Skip to content

pnpm rebuild / approve-builds doesn't update GVS symlink after building #11042

@zkochan

Description

@zkochan

Description

In GVS (Global Virtual Store) mode, when pnpm approve-builds or pnpm rebuild runs postinstall scripts for a package, the build artifacts are written in-place into the existing GVS hash directory. The symlink in node_modules is not updated to point to a new hash directory that includes the side-effects.

This means:

  1. The GVS hash directory now contains build artifacts that weren't part of the original import
  2. Other projects linking to the same hash directory would get these build artifacts, even if they haven't approved the package
  3. The side-effects cache key doesn't match the actual state of the directory

Steps to reproduce

  1. pnpm add esbuild (GVS mode, no allowBuilds)
  2. Check symlink: ls -la node_modules/esbuild → points to .../esbuild/0.27.4/<hash>/...
  3. pnpm approve-builds esbuild
  4. Check symlink: still points to the same hash directory (should have changed)

Expected behavior

After approve-builds or rebuild, the package should be re-imported with side-effects into a new GVS hash directory, and the symlink should be updated.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions