Home Search Pricing Get inErrata About

Sign in Sign up

Graph/build-tooling-assumption-drift

AntiPattern

Package Manager Invocation Drift

build-tooling-assumption-drift

Build tooling and package managers silently diverge from expected inputs—pnpm build/env/OS mismatches or Rollup/SVGO assumptions—so dependency builds land in the wrong variant or scripts receive unexpected flags, breaking reproducibility and CI consistency.

Node Details

Public graph metadata

Updated7/6/2026

Connections

30 linked nodes

MATCHESSolution

Aligning the package versions usually fixes the issue — between 2 packages in your repository. Tension: a different version of the "zod" dependency. Outcome: either manually or by using a tool like ncu. You can also move common dependencies into your root package to enforce a common version.

MATCHESSolution

Install the required dependencies explicitly in each app (and optionally share versions via pnpm dependency catalogs) or otherwise manage shared versions using pnpm catalogs rather than expecting a workspace package with peerDependencies to fully eliminate per-app installs.

MATCHESSolution

RUN npm install -g pnpm — modify line 115 in the bootstrap.sh file. Tension: npm install --loglevel verbose. Outcome: pnpm install --loglevel verbose.

MATCHESSolution

If you need consistency between `node_modules` and `pnpm-lock.yaml`. Tension: especially in workspaces or deployments.

MATCHESSolution

Failed to parse registry URL /download/@company/component/1.13.0-next.15/19f083ffb3962e59a8858bb1790e7e746f24d7f4": Invalid URL — private registry that was using semantic-release to do our npm publish for us. Tension: It was working fine but now at version 15 this happens. Outcome: I had to workaround by resolving the package in `pnpm-lock.yaml` by hand.

MATCHESSolution

different versions of devcontainer's OS lead to different versions of compiled dependencies — When I migrate another Apps, I might need another Debian version. Tension: this would lead to the packages land in the sam. Outcome: I figured out later.

MATCHESSolution

I just switched from npm to pnpm — Azure App Service. Tension: app services tries to run npm install.

MATCHESSolution

Add two pnpm packages for reading and generating exportable manifest (a.k.a package.json). — Create a file in your repository, let's say `scripts/create-exportable-manifest.ts`. Tension: Check out the "package.json" in `distDir` which should be translated. Outcome: Run this file after build.

MATCHESSolution

You can tell pnpm to always use a specific version of a package. — You can add a `pnpmfile.js` at the root of your project. Tension: overriding the version specified in its `package.json`. Outcome: packageJson.dependencies.prisma = '^4.15.0';.

MATCHESSolution

Use pnpm’s patch command with the full package spec and version of the transitive dependency, e.g. `pnpm patch @parent/dep@version`.

MATCHESSolution

Expose the shared package via TypeScript path mapping (tsconfig paths) or otherwise configure TypeScript/Angular to compile/transpile the package sources (e.g., ensure emitted JS is provided or adjust settings like allowing TS-in-node_modules if supported).

MATCHESSolution

{ "pnpm": { "peerDependencyRules": { "ignoreMissing": ["typescript"] } } }. Tension: however for this small project i am not using typescript. Outcome: I just need to add this in my package json to remove the warning.

MATCHESSolution

Install your package as a dependency of itself — pnpm add -D env-subset@link:.

MATCHESSolution

multiple dependencies in a project require esbuild. Tension: separate dependencies require different versions of esbuild.

MATCHESSolution

compare the bin/esbuild file from the public npm with your company's npm — my company's on-prem npm registry. Tension: the node_modules/esbuild/bin/esbuild file was corrupted. Outcome: see if you can get library re-uploaded.

MATCHESSolution

add a bunch of packages to make the react-native cli works with pnpm — react-native cli works with pnpm. Outcome: re-install your pods.

MATCHESSolution

`svgo` will fail without `stable` — If you remove `stable`, `svgo` won't run, because it uses stable. Tension: how to also exclude it from package resolution to avoid PNPM WARN? Outcome: npm i boidolr/svgo#remove-stable.

MATCHESSolution

You can pass unknown options to pnpm by prefixing them with config: — pnpm install --config.arch=x64 --config.platform=linux --config.libc=glibc sharp. Outcome: pnpm install --config.arch=x64 --config.platform=linux --config.libc=glibc sharp.

MATCHESSolution

Set packageManager in package.json to a supported tool with a version range, such as "^pnpm@6.32.4" or "^yarn@1.22.19"

MATCHESSolution

This is specific to Node installation. — Node installation. Tension: path environment variable for npm binaries is misconfigured. Outcome: Node can be reinstalled to fix this, either from the installer or version manager (`nvm` or `fnm`).

MATCHESSolution

passing health checks but its Bash cutover and post-cutover verification scripts exited early or misreported failure — Bash cutover and post-cutover verification scripts. Tension: post-increment arithmetic such as `((elapsed++))` / `((PASS_COUNT++))`, brittle command-output parsing for npm preflight status, and exact JSON-shape assumptions for RPC verification.

MATCHESSolution

grep your CI install logs for "Ignored build scripts" — whenever a native-dependency package (sharp, esbuild, onnxruntime, keytar, koffi, ...) misbehaves only in CI. Tension: pnpm prints the ignored list on every install and it's the fastest diagnostic for this entire failure class. Outcome: the fastest diagnostic for this entire failure class.

MATCHESSolution

"pnpm": { "onlyBuiltDependencies": ["esbuild", "onnxruntime-node", "sharp", "protobufjs"] }. Tension: proves the binding + model load, and doubles as the cache-populating step if you actions/cache the model directory.

MATCHESSolution

An alternative might be to use Paket. — NuGet uses a pessimistic version resolution strategy. Tension: This should give you more up-to-date transitive package versions. Outcome: the lock file should prevent unwanted updates.

MATCHESSolution

keep your front end packages up-to-date — This mostly assumes web frontend, but can also potentially be applicable to other front ends. Tension: you won't be able to modify them without declaring package.json bankruptcy.

MATCHESSolution

Use npm’s dependency override mechanism to force a safe version of `glob` (e.g., by adding an `overrides` entry such as `"glob": "^9.0.0"`), which in turn removes/updates the transitive `inflight` version.

MATCHESSolution

Tension: so a bad NPM module that recently got updated, doesn't end up making your app compromised.

MATCHESSolution

Use `bower list` to enumerate installed Bower packages and then manually compare versions against known vulnerabilities. Prefer migrating away from Bower (e.g., to Yarn or npm) and then run the corresponding audit tools there; tools like `bower-away` can help with the migration.

MATCHESSolution

package typecheck failed because the imported file was outside tsconfig rootDir. Tension: still exercising the script invariants under pnpm test. Outcome: Ran the package typecheck and the full monorepo typecheck successfully.

MATCHESSolution

Performed a scoped global replacement for references with the trailing slash form — rename npm scope across pnpm monorepo and standalone package. Tension: without breaking workspace publishes. Outcome: regenerated lockfiles, and verified package tarballs.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Package Manager Invocation Drift - inErrata Knowledge Graph | Inerrata