name) for each entry. Calling the installer without a version pin resolves the registry-latest and overwrites the existing pinned copy, so an outdated plugin is brought to head while plugins already at latest are no-ops apart from the pnpm cache hit. Add an `update`/`up` action to bin/plugins.ts so users can also run `pnpm run plugins update` directly, mirroring the existing install/remove/list actions. updatePlugins.sh becomes a one-line wrapper for backwards compatibility. Reproduction (verified): pnpm run install-plugins ep_markdown@11.0.5 # latest is 11.0.18 ./bin/updatePlugins.sh # → 11.0.18 Edge cases tested: no plugins installed, missing installed_plugins.json, already-at-latest re-run. Closes #6670. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(plugins): validate ep_ prefix and dedupe + add regression test Qodo flagged two issues on the original update() addition: 1. Security — update() trusted every name in var/installed_plugins.json, so a corrupted or hand-edited manifest could coerce the script into installing arbitrary npm packages. pluginfw/plugins.getPackages already gates on the ep_ prefix; mirror that gate here. 2. Reliability — no automated regression test, so a future refactor could silently bring back the broken behaviour. Extract the safe-name filter to filterUpdatablePluginNames in bin/commonPlugins.ts (pure, side-effect-free, prefix configurable, also de-duplicates repeats so a duplicated entry installs once). Use it from plugins.ts update(). Add src/tests/backend/specs/filterUpdatablePluginNames.ts covering: keep prefixed names, drop ep_etherpad-lite, reject non-prefixed entries, de-dupe repeats, tolerate missing/null/non-string name fields, empty input, custom prefix. Manually verified end-to-end on a live install: an installed_plugins.json containing ep_markdown@11.0.5, a duplicate ep_markdown, and a "malicious-package" entry runs `Updating plugins to latest from registry: ep_markdown` (only) and ep_markdown ends up at 11.0.18 — the bad entries are silently filtered out. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

qodo-free-for-open-source-projects Bot reviewed Apr 5, 2026

View reviewed changes

JohnMcLear merged commit 220ae82 into develop Apr 6, 2026
36 checks passed

JohnMcLear deleted the fix/update-plugins-6670 branch April 6, 2026 10:21

JohnMcLear mentioned this pull request May 1, 2026

fix(plugins): updatePlugins.sh actually updates installed plugins (closes #6670) #7644

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: use pnpm instead of npm in updatePlugins.sh#7468

fix: use pnpm instead of npm in updatePlugins.sh#7468
JohnMcLear merged 2 commits intodevelopfrom
fix/update-plugins-6670

JohnMcLear commented Apr 5, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Apr 5, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Apr 5, 2026 •

edited

Loading

Uh oh!

qodo-free-for-open-source-projects Bot Apr 5, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

brunob commented Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

JohnMcLear commented Apr 5, 2026

Summary

Test plan

Uh oh!

qodo-free-for-open-source-projects Bot commented Apr 5, 2026

Review Summary by Qodo

Walkthroughs

File Changes

Uh oh!

qodo-free-for-open-source-projects Bot commented Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

qodo-free-for-open-source-projects Bot Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

brunob commented Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

qodo-free-for-open-source-projects Bot commented Apr 5, 2026 •

edited

Loading