diff --git a/.github/workflows/floating-deps.yml b/.github/workflows/floating-deps.yml index a946bebac540..ac600db78d1c 100644 --- a/.github/workflows/floating-deps.yml +++ b/.github/workflows/floating-deps.yml @@ -36,7 +36,7 @@ jobs: - uses: actions/setup-node@v7 with: - node-version: 24 + node-version-file: .node-version - name: Install Postgres extensions env: diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 50e4895772bf..b0ff101816da 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -16,7 +16,7 @@ jobs: - uses: pnpm/action-setup@v6 - uses: actions/setup-node@v7 with: - node-version: 24 + node-version-file: .node-version cache: pnpm - run: pnpm install --frozen-lockfile @@ -35,7 +35,7 @@ jobs: - uses: pnpm/action-setup@v6 - uses: actions/setup-node@v7 with: - node-version: 24 + node-version-file: .node-version cache: pnpm - run: pnpm install --frozen-lockfile diff --git a/.node-version b/.node-version new file mode 100644 index 000000000000..df6ae3370f9f --- /dev/null +++ b/.node-version @@ -0,0 +1 @@ +24.21.0 diff --git a/.npmrc b/.npmrc deleted file mode 100644 index 728a81207532..000000000000 --- a/.npmrc +++ /dev/null @@ -1,7 +0,0 @@ -# Careful: pnpm reads npm's `package-lock` key as an alias for its own `lockfile` -# setting. This file used to contain `package-lock=false`, which silently prevented -# pnpm from writing pnpm-lock.yaml at all. Do not reintroduce it — the lockfile is -# committed and CI installs with --frozen-lockfile. -# -# package-lock.json and yarn.lock stay in .gitignore, so using the wrong package -# manager locally still can't pollute the repo. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index bc3f7902a056..a7abb883889e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -39,21 +39,17 @@ Still interested? Coolio! Here is how to get started: Here comes a little surprise: You need [Node.JS](http://nodejs.org). -This repository uses [pnpm](https://pnpm.io), and pins both Node and pnpm with -[Volta](https://volta.sh): +The development Node version is pinned in `.node-version`, which fnm, nvm, mise and +asdf all read. CI's non-matrix jobs use the same file. Any Node satisfying `engines` in +`package.json` works. -```json -"volta": { "node": "24.18.1", "pnpm": "10.34.5" } -``` - -With Volta installed, `cd`-ing into the repo gives you the right Node and pnpm -automatically — nothing else to do. Without Volta, the same pnpm version is also in the -`packageManager` field, which `corepack enable` and pnpm itself both honour; you will -just have to get Node 24 yourself. +This repository uses [pnpm](https://pnpm.io), pinned by the `packageManager` field in +`package.json`. Install any pnpm 12 (for example `npm install -g pnpm@12`) and it will +switch itself to the pinned version inside the repo. -Keep `volta.pnpm` and `packageManager` in sync. pnpm self-switches to whatever -`packageManager` says, so if they disagree the `packageManager` value silently wins and -your Volta pin does nothing. +pnpm does not resolve packages published less than a day ago (its default +`minimumReleaseAge`). That is deliberate supply-chain protection, so a version you just +saw announced may not install yet. ### 2. Install the dependencies @@ -69,9 +65,9 @@ If you change anything in `package.json`, commit the updated lockfile alongside CI installs with `--frozen-lockfile` and will fail if the two disagree. The `libpq` package (via `pg-native`) compiles native bindings. pnpm only runs its build -script because it is listed under `onlyBuiltDependencies` in `pnpm-workspace.yaml`; if you -add another dependency that needs a build step, it has to be added there too or it will -install silently broken. +script because it is listed under `allowBuilds` in `pnpm-workspace.yaml`; if you add +another dependency that needs a build step, it has to be added there too or +`pnpm install` will fail. ### 3. Database @@ -179,6 +175,7 @@ This package ships raw `lib/` — there is deliberately no `prepare`, `prepack`, `build` script, and adding one is a breaking change for consumers. Because the package is fetched as a GitHub tarball, a build script forces pnpm off that fast path into clone-and-build, _and_ trips pnpm's build gate: every consuming repo would have to add -`sequelize` to its own `onlyBuiltDependencies` before it would install at all. +`sequelize` to its own `allowBuilds` (`onlyBuiltDependencies` on pnpm 10) before it +would install at all. If a build step ever becomes genuinely necessary, publish to a private registry instead. diff --git a/package.json b/package.json index c5a2001e208e..8351e2d855a6 100644 --- a/package.json +++ b/package.json @@ -62,7 +62,7 @@ "test-postgres-native": "cross-env DIALECT=postgres-native pnpm test", "test-postgresn": "pnpm run test-postgres-native", "test-all": "pnpm run test-postgres && pnpm run test-postgres-native", - "sscce": "env-cmd -f $npm_package_options_env_cmd node sscce.js", + "sscce": "env-cmd -f ./test/config/.docker.env node sscce.js", "sscce-postgres": "cross-env DIALECT=postgres pnpm run sscce" }, "dependencies": { @@ -103,12 +103,5 @@ "engines": { "node": ">=24.19.0" }, - "volta": { - "node": "24.21.0", - "pnpm": "10.34.5" - }, - "packageManager": "pnpm@10.34.5", - "options": { - "env_cmd": "./test/config/.docker.env" - } + "packageManager": "pnpm@12.8.1" } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 7c68988f3a41..2db99b0cef71 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1,3 +1,161 @@ +--- +lockfileVersion: '9.0' + +importers: + + .: + configDependencies: {} + packageManagerDependencies: + pnpm: + specifier: 12.8.1 + version: 12.8.1 + +packages: + + '@pnpm/exe.android-arm64@12.8.1': + resolution: {integrity: sha512-siDxcidfz5eM6L2tJfik+i2bbUEw8UC7MZ3Yl2HYdRmqbdhHGAOQACtOOu6QVW4Jul4/w5wVKm+wM8ACtgh1Pg==} + cpu: [arm64] + os: [android] + + '@pnpm/exe.android-x64@12.8.1': + resolution: {integrity: sha512-0F/uqPRc3aN4vLHsa0f+6fTtmsigFQ9/yxEU43fionF//pNHEd5e97b3w/nKIgqYMCUQCJphmBRMA9Q8/wlo9Q==} + cpu: [x64] + os: [android] + + '@pnpm/exe.darwin-arm64@12.8.1': + resolution: {integrity: sha512-/rwavvMQJsl2RIxOHBnDF+4Gk+fhQFAY4M3PQZoKskJOEnaJcygG9p1xby6wcQcbS4d9dIubv09CQhufTgfmpw==} + cpu: [arm64] + os: [darwin] + + '@pnpm/exe.darwin-x64@12.8.1': + resolution: {integrity: sha512-htYt2gN7zqJKLhC99Ft6EUiO7myjZAZXfmGCTJUL1v+o7vE9hZdE1+fAkk4Oj1ZHNRti6b2woOxEkRkAusi8OQ==} + cpu: [x64] + os: [darwin] + + '@pnpm/exe.freebsd-x64@12.8.1': + resolution: {integrity: sha512-PB5BULNgytxvExoOXUUeseS/DcpPENs+cg3iA6xHHeaLT4ctEGKSGXEbuj7USeqvo8JBpAx039hivnbzGqDwnA==} + cpu: [x64] + os: [freebsd] + + '@pnpm/exe.linux-arm64-musl@12.8.1': + resolution: {integrity: sha512-kKeyC/ArjrgdciQRBrOL0j9HtOI4gDRgoyP+eJ1CQKyadpKlf/DhDDyspXe07R3B9KagTVLUF2nlt6Dr5quFIg==} + cpu: [arm64] + os: [linux] + libc: [musl] + + '@pnpm/exe.linux-arm64@12.8.1': + resolution: {integrity: sha512-q4s9a9X2O3N9aeUFooW24orNrxvu20+jyVUFR5RanPCqOKKPBrgs2iywMkBBx1aXkkzdWT54/mfz8Be8sJlWEw==} + cpu: [arm64] + os: [linux] + libc: [glibc] + + '@pnpm/exe.linux-ppc64@12.8.1': + resolution: {integrity: sha512-F7XSjKJthwCh/L6abZiMpAfo2Cm61SZIT3e4dfgiIjESndlWaXCnfLKngSgZ/SEMsdmHT6dud3+kWIB3tw0/xQ==} + cpu: [ppc64] + os: [linux] + libc: [glibc] + + '@pnpm/exe.linux-riscv64@12.8.1': + resolution: {integrity: sha512-z1ecpIK/ZY08Unk69KWWE9867oaKUytGUjrHnBoGFAAhsK+q+0cfvBH+f5fWobJ7FX97leMlLO+gkJolddM45Q==} + cpu: [riscv64] + os: [linux] + libc: [glibc] + + '@pnpm/exe.linux-s390x@12.8.1': + resolution: {integrity: sha512-KU6tnrBfu4uKXTq6N5qJwSm8FSrs9Wc8b5AUEsHK9bRXwNdsZ1/lRxG1++X29SKRW9OSNuDSjxASv5mAvGo1gA==} + cpu: [s390x] + os: [linux] + libc: [glibc] + + '@pnpm/exe.linux-x64-musl@12.8.1': + resolution: {integrity: sha512-eUE8BWJkDr2tJb/yrk0yVnszlmNqFarVxUlqiZ9BAkct28Nq/5g2H0tvMDmPA7fAQW3STNj+omJPPRVT+4s5sQ==} + cpu: [x64] + os: [linux] + libc: [musl] + + '@pnpm/exe.linux-x64@12.8.1': + resolution: {integrity: sha512-8bDZ0lZlCdi2rvnFul7EYgcC7zKeWSe76y8JV2oXobaS8p9i9d6PSf6LgLtTM0fI7R9Oh4eLCbveXyNDMmvZ+g==} + cpu: [x64] + os: [linux] + libc: [glibc] + + '@pnpm/exe.win32-arm64@12.8.1': + resolution: {integrity: sha512-MsT0dlrRxnCRCHCaosNbhWpEiAFnFuMEu3KuDJDU41BXgTwiINxU8goloUSUDejWZUqKaUqNC/qUTihl9nFtqg==} + cpu: [arm64] + os: [win32] + + '@pnpm/exe.win32-x64@12.8.1': + resolution: {integrity: sha512-SWtPe0PsbTTk//gJND10tMdOfCYjrkq5+qV49hzVhY7xz2iJ339Rc+xwASlcvbwTfrvH39YNqpKYibD+CRGLwA==} + cpu: [x64] + os: [win32] + + pnpm@12.8.1: + resolution: {integrity: sha512-9kupB1B/XOr+BsjTjmBS0BeURFgOwSed3Vv8EctIqoomRLZlmOB+dh2oSHKp/FfV+QK4f6SdAkGY1VhhKqu+RQ==} + engines: {node: '>=18.*'} + hasBin: true + +snapshots: + + '@pnpm/exe.android-arm64@12.8.1': + optional: true + + '@pnpm/exe.android-x64@12.8.1': + optional: true + + '@pnpm/exe.darwin-arm64@12.8.1': + optional: true + + '@pnpm/exe.darwin-x64@12.8.1': + optional: true + + '@pnpm/exe.freebsd-x64@12.8.1': + optional: true + + '@pnpm/exe.linux-arm64-musl@12.8.1': + optional: true + + '@pnpm/exe.linux-arm64@12.8.1': + optional: true + + '@pnpm/exe.linux-ppc64@12.8.1': + optional: true + + '@pnpm/exe.linux-riscv64@12.8.1': + optional: true + + '@pnpm/exe.linux-s390x@12.8.1': + optional: true + + '@pnpm/exe.linux-x64-musl@12.8.1': + optional: true + + '@pnpm/exe.linux-x64@12.8.1': + optional: true + + '@pnpm/exe.win32-arm64@12.8.1': + optional: true + + '@pnpm/exe.win32-x64@12.8.1': + optional: true + + pnpm@12.8.1: + optionalDependencies: + '@pnpm/exe.android-arm64': 12.8.1 + '@pnpm/exe.android-x64': 12.8.1 + '@pnpm/exe.darwin-arm64': 12.8.1 + '@pnpm/exe.darwin-x64': 12.8.1 + '@pnpm/exe.freebsd-x64': 12.8.1 + '@pnpm/exe.linux-arm64': 12.8.1 + '@pnpm/exe.linux-arm64-musl': 12.8.1 + '@pnpm/exe.linux-ppc64': 12.8.1 + '@pnpm/exe.linux-riscv64': 12.8.1 + '@pnpm/exe.linux-s390x': 12.8.1 + '@pnpm/exe.linux-x64': 12.8.1 + '@pnpm/exe.linux-x64-musl': 12.8.1 + '@pnpm/exe.win32-arm64': 12.8.1 + '@pnpm/exe.win32-x64': 12.8.1 + +--- lockfileVersion: '9.0' settings: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index be80abe7a240..ad9804130667 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,9 +1,10 @@ -# pnpm blocks dependency build scripts by default. This one compiles native -# bindings and is silently non-functional without an approved build: +# pnpm blocks dependency build scripts by default, and fails the install when an +# unapproved package has one. This one compiles native bindings: # libpq -> addon.node (transitive via pg-native, postgres-native dialect) -# -# Note: pnpm 11 renamed this key to `allowBuilds` (a bool map). Do not migrate to it -# without also reading the pnpm version note in CONTRIBUTING.md -- we are held on -# pnpm 10 deliberately. -onlyBuiltDependencies: - - libpq +allowBuilds: + libpq: true + +minimumReleaseAgeExclude: + - vitest@5.0.3 + - '@vitest/mocker@5.0.3' + - '@vitest/spy@5.0.3'