Skip to content

fix(plugin-npm): limit implicit node-gyp checks to build scripts#7213

Open
ychampion wants to merge 3 commits into
yarnpkg:masterfrom
ychampion:fix-node-gyp-build-script-detection
Open

fix(plugin-npm): limit implicit node-gyp checks to build scripts#7213
ychampion wants to merge 3 commits into
yarnpkg:masterfrom
ychampion:fix-node-gyp-build-script-detection

Conversation

@ychampion

Copy link
Copy Markdown

What's the problem this PR addresses?

Closes #3366.

The implicit node-gyp dependency detection scans every package script today, so packages that only mention node-gyp in non-build scripts can get a node-gyp dependency added during resolution.

How did you fix it?

The npm semver resolver now checks only the install lifecycle scripts Yarn treats as build scripts: preinstall, install, and postinstall.

The resolver tests cover both the false-positive non-build script case and the install-script case that should still inject node-gyp.

Validation

  • corepack yarn jest packages/plugin-npm/tests/NpmSemverResolver.test.ts --runInBand
  • corepack yarn jest packages/plugin-npm/tests --runInBand
  • corepack yarn eslint --max-warnings 0 packages/plugin-npm/sources/NpmSemverResolver.ts packages/plugin-npm/tests/NpmSemverResolver.test.ts
  • corepack yarn version check
  • corepack yarn typecheck:all
  • git diff --check

Checklist

  • I have read the Contributing Guide.
  • I have set the packages that need to be released for my changes to be effective.
  • I will check that all automated PR checks pass before the PR gets reviewed.

Copilot AI review requested due to automatic review settings July 8, 2026 15:07

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@arcanis

arcanis commented Jul 8, 2026

Copy link
Copy Markdown
Member

That doesn't work since an install script may reference other scripts

@ychampion

Copy link
Copy Markdown
Author

That doesn't work since an install script may reference other scripts

Looking

Constraint: Maintainer pointed out install scripts can delegate to other package scripts.
Rejected: Only scan preinstall/install/postinstall bodies | Misses install scripts that call build scripts using node-gyp.
Confidence: high
Scope-risk: narrow
Directive: Keep test-only node-gyp references ignored unless an install lifecycle script makes package scripts reachable during install.
Tested: corepack yarn jest packages/plugin-npm/tests/NpmSemverResolver.test.ts --runInBand; corepack yarn jest packages/plugin-npm/tests --runInBand; corepack yarn test:lint; corepack yarn constraints; corepack yarn version check; corepack yarn dedupe --check; corepack yarn typecheck:all; YARN_ENABLE_HARDENED_MODE=1 corepack yarn install --immutable --immutable-cache; git diff --check.
Not-tested: Netlify docs build, already failing on upstream master for an unrelated schema example issue.
@ychampion

Copy link
Copy Markdown
Author

Fixed in ae53f78. It now scans all package scripts when an install lifecycle script exists, so install -> build -> node-gyp still gets the implicit dependency while test-only node-gyp references without install scripts stay ignored.

Validation:

  • corepack yarn jest packages/plugin-npm/tests/NpmSemverResolver.test.ts --runInBand
  • corepack yarn jest packages/plugin-npm/tests --runInBand
  • corepack yarn test:lint
  • corepack yarn constraints
  • corepack yarn version check
  • corepack yarn dedupe --check
  • corepack yarn typecheck:all
  • YARN_ENABLE_HARDENED_MODE=1 corepack yarn install --immutable --immutable-cache

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug?]: yarn berry showing extra dependency that yarn 1.22 doesn't show.

3 participants