Skip to content

[test] Pin package manager to patch versions#93592

Merged
eps1lon merged 2 commits into
canaryfrom
sebbie/pnpm-pin
May 7, 2026
Merged

[test] Pin package manager to patch versions#93592
eps1lon merged 2 commits into
canaryfrom
sebbie/pnpm-pin

Conversation

@eps1lon

@eps1lon eps1lon commented May 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Various installs used the latest package manager versions Corepack settled on (test fixtures and stats actions).

This is generally unsafe for two reasons:

  1. CI might start randomly failing on new, incompatible releases
  2. No explicit approval for newly released versions which opens us up to supply chain attacks

We're hitting the first point at the moment: https://github.com/vercel/next.js/actions/runs/25491587958/job/74801639436?pr=93590#step:36:201

@github-actions github-actions Bot added created-by: Next.js team PRs by the Next.js team. tests labels May 7, 2026
@eps1lon eps1lon force-pushed the sebbie/pnpm-pin branch from aae216a to de2279c Compare May 7, 2026 11:24
@eps1lon eps1lon changed the title [test] Pin package manager versions used in test fixtures [test] Pin package manager versions used May 7, 2026
@eps1lon eps1lon force-pushed the sebbie/pnpm-pin branch from de2279c to 30b797b Compare May 7, 2026 11:38
@github-actions

github-actions Bot commented May 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Stats from current PR

🔴 1 regression

Metric Canary PR Change Trend
Turbo Build Time (cached) 4.954s 5.268s 🔴 +314ms (+6%) ▂▆▇▁█
📊 All Metrics
📖 Metrics Glossary

Dev Server Metrics:

  • Listen = TCP port starts accepting connections
  • First Request = HTTP server returns successful response
  • Cold = Fresh build (no cache)
  • Warm = With cached build artifacts

Build Metrics:

  • Fresh = Clean build (no .next directory)
  • Cached = With existing .next directory

Change Thresholds:

  • Time: Changes < 50ms AND < 10%, OR < 2% are insignificant
  • Size: Changes < 1KB AND < 1% are insignificant
  • All other changes are flagged to catch regressions

⚡ Dev Server

Metric Canary PR Change Trend
Cold (Listen) 864ms 815ms ✓ █████
Cold (Ready in log) 830ms 820ms ✓ ███▆▇
Cold (First Request) 1.371s 1.370s ✓ ▇█▇▁█
Warm (Listen) 863ms 811ms ✓ █████
Warm (Ready in log) 824ms 814ms ✓ ▇██▆█
Warm (First Request) 625ms 654ms ✓ ▆█▇▄▆
📦 Dev Server (Webpack) (Legacy)

📦 Dev Server (Webpack)

Metric Canary PR Change Trend
Cold (Listen) 813ms 811ms ✓ █████
Cold (Ready in log) 801ms 799ms ✓ █▆▆██
Cold (First Request) 3.304s 3.309s ✓ ▆▂▃▆▆
Warm (Listen) 812ms 811ms ✓ █████
Warm (Ready in log) 797ms 799ms ✓ █▆▆█▇
Warm (First Request) 3.331s 3.305s ✓ ▇▃▄▇▆

⚡ Production Builds

Metric Canary PR Change Trend
Fresh Build 5.132s 5.214s ✓ ▁▆▆▃▇
Cached Build 4.954s 5.268s 🔴 +314ms (+6%) ▂▆▇▁█
📦 Production Builds (Webpack) (Legacy)

📦 Production Builds (Webpack)

Metric Canary PR Change Trend
Fresh Build 24.312s 24.444s ✓ ▄▃▃▄▄
Cached Build 24.579s 24.514s ✓ ▆▄▄▆▅
node_modules Size 505 MB 505 MB ✓ ▁▁███
📦 Bundle Sizes

Bundle Sizes

⚡ Turbopack

Client

Main Bundles
Canary PR Change
032hjf6w5lawy.js gzip 155 B N/A -
04hm05ar7kldw.js gzip 5.73 kB N/A -
0850xfjov8qxk.js gzip 65.5 kB N/A -
0aqhtuqjkttbp.js gzip 151 B N/A -
0cz1d0mv5g_q7.js gzip 39.4 kB 39.4 kB ✓
0d-t04d90nxyx.js gzip 155 B N/A -
0ge4x21m_fuc8.js gzip 156 B N/A -
0q_zozu0nq_np.js gzip 8.51 kB N/A -
13lrt22t_69qa.js gzip 8.6 kB N/A -
13s20nrhn4s8-.js gzip 13.8 kB N/A -
14fqn5gkfi5dy.js gzip 159 B N/A -
1elt1qium-r2m.css gzip 115 B 115 B ✓
1jpaub6y8xlfr.js gzip 2.3 kB N/A -
1ot0mvscrc_uf.js gzip 233 B N/A -
1uqyjms2v3a2x.js gzip 10.4 kB N/A -
1v0ycni370q_7.js gzip 8.52 kB N/A -
1vb52vs5uaqof.js gzip 70.8 kB N/A -
2_m3xv2uq3sjc.js gzip 1.46 kB N/A -
292_67uk8hyod.js gzip 155 B N/A -
2extn3odmmem_.js gzip 12.9 kB N/A -
2fyhyy7niw9r6.js gzip 7.61 kB N/A -
2puaaj60ms-56.js gzip 169 B N/A -
2riibg1ndirpj.js gzip 10.1 kB N/A -
2zc4tax40sui6.js gzip 9.24 kB N/A -
30r8mm-46bdqy.js gzip 220 B 220 B ✓
35vhda91jf4lt.js gzip 159 B N/A -
3b9sh0ke-wiue.js gzip 157 B N/A -
3dd42mxmevz1t.js gzip 49.5 kB N/A -
3dnxhpk39f53v.js gzip 8.57 kB N/A -
3dsng975is7ps.js gzip 8.59 kB N/A -
3ecye0akknyhh.js gzip 154 B N/A -
3inab2jybr4k9.js gzip 450 B N/A -
3jkm5tdjvaf_q.js gzip 13.1 kB N/A -
3jvw4u1y018lt.js gzip 9.82 kB N/A -
3kfxy6omiyi8i.js gzip 8.57 kB N/A -
3ps-lt0314a0m.js gzip 155 B N/A -
3r9qhujmuwkzb.js gzip 8.63 kB N/A -
3rna-uxopfrvd.js gzip 8.6 kB N/A -
3tndwlmduss27.js gzip 13.4 kB N/A -
3urke96askytl.js gzip 155 B N/A -
3v4hrsbsd52mb.js gzip 153 B N/A -
turbopack-0-..lk0-.js gzip 4.2 kB N/A -
turbopack-0b..sbhx.js gzip 4.2 kB N/A -
turbopack-0p..-tsx.js gzip 4.2 kB N/A -
turbopack-0s..-8d8.js gzip 4.21 kB N/A -
turbopack-0w..gwj9.js gzip 4.2 kB N/A -
turbopack-0x..y1td.js gzip 4.2 kB N/A -
turbopack-1i..1ikw.js gzip 4.2 kB N/A -
turbopack-1r..04k6.js gzip 4.2 kB N/A -
turbopack-22..0onz.js gzip 4.2 kB N/A -
turbopack-2v..l6en.js gzip 4.2 kB N/A -
turbopack-35..j8rh.js gzip 4.18 kB N/A -
turbopack-3b..15jk.js gzip 4.2 kB N/A -
turbopack-3g..l-ny.js gzip 4.2 kB N/A -
turbopack-3i..-fxp.js gzip 4.2 kB N/A -
03_5w3jfg2kc-.js gzip N/A 10.1 kB -
05e40c15cx1dd.js gzip N/A 7.61 kB -
05pe8rzbupg6u.js gzip N/A 10.4 kB -
05v6t_jh5f_yx.js gzip N/A 13.8 kB -
07-r4t7h7oran.js gzip N/A 70.8 kB -
0806zgk7siyp7.js gzip N/A 8.6 kB -
09n8tafnk1gut.js gzip N/A 154 B -
0b29hwveensqm.js gzip N/A 158 B -
0dd4zxdgej84s.js gzip N/A 65.6 kB -
0fod6nyyd77zu.js gzip N/A 49.5 kB -
0htsbiobnao9x.js gzip N/A 13.4 kB -
0m34gln_kt4fg.js gzip N/A 5.73 kB -
0rs6tf8z8po60.js gzip N/A 8.52 kB -
1av1jag822n6l.js gzip N/A 8.51 kB -
1c_jcnid1asvv.js gzip N/A 155 B -
1er7dqnoopydf.js gzip N/A 8.59 kB -
1fqapc82_q_1-.js gzip N/A 160 B -
1g3q1ww01thnl.js gzip N/A 2.3 kB -
1i0eqvqjhhe_v.js gzip N/A 8.57 kB -
1i3tnfdidr7-g.js gzip N/A 169 B -
1l9un1sl77287.js gzip N/A 1.46 kB -
2147zgtf14z-q.js gzip N/A 234 B -
25z5pyx03noy-.js gzip N/A 8.57 kB -
26hzu82vflfgo.js gzip N/A 154 B -
2lf717n7y9xvn.js gzip N/A 9.82 kB -
2phvmz17a6w5i.js gzip N/A 156 B -
2r1_kwolhfcb_.js gzip N/A 156 B -
2st_qs6p_9us0.js gzip N/A 13.1 kB -
3214a3_0hs02x.js gzip N/A 8.6 kB -
38l-2n-xv_j.js gzip N/A 9.24 kB -
3aagjcb818_x3.js gzip N/A 155 B -
3g66hnyrm_e1s.js gzip N/A 151 B -
3hqti_t-zy1x4.js gzip N/A 449 B -
3ol-m0wj6r9mx.js gzip N/A 160 B -
3wri_t1hp2hj2.js gzip N/A 157 B -
3z3a37i3a_vgl.js gzip N/A 8.63 kB -
41mf-x3mmsxae.js gzip N/A 12.9 kB -
42lrhf83syghj.js gzip N/A 156 B -
turbopack-0-..bpux.js gzip N/A 4.2 kB -
turbopack-07..cdsy.js gzip N/A 4.2 kB -
turbopack-0v..-_42.js gzip N/A 4.2 kB -
turbopack-0x..sg9g.js gzip N/A 4.2 kB -
turbopack-0x..fvex.js gzip N/A 4.2 kB -
turbopack-19..duua.js gzip N/A 4.2 kB -
turbopack-1c..xelm.js gzip N/A 4.2 kB -
turbopack-1d..grih.js gzip N/A 4.18 kB -
turbopack-1g..2g06.js gzip N/A 4.21 kB -
turbopack-2o..5_gh.js gzip N/A 4.2 kB -
turbopack-39..orer.js gzip N/A 4.2 kB -
turbopack-3k..8y4r.js gzip N/A 4.2 kB -
turbopack-3x..olh8.js gzip N/A 4.2 kB -
turbopack-44..sont.js gzip N/A 4.2 kB -
Total 466 kB 466 kB ⚠️ +51 B

Server

Middleware
Canary PR Change
middleware-b..fest.js gzip 722 B 713 B 🟢 9 B (-1%)
Total 722 B 713 B ✅ -9 B
Build Details
Build Manifests
Canary PR Change
_buildManifest.js gzip 432 B 429 B ✓
Total 432 B 429 B ✅ -3 B

📦 Webpack

Client

Main Bundles
Canary PR Change
2258-HASH.js gzip 61.1 kB N/A -
2266-HASH.js gzip 4.69 kB N/A -
3317.HASH.js gzip 169 B N/A -
4866-HASH.js gzip 5.64 kB N/A -
9e302639-HASH.js gzip 62.7 kB N/A -
framework-HASH.js gzip 59.5 kB 59.5 kB ✓
main-app-HASH.js gzip 254 B 254 B ✓
main-HASH.js gzip 39.7 kB 39.7 kB ✓
webpack-HASH.js gzip 1.68 kB 1.68 kB ✓
175fd0fd-HASH.js gzip N/A 62.7 kB -
2596-HASH.js gzip N/A 5.63 kB -
34-HASH.js gzip N/A 61 kB -
5691.HASH.js gzip N/A 169 B -
9156-HASH.js gzip N/A 4.68 kB -
Total 235 kB 235 kB ✅ -88 B
Polyfills
Canary PR Change
polyfills-HASH.js gzip 39.4 kB 39.4 kB ✓
Total 39.4 kB 39.4 kB ✓
Pages
Canary PR Change
_app-HASH.js gzip 193 B 193 B ✓
_error-HASH.js gzip 181 B 182 B ✓
css-HASH.js gzip 334 B 332 B ✓
dynamic-HASH.js gzip 1.79 kB 1.81 kB ✓
edge-ssr-HASH.js gzip 255 B 255 B ✓
head-HASH.js gzip 351 B 348 B ✓
hooks-HASH.js gzip 385 B 384 B ✓
image-HASH.js gzip 580 B 580 B ✓
index-HASH.js gzip 257 B 259 B ✓
link-HASH.js gzip 2.51 kB 2.52 kB ✓
routerDirect..HASH.js gzip 318 B 319 B ✓
script-HASH.js gzip 387 B 386 B ✓
withRouter-HASH.js gzip 316 B 316 B ✓
1afbb74e6ecf..834.css gzip 106 B 106 B ✓
Total 7.97 kB 7.99 kB ⚠️ +19 B

Server

Edge SSR
Canary PR Change
edge-ssr.js gzip 126 kB 126 kB ✓
page.js gzip 275 kB 269 kB 🟢 5.3 kB (-2%)
Total 401 kB 395 kB ✅ -5.57 kB
Middleware
Canary PR Change
middleware-b..fest.js gzip 618 B 612 B ✓
middleware-r..fest.js gzip 155 B 155 B ✓
middleware.js gzip 44.4 kB 44.4 kB ✓
edge-runtime..pack.js gzip 842 B 842 B ✓
Total 46 kB 46 kB ⚠️ +38 B
Build Details
Build Manifests
Canary PR Change
_buildManifest.js gzip 719 B 717 B ✓
Total 719 B 717 B ✅ -2 B
Build Cache
Canary PR Change
0.pack gzip 4.44 MB 4.44 MB 🟢 7.03 kB (0%)
index.pack gzip 116 kB 115 kB ✓
index.pack.old gzip 112 kB 115 kB 🔴 +2.39 kB (+2%)
Total 4.67 MB 4.67 MB ✅ -5.75 kB

🔄 Shared (bundler-independent)

Runtimes
Canary PR Change
app-page-exp...dev.js gzip 349 kB 349 kB ✓
app-page-exp..prod.js gzip 194 kB 194 kB ✓
app-page-tur...dev.js gzip 349 kB 349 kB ✓
app-page-tur..prod.js gzip 194 kB 194 kB ✓
app-page-tur...dev.js gzip 345 kB 345 kB ✓
app-page-tur..prod.js gzip 192 kB 192 kB ✓
app-page.run...dev.js gzip 346 kB 346 kB ✓
app-page.run..prod.js gzip 192 kB 192 kB ✓
app-route-ex...dev.js gzip 77.4 kB 77.4 kB ✓
app-route-ex..prod.js gzip 52.8 kB 52.8 kB ✓
app-route-tu...dev.js gzip 77.4 kB 77.4 kB ✓
app-route-tu..prod.js gzip 52.8 kB 52.8 kB ✓
app-route-tu...dev.js gzip 77 kB 77 kB ✓
app-route-tu..prod.js gzip 52.6 kB 52.6 kB ✓
app-route.ru...dev.js gzip 77 kB 77 kB ✓
app-route.ru..prod.js gzip 52.6 kB 52.6 kB ✓
dist_client_...dev.js gzip 324 B 324 B ✓
dist_client_...dev.js gzip 326 B 326 B ✓
dist_client_...dev.js gzip 318 B 318 B ✓
dist_client_...dev.js gzip 317 B 317 B ✓
pages-api-tu...dev.js gzip 44.3 kB 44.3 kB ✓
pages-api-tu..prod.js gzip 33.7 kB 33.7 kB ✓
pages-api.ru...dev.js gzip 44.3 kB 44.3 kB ✓
pages-api.ru..prod.js gzip 33.7 kB 33.7 kB ✓
pages-turbo....dev.js gzip 53.7 kB 53.7 kB ✓
pages-turbo...prod.js gzip 39.4 kB 39.4 kB ✓
pages.runtim...dev.js gzip 53.7 kB 53.7 kB ✓
pages.runtim..prod.js gzip 39.4 kB 39.4 kB ✓
server.runti..prod.js gzip 63.2 kB 63.2 kB ✓
use-cache-pr...dev.js gzip 69.7 kB 69.7 kB ✓
use-cache-pr...dev.js gzip 69.7 kB 69.7 kB ✓
use-cache-pr...dev.js gzip 68 kB 68 kB ✓
use-cache-pr...dev.js gzip 68 kB 68 kB ✓
Total 3.36 MB 3.36 MB ✓
📎 Tarball URL 
https://vercel-packages.vercel.app/next/commits/f85d9eee89955a75290b90c9e8e6a065cd525f5a/next

Commit: f85d9ee

@eps1lon eps1lon force-pushed the sebbie/pnpm-pin branch from 30b797b to f85d9ee Compare May 7, 2026 12:08
@eps1lon eps1lon marked this pull request as ready for review May 7, 2026 12:44
@eps1lon eps1lon requested review from sokra and timneutkens May 7, 2026 12:44
@github-actions

github-actions Bot commented May 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Tests Passed

Commit: f85d9ee

@eps1lon eps1lon enabled auto-merge (squash) May 7, 2026 12:48
@eps1lon eps1lon changed the title [test] Pin package manager versions used [test] Pin package manager to patch versions May 7, 2026
This was referenced May 7, 2026
Merged
Merged
@eps1lon eps1lon merged commit 225be6a into canary May 7, 2026
335 of 337 checks passed
@eps1lon eps1lon deleted the sebbie/pnpm-pin branch May 7, 2026 13:01
@github-actions github-actions Bot locked as resolved and limited conversation to collaborators May 21, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@unstubbable unstubbable unstubbable approved these changes

@sokra sokra Awaiting requested review from sokra

@timneutkens timneutkens Awaiting requested review from timneutkens

Assignees

No one assigned

Labels

created-by: Next.js team PRs by the Next.js team. locked tests

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@eps1lon @unstubbable