feat: add sub folder support for git url#7487
Conversation
|
@zkochan I have two questions according to your comment:
The "workspace" feature in NPM, Yarn and PNPM is different. PNPM uses It seems the only work is to add logic to the I found that Yarn's "workspace clone" is actually placed on the docs Git Protocol, which gives a syntax that uses Should I change the separator to |
The current logic might already work for the monorepo scenario. pnpm checks what lockfile is used and runs the right package manager.
I'm fine with this approach just use path instead of workspace |
The current logic does not handle the I'll add a check for this that only runs when |
cb0c93e to
fcba8dc
Compare
fcba8dc to
3744c3d
Compare
|
@zkochan I've finished all changes; please take a look~ |
|
add changesets. Also, this is a new feature, so I'd like more members to review it. |
|
What to do with packages that have the pnpm/network/fetch/package.json Lines 36 to 37 in 46990ec Installation will fail because I guess the "right" solution would be to convert those dependencies to something like: "@pnpm/core-loggers": "github:pnpm/pnpm#main&path:packages/core-loggers",
"@pnpm/fetching-types": "github:pnpm/pnpm#main&path:network/fetching-types", |
|
Using The scenario may need to be supported, but maybe not by this PR? |
|
Currently, pnpm works fine only for the following scenarios (without
After this PR, pnpm will also work fine in these scenarios if users specify |
zkochan
left a comment
There was a problem hiding this comment.
You need to make changes to https://github.com/pnpm/pnpm/blob/main/fetching/tarball-fetcher/src/gitHostedTarballFetcher.ts too.
Some git-hosting providers (e.g. Github) have API for downloading the tarball through an HTTP request.
|
I've added support for tarball fetcher, and changed |
45be164 to
5b03360
Compare
d8b007a to
374c478
Compare
|
It still doesn't work as far as I can tell. Will check later why. Also, it is stored currently in the store by git URL, so it will work only for the first package from the given git repo, the next one will be broken. |
|
It should be okay to store only by Git URL - just 1 item in But I found it strange that pnpm somehow uses both tarball fetcher and git fetcher even if the Git URLs are the same. Please see the following {
"name": "test",
"version": "1.0.0",
"dependencies": {
"simple-react-app": "github:RexSkz/test-git-subfolder-fetch.git#path:/packages/simple-react-app",
"simple-express-server": "github:RexSkz/test-git-subfolder-fetch.git#path:/packages/simple-express-server"
}
}dependencies:
simple-express-server:
specifier: github:RexSkz/test-git-subfolder-fetch.git#path:/packages/simple-express-server
version: git@github.com+RexSkz/test-git-subfolder-fetch/2b42a57a945f19f8ffab8ecbd2021fdc2c58ee22
simple-react-app:
specifier: github:RexSkz/test-git-subfolder-fetch.git#path:/packages/simple-react-app
version: github.com/RexSkz/test-git-subfolder-fetch/2b42a57a945f19f8ffab8ecbd2021fdc2c58ee22
packages:
git@github.com+RexSkz/test-git-subfolder-fetch/2b42a57a945f19f8ffab8ecbd2021fdc2c58ee22:
resolution: {commit: 2b42a57a945f19f8ffab8ecbd2021fdc2c58ee22, path: /packages/simple-express-server, repo: git@github.com:RexSkz/test-git-subfolder-fetch.git, type: git}
name: '@my-namespace/simple-express-server'
version: 1.0.0
dependencies:
express: 4.18.2
lodash: 4.17.21
transitivePeerDependencies:
- supports-color
dev: false
github.com/RexSkz/test-git-subfolder-fetch/2b42a57a945f19f8ffab8ecbd2021fdc2c58ee22:
resolution: {tarball: https://codeload.github.com/RexSkz/test-git-subfolder-fetch/tar.gz/2b42a57a945f19f8ffab8ecbd2021fdc2c58ee22}
name: monorepo-example
version: 1.0.0
dev: falseThe |
|
I will look into it only after I finish with #7407 |
|
TODO:
|
|
Hi, Is it going to be a part of 8.x? |
|
It seems a part of 9.x. https://github.com/pnpm/pnpm/releases/tag/v9.0.0-alpha.1 |
| const joined = path.join(root, sub) | ||
| // prevent the dir traversal attack | ||
| const relative = path.relative(root, joined) | ||
| if (relative.startsWith('..')) { |
There was a problem hiding this comment.
Doesn't this still allow passing subdir/../../../ and a relative.includes('..') would be safer?
There was a problem hiding this comment.
relative is a calculated relative path between two ABSOLUTE paths: root and joined. If you pass subdir/../../../, the relative will definitely start with ...
There was a problem hiding this comment.
Oh. I missed the call to path.relative before.
There was a problem hiding this comment.
We should always use path.relative to let Node.js calculate whether the user input path is outside the project root. Disallowing .. or / might not be a safe way since the resolving rules may change in future, and our block list may not be effective then :)
The capability to install packages with |
No, it will only be part of v9. v8 will probably have only bug fixes from now on.
It is not an easy task. It isn't high in my own priority list. In general, I don't think installing from git is a good idea although I do see that many people do it. I would recommend looking into bit.dev as an alternative to monorepo(s) usage. With bit every component is independent but can be developed together in a singe workspace. So, you don't need to maintain monorepos. When you want to change some components, you just import them to a workspace. When the changes are done, you export them. This workflow is much better than monorepos, especially than multiple monorepos. |
Close #4765