Description
In GVS (Global Virtual Store) mode, when pnpm approve-builds or pnpm rebuild runs postinstall scripts for a package, the build artifacts are written in-place into the existing GVS hash directory. The symlink in node_modules is not updated to point to a new hash directory that includes the side-effects.
This means:
- The GVS hash directory now contains build artifacts that weren't part of the original import
- Other projects linking to the same hash directory would get these build artifacts, even if they haven't approved the package
- The side-effects cache key doesn't match the actual state of the directory
Steps to reproduce
pnpm add esbuild (GVS mode, no allowBuilds)
- Check symlink:
ls -la node_modules/esbuild → points to .../esbuild/0.27.4/<hash>/...
pnpm approve-builds esbuild
- Check symlink: still points to the same hash directory (should have changed)
Expected behavior
After approve-builds or rebuild, the package should be re-imported with side-effects into a new GVS hash directory, and the symlink should be updated.
Description
In GVS (Global Virtual Store) mode, when
pnpm approve-buildsorpnpm rebuildruns postinstall scripts for a package, the build artifacts are written in-place into the existing GVS hash directory. The symlink innode_modulesis not updated to point to a new hash directory that includes the side-effects.This means:
Steps to reproduce
pnpm add esbuild(GVS mode, noallowBuilds)ls -la node_modules/esbuild→ points to.../esbuild/0.27.4/<hash>/...pnpm approve-builds esbuildExpected behavior
After
approve-buildsorrebuild, the package should be re-imported with side-effects into a new GVS hash directory, and the symlink should be updated.