Blocked from using PNPM v10 with NX & Webpack

[estiller]

Hi,
I'm using PNPM with NX to manage a TypeScript monorepo. We're using Webpack to compile backend applications into their own distributable, with Webpack generating a package.json that is used to install only the required dependencies in a Docker container.

The problem is that starting with v10, PNPM requires specifying onlyBuiltDependencies for dependencies that run post-build scripts. However, the package.json files generated by Webpack don't contain these directives, and the Docker container fails since the post-build scripts are not executed as part of its creation.

The way I see it, there are several ways to solve this:

1. Get Webpack to support this PNPM-specific behavior. This could take a while, and we'll be blocked from upgrading to PNPM v10 until they support it.
2. Switch Webpack to an alternative tool that supports this PNPM behavior. Is there such a tool?
3. Override PNPM from the command line or with an environment variable so that it'll run all the scripts in the context of the Docker build (by using appropriate instructions in the Dockerfile). This is OK from a security perspective since the dependencies are governed in the root package.json in the monorepo.

I would prefer option 3, but I haven't found a way to achieve this. Ideally, it would include a command like pnpm install --build-all-dependencies.
Does anyone have any thoughts or ideas? Thanks!

[rp-pedraza]

You can try specifying which packages to build in pnpm-workspace.yaml instead. For example:

packages:
  - some-package
onlyBuiltDependencies:
  - sqlite3

[estiller]

NX doesn't use PNPM Workspaces to manage the monorepo.

[rp-pedraza]

But how is the monorepo structured if you're using PNPM along with it (besides NX as you mentioned)?

[estiller]

The NX monorepo itself uses PNPM and has a similar setup to ours.
https://github.com/nrwl/nx

It has a single root-level package.json and pnpm-lock.yaml, and NX automatically manages the dependencies between the various components in the repository.

[rp-pedraza]

I just remembered it would be nice to allow approve-builds to accept package arguments so packages wouldn't have to be selected manually in a dialog box. Maybe add three options to it: -s (shows available packages), -e enable a package, and -d (disables a package.

The approve-builds command being scriptable might be helpful to your problem.

[estiller]

FYI, I created a bug and a reproduction on the NX repo.
nrwl/nx#30240

I still think it's worth exploring the addition of some command line arguments as requested above.
Thanks for the input!

[zkochan]

We can add a new setting called something like dangerously-approve-all-builds.

Settings can be set through .npmrc and as CLI flags.

[alumni]

BTW, bun pm uses trustedDependencies identically to pnpm.onlyBuiltDependencies. Maybe this should be experimental until all package managers agree on something?

[zkochan]

pnpm v10.9 now has an option to allow all builds: dangerouslyAllowAllBuilds

it should be set in pnpm-workspace.yaml.

[estiller]

I'll review it. Thanks!