preinstall script error fix#3327
Merged
Merged
Conversation
*fix gridstack#3325 Cursor: Why is this a bug? When a user installs gridstack as a dependency (e.g., npm install gridstack), npm automatically executes the library's preinstall, install, and postinstall scripts on the consumer's machine. Because gridstack.js had "preinstall": "npx only-allow yarn" in its package.json, this script runs during the consumer's installation process. This breaks things in two ways: It attempts to download only-allow dynamically via npx over the network. For users with a private registry or restricted network (like the Nexus registry returning a 401 error in the issue description), this completely halts the installation. Even if it could download, it forces the consumer of the library to use yarn for their own app! If they are trying to build an app with npm or pnpm, our preinstall script will throw an error and refuse to let them install our library. Scripts like only-allow are meant to ensure contributors to the gridstack.js codebase use yarn, but binding it to the preinstall hook in a published library inappropriately enforces this on end-users. Suggestion / Fix The only-allow package itself is actually deprecated for exactly these kinds of reasons. The modern and native way to enforce a package manager for repository contributors is using the "packageManager" field in package.json. Node's built-in corepack reads this and will automatically ensure contributors use the correct package manager. Since gridstack.js already includes "packageManager": "yarn@1.22.22..." in its package.json, the only-allow script is completely redundant anyway. I have gone ahead and removed the "preinstall": "npx only-allow yarn" script from the package.json.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
*fix #3325
Description
Cursor:
Why is this a bug?
When a user installs gridstack as a dependency (e.g., npm install gridstack), npm automatically executes the library's preinstall, install, and postinstall scripts on the consumer's machine.
Because gridstack.js had "preinstall": "npx only-allow yarn" in its package.json, this script runs during the consumer's installation process. This breaks things in two ways:
It attempts to download only-allow dynamically via npx over the network. For users with a private registry or restricted network (like the Nexus registry returning a 401 error in the issue description), this completely halts the installation. Even if it could download, it forces the consumer of the library to use yarn for their own app! If they are trying to build an app with npm or pnpm, our preinstall script will throw an error and refuse to let them install our library. Scripts like only-allow are meant to ensure contributors to the gridstack.js codebase use yarn, but binding it to the preinstall hook in a published library inappropriately enforces this on end-users.
Suggestion / Fix
The only-allow package itself is actually deprecated for exactly these kinds of reasons.
The modern and native way to enforce a package manager for repository contributors is using the "packageManager" field in package.json. Node's built-in corepack reads this and will automatically ensure contributors use the correct package manager. Since gridstack.js already includes "packageManager": "yarn@1.22.22..." in its package.json, the only-allow script is completely redundant anyway.
I have gone ahead and removed the "preinstall": "npx only-allow yarn" script from the package.json.
Checklist
yarn test)