Skip to content

fix(core): include PNPM patches in externalDependencies hash computations#33551

Merged
leosvelperez merged 3 commits intonrwl:masterfrom
comp615:ccroom/pnpm_patches
Dec 16, 2025
Merged

fix(core): include PNPM patches in externalDependencies hash computations#33551
leosvelperez merged 3 commits intonrwl:masterfrom
comp615:ccroom/pnpm_patches

Conversation

@comp615
Copy link
Copy Markdown
Contributor

@comp615 comp615 commented Nov 19, 2025

Current Behavior

If a workspace uses pnpm and adds a local patch to a dependency (e.g. vitest), this patch is not taken into account when computing that dependency's hash for purposes of determining cache changes. In practice, you could patch vitest locally, and tests would pull from the cache.

Expected Behavior

Patches can alter behavior in the same way that updating the version could, it's just that the version is not created and the patch is applied locally.

This updates the pnpm lockfile parsing functionality to read the patches field into a map and then combine the patch hash with the integrity hash. The integrity hash ONLY represents the remote / tarball intergrity, so these have to be combined in order to create a proper key.

Related Issue(s)

(Could not find any, but saw this in my work today)

@comp615 comp615 requested review from a team and meeroslav as code owners November 19, 2025 21:50
@comp615 comp615 requested a review from leosvelperez November 19, 2025 21:50
@netlify
Copy link
Copy Markdown

netlify Bot commented Nov 19, 2025

👷 Deploy request for nx-docs pending review.

Visit the deploys page to approve it

Name Link
🔨 Latest commit 6bc7333

@vercel
Copy link
Copy Markdown

vercel Bot commented Nov 19, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (UTC)
nx-dev Ready Ready Preview Dec 16, 2025 11:58am

@comp615 comp615 changed the title fix(core): include PNPM patches in externalDependncy hash computations fix(core): include PNPM patches in externalDependencies hash computations Nov 19, 2025
@nx-cloud
Copy link
Copy Markdown
Contributor

nx-cloud Bot commented Dec 9, 2025

View your CI Pipeline Execution ↗ for commit 6bc7333

Command Status Duration Result
nx affected --targets=lint,test,test-kt,build,e... ✅ Succeeded 5m 27s View ↗
nx run-many -t check-imports check-lock-files c... ✅ Succeeded 1m 48s View ↗
nx-cloud record -- nx-cloud conformance:check ✅ Succeeded 7s View ↗
nx-cloud record -- nx format:check ✅ Succeeded 2s View ↗
nx-cloud record -- nx sync:check ✅ Succeeded <1s View ↗

☁️ Nx Cloud last updated this comment at 2025-12-16 12:50:00 UTC

nx-cloud[bot]

This comment was marked as outdated.

Copy link
Copy Markdown
Contributor

@nx-cloud nx-cloud Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nx Cloud has identified a flaky task in your failed CI:

Since the failure was identified as flaky, the solution is to rerun CI. Because this branch comes from a fork, it is not possible for us to push directly, but you can rerun by pushing an empty commit:

git commit --allow-empty -m "chore: trigger rerun"
git push

Nx Cloud View detailed reasoning in Nx Cloud ↗


🎓 Learn more about Self-Healing CI on nx.dev

Copy link
Copy Markdown
Member

@leosvelperez leosvelperez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the contribution!

It's mostly fine, but we need to handle the different formats the keys in patchedDependencies can have.

Comment thread packages/nx/src/plugins/js/lock-file/pnpm-parser.ts Outdated
@comp615 comp615 force-pushed the ccroom/pnpm_patches branch from a86c4bf to fc162ba Compare December 12, 2025 15:16
// find the position of the '@'
return key.slice(0, key.indexOf('@', 1));
const atIndex = key.indexOf('@', 1);
return atIndex === -1 ? key : key.slice(0, atIndex);
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As a note, I updated this so that it works with "packageName" specifiers to return the original. I felt that made the helper a little more predictable and cleaned up my code a bit :)

Copy link
Copy Markdown
Member

@leosvelperez leosvelperez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks again for your contribution! LGTM!

I went ahead with some minor tweaks (refactored the patchEntries array to use a Map, reverted some unrelated lock file changes, etc.) to speed up the feedback and get this merged.

@leosvelperez leosvelperez merged commit d5bd57e into nrwl:master Dec 16, 2025
17 of 19 checks passed
@comp615
Copy link
Copy Markdown
Contributor Author

comp615 commented Dec 16, 2025

Thanks again for your contribution! LGTM!

I went ahead with some minor tweaks (refactored the patchEntries array to use a Map, reverted some unrelated lock file changes, etc.) to speed up the feedback and get this merged.

Ah thanks @leosvelperez. Sorry, I have to remove the lock file stuff every time I run pnpm and forgot. Probably a repo difference or ambiguous config. Appreciate it!

@comp615 comp615 deleted the ccroom/pnpm_patches branch December 16, 2025 13:01
FrozenPandaz pushed a commit that referenced this pull request Dec 16, 2025
…ions (#33551)

## Current Behavior
If a workspace uses pnpm and adds a local patch to a dependency (e.g.
`vitest`), this patch is not taken into account when computing that
dependency's hash for purposes of determining cache changes. In
practice, you could patch vitest locally, and tests would pull from the
cache.

## Expected Behavior
Patches can alter behavior in the same way that updating the version
could, it's just that the version is not created and the patch is
applied locally.

This updates the pnpm lockfile parsing functionality to read the patches
field into a map and then combine the patch hash with the integrity
hash. The integrity hash ONLY represents the remote / tarball
intergrity, so these have to be combined in order to create a proper
key.

## Related Issue(s)
(Could not find any, but saw this in my work today)

---------

Co-authored-by: Leosvel Pérez Espinosa <leosvel.perez.espinosa@gmail.com>
@github-actions
Copy link
Copy Markdown
Contributor

This pull request has already been merged/closed. If you experience issues related to these changes, please open a new issue referencing this pull request.

@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Dec 22, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants