fix: Fall back to lockfile detection in @turbo/repository when package manager is undeclared - #13275
Merged
Conversation
…e manager is undeclared The devEngines.packageManager support (#12388) made package manager resolution strict: a package.json with neither `packageManager` nor `devEngines.packageManager` now yields Error::MissingPackageManager instead of falling back to lockfile-based detection. That strictness is intentional for the CLI, but it also changed Workspace.find in @turbo/repository, which analyzes repositories it doesn't control — any repo without a declared package manager now fails to load at all. Mirror the CLI's --dangerously-allow-missing-package-manager behavior in the library layer: when the declaration is missing or unusable, fall back to detect_package_manager, and recompute the repo mode (which was derived while the package manager was unresolved, so workspace globs could not be read). If detection also fails, the original declaration error still surfaces. CLI behavior is unchanged.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
anthonyshew
marked this pull request as ready for review
July 6, 2026 16:27
anthonyshew
pushed a commit
that referenced
this pull request
Jul 6, 2026
## Release v2.10.4-canary.2 > [!CAUTION] > Versioned docs aliasing FAILED. [View logs](https://github.com/vercel/turborepo/actions/runs/28806467849) ### Changes - release(turborepo): 2.10.4-canary.1 (#13247) (`a31389e`) - feat: Discover Cargo crates as packages (#13248) (`d813d12`) - perf: Reuse per-package external dependency hashes in run summaries (#13249) (`ef7ef06`) - perf: Stat workspace turbo.json files concurrently during discovery (#13251) (`57be8e5`) - chore: Add tracing spans to workspace discovery and globwalk phases (#13252) (`bd76946`) - fix: Avoid non-reentrant libc calls in concurrent shutdown process scans (#13256) (`bf2d827`) - perf: Memoize resolved task definitions during engine construction (#13257) (`9085289`) - perf: Compute transitive closures and external dependency hashes concurrently with run setup (#13250) (`b305fe2`) - perf: Probe microfrontends configs in parallel (#13262) (`ea7c1f8`) - feat: Execute Cargo crate tasks via cargo (#13261) (`ee81349`) - perf: Pre-size engine task collections (#13265) (`17bc22e`) - feat: Expose resolved experimentalCI task configuration in `turbo query` (#13264) (`0f564e5`) - feat: Derive input and output globs for Cargo tasks (#13263) (`05b0e74`) - perf: Parse large pnpm lockfile sections in parallel (#13266) (`ac4155e`) - feat: Hash Cargo external dependencies per-crate (#13267) (`71300aa`) - ci: Install pnpm 10 in musl containers for Library Release (#13269) (`5ba9f66`) - ci: Force pnpm overwrite in Library Release musl containers (#13270) (`560ee2f`) - perf: Defer the untracked-scan barrier to first file-hash use (#13268) (`96b0f5a`) - ci: Fetch API-created commit before updating local ref (#13271) (`4cbaf48`) - release(library): 0.0.1-canary.22 (#13272) (`d2e0691`) - perf: Remove lock and dispatch overhead from task hash precomputation (#13273) (`dd6de07`) - fix: Fall back to lockfile detection in @turbo/repository when package manager is undeclared (#13275) (`8cf0e75`) - test: Add end-to-end coverage for Cargo workspaces (#13274) (`ce18f0a`) - release(library): 0.0.1-canary.23 (#13276) (`8e3a59f`) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
anthonyshew
added a commit
that referenced
this pull request
Jul 6, 2026
## Why `Lint / Rust clippy` is failing on main: the nested `if` introduced in #13275 trips `clippy::collapsible_if` under `RUSTFLAGS=-D warnings`, blocking CI for every open PR (surfaced on #13277's merge-commit run). ## What Collapse the nested `if`/`if let` into a let-chain per clippy's suggestion. No behavior change. ## How to verify `RUSTFLAGS="-D warnings" cargo clippy -p turborepo-napi --all-targets` passes.
anthonyshew
pushed a commit
that referenced
this pull request
Jul 6, 2026
## Release v2.10.4 > [!CAUTION] > Versioned docs aliasing FAILED. [View logs](https://github.com/vercel/turborepo/actions/runs/28819266360) ### Changes - release(turborepo): 2.10.3 (#13222) (`02f4ed0`) - ci: Retry Windows nextest aborts from transient 0xc0000142 spawn failures (#13240) (`222ffff`) - perf: Use mimalloc as the global allocator (#13237) (`c42a8a9`) - perf: Parse yarn v1 lockfiles in a single pass (#13241) (`6207099`) - ci: Fix cache outputs for Eve app (#13243) (`d8b556d`) - perf: Stop materializing spans for the disabled daemon log layer (#13244) (`623aadc`) - fix: Keep ancestor-scoped bun dependencies resolvable after prune renames (#13236) (`8658b66`) - perf: Overlap external dependency hashing with package file hashing (#13234) (`445b0c7`) - perf: Build tracked repo index concurrently with package graph (#13232) (`f4699c6`) - perf: Release tokio runtime at exit so background DNS lookups never stall the user (#13231) (`ae635bd`) - perf: Overhaul pnpm lockfile parsing and dependency closure computation (#13228) (`669676d`) - feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) (#13227) (`f546930`) - feat: Introduce toolchain provider abstraction (#13235) (`f03addb`) - perf: Parse Berry lockfiles in a single pass (#13242) (`6d36125`) - fix: Apply input exclusion globs to the filesystem walk (#13224) (`d3f9dd3`) - fix: Stop root-directory packages from claiming every file in change mapping (#13225) (`f80203a`) - chore: Rename turborepo-repository napi package to @turbo/repository (#13226) (`c1972b3`) - perf: Hash git blobs with hardware-accelerated SHA-1 (#13245) (`17ffa0c`) - release(turborepo): 2.10.4-canary.1 (#13247) (`a31389e`) - feat: Discover Cargo crates as packages (#13248) (`d813d12`) - perf: Reuse per-package external dependency hashes in run summaries (#13249) (`ef7ef06`) - perf: Stat workspace turbo.json files concurrently during discovery (#13251) (`57be8e5`) - chore: Add tracing spans to workspace discovery and globwalk phases (#13252) (`bd76946`) - fix: Avoid non-reentrant libc calls in concurrent shutdown process scans (#13256) (`bf2d827`) - perf: Memoize resolved task definitions during engine construction (#13257) (`9085289`) - perf: Compute transitive closures and external dependency hashes concurrently with run setup (#13250) (`b305fe2`) - perf: Probe microfrontends configs in parallel (#13262) (`ea7c1f8`) - feat: Execute Cargo crate tasks via cargo (#13261) (`ee81349`) - perf: Pre-size engine task collections (#13265) (`17bc22e`) - feat: Expose resolved experimentalCI task configuration in `turbo query` (#13264) (`0f564e5`) - feat: Derive input and output globs for Cargo tasks (#13263) (`05b0e74`) - perf: Parse large pnpm lockfile sections in parallel (#13266) (`ac4155e`) - feat: Hash Cargo external dependencies per-crate (#13267) (`71300aa`) - ci: Install pnpm 10 in musl containers for Library Release (#13269) (`5ba9f66`) - ci: Force pnpm overwrite in Library Release musl containers (#13270) (`560ee2f`) - perf: Defer the untracked-scan barrier to first file-hash use (#13268) (`96b0f5a`) - ci: Fetch API-created commit before updating local ref (#13271) (`4cbaf48`) - release(library): 0.0.1-canary.22 (#13272) (`d2e0691`) - perf: Remove lock and dispatch overhead from task hash precomputation (#13273) (`dd6de07`) - fix: Fall back to lockfile detection in @turbo/repository when package manager is undeclared (#13275) (`8cf0e75`) - test: Add end-to-end coverage for Cargo workspaces (#13274) (`ce18f0a`) - release(library): 0.0.1-canary.23 (#13276) (`8e3a59f`) - release(turborepo): 2.10.4-canary.2 (#13278) (`7e02f94`) - fix: Collapse nested package-manager fallback conditional (#13279) (`af01fdf`) - feat: Make turbo watch Cargo-aware (#13280) (`39d623e`) - perf: Skip dependency-closure assembly for toolchains that derive nothing (#13277) (`ff0d508`) - feat: Make turbo prune Cargo-aware (#13281) (`ddc584d`) - fix: Raise the open-file soft limit at startup (#13282) (`947b478`) - fix: Stop flagging relative imports that resolve into node_modules in boundaries (#13284) (`11a68c7`) - perf: Evaluate simple include globs without wax compilation (#13285) (`189897a`) - chore: Dogfood native Cargo support in this repository (#13283) (`42f067b`) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
anthonyshew
pushed a commit
that referenced
this pull request
Jul 7, 2026
## Release v2.10.5-canary.1 > [!CAUTION] > Versioned docs aliasing FAILED. [View logs](https://github.com/vercel/turborepo/actions/runs/28833246614) ### Changes - perf: Remove lock and dispatch overhead from task hash precomputation (#13273) (`dd6de07`) - fix: Fall back to lockfile detection in @turbo/repository when package manager is undeclared (#13275) (`8cf0e75`) - test: Add end-to-end coverage for Cargo workspaces (#13274) (`ce18f0a`) - release(library): 0.0.1-canary.23 (#13276) (`8e3a59f`) - release(turborepo): 2.10.4-canary.2 (#13278) (`7e02f94`) - fix: Collapse nested package-manager fallback conditional (#13279) (`af01fdf`) - feat: Make turbo watch Cargo-aware (#13280) (`39d623e`) - perf: Skip dependency-closure assembly for toolchains that derive nothing (#13277) (`ff0d508`) - feat: Make turbo prune Cargo-aware (#13281) (`ddc584d`) - fix: Raise the open-file soft limit at startup (#13282) (`947b478`) - fix: Stop flagging relative imports that resolve into node_modules in boundaries (#13284) (`11a68c7`) - perf: Evaluate simple include globs without wax compilation (#13285) (`189897a`) - chore: Dogfood native Cargo support in this repository (#13283) (`42f067b`) - release(turborepo): 2.10.4 (#13286) (`f2fce38`) - ci: Remove dead sccache configuration (#13289) (`558df3f`) - feat: Serve the Remote Cache as an sccache backend for Cargo tasks (#13288) (`0d9803f`) - fix: Reject output path traversal (#13290) (`733ccca`) - fix: Disable the sccache proxy when remote cache use is off (#13291) (`3249e22`) - feat: Embed sccache so the Cargo compile cache needs no installation (#13293) (`b6d0035`) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
devEngines.packageManagersupport (#12388) made package manager resolution strict: a package.json with neitherpackageManagernordevEngines.packageManagernow yieldsError::MissingPackageManagerinstead of falling back to lockfile-based detection (codified bytest_missing_package_manager_does_not_infer_missing_declarations). That strictness is right for the CLI, but it also changedWorkspace.findin@turbo/repository— a library that analyzes repositories it doesn't control. Any repo without a declared package manager now fails to load entirely, which regresses downstream consumers (e.g. Vercel's Skip Unaffected Projects would silently stop working for every such repo if it picked up a new canary).What
Workspace.findnow mirrors the CLI's--dangerously-allow-missing-package-managerbehavior: when the declaration is missing or unusable, fall back todetect_package_manager(lockfile-based). If detection also fails, the original declaration error still surfaces. CLI behavior is unchanged — the strict-resolution tests from #12388 are untouched and still pass.How
The fallback lives in the napi layer's
find_internal, repairing the memoizedRepoStateonce so every downstream consumer (packages_internal, graph build) sees the detected package manager.modeis recomputed alongside it: it was derived while the package manager was unresolved, so workspace globs could not be read and multi-package repos were misclassified as single-package.Regression test: a new
npm-monorepo-no-pmfixture (npm lockfile, no declaration) assertsWorkspace.findresolves npm, reportsisMultiPackage, and enumerates workspace packages. It fails on main withMissing \devEngines.packageManager` or legacy `packageManager` field in package.json`.