@vercel/build-utils 14.8.0 → 14.9.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @vercel/build-utils
 
+## 14.9.0
+
+### Minor Changes
+
+- 392c759: Honor pnpm 12 pins without auto-adopting, and stop passing `--unsafe-perm` to `pnpm install`.
+
+  When Corepack is off, a lockfile-compatible `packageManager` / `devEngines.packageManager` / `engines.pnpm` pin for 12.x selects `/pnpm12` if that directory exists. Unpinned lockfile `9.0` still defaults to pnpm 9/10/11 by project creation date. `pnpm install` no longer includes `--unsafe-perm`, which pnpm 12's Rust CLI rejects.
+
 ## 14.8.0
 
 ### Minor Changes

package/dist/fs/run-user-scripts.js

@@ -556,7 +556,9 @@ function getInstallCommandForPackageManager(packageManager, args) {
         prettyCommand: "pnpm install",
         // PNPM's install command is similar to NPM's but without the audit nonsense
         // @see options https://pnpm.io/cli/install
-        commandArguments: args.filter((a) => a !== "--prefer-offline").concat(["install", "--unsafe-perm"])
+        // Do not pass `--unsafe-perm`: pnpm 11 treated it as a no-op, but
+        // pnpm 12's Rust CLI rejects unknown flags.
+        commandArguments: args.filter((a) => a !== "--prefer-offline").concat(["install"])
       };
     case "bun":
       return {
@@ -585,7 +587,9 @@ async function runInstallCommand({
   const { commandArguments, prettyCommand } = getInstallCommandForPackageManager(packageManager, args);
   opts.prettyCommand = prettyCommand;
   if (process.env.NPM_ONLY_PRODUCTION) {
-    commandArguments.push("--production");
+    commandArguments.push(
+      packageManager === "pnpm" ? "--prod" : "--production"
+    );
   }
   opts.outputStream = output?.stdout;
   opts.errorStream = output?.stderr;
@@ -812,7 +816,7 @@ To use a different version, set package.json#packageManager or package.json#devE
 }
 const PNPM_10_PREFERRED_AT = /* @__PURE__ */ new Date("2025-02-27T20:00:00Z");
 const PNPM_11_PREFERRED_AT = /* @__PURE__ */ new Date("2026-08-19T20:00:00Z");
-const INSTALLED_PNPM_MAJORS = [11, 10, 9, 8, 7, 6];
+const INSTALLED_PNPM_MAJORS = [12, 11, 10, 9, 8, 7, 6];
 function pnpmPathOverride(major) {
   return {
     path: `/pnpm${major}/node_modules/.bin`,
@@ -882,6 +886,7 @@ function validLockfileForPackageManager(cliType, lockfileVersion, packageManager
       return true;
     case "pnpm":
       switch (packageManagerMajorVersion) {
+        case 12:
         case 11:
         case 10:
           return lockfileVersion === 9;
@@ -1035,7 +1040,7 @@ function applyEnginesPnpm({
       if (major !== void 0) {
         return pnpmPathOverride(major);
       }
-      if (shouldDeferPnpm11UntilImageHasBinary(enginesPnpm, lockfileVersion)) {
+      if (shouldDeferPnpmMajorUntilImageHasBinary(enginesPnpm, lockfileVersion)) {
         warnEnginesPnpmWithoutPin();
         return selected;
       }
@@ -1054,12 +1059,20 @@ function warnEnginesPnpmWithoutPin() {
     `Using package.json#engines.pnpm without corepack and package.json#packageManager could lead to failed builds with ERR_PNPM_UNSUPPORTED_ENGINE. Learn more: https://vercel.com/docs/errors/error-list#pnpm-engine-unsupported`
   );
 }
-function shouldDeferPnpm11UntilImageHasBinary(enginesPnpm, lockfileVersion) {
-  if (isPnpmMajorAvailable(11) || !(0, import_semver.intersects)("11.x", enginesPnpm)) {
-    return false;
+function shouldDeferPnpmMajorUntilImageHasBinary(enginesPnpm, lockfileVersion) {
+  for (const major of INSTALLED_PNPM_MAJORS) {
+    if (major <= 10) {
+      continue;
+    }
+    if (isPnpmMajorAvailable(major) || !(0, import_semver.intersects)(`${major}.x`, enginesPnpm)) {
+      continue;
+    }
+    const version = (0, import_semver.parse)(`${major}.0.0`);
+    if (version && lockfileCompatibleWithPnpm(lockfileVersion, version)) {
+      return true;
+    }
   }
-  const pnpm11 = (0, import_semver.parse)("11.0.0");
-  return Boolean(pnpm11 && lockfileCompatibleWithPnpm(lockfileVersion, pnpm11));
+  return false;
 }
 function validateCorepackPackageManager(cliType, lockfileVersion, corepackPackageManager, enginesPnpmVersionRange) {
   const validatedCorepackPackageManager = validateVersionSpecifier(

package/dist/index.js

@@ -37195,7 +37195,9 @@ function getInstallCommandForPackageManager(packageManager, args) {
         prettyCommand: "pnpm install",
         // PNPM's install command is similar to NPM's but without the audit nonsense
         // @see options https://pnpm.io/cli/install
-        commandArguments: args.filter((a) => a !== "--prefer-offline").concat(["install", "--unsafe-perm"])
+        // Do not pass `--unsafe-perm`: pnpm 11 treated it as a no-op, but
+        // pnpm 12's Rust CLI rejects unknown flags.
+        commandArguments: args.filter((a) => a !== "--prefer-offline").concat(["install"])
       };
     case "bun":
       return {
@@ -37224,7 +37226,9 @@ async function runInstallCommand({
   const { commandArguments, prettyCommand } = getInstallCommandForPackageManager(packageManager, args);
   opts.prettyCommand = prettyCommand;
   if (process.env.NPM_ONLY_PRODUCTION) {
-    commandArguments.push("--production");
+    commandArguments.push(
+      packageManager === "pnpm" ? "--prod" : "--production"
+    );
   }
   opts.outputStream = output?.stdout;
   opts.errorStream = output?.stderr;
@@ -37451,7 +37455,7 @@ To use a different version, set package.json#packageManager or package.json#devE
 }
 var PNPM_10_PREFERRED_AT = /* @__PURE__ */ new Date("2025-02-27T20:00:00Z");
 var PNPM_11_PREFERRED_AT = /* @__PURE__ */ new Date("2026-08-19T20:00:00Z");
-var INSTALLED_PNPM_MAJORS = [11, 10, 9, 8, 7, 6];
+var INSTALLED_PNPM_MAJORS = [12, 11, 10, 9, 8, 7, 6];
 function pnpmPathOverride(major) {
   return {
     path: `/pnpm${major}/node_modules/.bin`,
@@ -37521,6 +37525,7 @@ function validLockfileForPackageManager(cliType, lockfileVersion, packageManager
       return true;
     case "pnpm":
       switch (packageManagerMajorVersion) {
+        case 12:
         case 11:
         case 10:
           return lockfileVersion === 9;
@@ -37674,7 +37679,7 @@ function applyEnginesPnpm({
       if (major !== void 0) {
         return pnpmPathOverride(major);
       }
-      if (shouldDeferPnpm11UntilImageHasBinary(enginesPnpm, lockfileVersion)) {
+      if (shouldDeferPnpmMajorUntilImageHasBinary(enginesPnpm, lockfileVersion)) {
         warnEnginesPnpmWithoutPin();
         return selected;
       }
@@ -37693,12 +37698,20 @@ function warnEnginesPnpmWithoutPin() {
     `Using package.json#engines.pnpm without corepack and package.json#packageManager could lead to failed builds with ERR_PNPM_UNSUPPORTED_ENGINE. Learn more: https://vercel.com/docs/errors/error-list#pnpm-engine-unsupported`
   );
 }
-function shouldDeferPnpm11UntilImageHasBinary(enginesPnpm, lockfileVersion) {
-  if (isPnpmMajorAvailable(11) || !(0, import_semver2.intersects)("11.x", enginesPnpm)) {
-    return false;
+function shouldDeferPnpmMajorUntilImageHasBinary(enginesPnpm, lockfileVersion) {
+  for (const major of INSTALLED_PNPM_MAJORS) {
+    if (major <= 10) {
+      continue;
+    }
+    if (isPnpmMajorAvailable(major) || !(0, import_semver2.intersects)(`${major}.x`, enginesPnpm)) {
+      continue;
+    }
+    const version = (0, import_semver2.parse)(`${major}.0.0`);
+    if (version && lockfileCompatibleWithPnpm(lockfileVersion, version)) {
+      return true;
+    }
   }
-  const pnpm11 = (0, import_semver2.parse)("11.0.0");
-  return Boolean(pnpm11 && lockfileCompatibleWithPnpm(lockfileVersion, pnpm11));
+  return false;
 }
 function validateCorepackPackageManager(cliType, lockfileVersion, corepackPackageManager, enginesPnpmVersionRange) {
   const validatedCorepackPackageManager = validateVersionSpecifier(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/build-utils",
-  "version": "14.8.0",
+  "version": "14.9.0",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.js",
@@ -52,8 +52,8 @@
     "vitest": "4.1.10",
     "typescript": "4.9.5",
     "yazl": "2.5.1",
-    "@vercel/error-utils": "2.2.1",
-    "@vercel/routing-utils": "6.5.0"
+    "@vercel/routing-utils": "6.5.0",
+    "@vercel/error-utils": "2.2.1"
   },
   "scripts": {
     "build": "node build.mjs",