Update pnpm to v11 by delucis · Pull Request #16716 · withastro/astro

delucis · 2026-05-12T17:38:04Z

Changes

Updates pnpm to v11
Removes minimum release age exceptions that are no longer required
Cleans up deps in a couple of fixtures that were accidentally using npm versions of monorepo packages
Explicitly disallows postinstall scripts for all dependencies that have them
Enables pnpm’s trustPolicy which prevents installing versions of packages that have reduced their publishing provenance. This required applying some limited exceptions to continue installing our currently installed packages.

Some semi-user-facing changes:

Updated deps in the Netlify adapter
Dropped support for older versions of VS Code so we can test with Node ≥22 which is pnpm 11’s minimum required version

Testing

Existing tests should pass

Docs

n/a — monorepo hardening only

changeset-bot · 2026-05-12T17:38:11Z

🦋 Changeset detected

Latest commit: c53b7b6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@astrojs/netlify	Patch
@astrojs/ts-plugin	Patch
astro-vscode	Patch
@test/netlify-session	Patch
@test/netlify-hosted-astro-project	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

matthewp · 2026-05-12T17:40:33Z

  },
  "dependencies": {
-    "@webcomponents/template-shadowroot": "^0.2.1",
-    "lit": "^3.3.2",


haha, i can't believe we still had this.

delucis · 2026-05-12T17:40:23Z

-    "@webcomponents/template-shadowroot": "^0.2.1",
-    "lit": "^3.3.2",


These packages used to be used in this fixture but are no longer needed now we don’t have the Lit integration. Removing them allowed me to clean up some pnpm config.

delucis · 2026-05-12T17:41:11Z

 	"dependencies": {
 		"@astrojs/cloudflare": "workspace:*",
-		"@astrojs/solid-js": "^5.1.3",
+		"@astrojs/solid-js": "workspace:*",


This fixture and a few others were not using workspace:* copies of monorepo packages. This caused them to lag behind and use outdated versions which the newly enable trustPolicy caught.

delucis · 2026-05-12T17:43:29Z

Ah, smoke test is failing because it clones docs but runs it in the context of the monorepo so trustPolicy needs to apply on docs deps too 😅

I might first make a PR to docs to enable it there and then I’ll come back here knowing what’s needed.

Update: 9050066 should fix this

ematipico

The failure is caused by an accidental update of one of netlfy deps, which are buggy and make our tests fail. In fact, the lock file changed some of those deps. Please revert them.

The Netlify team published a fixed a version a few days ago, but I don't know if it matches our minium age policy. The fix is here https://github.com/netlify/primitives/releases/tag/vite-plugin-v2.12.2

ematipico · 2026-05-13T09:13:11Z

+  # Dependencies in the docs repo that gets cloned for smoke tests
+  - 'undici@5.29.0'
+  - 'algoliasearch@4.27.0'
+  - '@algolia/client-analytics@4.27.0'
+  - '@algolia/recommend@4.27.0'
+  - '@algolia/client-search@4.27.0'
+  - '@algolia/requester-browser-xhr@4.27.0'
+  - '@algolia/requester-node-http@4.27.0'
+  - '@algolia/client-common@4.27.0'
+  - '@algolia/logger-console@4.27.0'
+  - '@algolia/client-personalization@4.27.0'


nit: Uhm, not a fan of this. We should probably review our smoke tests.

Yeah agreed. I wondered if instead of cloning to smoke/docs/ and relying on pnpm to autolink astro & co, we should clone as a sibling to the monorepo and npm link packages? If possible? Might be too much to do in this PR though, so went with this as the easiest quick fix.

I accidentally ran an install with the docs repo still cloned, this fixes that.

delucis · 2026-05-13T12:42:14Z

-      # Reset lockfile changes so that Turbo can reuse the old build cache
-      - name: Reset lockfile changes
-        run: git reset --hard
-


This hack no longer works: it appears pnpm 11 will run an install if it detects that packages are not installed correctly. This means that this reset caused the subsequent pnpm run build to rerun an install, which fails due to frozen lockfile requirements in CI. There’s no way to pass --no-frozen-lockfile in this scenario though.

I tested this in a small dummy project where I manually added a dep to package.json and tried running a script. pnpm 11 immediately went to install the dep before running the script.

Princesseuh · 2026-05-13T12:54:48Z

You can update the VS Code engine and types package to 1.101.x and update the CI to run on Node 22.15.1, this will need a vscode changeset too (can be a patch, it's not "breaking" people in the same way a library would)

…w minimum VSC

delucis · 2026-05-13T15:51:56Z

I think this is ready.

Some follow-ups coming out of this PR:

Clean up pnpm overrides that may no longer be necessary (see Update pnpm to v11 #16716 (comment))
Remove minimum release age config that’s no longer necessary (on Friday)
Figure out if we can better handle the docs smoke test so we’re not maintaining a list of docs deps to exclude in this repo

delucis added 8 commits May 12, 2026 18:58

Update pnpm to v11

35c358c

Remove some outdated config for the removed Lit integration

d6f7336

Remove minimum age exceptions that are no longer needed

84d5ace

Disallow builds explicitly

9a9589d

Fix some fixtures using Astro packages from npm

a80e79a

Update lock file

431219e

Enable pnpm trustPolicy

36ca64d

Dedupe deps and add two more trust policy exceptions

2ee0bc3

github-actions Bot added pkg: integration Related to any renderer integration (scope) pkg: astro Related to the core `astro` package (scope) labels May 12, 2026

matthewp reviewed May 12, 2026

View reviewed changes

matthewp approved these changes May 12, 2026

View reviewed changes

delucis commented May 12, 2026

View reviewed changes

ocavue reviewed May 12, 2026

View reviewed changes

Comment thread package.json Outdated

matthewp mentioned this pull request May 12, 2026

Use --ignore-scripts in release and preview-release installs #16715

Closed

delucis added 2 commits May 12, 2026 19:46

Move overrides from package.json to pnpm-workspace.yaml

f609928

Fix lock file

fe0c779

ocavue reviewed May 12, 2026

View reviewed changes

Comment thread pnpm-workspace.yaml

Exempt docs dependencies from trust policy too

9050066

ematipico requested changes May 13, 2026

View reviewed changes

Update Netlify deps

463b3f6

This comment was marked as outdated.

Sign in to view

delucis added 5 commits May 13, 2026 12:24

Fix lock file

0f15789

I accidentally ran an install with the docs repo still cloned, this fixes that.

Merge branch 'main' into chris/pnpm-11

99d5a9f

Fix workspace config indentation

d9c66d2

Add changeset to release Netlify adapter dep updates

9a8925f

Experiment

64b0dd7

github-actions Bot added the 🚨 action Modifies GitHub Actions label May 13, 2026

ematipico approved these changes May 13, 2026

View reviewed changes

Remove hack that no longer works

555d95a

delucis commented May 13, 2026

View reviewed changes

delucis added 4 commits May 13, 2026 16:54

Update language tools to run on Node 22

536a8ae

Update node version *everywhere* it was set

d89b4a5

Include ts-plugin package in changeset and mention release date of ne…

0c783bd

…w minimum VSC

Use more recent version of Node 22 for language tools tests in CI

c53b7b6

ematipico approved these changes May 13, 2026

View reviewed changes

delucis merged commit 04fdbb2 into main May 13, 2026
26 checks passed

delucis deleted the chris/pnpm-11 branch May 13, 2026 15:56

astrobot-houston mentioned this pull request May 13, 2026

[ci] release #16653

Merged

This was referenced May 14, 2026

chore(deps): remove redundant pnpm overrides #16732

Merged

chore: clean up redundant minimumReleaseAgeExclude items #16779

Merged

		"@webcomponents/template-shadowroot": "^0.2.1",
		"lit": "^3.3.2",

Uh oh!

Conversation

delucis commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Testing

Docs

Uh oh!

changeset-bot Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

matthewp May 12, 2026

Choose a reason for hiding this comment

Uh oh!

delucis May 12, 2026

Choose a reason for hiding this comment

Uh oh!

delucis May 12, 2026

Choose a reason for hiding this comment

Uh oh!

delucis commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ematipico left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ematipico May 13, 2026

Choose a reason for hiding this comment

Uh oh!

delucis May 13, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

delucis May 13, 2026

Choose a reason for hiding this comment

Uh oh!

Princesseuh commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

delucis commented May 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

delucis commented May 12, 2026 •

edited

Loading

changeset-bot Bot commented May 12, 2026 •

edited

Loading

delucis commented May 12, 2026 •

edited

Loading

ematipico left a comment •

edited

Loading

Princesseuh commented May 13, 2026 •

edited

Loading