Repository navigation
[rushstack] Move to pnpm 12.13.0 and use catalogs for external dependency versions - #6146
Draft
Bharat Middha (bmiddha) wants to merge 6 commits into
Draft
Bharat Middha (bmiddha) wants to merge 6 commits into
Bharat Middha (bmiddha) wants to merge 6 commits into
Conversation
Bharat Middha (bmiddha)
force-pushed
the
bmiddha-migrate-rushstack-to-pnpm-catalogs
branch
from
October 15, 2026 01:52
51d9b41 to
d3f36bb
Compare
Bharat Middha (bmiddha)
force-pushed
the
bmiddha-migrate-rushstack-to-pnpm-catalogs
branch
from
October 20, 2026 21:13
266d15f to
bf97705
Compare
Bharat Middha (bmiddha)
added a commit
that referenced
this pull request
Oct 20, 2026
Now that the subspace pnpmfile shim resolves `catalog:` references in injected cross-subspace Rush projects, migrate the 98 literal dependencies/optionalDependencies specs that #6146 kept in the build-tests-subspace injected closure (23 projects) to `catalog:`, and add the 42 corresponding entries to globalCatalogs.default. Resolved versions are unchanged: lockfile packages/snapshots are identical, and sha512 integrity hashes are preserved. Co-authored-by: Copilot App <[email protected]>
Bharat Middha (bmiddha)
force-pushed
the
bmiddha-migrate-rushstack-to-pnpm-catalogs
branch
from
October 28, 2026 05:14
bf97705 to
180e1fc
Compare
Bharat Middha (bmiddha)
added a commit
that referenced
this pull request
Oct 28, 2026
Now that the subspace pnpmfile shim resolves `catalog:` references in injected cross-subspace Rush projects, migrate the 98 literal dependencies/optionalDependencies specs that #6146 kept in the build-tests-subspace injected closure (23 projects) to `catalog:`, and add the 42 corresponding entries to globalCatalogs.default. Resolved versions are unchanged: lockfile packages/snapshots are identical, and sha512 integrity hashes are preserved. Co-authored-by: Copilot App <[email protected]>
Bharat Middha (bmiddha)
force-pushed
the
bmiddha-migrate-rushstack-to-pnpm-catalogs
branch
from
October 30, 2026 21:39
180e1fc to
b69604b
Compare
Bharat Middha (bmiddha)
added a commit
that referenced
this pull request
Oct 30, 2026
Now that the subspace pnpmfile shim resolves `catalog:` references in injected cross-subspace Rush projects, migrate the 98 literal dependencies/optionalDependencies specs that #6146 kept in the build-tests-subspace injected closure (23 projects) to `catalog:`, and add the 42 corresponding entries to globalCatalogs.default. Resolved versions are unchanged: lockfile packages/snapshots are identical, and sha512 integrity hashes are preserved. Co-authored-by: Copilot App <[email protected]>
This was referenced Oct 30, 2026
Bharat Middha (bmiddha)
force-pushed
the
bmiddha-migrate-rushstack-to-pnpm-catalogs
branch
from
November 8, 2026 02:32
b69604b to
782901d
Compare
Bharat Middha (bmiddha)
changed the title
Bharat Middha (bmiddha)
force-pushed
the
bmiddha-migrate-rushstack-to-pnpm-catalogs
branch
3 times, most recently
from
November 10, 2026 01:02
400ccc6 to
bb76bb4
Compare
pnpm 12.10.1 and older drop files re-included by .npmignore negations, which breaks injected dependencies and "rush-pnpm pack". pnpm 11 removed neverBuiltDependencies, so globalNeverBuiltDependencies becomes globalAllowBuilds, allowing the native-binary packages that pnpm 10 built by default. The lockfiles omit ms-feed tarball URLs because the feed rotates its hosts and pnpm 12 rejects mismatched tarball URLs. Co-authored-by: Copilot App <[email protected]>
Declare each external dependency version once, in globalCatalogs in common/config/rush/pnpm-config.json, instead of in every package.json that uses it. The globalCatalogs comment lists the specifiers that stay literal. Co-authored-by: Copilot App <[email protected]>
pnpm replaces "catalog:" with the catalog version when packing, so the published manifests do not change. Co-authored-by: Copilot App <[email protected]>
…hs in snapshots With pnpm 12, css-loader's virtual store folder name includes webpack's resolved optional peers and is long enough that pnpm shortens it differently on Windows, so the snapshots differed by platform. Co-authored-by: Copilot App <[email protected]>
PNPM 11 replaced bin/pnpm.cjs with bin/pnpm.mjs, so the native install and update tests failed with "Cannot find module .../bin/pnpm.cjs". Co-authored-by: Copilot App <[email protected]>
The package feed serves only the sha1 shasum, so re-resolving with pnpm 12 downgraded integrity hashes to sha1. Restore the sha512 hashes from the pnpm 10 lockfiles; the package keys are unchanged, so the tarballs are the same. A full re-resolve will downgrade them again until the feed serves sha512. Co-authored-by: Copilot App <[email protected]>
Bharat Middha (bmiddha)
force-pushed
the
bmiddha-migrate-rushstack-to-pnpm-catalogs
branch
from
November 10, 2026 01:51
bb76bb4 to
c2f5871
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
External dependency versions are repeated in the package.json files of about 170 projects and kept in sync by
ensureConsistentVersions. This PR moves the repo to pnpm 12.13.0 and declares each external version once, in adefaultcatalog incommon/config/rush/pnpm-config.json, which projects reference with"catalog:". Resolved versions and published manifests don't change, because pnpm substitutes catalog versions when packing.CI fails at the
rush installconsistency check until a Rush release includes #6119 and #6136–#6141 andrushVersionis bumped.Details
.npmignorenegations, which breaks injected dependencies andrush-pnpm pack.globalCatalogscomment lists the cases. The notable one is the production dependencies of projects thatbuild-tests-subspaceinjects (rush-lib, heft, node-core-library and their dependencies): pnpm can't resolve"catalog:"in injectedfile:packages, so those specs keep literal versions.serialize-javascriptis~7.1.3, as on main.catalogPrunestays off: each subspace's workspace only sees its own projects, so pruning would drop entries that the other subspace uses.shasum, so pnpm 12 re-resolution downgraded the lockfile hashes to sha1. The last commit restores the sha512 hashes from the pnpm 10 lockfiles. A full re-resolve (rush update --full) will downgrade them again until the feed serves sha512.ms-feedtarball URLs, because the feed rotates its hosts and pnpm 12 rejects mismatched URLs.How it was tested
With a locally built Rush from this stack and pnpm 12.13.0:
CI=true rush installleaves the lockfiles unchanged;rush checkpasses for both subspaces;rush change --verifypasses.rush build --productionpasses with no warnings.rush-pnpm packfor several published packages produces no"catalog:"and the same dependency specifiers as main.rush add -p <cataloged package> --devwrites"catalog:".