only-allow a specific version of the package manager

[Ravi-Rajpurohit]

Hi,

Can I use only-allow with a specific version?

For example →

{
  "scripts": {
    "preinstall": "npx only-allow npm@8"
  }
}

If not, is it possible to have this feature?

Also, I would like to contribute in building this feature if not already available.

[Ravi-Rajpurohit]

Why we need this feature?

Starting from NPM 7, the package-lock.json has a different version and there are too many changes.

So, if a team member is using NPM 6 and others are using NPM 7 the package-lock.json after each install is completely different for both.

It will be good to have this feature so that we can lock the package manager versions as well.

[Ravi-Rajpurohit]

I think it is possible. 'which-pm-runs' also gives us a version number.

I am going ahead with this. Let me know if there is anything I should know.

[zkochan]

The issue is that this package doesn't really work anymore as npm doesn't run preinstall before the actual install. So there is no way to block npm CLI.

[luckymore]

The issue is that this package doesn't really work anymore as npm doesn't run preinstall before the actual install. So there is no way to block npm CLI.

RR‘s meaning is detect the pm version when install，it'a realizable point.

[jcollum-nutrien]

You should be able to accomplish this with the engines declaration in package.json

[luckymore]

zkochan is right, look this

• [BUG] Preinstall script runs after installing dependencies npm/cli#2660
• RFC: Add preunpack life cycle script npm/rfcs#403

(😭tried and faild , emm https://github.com/luckymore/only-allow)

[fritx]

zkochan is right, look this

• [BUG] Preinstall script runs after installing dependencies npm/cli#2660
• RFC: Add preunpack life cycle script npm/rfcs#403

(😭tried and faild , emm https://github.com/luckymore/only-allow)

What was the problem when you tried to support the version restriction?

Will script like "only-allow2 pnpm@>=9.0.0" just work?