From 020298927184473939dbb61b2628ea3082e15d99 Mon Sep 17 00:00:00 2001 From: Sefa Eyeoglu Date: Tue, 7 Jul 2026 12:17:31 +0200 Subject: [PATCH] pnpm_8: drop Insecure and unmaintained. No consumers in nixpkgs anymore so it can go. Signed-off-by: Sefa Eyeoglu --- doc/languages-frameworks/javascript.section.md | 2 +- pkgs/development/tools/pnpm/default.nix | 16 ---------------- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 1 - 4 files changed, 2 insertions(+), 18 deletions(-) diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md index 19335a88da18..c506db3469c8 100644 --- a/doc/languages-frameworks/javascript.section.md +++ b/doc/languages-frameworks/javascript.section.md @@ -305,7 +305,7 @@ This package puts the corepack wrappers for pnpm and yarn in your PATH, and they ### pnpm {#javascript-pnpm} -pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions. +pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions. When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above: diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix index 6b7b4209bf59..4f5f52787ebb 100644 --- a/pkgs/development/tools/pnpm/default.nix +++ b/pkgs/development/tools/pnpm/default.nix @@ -6,22 +6,6 @@ let inherit (lib) mapAttrs' nameValuePair; variants = { - "8" = { - version = "8.15.9"; - hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY="; - knownVulnerabilities = [ - "CVE-2026-48995" - "CVE-2026-50014" - "CVE-2026-50015" - "CVE-2026-50016" - "CVE-2026-50017" - "CVE-2026-50573" - "CVE-2026-55699" - "CVE-2026-59194" - "CVE-2026-59195" - "CVE-2026-59196" - ]; - }; "9" = { version = "9.15.9"; hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc="; diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index c569d7201957..fcf6886f152c 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1843,6 +1843,7 @@ mapAliases { pltScheme = throw "'pltScheme' has been renamed to/replaced by 'racket'"; # Converted to throw 2025-10-27 plv8 = throw "'plv8' has been removed. Use 'postgresqlPackages.plv8' instead."; # Added 2025-07-19 pn = throw "'pn' has been removed as upstream was archived in 2020"; # Added 2025-10-17 + pnpm_8 = throw "'pnpm_8' has been removed as it hasn't been updated since 2024. Please use 'pnpm'"; # Added 2026-07-07 poac = throw "'poac' has been renamed to/replaced by 'cabinpkg'"; # Converted to throw 2025-10-27 pocket-updater-utility = throw "'pocket-updater-utility' has been renamed to/replaced by 'pupdate'"; # Converted to throw 2025-10-27 podofo010 = throw "'podofo010' has been renamed to 'podofo0'"; # Converted to throw 2025-10-27 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 8a89d44d2572..71844dc080a5 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -2801,7 +2801,6 @@ with pkgs; tdarr-node = tdarrPackages.node; inherit (callPackage ../development/tools/pnpm { }) - pnpm_8 pnpm_9 pnpm_10_29_2 pnpm_10_34_0