From 599909067c73a154d5c3a7866176d79734146555 Mon Sep 17 00:00:00 2001 From: Sefa Eyeoglu Date: Sun, 24 May 2026 13:40:06 +0200 Subject: [PATCH 1/3] pnpmConfigHook: disable lockfile verification against supply-chain policies These checks are still performed in fetchPnpmDeps. These checks require access to the registries used in the lockfile, making it infeasible to run during configurePhase in a sandboxed build. Signed-off-by: Sefa Eyeoglu --- pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh b/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh index 79c8f2d1a3a9..576954e7baf1 100644 --- a/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh +++ b/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh @@ -28,6 +28,11 @@ pnpmConfigHook() { if versionAtLeast "$pnpmVersion" "11"; then # pnpm 11 uses a different mechanism to manage package manager versions export pnpm_config_pm_on_fail=ignore + + # Disable lockfile verification against supply-chain policies. This is + # already done in fetchPnpmDeps, so if these checks failed there, we + # wouldn't be here in the first place + export pnpm_config_trust_lockfile=true else pnpm config set manage-package-manager-versions false fi From d5cbb9e641139edbe0ae9e2a4248ad7586bc4985 Mon Sep 17 00:00:00 2001 From: Sefa Eyeoglu Date: Sun, 24 May 2026 13:47:56 +0200 Subject: [PATCH 2/3] fetchPnpmDeps,pnpmConfigHook: print final config before install This should help debugging config values. I verified that `pnpm config list` works across pnpm_8, pnpm_9, pnpm_10, pnpm_10_29_2 and pnpm_11. Signed-off-by: Sefa Eyeoglu --- pkgs/build-support/node/fetch-pnpm-deps/default.nix | 4 ++++ pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/pkgs/build-support/node/fetch-pnpm-deps/default.nix b/pkgs/build-support/node/fetch-pnpm-deps/default.nix index c16a8fb1f89e..b6472839465d 100644 --- a/pkgs/build-support/node/fetch-pnpm-deps/default.nix +++ b/pkgs/build-support/node/fetch-pnpm-deps/default.nix @@ -146,6 +146,10 @@ in # Run any additional pnpm configuration commands that users provide. ${prePnpmInstall} + echo "Final pnpm config:" + pnpm config list + echo + # pnpm is going to warn us about using --force # --force allows us to fetch all dependencies including ones that aren't meant for our host platform pnpm install \ diff --git a/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh b/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh index 576954e7baf1..dc732c3822f8 100644 --- a/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh +++ b/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh @@ -89,6 +89,10 @@ pnpmConfigHook() { runHook prePnpmInstall + echo "Final pnpm config:" + pnpm config list + echo + if ! pnpm install \ --offline \ --ignore-scripts \ From 1d7401809103923161bf8bde9e18951f5f49ed9e Mon Sep 17 00:00:00 2001 From: Sefa Eyeoglu Date: Thu, 21 May 2026 09:47:18 +0200 Subject: [PATCH 3/3] pnpm: 11.1.2 -> 11.3.0 https://github.com/pnpm/pnpm/releases/tag/v11.3.0 https://github.com/pnpm/pnpm/releases/tag/v11.2.2 https://github.com/pnpm/pnpm/releases/tag/v11.2.1 https://github.com/pnpm/pnpm/releases/tag/v11.2.0 https://github.com/pnpm/pnpm/releases/tag/v11.1.3 Signed-off-by: Sefa Eyeoglu --- pkgs/development/tools/pnpm/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix index 8d64ad10b04c..a6545815b98a 100644 --- a/pkgs/development/tools/pnpm/default.nix +++ b/pkgs/development/tools/pnpm/default.nix @@ -26,8 +26,8 @@ let hash = "sha256-jnDdxmSbGLw9iVzzqQjAKR6kw4A5rYcixH4Bja8enPw="; }; "11" = { - version = "11.1.2"; - hash = "sha256-v+TSssejIQVlu6YpKfnv5JPrXyRicgGhAupFFOroz4A="; + version = "11.3.0"; + hash = "sha256-Wt4e9RzzZEH0oAkx6vkANlRonro2hJOfcNdXay37hHQ="; }; };