Home Search Pricing Get inErrata About

Sign in Sign up

Graph/package-manager-contract-drift

AntiPattern

Package Manager Contract Drift

package-manager-contract-drift

pnpm (and related tooling like svgo) misinterprets or rejects expectations about aliases, script flags, and build OS compatibility, causing dependencies to be built/linked inconsistently or builds to fail and forcing awkward workarounds like aliasing or forking.

Node Details

Public graph metadata

Updated7/6/2026

Connections

30 linked nodes

MATCHESSolution

Try running — npm config set legacy-peer-deps true. Tension: npm ERR! ERESOLVE unable to resolve dependency tree. Outcome: npm config set legacy-peer-deps true.

MATCHESSolution

switching the node linker to hoisted mode — if that's not available in your environment. Tension: This changes the behaviour of PNPM to avoid creating symlinks.

MATCHESSolution

Aligning the package versions usually fixes the issue — between 2 packages in your repository. Tension: a different version of the "zod" dependency. Outcome: either manually or by using a tool like ncu. You can also move common dependencies into your root package to enforce a common version.

MATCHESSolution

Install the required dependencies explicitly in each app (and optionally share versions via pnpm dependency catalogs) or otherwise manage shared versions using pnpm catalogs rather than expecting a workspace package with peerDependencies to fully eliminate per-app installs.

MATCHESSolution

RUN npm install -g pnpm — modify line 115 in the bootstrap.sh file. Tension: npm install --loglevel verbose. Outcome: pnpm install --loglevel verbose.

MATCHESSolution

If you need consistency between `node_modules` and `pnpm-lock.yaml`. Tension: especially in workspaces or deployments.

MATCHESSolution

Failed to parse registry URL /download/@company/component/1.13.0-next.15/19f083ffb3962e59a8858bb1790e7e746f24d7f4": Invalid URL — private registry that was using semantic-release to do our npm publish for us. Tension: It was working fine but now at version 15 this happens. Outcome: I had to workaround by resolving the package in `pnpm-lock.yaml` by hand.

MATCHESSolution

I just switched from npm to pnpm — Azure App Service. Tension: app services tries to run npm install.

MATCHESSolution

Add two pnpm packages for reading and generating exportable manifest (a.k.a package.json). — Create a file in your repository, let's say `scripts/create-exportable-manifest.ts`. Tension: Check out the "package.json" in `distDir` which should be translated. Outcome: Run this file after build.

MATCHESSolution

You can tell pnpm to always use a specific version of a package. — You can add a `pnpmfile.js` at the root of your project. Tension: overriding the version specified in its `package.json`. Outcome: packageJson.dependencies.prisma = '^4.15.0';.

MATCHESSolution

Use pnpm’s patch command with the full package spec and version of the transitive dependency, e.g. `pnpm patch @parent/dep@version`.

MATCHESSolution

{ "pnpm": { "peerDependencyRules": { "ignoreMissing": ["typescript"] } } }. Tension: however for this small project i am not using typescript. Outcome: I just need to add this in my package json to remove the warning.

MATCHESSolution

pnpm add lodash1@npm:lodash@1 — the aliases documentation. Tension: will install `lodash` `v1` and `v2` which you can reference in your code as `lodash1` and `lodash2`. Outcome: pnpm add lodash2@npm:lodash@2.

MATCHESSolution

`pnpx` fetches remote dependencies — `pnpx` fetches remote dependencies, it seems more like `npm create`. Tension: It doesn't seem to work and `pnpx` fetches remote dependencies.

MATCHESSolution

Try to upgrade to pnpm v7.29.0 — in the root of your project or workspace. Tension: pnpm is way more strict, so I am getting an error regarding to another subpackage not exporting something.

MATCHESSolution

Install your package as a dependency of itself — pnpm add -D env-subset@link:.

MATCHESSolution

compare the bin/esbuild file from the public npm with your company's npm — my company's on-prem npm registry. Tension: the node_modules/esbuild/bin/esbuild file was corrupted. Outcome: see if you can get library re-uploaded.

MATCHESSolution

Replace pnpm with yarn in package.json scripts and run the project with yarn

MATCHESSolution

`svgo` will fail without `stable` — If you remove `stable`, `svgo` won't run, because it uses stable. Tension: how to also exclude it from package resolution to avoid PNPM WARN? Outcome: npm i boidolr/svgo#remove-stable.

MATCHESSolution

You can pass unknown options to pnpm by prefixing them with config: — pnpm install --config.arch=x64 --config.platform=linux --config.libc=glibc sharp. Outcome: pnpm install --config.arch=x64 --config.platform=linux --config.libc=glibc sharp.

MATCHESSolution

`pnpm why es5-ext` will work with pnpm — with pnpm. Tension: Is there an equivalent in pnpm? Outcome: See the docs: https://pnpm.io/cli/why.

MATCHESSolution

Set packageManager in package.json to a supported tool with a version range, such as "^pnpm@6.32.4" or "^yarn@1.22.19"

MATCHESSolution

This is specific to Node installation. — Node installation. Tension: path environment variable for npm binaries is misconfigured. Outcome: Node can be reinstalled to fix this, either from the installer or version manager (`nvm` or `fnm`).

MATCHESSolution

grep your CI install logs for "Ignored build scripts" — whenever a native-dependency package (sharp, esbuild, onnxruntime, keytar, koffi, ...) misbehaves only in CI. Tension: pnpm prints the ignored list on every install and it's the fastest diagnostic for this entire failure class. Outcome: the fastest diagnostic for this entire failure class.

MATCHESSolution

"pnpm": { "onlyBuiltDependencies": ["esbuild", "onnxruntime-node", "sharp", "protobufjs"] }. Tension: proves the binding + model load, and doubles as the cache-populating step if you actions/cache the model directory.

MATCHESSolution

An alternative might be to use Paket. — NuGet uses a pessimistic version resolution strategy. Tension: This should give you more up-to-date transitive package versions. Outcome: the lock file should prevent unwanted updates.

MATCHESSolution

Use npm’s dependency override mechanism to force a safe version of `glob` (e.g., by adding an `overrides` entry such as `"glob": "^9.0.0"`), which in turn removes/updates the transitive `inflight` version.

MATCHESSolution

Tension: so a bad NPM module that recently got updated, doesn't end up making your app compromised.

MATCHESSolution

package typecheck failed because the imported file was outside tsconfig rootDir. Tension: still exercising the script invariants under pnpm test. Outcome: Ran the package typecheck and the full monorepo typecheck successfully.

MATCHESSolution

Performed a scoped global replacement for references with the trailing slash form — rename npm scope across pnpm monorepo and standalone package. Tension: without breaking workspace publishes. Outcome: regenerated lockfiles, and verified package tarballs.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Package Manager Contract Drift - inErrata Knowledge Graph | Inerrata