@vercel/build-utils 8.3.1 → 8.3.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @vercel/build-utils
 
+## 8.3.2
+
+### Patch Changes
+
+- reject mismatched corepack and detected package managers ([#11603](https://github.com/vercel/vercel/pull/11603))
+
 ## 8.3.1
 
 ### Patch Changes

package/dist/fs/run-user-scripts.d.ts

@@ -97,11 +97,12 @@ export declare function getEnvForPackageManager({ cliType, lockfileVersion, pack
  * Helper to get the binary paths that link to the used package manager.
  * Note: Make sure it doesn't contain any `console.log` calls.
  */
-export declare function getPathOverrideForPackageManager({ cliType, lockfileVersion, corepackEnabled, nodeVersion, }: {
+export declare function getPathOverrideForPackageManager({ cliType, lockfileVersion, corepackPackageManager, corepackEnabled, }: {
     cliType: CliType;
     lockfileVersion: number | undefined;
-    corepackEnabled: boolean;
+    corepackPackageManager: string | undefined;
     nodeVersion: NodeVersion | undefined;
+    corepackEnabled?: boolean;
 }): {
     /**
      * Which lockfile was detected.
@@ -117,6 +118,15 @@ export declare function getPathOverrideForPackageManager({ cliType, lockfileVers
      */
     path: string | undefined;
 };
+export declare function detectPackageManager(cliType: CliType, lockfileVersion: number | undefined): {
+    path: string;
+    detectedLockfile: string;
+    detectedPackageManager: string;
+} | {
+    path: undefined;
+    detectedLockfile: string;
+    detectedPackageManager: string;
+} | undefined;
 /**
  * Helper to get the binary paths that link to the used package manager.
  * Note: Make sure it doesn't contain any `console.log` calls.

package/dist/fs/run-user-scripts.js

@@ -28,6 +28,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var run_user_scripts_exports = {};
 __export(run_user_scripts_exports, {
+  detectPackageManager: () => detectPackageManager,
   execCommand: () => execCommand,
   getEnvForPackageManager: () => getEnvForPackageManager,
   getNodeBinPath: () => getNodeBinPath,
@@ -64,6 +65,11 @@ var import_node_version = require("./node-version");
 var import_read_config_file = require("./read-config-file");
 var import_clone_env = require("../clone-env");
 const runNpmInstallSema = new import_async_sema.default(1);
+const NO_OVERRIDE = {
+  detectedLockfile: void 0,
+  detectedPackageManager: void 0,
+  path: void 0
+};
 function spawnAsync(command, args, opts = {}) {
   return new Promise((resolve, reject) => {
     const stderrLogs = [];
@@ -425,8 +431,9 @@ function getEnvForPackageManager({
   } = getPathOverrideForPackageManager({
     cliType,
     lockfileVersion,
-    corepackEnabled,
-    nodeVersion
+    corepackPackageManager: packageJsonPackageManager,
+    nodeVersion,
+    corepackEnabled
   });
   if (corepackEnabled) {
     (0, import_debug.default)(
@@ -464,10 +471,8 @@ function getEnvForPackageManager({
   }
   return newEnv;
 }
-function detectPnpmVersion(lockfileVersion, corepackEnabled) {
+function detectPnpmVersion(lockfileVersion) {
   switch (true) {
-    case corepackEnabled:
-      return "corepack_enabled";
     case lockfileVersion === void 0:
       return "not found";
     case lockfileVersion === 5.3:
@@ -482,98 +487,154 @@ function detectPnpmVersion(lockfileVersion, corepackEnabled) {
       return "not found";
   }
 }
-function shouldUseNpm7(lockfileVersion, nodeVersion) {
-  if (lockfileVersion === void 0)
-    return false;
-  return lockfileVersion >= 2 && (nodeVersion?.major || 0) < 16;
+function validLockfileForPackageManager(cliType, lockfileVersion, packageManagerVersion) {
+  const packageManagerMajorVersion = packageManagerVersion.major;
+  switch (cliType) {
+    case "npm":
+    case "bun":
+    case "yarn":
+      return true;
+    case "pnpm":
+      switch (packageManagerMajorVersion) {
+        case 9:
+          if ("9.0.0" === packageManagerVersion.version && lockfileVersion === 6) {
+            return false;
+          }
+          return [6, 7, 9].includes(lockfileVersion);
+        case 8:
+          return [6, 6.1].includes(lockfileVersion);
+        case 7:
+          return [5.3, 5.4].includes(lockfileVersion);
+        case 6:
+          return [5.3, 5.4].includes(lockfileVersion);
+        default:
+          return true;
+      }
+  }
 }
 function getPathOverrideForPackageManager({
   cliType,
   lockfileVersion,
-  corepackEnabled,
-  nodeVersion
+  corepackPackageManager,
+  corepackEnabled = true
 }) {
-  const no_override = {
-    detectedLockfile: void 0,
-    detectedPackageManager: void 0,
-    path: void 0
+  const detectedPackageManger = detectPackageManager(cliType, lockfileVersion);
+  if (!corepackPackageManager) {
+    return detectedPackageManger ?? NO_OVERRIDE;
+  }
+  if (lockfileVersion === void 0 || !corepackEnabled) {
+    return NO_OVERRIDE;
+  }
+  if (validateCorepackPackageManager(
+    cliType,
+    lockfileVersion,
+    corepackPackageManager
+  )) {
+    return NO_OVERRIDE;
+  }
+  console.warn(
+    `WARN [package-manager-warning-1] Detected lockfile "${lockfileVersion}" which is not compatible with the intended corepack package manager "${corepackPackageManager}". Update your lockfile or change to a compatible corepack version.`
+  );
+  return NO_OVERRIDE;
+}
+function validateCorepackPackageManager(cliType, lockfileVersion, corepackPackageManager) {
+  const validatedCorepackPackageManager = validateVersionSpecifier(
+    corepackPackageManager
+  );
+  if (!validatedCorepackPackageManager) {
+    console.warn(
+      `WARN [package-manager-warning-2] Intended corepack defined package manager "${corepackPackageManager}" is not a valid semver value.`
+    );
+    return false;
+  }
+  if (cliType !== validatedCorepackPackageManager.packageName) {
+    console.warn(
+      `WARN [package-manager-warning-3] Detected package manager "${cliType}" does not match intended corepack defined package manager "${validatedCorepackPackageManager.packageName}". Change your lockfile or "package.json#packageManager" value to match.`
+    );
+    return false;
+  }
+  const corepackPackageManagerVersion = (0, import_semver.coerce)(
+    validatedCorepackPackageManager.packageVersionRange
+  );
+  if (corepackPackageManagerVersion === null) {
+    return true;
+  } else {
+    return validLockfileForPackageManager(
+      cliType,
+      lockfileVersion,
+      corepackPackageManagerVersion
+    );
+  }
+}
+function validateVersionSpecifier(version) {
+  if (!version) {
+    return void 0;
+  }
+  const [before, after, ...extra] = version.split("@");
+  if (extra.length) {
+    return void 0;
+  }
+  if (!before) {
+    return void 0;
+  }
+  if (!after) {
+    return void 0;
+  }
+  if (!(0, import_semver.validRange)(after)) {
+    return void 0;
+  }
+  return {
+    packageName: before,
+    packageVersionRange: after
   };
+}
+function detectPackageManager(cliType, lockfileVersion) {
   switch (cliType) {
     case "npm":
-      switch (true) {
-        case corepackEnabled:
-          return no_override;
-        case shouldUseNpm7(lockfileVersion, nodeVersion):
-          return {
-            path: "/node16/bin-npm7",
-            detectedLockfile: "package-lock.json",
-            detectedPackageManager: "npm 7+"
-          };
-        default:
-          return no_override;
-      }
+      return void 0;
     case "pnpm":
-      switch (detectPnpmVersion(lockfileVersion, corepackEnabled)) {
-        case "corepack_enabled":
-          return no_override;
+      switch (detectPnpmVersion(lockfileVersion)) {
         case "pnpm 7":
           return {
             path: "/pnpm7/node_modules/.bin",
             detectedLockfile: "pnpm-lock.yaml",
-            detectedPackageManager: "pnpm 7"
+            detectedPackageManager: "pnpm@7.x"
           };
         case "pnpm 8":
           return {
             path: "/pnpm8/node_modules/.bin",
             detectedLockfile: "pnpm-lock.yaml",
-            detectedPackageManager: "pnpm 8"
+            detectedPackageManager: "pnpm@8.x"
           };
         case "pnpm 9":
           return {
             path: "/pnpm9/node_modules/.bin",
             detectedLockfile: "pnpm-lock.yaml",
-            detectedPackageManager: "pnpm 9"
+            detectedPackageManager: "pnpm@9.x"
           };
         case "pnpm 6":
-        default:
-          return no_override;
-      }
-    case "bun":
-      switch (true) {
-        case corepackEnabled:
-          return no_override;
-        default:
           return {
-            path: "/bun1",
-            detectedLockfile: "bun.lockb",
-            detectedPackageManager: "Bun"
+            // undefined because pnpm@6 is the current default in the build container
+            path: void 0,
+            detectedLockfile: "pnpm-lock.yaml",
+            detectedPackageManager: "pnpm 6"
           };
+        default:
+          return void 0;
       }
+    case "bun":
+      return {
+        path: "/bun1",
+        detectedLockfile: "bun.lockb",
+        detectedPackageManager: "bun@1.x"
+      };
     case "yarn":
-      return no_override;
-  }
-}
-function validateVersionSpecifier(version) {
-  if (!version) {
-    return void 0;
-  }
-  const [before, after, ...extra] = version.split("@");
-  if (extra.length) {
-    return void 0;
-  }
-  if (!before) {
-    return void 0;
-  }
-  if (!after) {
-    return void 0;
-  }
-  if (!(0, import_semver.validRange)(after)) {
-    return void 0;
+      return {
+        path: void 0,
+        detectedLockfile: "yarn.lock",
+        detectedPackageManager: "yarn"
+      };
   }
-  return {
-    packageName: before,
-    packageVersionRange: after
-  };
 }
 function getPathForPackageManager({
   cliType,
@@ -582,12 +643,15 @@ function getPathForPackageManager({
   env
 }) {
   const corepackEnabled = env.ENABLE_EXPERIMENTAL_COREPACK === "1";
-  const overrides = getPathOverrideForPackageManager({
+  let overrides = getPathOverrideForPackageManager({
     cliType,
     lockfileVersion,
-    corepackEnabled,
+    corepackPackageManager: void 0,
     nodeVersion
   });
+  if (corepackEnabled) {
+    overrides = NO_OVERRIDE;
+  }
   const alreadyInPath = (newPath) => {
     const oldPath = env.PATH ?? "";
     return oldPath.split(import_path.default.delimiter).includes(newPath);
@@ -708,6 +772,7 @@ const installDependencies = (0, import_util.deprecate)(
 );
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  detectPackageManager,
   execCommand,
   getEnvForPackageManager,
   getNodeBinPath,

package/dist/index.js

@@ -13072,7 +13072,7 @@ var require_readShebang = __commonJS({
 // ../../node_modules/.pnpm/semver@5.7.2/node_modules/semver/semver.js
 var require_semver = __commonJS({
   "../../node_modules/.pnpm/semver@5.7.2/node_modules/semver/semver.js"(exports2, module2) {
-    exports2 = module2.exports = SemVer;
+    exports2 = module2.exports = SemVer2;
     var debug2;
     if (typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG)) {
       debug2 = function() {
@@ -13205,7 +13205,7 @@ var require_semver = __commonJS({
           includePrerelease: false
         };
       }
-      if (version instanceof SemVer) {
+      if (version instanceof SemVer2) {
         return version;
       }
       if (typeof version !== "string") {
@@ -13219,7 +13219,7 @@ var require_semver = __commonJS({
         return null;
       }
       try {
-        return new SemVer(version, options);
+        return new SemVer2(version, options);
       } catch (er) {
         return null;
       }
@@ -13234,15 +13234,15 @@ var require_semver = __commonJS({
       var s = parse2(version.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     }
-    exports2.SemVer = SemVer;
-    function SemVer(version, options) {
+    exports2.SemVer = SemVer2;
+    function SemVer2(version, options) {
       if (!options || typeof options !== "object") {
         options = {
           loose: !!options,
           includePrerelease: false
         };
       }
-      if (version instanceof SemVer) {
+      if (version instanceof SemVer2) {
         if (version.loose === options.loose) {
           return version;
         } else {
@@ -13254,8 +13254,8 @@ var require_semver = __commonJS({
       if (version.length > MAX_LENGTH) {
         throw new TypeError("version is longer than " + MAX_LENGTH + " characters");
       }
-      if (!(this instanceof SemVer)) {
-        return new SemVer(version, options);
+      if (!(this instanceof SemVer2)) {
+        return new SemVer2(version, options);
       }
       debug2("SemVer", version, options);
       this.options = options;
@@ -13293,32 +13293,32 @@ var require_semver = __commonJS({
       this.build = m[5] ? m[5].split(".") : [];
       this.format();
     }
-    SemVer.prototype.format = function() {
+    SemVer2.prototype.format = function() {
       this.version = this.major + "." + this.minor + "." + this.patch;
       if (this.prerelease.length) {
         this.version += "-" + this.prerelease.join(".");
       }
       return this.version;
     };
-    SemVer.prototype.toString = function() {
+    SemVer2.prototype.toString = function() {
       return this.version;
     };
-    SemVer.prototype.compare = function(other) {
+    SemVer2.prototype.compare = function(other) {
       debug2("SemVer.compare", this.version, this.options, other);
-      if (!(other instanceof SemVer)) {
-        other = new SemVer(other, this.options);
+      if (!(other instanceof SemVer2)) {
+        other = new SemVer2(other, this.options);
       }
       return this.compareMain(other) || this.comparePre(other);
     };
-    SemVer.prototype.compareMain = function(other) {
-      if (!(other instanceof SemVer)) {
-        other = new SemVer(other, this.options);
+    SemVer2.prototype.compareMain = function(other) {
+      if (!(other instanceof SemVer2)) {
+        other = new SemVer2(other, this.options);
       }
       return compareIdentifiers(this.major, other.major) || compareIdentifiers(this.minor, other.minor) || compareIdentifiers(this.patch, other.patch);
     };
-    SemVer.prototype.comparePre = function(other) {
-      if (!(other instanceof SemVer)) {
-        other = new SemVer(other, this.options);
+    SemVer2.prototype.comparePre = function(other) {
+      if (!(other instanceof SemVer2)) {
+        other = new SemVer2(other, this.options);
       }
       if (this.prerelease.length && !other.prerelease.length) {
         return -1;
@@ -13345,7 +13345,7 @@ var require_semver = __commonJS({
         }
       } while (++i2);
     };
-    SemVer.prototype.inc = function(release, identifier) {
+    SemVer2.prototype.inc = function(release, identifier) {
       switch (release) {
         case "premajor":
           this.prerelease.length = 0;
@@ -13431,7 +13431,7 @@ var require_semver = __commonJS({
         loose = void 0;
       }
       try {
-        return new SemVer(version, loose).inc(release, identifier).version;
+        return new SemVer2(version, loose).inc(release, identifier).version;
       } catch (er) {
         return null;
       }
@@ -13475,19 +13475,19 @@ var require_semver = __commonJS({
     }
     exports2.major = major;
     function major(a, loose) {
-      return new SemVer(a, loose).major;
+      return new SemVer2(a, loose).major;
     }
     exports2.minor = minor;
     function minor(a, loose) {
-      return new SemVer(a, loose).minor;
+      return new SemVer2(a, loose).minor;
     }
     exports2.patch = patch;
     function patch(a, loose) {
-      return new SemVer(a, loose).patch;
+      return new SemVer2(a, loose).patch;
     }
     exports2.compare = compare;
     function compare(a, b, loose) {
-      return new SemVer(a, loose).compare(new SemVer(b, loose));
+      return new SemVer2(a, loose).compare(new SemVer2(b, loose));
     }
     exports2.compareLoose = compareLoose;
     function compareLoose(a, b) {
@@ -13610,7 +13610,7 @@ var require_semver = __commonJS({
       if (!m[2]) {
         this.semver = ANY;
       } else {
-        this.semver = new SemVer(m[2], this.options.loose);
+        this.semver = new SemVer2(m[2], this.options.loose);
       }
     };
     Comparator.prototype.toString = function() {
@@ -13622,7 +13622,7 @@ var require_semver = __commonJS({
         return true;
       }
       if (typeof version === "string") {
-        version = new SemVer(version, this.options);
+        version = new SemVer2(version, this.options);
       }
       return cmp(version, this.operator, this.semver, this.options);
     };
@@ -13919,7 +13919,7 @@ var require_semver = __commonJS({
         return false;
       }
       if (typeof version === "string") {
-        version = new SemVer(version, this.options);
+        version = new SemVer2(version, this.options);
       }
       for (var i2 = 0; i2 < this.set.length; i2++) {
         if (testSet(this.set[i2], version, this.options)) {
@@ -13973,7 +13973,7 @@ var require_semver = __commonJS({
         if (rangeObj.test(v)) {
           if (!max || maxSV.compare(v) === -1) {
             max = v;
-            maxSV = new SemVer(max, options);
+            maxSV = new SemVer2(max, options);
           }
         }
       });
@@ -13992,7 +13992,7 @@ var require_semver = __commonJS({
         if (rangeObj.test(v)) {
           if (!min || minSV.compare(v) === 1) {
             min = v;
-            minSV = new SemVer(min, options);
+            minSV = new SemVer2(min, options);
           }
         }
       });
@@ -14001,11 +14001,11 @@ var require_semver = __commonJS({
     exports2.minVersion = minVersion;
     function minVersion(range, loose) {
       range = new Range(range, loose);
-      var minver = new SemVer("0.0.0");
+      var minver = new SemVer2("0.0.0");
       if (range.test(minver)) {
         return minver;
       }
-      minver = new SemVer("0.0.0-0");
+      minver = new SemVer2("0.0.0-0");
       if (range.test(minver)) {
         return minver;
       }
@@ -14013,7 +14013,7 @@ var require_semver = __commonJS({
       for (var i2 = 0; i2 < range.set.length; ++i2) {
         var comparators = range.set[i2];
         comparators.forEach(function(comparator) {
-          var compver = new SemVer(comparator.semver.version);
+          var compver = new SemVer2(comparator.semver.version);
           switch (comparator.operator) {
             case ">":
               if (compver.prerelease.length === 0) {
@@ -14059,7 +14059,7 @@ var require_semver = __commonJS({
     }
     exports2.outside = outside;
     function outside(version, range, hilo, options) {
-      version = new SemVer(version, options);
+      version = new SemVer2(version, options);
       range = new Range(range, options);
       var gtfn, ltefn, ltfn, comp, ecomp;
       switch (hilo) {
@@ -14123,7 +14123,7 @@ var require_semver = __commonJS({
     }
     exports2.coerce = coerce2;
     function coerce2(version) {
-      if (version instanceof SemVer) {
+      if (version instanceof SemVer2) {
         return version;
       }
       if (typeof version !== "string") {
@@ -14304,7 +14304,7 @@ var require_cross_spawn = __commonJS({
 // ../../node_modules/.pnpm/semver@6.3.1/node_modules/semver/semver.js
 var require_semver2 = __commonJS({
   "../../node_modules/.pnpm/semver@6.3.1/node_modules/semver/semver.js"(exports2, module2) {
-    exports2 = module2.exports = SemVer;
+    exports2 = module2.exports = SemVer2;
     var debug2;
     if (typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG)) {
       debug2 = function() {
@@ -14446,7 +14446,7 @@ var require_semver2 = __commonJS({
           includePrerelease: false
         };
       }
-      if (version instanceof SemVer) {
+      if (version instanceof SemVer2) {
         return version;
       }
       if (typeof version !== "string") {
@@ -14460,7 +14460,7 @@ var require_semver2 = __commonJS({
         return null;
       }
       try {
-        return new SemVer(version, options);
+        return new SemVer2(version, options);
       } catch (er) {
         return null;
       }
@@ -14475,15 +14475,15 @@ var require_semver2 = __commonJS({
       var s = parse2(version.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     }
-    exports2.SemVer = SemVer;
-    function SemVer(version, options) {
+    exports2.SemVer = SemVer2;
+    function SemVer2(version, options) {
       if (!options || typeof options !== "object") {
         options = {
           loose: !!options,
           includePrerelease: false
         };
       }
-      if (version instanceof SemVer) {
+      if (version instanceof SemVer2) {
         if (version.loose === options.loose) {
           return version;
         } else {
@@ -14495,8 +14495,8 @@ var require_semver2 = __commonJS({
       if (version.length > MAX_LENGTH) {
         throw new TypeError("version is longer than " + MAX_LENGTH + " characters");
       }
-      if (!(this instanceof SemVer)) {
-        return new SemVer(version, options);
+      if (!(this instanceof SemVer2)) {
+        return new SemVer2(version, options);
       }
       debug2("SemVer", version, options);
       this.options = options;
@@ -14534,32 +14534,32 @@ var require_semver2 = __commonJS({
       this.build = m[5] ? m[5].split(".") : [];
       this.format();
     }
-    SemVer.prototype.format = function() {
+    SemVer2.prototype.format = function() {
       this.version = this.major + "." + this.minor + "." + this.patch;
       if (this.prerelease.length) {
         this.version += "-" + this.prerelease.join(".");
       }
       return this.version;
     };
-    SemVer.prototype.toString = function() {
+    SemVer2.prototype.toString = function() {
       return this.version;
     };
-    SemVer.prototype.compare = function(other) {
+    SemVer2.prototype.compare = function(other) {
       debug2("SemVer.compare", this.version, this.options, other);
-      if (!(other instanceof SemVer)) {
-        other = new SemVer(other, this.options);
+      if (!(other instanceof SemVer2)) {
+        other = new SemVer2(other, this.options);
       }
       return this.compareMain(other) || this.comparePre(other);
     };
-    SemVer.prototype.compareMain = function(other) {
-      if (!(other instanceof SemVer)) {
-        other = new SemVer(other, this.options);
+    SemVer2.prototype.compareMain = function(other) {
+      if (!(other instanceof SemVer2)) {
+        other = new SemVer2(other, this.options);
       }
       return compareIdentifiers(this.major, other.major) || compareIdentifiers(this.minor, other.minor) || compareIdentifiers(this.patch, other.patch);
     };
-    SemVer.prototype.comparePre = function(other) {
-      if (!(other instanceof SemVer)) {
-        other = new SemVer(other, this.options);
+    SemVer2.prototype.comparePre = function(other) {
+      if (!(other instanceof SemVer2)) {
+        other = new SemVer2(other, this.options);
       }
       if (this.prerelease.length && !other.prerelease.length) {
         return -1;
@@ -14586,9 +14586,9 @@ var require_semver2 = __commonJS({
         }
       } while (++i2);
     };
-    SemVer.prototype.compareBuild = function(other) {
-      if (!(other instanceof SemVer)) {
-        other = new SemVer(other, this.options);
+    SemVer2.prototype.compareBuild = function(other) {
+      if (!(other instanceof SemVer2)) {
+        other = new SemVer2(other, this.options);
       }
       var i2 = 0;
       do {
@@ -14608,7 +14608,7 @@ var require_semver2 = __commonJS({
         }
       } while (++i2);
     };
-    SemVer.prototype.inc = function(release, identifier) {
+    SemVer2.prototype.inc = function(release, identifier) {
       switch (release) {
         case "premajor":
           this.prerelease.length = 0;
@@ -14694,7 +14694,7 @@ var require_semver2 = __commonJS({
         loose = void 0;
       }
       try {
-        return new SemVer(version, loose).inc(release, identifier).version;
+        return new SemVer2(version, loose).inc(release, identifier).version;
       } catch (er) {
         return null;
       }
@@ -14738,19 +14738,19 @@ var require_semver2 = __commonJS({
     }
     exports2.major = major;
     function major(a, loose) {
-      return new SemVer(a, loose).major;
+      return new SemVer2(a, loose).major;
     }
     exports2.minor = minor;
     function minor(a, loose) {
-      return new SemVer(a, loose).minor;
+      return new SemVer2(a, loose).minor;
     }
     exports2.patch = patch;
     function patch(a, loose) {
-      return new SemVer(a, loose).patch;
+      return new SemVer2(a, loose).patch;
     }
     exports2.compare = compare;
     function compare(a, b, loose) {
-      return new SemVer(a, loose).compare(new SemVer(b, loose));
+      return new SemVer2(a, loose).compare(new SemVer2(b, loose));
     }
     exports2.compareLoose = compareLoose;
     function compareLoose(a, b) {
@@ -14758,8 +14758,8 @@ var require_semver2 = __commonJS({
     }
     exports2.compareBuild = compareBuild;
     function compareBuild(a, b, loose) {
-      var versionA = new SemVer(a, loose);
-      var versionB = new SemVer(b, loose);
+      var versionA = new SemVer2(a, loose);
+      var versionB = new SemVer2(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
     exports2.rcompare = rcompare;
@@ -14879,7 +14879,7 @@ var require_semver2 = __commonJS({
       if (!m[2]) {
         this.semver = ANY;
       } else {
-        this.semver = new SemVer(m[2], this.options.loose);
+        this.semver = new SemVer2(m[2], this.options.loose);
       }
     };
     Comparator.prototype.toString = function() {
@@ -14892,7 +14892,7 @@ var require_semver2 = __commonJS({
       }
       if (typeof version === "string") {
         try {
-          version = new SemVer(version, this.options);
+          version = new SemVer2(version, this.options);
         } catch (er) {
           return false;
         }
@@ -15213,7 +15213,7 @@ var require_semver2 = __commonJS({
       }
       if (typeof version === "string") {
         try {
-          version = new SemVer(version, this.options);
+          version = new SemVer2(version, this.options);
         } catch (er) {
           return false;
         }
@@ -15270,7 +15270,7 @@ var require_semver2 = __commonJS({
         if (rangeObj.test(v)) {
           if (!max || maxSV.compare(v) === -1) {
             max = v;
-            maxSV = new SemVer(max, options);
+            maxSV = new SemVer2(max, options);
           }
         }
       });
@@ -15289,7 +15289,7 @@ var require_semver2 = __commonJS({
         if (rangeObj.test(v)) {
           if (!min || minSV.compare(v) === 1) {
             min = v;
-            minSV = new SemVer(min, options);
+            minSV = new SemVer2(min, options);
           }
         }
       });
@@ -15298,11 +15298,11 @@ var require_semver2 = __commonJS({
     exports2.minVersion = minVersion;
     function minVersion(range, loose) {
       range = new Range(range, loose);
-      var minver = new SemVer("0.0.0");
+      var minver = new SemVer2("0.0.0");
       if (range.test(minver)) {
         return minver;
       }
-      minver = new SemVer("0.0.0-0");
+      minver = new SemVer2("0.0.0-0");
       if (range.test(minver)) {
         return minver;
       }
@@ -15310,7 +15310,7 @@ var require_semver2 = __commonJS({
       for (var i2 = 0; i2 < range.set.length; ++i2) {
         var comparators = range.set[i2];
         comparators.forEach(function(comparator) {
-          var compver = new SemVer(comparator.semver.version);
+          var compver = new SemVer2(comparator.semver.version);
           switch (comparator.operator) {
             case ">":
               if (compver.prerelease.length === 0) {
@@ -15356,7 +15356,7 @@ var require_semver2 = __commonJS({
     }
     exports2.outside = outside;
     function outside(version, range, hilo, options) {
-      version = new SemVer(version, options);
+      version = new SemVer2(version, options);
       range = new Range(range, options);
       var gtfn, ltefn, ltfn, comp, ecomp;
       switch (hilo) {
@@ -15420,7 +15420,7 @@ var require_semver2 = __commonJS({
     }
     exports2.coerce = coerce2;
     function coerce2(version, options) {
-      if (version instanceof SemVer) {
+      if (version instanceof SemVer2) {
         return version;
       }
       if (typeof version === "number") {
@@ -21786,6 +21786,11 @@ function cloneEnv(...envs) {
 
 // src/fs/run-user-scripts.ts
 var runNpmInstallSema = new import_async_sema4.default(1);
+var NO_OVERRIDE = {
+  detectedLockfile: void 0,
+  detectedPackageManager: void 0,
+  path: void 0
+};
 function spawnAsync(command, args, opts = {}) {
   return new Promise((resolve, reject) => {
     const stderrLogs = [];
@@ -22147,8 +22152,9 @@ function getEnvForPackageManager({
   } = getPathOverrideForPackageManager({
     cliType,
     lockfileVersion,
-    corepackEnabled,
-    nodeVersion
+    corepackPackageManager: packageJsonPackageManager,
+    nodeVersion,
+    corepackEnabled
   });
   if (corepackEnabled) {
     debug(
@@ -22186,10 +22192,8 @@ function getEnvForPackageManager({
   }
   return newEnv;
 }
-function detectPnpmVersion(lockfileVersion, corepackEnabled) {
+function detectPnpmVersion(lockfileVersion) {
   switch (true) {
-    case corepackEnabled:
-      return "corepack_enabled";
     case lockfileVersion === void 0:
       return "not found";
     case lockfileVersion === 5.3:
@@ -22204,98 +22208,154 @@ function detectPnpmVersion(lockfileVersion, corepackEnabled) {
       return "not found";
   }
 }
-function shouldUseNpm7(lockfileVersion, nodeVersion) {
-  if (lockfileVersion === void 0)
-    return false;
-  return lockfileVersion >= 2 && (nodeVersion?.major || 0) < 16;
+function validLockfileForPackageManager(cliType, lockfileVersion, packageManagerVersion) {
+  const packageManagerMajorVersion = packageManagerVersion.major;
+  switch (cliType) {
+    case "npm":
+    case "bun":
+    case "yarn":
+      return true;
+    case "pnpm":
+      switch (packageManagerMajorVersion) {
+        case 9:
+          if ("9.0.0" === packageManagerVersion.version && lockfileVersion === 6) {
+            return false;
+          }
+          return [6, 7, 9].includes(lockfileVersion);
+        case 8:
+          return [6, 6.1].includes(lockfileVersion);
+        case 7:
+          return [5.3, 5.4].includes(lockfileVersion);
+        case 6:
+          return [5.3, 5.4].includes(lockfileVersion);
+        default:
+          return true;
+      }
+  }
 }
 function getPathOverrideForPackageManager({
   cliType,
   lockfileVersion,
-  corepackEnabled,
-  nodeVersion
+  corepackPackageManager,
+  corepackEnabled = true
 }) {
-  const no_override = {
-    detectedLockfile: void 0,
-    detectedPackageManager: void 0,
-    path: void 0
+  const detectedPackageManger = detectPackageManager(cliType, lockfileVersion);
+  if (!corepackPackageManager) {
+    return detectedPackageManger ?? NO_OVERRIDE;
+  }
+  if (lockfileVersion === void 0 || !corepackEnabled) {
+    return NO_OVERRIDE;
+  }
+  if (validateCorepackPackageManager(
+    cliType,
+    lockfileVersion,
+    corepackPackageManager
+  )) {
+    return NO_OVERRIDE;
+  }
+  console.warn(
+    `WARN [package-manager-warning-1] Detected lockfile "${lockfileVersion}" which is not compatible with the intended corepack package manager "${corepackPackageManager}". Update your lockfile or change to a compatible corepack version.`
+  );
+  return NO_OVERRIDE;
+}
+function validateCorepackPackageManager(cliType, lockfileVersion, corepackPackageManager) {
+  const validatedCorepackPackageManager = validateVersionSpecifier(
+    corepackPackageManager
+  );
+  if (!validatedCorepackPackageManager) {
+    console.warn(
+      `WARN [package-manager-warning-2] Intended corepack defined package manager "${corepackPackageManager}" is not a valid semver value.`
+    );
+    return false;
+  }
+  if (cliType !== validatedCorepackPackageManager.packageName) {
+    console.warn(
+      `WARN [package-manager-warning-3] Detected package manager "${cliType}" does not match intended corepack defined package manager "${validatedCorepackPackageManager.packageName}". Change your lockfile or "package.json#packageManager" value to match.`
+    );
+    return false;
+  }
+  const corepackPackageManagerVersion = (0, import_semver2.coerce)(
+    validatedCorepackPackageManager.packageVersionRange
+  );
+  if (corepackPackageManagerVersion === null) {
+    return true;
+  } else {
+    return validLockfileForPackageManager(
+      cliType,
+      lockfileVersion,
+      corepackPackageManagerVersion
+    );
+  }
+}
+function validateVersionSpecifier(version) {
+  if (!version) {
+    return void 0;
+  }
+  const [before, after, ...extra] = version.split("@");
+  if (extra.length) {
+    return void 0;
+  }
+  if (!before) {
+    return void 0;
+  }
+  if (!after) {
+    return void 0;
+  }
+  if (!(0, import_semver2.validRange)(after)) {
+    return void 0;
+  }
+  return {
+    packageName: before,
+    packageVersionRange: after
   };
+}
+function detectPackageManager(cliType, lockfileVersion) {
   switch (cliType) {
     case "npm":
-      switch (true) {
-        case corepackEnabled:
-          return no_override;
-        case shouldUseNpm7(lockfileVersion, nodeVersion):
-          return {
-            path: "/node16/bin-npm7",
-            detectedLockfile: "package-lock.json",
-            detectedPackageManager: "npm 7+"
-          };
-        default:
-          return no_override;
-      }
+      return void 0;
     case "pnpm":
-      switch (detectPnpmVersion(lockfileVersion, corepackEnabled)) {
-        case "corepack_enabled":
-          return no_override;
+      switch (detectPnpmVersion(lockfileVersion)) {
         case "pnpm 7":
           return {
             path: "/pnpm7/node_modules/.bin",
             detectedLockfile: "pnpm-lock.yaml",
-            detectedPackageManager: "pnpm 7"
+            detectedPackageManager: "pnpm@7.x"
           };
         case "pnpm 8":
           return {
             path: "/pnpm8/node_modules/.bin",
             detectedLockfile: "pnpm-lock.yaml",
-            detectedPackageManager: "pnpm 8"
+            detectedPackageManager: "pnpm@8.x"
           };
         case "pnpm 9":
           return {
             path: "/pnpm9/node_modules/.bin",
             detectedLockfile: "pnpm-lock.yaml",
-            detectedPackageManager: "pnpm 9"
+            detectedPackageManager: "pnpm@9.x"
           };
         case "pnpm 6":
-        default:
-          return no_override;
-      }
-    case "bun":
-      switch (true) {
-        case corepackEnabled:
-          return no_override;
-        default:
           return {
-            path: "/bun1",
-            detectedLockfile: "bun.lockb",
-            detectedPackageManager: "Bun"
+            // undefined because pnpm@6 is the current default in the build container
+            path: void 0,
+            detectedLockfile: "pnpm-lock.yaml",
+            detectedPackageManager: "pnpm 6"
           };
+        default:
+          return void 0;
       }
+    case "bun":
+      return {
+        path: "/bun1",
+        detectedLockfile: "bun.lockb",
+        detectedPackageManager: "bun@1.x"
+      };
     case "yarn":
-      return no_override;
-  }
-}
-function validateVersionSpecifier(version) {
-  if (!version) {
-    return void 0;
-  }
-  const [before, after, ...extra] = version.split("@");
-  if (extra.length) {
-    return void 0;
-  }
-  if (!before) {
-    return void 0;
-  }
-  if (!after) {
-    return void 0;
-  }
-  if (!(0, import_semver2.validRange)(after)) {
-    return void 0;
+      return {
+        path: void 0,
+        detectedLockfile: "yarn.lock",
+        detectedPackageManager: "yarn"
+      };
   }
-  return {
-    packageName: before,
-    packageVersionRange: after
-  };
 }
 function getPathForPackageManager({
   cliType,
@@ -22304,12 +22364,15 @@ function getPathForPackageManager({
   env
 }) {
   const corepackEnabled = env.ENABLE_EXPERIMENTAL_COREPACK === "1";
-  const overrides = getPathOverrideForPackageManager({
+  let overrides = getPathOverrideForPackageManager({
     cliType,
     lockfileVersion,
-    corepackEnabled,
+    corepackPackageManager: void 0,
     nodeVersion
   });
+  if (corepackEnabled) {
+    overrides = NO_OVERRIDE;
+  }
   const alreadyInPath = (newPath) => {
     const oldPath = env.PATH ?? "";
     return oldPath.split(import_path5.default.delimiter).includes(newPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/build-utils",
-  "version": "8.3.1",
+  "version": "8.3.2",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.js",