[rush] Relocate pnpm settings to pnpm-workspace.yaml for pnpm 11 by brunojppb · Pull Request #5838 · microsoft/rushstack

brunojppb · 2026-06-18T12:50:48Z

Summary

Proposal fix for #5837

pnpm 11 stopped reading configuration from the pnpm field of package.json. Those settings must now live in pnpm-workspace.yaml (see the pnpm 11 release notes and settings docs).

Rush still serialized most of its pnpm-config.json settings into the pnpm field of the generated common/temp/package.json. After bumping pnpmVersion to 11.x, those settings were silently dropped: pnpm prints a warning, but the install still reports success. The most consequential of them, globalOverrides and globalPatchedDependencies, are commonly used to pin CVE remediations on transitive dependencies, so a rush update that re-resolves can quietly revert them to vulnerable versions.

#5817 already relocated allowBuilds to pnpm-workspace.yaml for pnpm 11. This PR applies the same mechanism to the remaining affected settings.

Changes

For pnpm >= 11.0.0, the following are now written to the generated common/temp/pnpm-workspace.yaml instead of the package.json pnpm field:

`pnpm-config.json` key	`pnpm-workspace.yaml` key
`globalOverrides`	`overrides`
`globalPackageExtensions`	`packageExtensions`
`globalPeerDependencyRules`	`peerDependencyRules`
`globalAllowedDeprecatedVersions`	`allowedDeprecatedVersions`
`globalPatchedDependencies`	`patchedDependencies`

PnpmWorkspaceFile: added fields, setters, and serialization for the five settings.
WorkspaceInstallManager: populates them on the workspace file when pnpmVersion >= 11.0.0.
InstallHelpers: skips writing the corresponding package.json pnpm entries when pnpmVersion >= 11.0.0.

Behavior for pnpm 10 and earlier is unchanged.

Out of scope

minimumReleaseAge (tracked in #5752 / #5798), trustPolicy*, and ignoredOptionalDependencies are also written to the pnpm field but are left for follow-up PRs to keep this change focused.

Could potentially include that here too if you folks want.

pnpm 11 no longer reads the "pnpm" field of package.json, so the settings Rush serialized there were silently ignored. Relocate globalOverrides, globalPackageExtensions, globalPeerDependencyRules, globalAllowedDeprecatedVersions, and globalPatchedDependencies to the generated common/temp/pnpm-workspace.yaml for pnpm >= 11.0.0, mirroring the allowBuilds relocation from microsoft#5817. Behavior for older pnpm is unchanged. Fixes microsoft#5837

Co-references microsoft#5837

brunojppb · 2026-06-18T12:57:20Z

@microsoft-github-policy-service agree

Two fixes from adversarial review of the pnpm 11 settings relocation: 1. rush-pnpm patch-commit / patch-remove read patchedDependencies from common/temp/package.json, which pnpm 11 no longer populates. They now read patchedDependencies from common/temp/pnpm-workspace.yaml for pnpm >= 11 (mirroring the approve-builds allowBuilds path), preserving the package.json path for pnpm < 11 and the existing subspace + patches-folder logic. 2. Added integration coverage: - InstallHelpers.generateCommonPackageJson omits the relocated settings from package.json for pnpm 11 and still writes them for pnpm < 11. - RushPnpmCommandLineParser reads patchedDependencies from pnpm-workspace.yaml for pnpm 11 and from package.json for pnpm < 11. Refs microsoft#5837

…obal-settings # Conflicts: # libraries/rush-lib/src/logic/installManager/WorkspaceInstallManager.ts # libraries/rush-lib/src/logic/pnpm/PnpmWorkspaceFile.ts # libraries/rush-lib/src/logic/pnpm/test/PnpmWorkspaceFile.test.ts # libraries/rush-lib/src/logic/pnpm/test/__snapshots__/PnpmWorkspaceFile.test.ts.snap

iclanton · 2026-07-15T21:38:23Z

+    if (this._overrides && Object.keys(this._overrides).length > 0) {
+      workspaceYaml.overrides = this._overrides;
+    }
+
+    if (this._packageExtensions && Object.keys(this._packageExtensions).length > 0) {
+      workspaceYaml.packageExtensions = this._packageExtensions;
+    }
+
+    if (this._peerDependencyRules && Object.keys(this._peerDependencyRules).length > 0) {
+      workspaceYaml.peerDependencyRules = this._peerDependencyRules;
+    }
+
+    if (this._allowedDeprecatedVersions && Object.keys(this._allowedDeprecatedVersions).length > 0) {
+      workspaceYaml.allowedDeprecatedVersions = this._allowedDeprecatedVersions;
+    }
+
+    if (this._patchedDependencies && Object.keys(this._patchedDependencies).length > 0) {
+      workspaceYaml.patchedDependencies = this._patchedDependencies;
+    }


The guards aren't necessary. See #5859 (comment)

Suggested change

if (this._overrides && Object.keys(this._overrides).length > 0) {

workspaceYaml.overrides = this._overrides;

}

if (this._packageExtensions && Object.keys(this._packageExtensions).length > 0) {

workspaceYaml.packageExtensions = this._packageExtensions;

}

if (this._peerDependencyRules && Object.keys(this._peerDependencyRules).length > 0) {

workspaceYaml.peerDependencyRules = this._peerDependencyRules;

}

if (this._allowedDeprecatedVersions && Object.keys(this._allowedDeprecatedVersions).length > 0) {

workspaceYaml.allowedDeprecatedVersions = this._allowedDeprecatedVersions;

}

if (this._patchedDependencies && Object.keys(this._patchedDependencies).length > 0) {

workspaceYaml.patchedDependencies = this._patchedDependencies;

}

workspaceYaml.overrides = this._overrides;

workspaceYaml.packageExtensions = this._packageExtensions;

workspaceYaml.peerDependencyRules = this._peerDependencyRules;

workspaceYaml.allowedDeprecatedVersions = this._allowedDeprecatedVersions;

workspaceYaml.patchedDependencies = this._patchedDependencies;

iclanton · 2026-07-15T21:43:03Z

        }
      );
-      const { stdout: fileLog, exitCode, signal } = await Executable.waitForExitAsync(gitProcess, {
+      const {


Unrelated change?

iclanton · 2026-07-15T21:43:24Z

@@ -140,11 +140,9 @@ describe(PublishUtilities.findChangeRequestsAsync.name, () => {



All of these changes look unrelated.

iclanton · 2026-07-15T21:57:21Z


  public constructor(options: IShellOperationRunnerOptions) {
-    const { phase, displayName, rushProject, initialCommand, incrementalCommand, commandForHash, ignoredParameterValues } = options;
+    const {


Unrelated change?

iclanton · 2026-07-15T21:58:16Z

+      // See https://github.com/microsoft/rushstack/issues/5837
+      const isPnpm11OrNewer: boolean = semver.gte(pnpmVersion, '11.0.0');
+
+      if (!isPnpm11OrNewer && pnpmOptions.globalOverrides) {


Instead of repeatedly checking isPnpm11OrNewer, just organize all of these in a single check.

iclanton · 2026-07-15T22:01:14Z

+interface IPnpmOptionsStub {
+  globalPatchedDependencies: Record<string, string> | undefined;
+  updateGlobalPatchedDependencies: jest.Mock;
+}
+
+interface ISubspaceStub {
+  getSubspaceTempFolderPath(): string;
+  getSubspaceConfigFolderPath(): string;
+  getSubspacePnpmPatchesFolderPath(): string;
+  getPnpmOptions(): IPnpmOptionsStub | undefined;
+}
+
+interface IPostExecuteInternals {
+  _commandName?: string;
+  _subspace: ISubspaceStub;
+  _rushConfiguration: { packageManagerToolVersion: string };
+  _terminal: { writeWarningLine: jest.Mock; writeErrorLine: jest.Mock };
+  _doRushUpdateAsync: jest.Mock;
+  _postExecuteAsync(): Promise<void>;
+}


These shouldn't be necessary.

iclanton · 2026-07-15T22:01:32Z

  });
 });
+
+describe('RushPnpmCommandLineParser patch-commit patchedDependencies sync', () => {


Suggested change

describe('RushPnpmCommandLineParser patch-commit patchedDependencies sync', () => {

describe(`${RushPnpmCommandLineParser.name} patch-commit patchedDependencies sync`, () => {

iclanton · 2026-07-15T22:01:41Z

+  afterEach(() => {
+    readFileAsyncSpy?.mockRestore();
+    existsSpy?.mockRestore();
+    jsonLoadSpy?.mockRestore();
+  });


Doesn't this happen automatically?

iclanton · 2026-07-15T22:02:18Z

+      'patchedDependencies:\n' +
+      '  lodash@4.17.21: patches/lodash@4.17.21.patch\n';
+    readFileAsyncSpy = jest.spyOn(FileSystem, 'readFileAsync').mockResolvedValue(workspaceYaml);
+    existsSpy = jest.spyOn(FileSystem, 'exists').mockReturnValue(false);


This is never called.

iclanton · 2026-07-15T22:02:36Z

+    };
+    const parser: IPostExecuteInternals = createPostExecuteParser('patch-commit', '10.27.0', pnpmOptions);
+
+    existsSpy = jest.spyOn(FileSystem, 'exists').mockReturnValue(false);


This is never called.

brunojppb added 2 commits June 18, 2026 13:12

[rush] Add change file for pnpm 11 settings relocation

ff78c07

Co-references microsoft#5837

github-project-automation Bot added this to Bug Triage Jun 18, 2026

github-project-automation Bot moved this to Needs triage in Bug Triage Jun 18, 2026

brunojppb marked this pull request as ready for review June 18, 2026 18:42

brunojppb requested review from apostolisms, bmiddha, dmichon-msft, iclanton, jxanthony and octogonz as code owners June 18, 2026 18:42

brunojppb mentioned this pull request Jun 25, 2026

[rush] pnpm 11 no longer reads the pnpm field in package.json #5837

Open

bmiddha approved these changes Jul 15, 2026

View reviewed changes

iclanton reviewed Jul 16, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[rush] Relocate pnpm settings to pnpm-workspace.yaml for pnpm 11#5838

[rush] Relocate pnpm settings to pnpm-workspace.yaml for pnpm 11#5838
brunojppb wants to merge 4 commits into
microsoft:mainfrom
brunojppb:pnpm11-relocate-global-settings

brunojppb commented Jun 18, 2026 •

edited

Loading

Uh oh!

brunojppb commented Jun 18, 2026

Uh oh!

iclanton Jul 15, 2026

Uh oh!

iclanton Jul 15, 2026

Uh oh!

iclanton Jul 15, 2026

Uh oh!

iclanton Jul 15, 2026

Uh oh!

iclanton Jul 15, 2026

Uh oh!

iclanton Jul 15, 2026

Uh oh!

iclanton Jul 15, 2026

Uh oh!

iclanton Jul 15, 2026

Uh oh!

iclanton Jul 15, 2026

Uh oh!

iclanton Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -140,11 +140,9 @@ describe(PublishUtilities.findChangeRequestsAsync.name, () => {

	describe('RushPnpmCommandLineParser patch-commit patchedDependencies sync', () => {
	describe(`${RushPnpmCommandLineParser.name} patch-commit patchedDependencies sync`, () => {

Uh oh!

Conversation

brunojppb commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Out of scope

Uh oh!

brunojppb commented Jun 18, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

brunojppb commented Jun 18, 2026 •

edited

Loading