[FR]: pnpm 10

[yesudeep]

What is the current behavior?

Pnpm 9.15 is the latest version of PNPM available.

Describe the feature

Can we please add pnpm versions until 10.3.0: https://www.npmjs.com/package/pnpm
to https://github.com/aspect-build/rules_js/blob/main/npm/private/versions.bzl

[jbedard]

I think pnpm 10 still required some proper testing and possibly some fixes for rules_js to support the latest lockfile format. Have you tried it out yourself at all?

[yesudeep]

I've tried it on a project without rules_js. I'm proposing moving to rules_ts/rules_js to some teams and I'm currently blocked on this. How can I help with this?

[jbedard]

Here's my initial attempt from a few weeks ago: #2101

I think the initial issue is jq failing to parse some yaml syntax that wasn't in v9 🤷

[jbedard]

If you have a chance to help out you can checkout #2101 and try to understand why yq (not jq like I originally said) is failing. Maybe we just need to upgrade yq? Or maybe there is a yq bug that needs to be fixed?

I haven't had time to dive into it so maybe it's simple 🤞

[fa93hws]

A mini reproducible yq issue:

'foo':
  bar: {baz: foo?bar}

gives

ERROR:

while parsing a flow mapping
  in "<unicode string>", line 2, column 8:
      bar: {baz: foo?bar}
           ^
expected ',' or '}', but got '?'
  in "<unicode string>", line 2, column 17:
      bar: {baz: foo?bar}

on https://yaml-online-parser.appspot.com/
but

'foo':
  bar: {baz: "foo?bar"}

is good

So yq is happy when I changed your lockfile from

    resolution: {tarball: https://objects.githubusercontent.com/github-production-release-asset-2e65be/479133753/39afbe81-ae4d-4b58-97a4-a6a3ca092d4d?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250211%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250211T185742Z&X-Amz-Expires=300&X-Amz-Signature=22ff1778b26a1f8757c95957fc69cd3710d3a8caa3b68bd5ded7c2032a0f377b&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%40foo-jsonify-0.0.0.tgz&response-content-type=application%2Foctet-stream}

to

    resolution: {tarball: "https://objects.githubusercontent.com/github-production-release-asset-2e65be/479133753/39afbe81-ae4d-4b58-97a4-a6a3ca092d4d?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250211%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250211T185742Z&X-Amz-Expires=300&X-Amz-Signature=22ff1778b26a1f8757c95957fc69cd3710d3a8caa3b68bd5ded7c2032a0f377b&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%40foo-jsonify-0.0.0.tgz&response-content-type=application%2Foctet-stream"}

Could be a pnpm issue? pnpm/pnpm#9137
But I noticed that yaml specification didn't mentioned that ? can't be used in plain scalar or mapping value, so I think that should be a yq bug?

[jbedard]

If you think the yaml specification allows that ? then maybe you can log a yq issue asking there?

[fa93hws]

That's true! mikefarah/yq#2294

[fa93hws]

However I saw bunch of issues with no comments recently and the most recent commit is a month ago so not sure whether it's actively maintained. Maybe we should adopt something alternative to yq?

[jbedard]

Lets see what type of response we get for now? Ideally yq or pnpm would have the fix for this and rules_js wouldn't have to do anything :/