pnpm overrides are breaking gcp deployments about isolate-package HOT 7 CLOSED

@milo- Thanks for reporting. I have no experience using overrides, but it sounds like an easy fix so I will soon look into it.

Could you maybe post an example package manifest here so I'm sure what it looks like?

from isolate-package.

Sure thing @0x80

{
  "name": "XXX",
  "version": "0.0.0",
  "private": true,
  "scripts": {
    "build": "turbo run build",
    "dev": "turbo run dev",
    "lint": "turbo run lint",
    "format": "prettier --write \"**/*.{ts,tsx,md}\""
  },
  "dependencies": {},
  "devDependencies": {},
  "engines": {
    "node": "20",
    "pnpm": ">=3"
  },
  "packageManager": "[email protected]",
  "pnpm": {
    "overrides": {
      "lodash@<4.17.11": ">=4.17.11",
      "lodash@<4.17.5": ">=4.17.5",
      "minimatch@<3.0.2": ">=3.0.2",
      "lodash@<4.17.12": ">=4.17.12",
      "lodash@<4.17.21": ">=4.17.21",
      "minimatch@<3.0.5": ">=3.0.5",
      "undici": "^5.28.3",
      "jose@>=3.0.0 <=4.15.4": ">=4.15.5",
      "@google-cloud/firestore": "7.3.1"
    }
  }
}

from isolate-package.

Thanks, I'm going to assume that we can ditch the whole pnpm field then, unless you tell me otherwise. I don't know what other things can be part of it, or what it will be used for in the future, but I think it's probably safer to omit it completely if we don't know.

from isolate-package.

I think the two options that will work are:

1. Copy pnpm.overrides from the root package.json into isolate/package.json
2. Remove overrides from isolate/pnpm-lock.yaml

⬇️ This is an example of the lock file

lockfileVersion: '6.0'

overrides:
  lodash@<4.17.11: '>=4.17.11'
  lodash@<4.17.5: '>=4.17.5'

from isolate-package.

Ah, right. But to be version correct / true to the original lockfile, we should go for option 1 I think?

from isolate-package.

Yeah I think so 👍

from isolate-package.

I can also confirm that the correct path is to copy the pnpm.overrides to the isolate/package.json.

from isolate-package.