Update pnpm configuration by anomiex · Pull Request #46002 · Automattic/jetpack

anomiex · 2025-11-19T17:26:04Z

Closes MONOREP-233

Proposed changes:

Pnpm 11 will move most configuration from .npmrc to pnpm-workspace.yaml. We may as well get a head start on that.

Then let's make some changes too:

save-exact - We stopped having Renovate pin in Update renovatebot/github-action action to v34 #27087. May as well have this match.
minimumReleaseAge - New setting in 10.16, intended to help avoid installing compromised packages by waiting a day before upgrading.
trustPolicy - New setting in 10.21, intended to help avoid installing compromised packages by rejecting installation when the new version has no provenance and an older version does.
trustPolicyExclude - New setting in 10.22, to override trustPolicy when there's a legitimate reason.

This also takes the opportunity to clean up a few things:

public-hoist-pattern was set to the default value.
resolution-mode was only changed from 8.0.0–8.6.12. The current value is the default since then.
use-lockfile-v6 is obsolete.
Versions of swiper we use no longer have a build script.

Other information:

Have you written new tests for your changes, if applicable?
Have you checked the E2E test CI results, and verified that your changes do not break them?
Have you tested your changes on WordPress.com, if applicable (if so, you'll see a generated comment below with a script to run)?

Jetpack product discussion

pdWQjU-1tL-p2

Does this pull request change what data or activity we track or use?

No

Testing instructions:

Build artifacts shouldn't change due to this.
We should try running renovate on a fork to check that that doesn't break things either.
- Looks reasonable. It created Update dependency tsup to v8.5.1 - abandoned anomiex/jetpack#46 without issue, and Update dependency svelte to v4.2.20 anomiex/jetpack#45 had an expected artifact update failure.

Pnpm 11 will move most configuration from `.npmrc` to `pnpm-workspace.yaml`. We may as well get a head start on that. Then let's make some changes too: * save-exact - We stopped having Renovate pin in #27087. May as well have this match. * minimumReleaseAge - New setting in 10.16, intended to help avoid installing compromised packages by waiting a day before upgrading. * trustPolicy - New setting in 10.21, intended to help avoid installing compromised packages by rejecting installation when the new version has no provenance and an older version does. * trustPolicyExclude - New setting in 10.22, to override trustPolicy when there's a legitimate reason. This also takes the opportunity to clean up a few things: * public-hoist-pattern was set to the default value. * resolution-mode was only changed from 8.0.0–8.6.12. The current value is the default since then. * use-lockfile-v6 is obsolete. * Versions of `swiper` we use no longer have a build script.

github-actions · 2025-11-19T17:27:03Z

Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.

To test on WoA, go to the Plugins menu on a WoA dev site. Click on the "Upload" button and follow the upgrade flow to be able to upload, install, and activate the Jetpack Beta plugin. Once the plugin is active, go to Jetpack > Jetpack Beta, select your plugin (Jetpack or WordPress.com Site Helper), and enable the update/pnpm-configs branch.
To test on Simple, run the following command on your sandbox:

bin/jetpack-downloader test jetpack update/pnpm-configs

bin/jetpack-downloader test jetpack-mu-wpcom-plugin update/pnpm-configs

Interested in more tips and information?

In your local development environment, use the jetpack rsync command to sync your changes to a WoA dev blog.
Read more about our development workflow here: PCYsg-eg0-p2
Figure out when your changes will be shipped to customers here: PCYsg-eg5-p2

github-actions · 2025-11-19T17:27:15Z

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

✅ Include a description of your PR changes.
✅ Add a "[Status]" label (In Progress, Needs Review, ...).
✅ Add a "[Type]" label (Bug, Enhancement, Janitorial, Task).
✅ Add testing instructions.
✅ Specify whether this PR includes any changes to data or privacy.
✅ Add changelog entries to affected projects

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

Follow this PR Review Process:

Ensure all required checks appearing at the bottom of this PR are passing.
Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
You can use GitHub's Reviewers functionality to request a review.
When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

jp-launch-control · 2025-11-19T17:43:56Z

Code Coverage Summary

This PR did not change code coverage!

That could be good or bad, depending on the situation. Everything covered before, and still is? Great! Nothing was covered before? Not so great. 🤷

Full summary · PHP report · JS report

…e of @storybook/test-runner stops using

tbradsha

Artifacts look unchanged and CI is happy. A few inline questions for my own education.

pnpm-workspace.yaml

tbradsha · 2025-11-19T19:46:22Z

pnpm-workspace.yaml

+# Silence this warning. Our `jetpack dependencies build-order` (also used by `jetpack build --all`) checks for cycles itself, plus it has a way to indicate that a dep is only for testing.
+ignoreWorkspaceCycles: true
+
+# Package compromise avoidance: let new releases age a day, and don't allow trust downgrades unless explicitly excepted.


How will this work with Calypso packages? Does this just mean we need to explicitly state the update version?

We can set minimumReleaseAgeExclude for them if we want.

I haven't tested, but my guess is that trying to set the minimum version to a less-than-1440-minute old dep will make pnpm raise an error.

Yeah, I wonder if we should do this:

minimumReleaseAgeExclude: - '@automattic/*'

May as well do it preemptively, I suppose.

Added a couple more:

PNPM config: exclude wp and woo packages from minimum age limit #46124

projects/packages/subscribers-dashboard/webpack.config.js

.npmrc

anomiex requested a review from a team November 19, 2025 17:26

anomiex self-assigned this Nov 19, 2025

anomiex added [Status] Needs Review This PR is ready for review. [Type] Janitorial [Pri] Normal labels Nov 19, 2025

anomiex added 2 commits November 19, 2025 12:48

Fix CI build

f2b09fd

Work around a bug in jest-playwright-preset, which the pending upgrad…

163a448

…e of @storybook/test-runner stops using

github-actions bot added the Actions GitHub actions used to automate some of the work around releases and repository management label Nov 19, 2025

subscribers-dashboard: Fix build

af3e8c6

github-actions bot added the [Package] Subscribers Dashboard label Nov 19, 2025

tbradsha previously approved these changes Nov 19, 2025

View reviewed changes

Add minimumReleaseAgeExclude for @automattic/*

775008a

anomiex dismissed tbradsha’s stale review via 775008a November 19, 2025 20:34

tbradsha approved these changes Nov 19, 2025

View reviewed changes

anomiex merged commit 441b605 into trunk Nov 19, 2025
116 of 117 checks passed

anomiex deleted the update/pnpm-configs branch November 19, 2025 21:04

github-actions bot removed the [Status] Needs Review This PR is ready for review. label Nov 19, 2025

simison mentioned this pull request Nov 27, 2025

PNPM config: exclude wp and woo packages from minimum age limit #46124

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update pnpm configuration#46002

Update pnpm configuration#46002
anomiex merged 5 commits intotrunkfrom
update/pnpm-configs

anomiex commented Nov 19, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 19, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 19, 2025

Uh oh!

jp-launch-control bot commented Nov 19, 2025 •

edited

Loading

Uh oh!

tbradsha left a comment

Uh oh!

Uh oh!

Uh oh!

tbradsha Nov 19, 2025

Uh oh!

anomiex Nov 19, 2025

Uh oh!

tbradsha Nov 19, 2025

Uh oh!

anomiex Nov 19, 2025

Uh oh!

simison Nov 27, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

anomiex commented Nov 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes:

Other information:

Jetpack product discussion

Does this pull request change what data or activity we track or use?

Testing instructions:

Uh oh!

github-actions bot commented Nov 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 19, 2025

Uh oh!

jp-launch-control bot commented Nov 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Summary

Uh oh!

tbradsha left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

tbradsha Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

anomiex Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

tbradsha Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

anomiex Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

simison Nov 27, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

anomiex commented Nov 19, 2025 •

edited

Loading

github-actions bot commented Nov 19, 2025 •

edited

Loading

jp-launch-control bot commented Nov 19, 2025 •

edited

Loading