Skip to content

v1.1.3

Choose a tag to compare

View all tags
@mariokreitz mariokreitz released this 18 Aug 06:05
· 100 commits to main since this release
v1.1.3
e0e40ab
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes

v1.1.2 fixed the original npx-cache resolution bug but introduced a more severe one: npm install --prefix "$install_dir" still reads and parses the consumer's existing package.json, not just the packages named on the command line. Any pnpm (or Yarn) workspace-protocol dependency string there — workspace:*, pnpm's catalog: — crashed the install outright, regardless of --no-save. Caught in the very first real-world CI run against v1.1.2, against verbatra's own docs site, whose apps/docs/package.json uses exactly this.

  • Installs into an isolated scratch directory (no package.json to conflict with), then merges the result into working-directory — the consumer's own dependency manifest is never read by npm at all.
  • Fixes a node_modules/.bin symlink-dereferencing issue found while diagnosing the above (only matters for the merge step, not user-visible on its own).
  • Adds a pnpm-workspace-protocols regression fixture reproducing the exact failure, plus bumps all self-test fixtures to 0.9.0 (previously 0.8.0, stale).

No input or output changes; this is a drop-in upgrade.

Assets 2
Loading