fix: when using pnpm write overrides under pnpm (#21760) (#21815)

vaadin-bot · caalador · web-flow · commit 472825cf03cf · 2025-07-01T08:17:45.000Z
* fix: when using pnpm write overrides under pnpm For pnpm usage write the overrides section under the pnpm object instead of the root of the package.json Fixes #21724 Fixes #21682 * add all component versions to overrides. Will use $NAME for existing dependencies and devDpendencies. For other components in vaadin-versions and vaadin-core-versions version value will be added to overrides. * Keep existing overrides content from othe system if any Keep the existing overrides when moving from npm to pnpm and vice versa Refactor test to use Jackson Co-authored-by: caalador <mikael.grankvist@vaadin.com>
diff --git a/flow-plugins/flow-plugin-base/src/main/java/com/vaadin/flow/plugin/base/CleanFrontendUtil.java b/flow-plugins/flow-plugin-base/src/main/java/com/vaadin/flow/plugin/base/CleanFrontendUtil.java
@@ -38,6 +38,7 @@ public class CleanFrontendUtil {
     public static final String DEPENDENCIES = "dependencies";
     public static final String DEV_DEPENDENCIES = "devDependencies";
     public static final String OVERRIDES = "overrides";
+    public static final String PNPM = "pnpm";
 
     /**
      * Exception thrown when cleaning the frontend fails.
@@ -207,6 +208,9 @@ private static void cleanupPackage(PluginAdapterBase adapter,
         ObjectNode devDependencies = (ObjectNode) packageJson
                 .get(DEV_DEPENDENCIES);
         ObjectNode overridesSection = (ObjectNode) packageJson.get(OVERRIDES);
+        ObjectNode pnpmOverridesSection = packageJson.has(PNPM)
+                ? (ObjectNode) packageJson.get(PNPM).get(OVERRIDES)
+                : null;
 
         if (packageJson.has(VAADIN)) {
             ObjectNode vaadin = (ObjectNode) packageJson.get(VAADIN);
@@ -219,6 +223,7 @@ private static void cleanupPackage(PluginAdapterBase adapter,
             cleanObject(dependencies, vaadinDependencies);
             cleanObject(devDependencies, vaadinDevDependencies);
             cleanObject(overridesSection, vaadinDependencies, false);
+            cleanObject(pnpmOverridesSection, vaadinDependencies, false);
 
             packageJson.remove(VAADIN);
         }
diff --git a/flow-server/src/main/java/com/vaadin/flow/server/frontend/NodeUpdater.java b/flow-server/src/main/java/com/vaadin/flow/server/frontend/NodeUpdater.java
@@ -77,6 +77,7 @@ public abstract class NodeUpdater implements FallibleCommand {
     static final String HASH_KEY = "hash";
     static final String DEV_DEPENDENCIES = "devDependencies";
     static final String OVERRIDES = "overrides";
+    static final String PNPM = "pnpm";
 
     private static final String DEP_LICENSE_KEY = "license";
     private static final String DEP_LICENSE_DEFAULT = "UNLICENSED";
diff --git a/flow-server/src/main/java/com/vaadin/flow/server/frontend/TaskUpdatePackages.java b/flow-server/src/main/java/com/vaadin/flow/server/frontend/TaskUpdatePackages.java
@@ -45,6 +45,11 @@
 import com.vaadin.flow.server.frontend.scanner.ClassFinder;
 import com.vaadin.flow.server.frontend.scanner.FrontendDependenciesScanner;
 
+import static com.vaadin.flow.server.frontend.VersionsJsonConverter.JS_VERSION;
+import static com.vaadin.flow.server.frontend.VersionsJsonConverter.NPM_NAME;
+import static com.vaadin.flow.server.frontend.VersionsJsonConverter.NPM_VERSION;
+import static com.vaadin.flow.server.frontend.VersionsJsonConverter.VAADIN_CORE_NPM_PACKAGE;
+
 /**
  * Updates <code>package.json</code> by visiting {@link NpmPackage} annotations
  * found in the classpath. It also visits classes annotated with
@@ -114,6 +119,7 @@ boolean lockVersionForNpm(ObjectNode packageJson) throws IOException {
 
         ObjectNode overridesSection = getOverridesSection(packageJson);
         final JsonNode dependencies = packageJson.get(DEPENDENCIES);
+        ObjectNode fullPlatformDependencies = getFullPlatformDependencies();
         for (String dependency : JacksonUtils.getKeys(versionsJson)) {
             if (!overridesSection.has(dependency)
                     && shouldLockDependencyVersion(dependency, dependencies,
@@ -133,9 +139,108 @@ && shouldLockDependencyVersion(dependency, dependencies,
             }
         }
 
+        /*
+         * Remove platform dependencies for all existing dependencies and
+         * devDependencies
+         */
+        for (String dependency : JacksonUtils.getKeys(dependencies)) {
+            fullPlatformDependencies.remove(dependency);
+        }
+        for (String dependency : JacksonUtils.getKeys(devDependencies)) {
+            fullPlatformDependencies.remove(dependency);
+        }
+
+        // After removing any existing dependencies and devDependencies add all
+        // platform versions to overrides block
+        for (String dependency : JacksonUtils
+                .getKeys(fullPlatformDependencies)) {
+            try {
+                FrontendVersion frontendVersion = new FrontendVersion(
+                        fullPlatformDependencies.get(dependency).textValue());
+                if ("SNAPSHOT".equals(frontendVersion.getBuildIdentifier())) {
+                    continue;
+                }
+                overridesSection.set(dependency, JacksonUtils
+                        .createNode(frontendVersion.getFullVersion()));
+                versionLockingUpdated = true;
+            } catch (NumberFormatException nfe) {
+                continue;
+            }
+        }
+
         return versionLockingUpdated;
     }
 
+    /**
+     * Collect all platform npm dependencies from vaadin-core-versions.json and
+     * vaadin-versions.json to use in overrides so that any component versions
+     * get locked even when they are transitive.
+     *
+     * @return json containing all npm keys and versions
+     * @throws IOException
+     *             thrown for exception reading stream
+     */
+    private ObjectNode getFullPlatformDependencies() throws IOException {
+        ObjectNode platformDependencies = JacksonUtils.createObjectNode();
+        URL coreVersionsResource = finder
+                .getResource(Constants.VAADIN_CORE_VERSIONS_JSON);
+        if (coreVersionsResource == null) {
+            return platformDependencies;
+        }
+
+        try (InputStream content = coreVersionsResource.openStream()) {
+            collectDependencies(
+                    JacksonUtils.readTree(
+                            IOUtils.toString(content, StandardCharsets.UTF_8)),
+                    platformDependencies);
+        }
+
+        URL vaadinVersionsResource = finder
+                .getResource(Constants.VAADIN_VERSIONS_JSON);
+        if (vaadinVersionsResource == null) {
+            // vaadin is not on the classpath, only vaadin-core is present.
+            return platformDependencies;
+        }
+
+        try (InputStream content = vaadinVersionsResource.openStream()) {
+            collectDependencies(
+                    JacksonUtils.readTree(
+                            IOUtils.toString(content, StandardCharsets.UTF_8)),
+                    platformDependencies);
+        }
+
+        return platformDependencies;
+    }
+
+    private void collectDependencies(JsonNode obj, ObjectNode collection) {
+        for (String key : JacksonUtils.getKeys(obj)) {
+            JsonNode value = obj.get(key);
+            if (!(value instanceof ObjectNode)) {
+                continue;
+            }
+            if (value.has(NPM_NAME)) {
+                String npmName = value.get(NPM_NAME).textValue();
+                if (Objects.equals(npmName, VAADIN_CORE_NPM_PACKAGE)) {
+                    return;
+                }
+                String version;
+                if (value.has(NPM_VERSION)) {
+                    version = value.get(NPM_VERSION).textValue();
+                } else if (value.has(JS_VERSION)) {
+                    version = value.get(JS_VERSION).textValue();
+                } else {
+                    log().debug(
+                            "dependency '{}' has no 'npmVersion'/'jsVersion'.",
+                            npmName);
+                    continue;
+                }
+                collection.put(npmName, version);
+            } else {
+                collectDependencies(value, collection);
+            }
+        }
+    }
+
     private boolean shouldLockDependencyVersion(String dependency,
             JsonNode projectDependencies, JsonNode versionsJson) {
         String platformDefinedVersion = versionsJson.get(dependency)
@@ -166,9 +271,37 @@ private boolean isInternalPseudoDependency(String dependencyVersion) {
 
     private ObjectNode getOverridesSection(ObjectNode packageJson) {
         ObjectNode overridesSection = (ObjectNode) packageJson.get(OVERRIDES);
+        ObjectNode oldOverrides = null;
+        if (options.isEnablePnpm()) {
+            if (overridesSection != null) {
+                oldOverrides = overridesSection;
+                // remove npm overrides when moving to pnpm
+                packageJson.remove(OVERRIDES);
+            }
+            JsonNode pnpm = packageJson.get(PNPM);
+            if (pnpm == null) {
+                overridesSection = null;
+            } else {
+                overridesSection = (ObjectNode) pnpm.get(OVERRIDES);
+            }
+        } else if (packageJson.has(PNPM)) {
+            oldOverrides = overridesSection;
+            // remove pnpm overrides for npm
+            ((ObjectNode) packageJson.get(PNPM)).remove(OVERRIDES);
+        }
         if (overridesSection == null) {
-            overridesSection = JacksonUtils.createObjectNode();
-            packageJson.set(OVERRIDES, overridesSection);
+            overridesSection = oldOverrides == null
+                    ? JacksonUtils.createObjectNode()
+                    : oldOverrides;
+            if (options.isEnablePnpm()) {
+                ObjectNode pnpmNode = packageJson.has(PNPM)
+                        ? (ObjectNode) packageJson.get(PNPM)
+                        : JacksonUtils.createObjectNode();
+                packageJson.set(PNPM, pnpmNode);
+                pnpmNode.set(OVERRIDES, overridesSection);
+            } else {
+                packageJson.set(OVERRIDES, overridesSection);
+            }
         }
         return overridesSection;
     }
diff --git a/flow-server/src/main/java/com/vaadin/flow/server/frontend/VersionsJsonConverter.java b/flow-server/src/main/java/com/vaadin/flow/server/frontend/VersionsJsonConverter.java
@@ -43,9 +43,9 @@ class VersionsJsonConverter {
 
     static final String VAADIN_CORE_NPM_PACKAGE = "@vaadin/vaadin-core";
     static final String VAADIN_BUNDLES = "@vaadin/bundles";
-    private static final String JS_VERSION = "jsVersion";
-    private static final String NPM_NAME = "npmName";
-    private static final String NPM_VERSION = "npmVersion";
+    static final String JS_VERSION = "jsVersion";
+    static final String NPM_NAME = "npmName";
+    static final String NPM_VERSION = "npmVersion";
 
     /**
      * Key for exclusions array.
diff --git a/flow-server/src/test/java/com/vaadin/flow/server/frontend/TaskUpdatePackagesNpmTest.java b/flow-server/src/test/java/com/vaadin/flow/server/frontend/TaskUpdatePackagesNpmTest.java
