From c9ba7def4d7559b860a2a17e4fb0f630d98e1866 Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Sat, 19 Sep 2026 12:21:52 +0100 Subject: [PATCH 1/2] fix: declare sibling dependencies as plain versions so published manifests are installable The release publishes through npm, which copies package.json verbatim and does not understand the pnpm workspace protocol. The `workspace:^` dependencies of trilean and trilean-sql therefore reached the registry unchanged and made both fail to install with EUNSUPPORTEDPROTOCOL. Plain versions are rewritten by the release orchestrator when a sibling releases, and pnpm still links the workspace copies because linkWorkspacePackages is on. --- packages/trilean-sql/package.json | 4 ++-- packages/trilean/package.json | 2 +- pnpm-lock.yaml | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/packages/trilean-sql/package.json b/packages/trilean-sql/package.json index 1cc0d4d..739ff3d 100644 --- a/packages/trilean-sql/package.json +++ b/packages/trilean-sql/package.json @@ -47,8 +47,8 @@ }, "license": "MIT", "dependencies": { - "trilean": "workspace:^", - "trilean-regex": "workspace:^" + "trilean": "1.6.1", + "trilean-regex": "1.0.2" }, "scripts": { "build": "turbo run _build", diff --git a/packages/trilean/package.json b/packages/trilean/package.json index 088c3b7..03f2c9c 100644 --- a/packages/trilean/package.json +++ b/packages/trilean/package.json @@ -49,7 +49,7 @@ }, "license": "MIT", "dependencies": { - "trilean-regex": "workspace:^", + "trilean-regex": "1.0.2", "zod": "^4.5.4" }, "scripts": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4a6f8c8..da7cd1c 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -245,7 +245,7 @@ importers: packages/trilean: dependencies: trilean-regex: - specifier: workspace:^ + specifier: 1.0.2 version: link:../trilean-regex zod: specifier: ^4.5.4 @@ -357,10 +357,10 @@ importers: packages/trilean-sql: dependencies: trilean: - specifier: workspace:^ + specifier: 1.6.1 version: link:../trilean trilean-regex: - specifier: workspace:^ + specifier: 1.0.2 version: link:../trilean-regex devDependencies: '@arethetypeswrong/cli': From 42e43d87cbc62ea8734bf374f9b09608ec93932e Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Sat, 19 Sep 2026 12:21:54 +0100 Subject: [PATCH 2/2] build: stop pnpm add writing the workspace protocol for sibling dependencies pnpm's default is to save `workspace:^` when adding a sibling, which the npm-based release then publishes verbatim as an uninstallable range. With saveWorkspaceProtocol off, adding a sibling writes the plain exact version instead. Also drops a comment claiming the workspace holds a single package. --- pnpm-workspace.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index f49d744..a9be544 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,9 +1,14 @@ packages: - "packages/*" -# pnpm 11 defaults this to false, which means a dependency on a sibling package resolves from the npm registry even when the workspace holds a version satisfying the range. Setting it true links a sibling whenever the declared range is satisfied by the workspace version, and falls back to the registry when it is not. There is one package here today, so nothing exercises it yet -- it is set now so the first sibling added is linked rather than silently downloaded. +# pnpm 11 defaults this to false, which means a dependency on a sibling package resolves from the npm registry even when the workspace holds a version satisfying the range. Setting it true links a sibling whenever the declared range is satisfied by the workspace version, and falls back to the registry when it is not. linkWorkspacePackages: true +# Sibling dependencies are declared as plain exact versions, never with the `workspace:` protocol. The release publishes through `npm publish`, which copies the manifest verbatim and does not understand `workspace:`, so a `workspace:^` range would reach the registry as-is and make the package uninstallable for every consumer. `@exadev/semantic-release-workspace` maintains plain ranges itself, rewriting each dependent's range when the sibling releases, and linkWorkspacePackages above still symlinks the sibling locally whenever the workspace version satisfies it. +# +# pnpm's default for this setting is `rolling`, under which `pnpm add ` writes `workspace:^`. false makes it write the plain version instead, using saveExact below for the exact pin. +saveWorkspaceProtocol: false + # Every dependency in the tree that ships an install script, and whether it may run. pnpm 11 ignores install scripts unless listed, and fails the install outright while any is neither allowed nor refused -- so an entry is a decision recorded, not merely a permission granted, and `false` is as meaningful an answer as `true`. # # workerd (the Cloudflare Workers runtime @cloudflare/vitest-pool-workers drives the workers test suite through) and esbuild (its bundler) both need theirs: the script is how each fetches its own platform's binary, and neither runs at all without it.