pob 39.0.0 → 39.1.1

package/lib/generators/common/release/templates/workflow-release.yml.ejs

@@ -62,8 +62,6 @@ jobs:
 
       - name: Install pnpm
         uses: pnpm/action-setup@v6
-        with:
-          version: 12
 <% } -%>
 
       - uses: actions/setup-node@v7

package/lib/generators/core/bun/templates/bunfig.toml.ejs

@@ -1,7 +1,7 @@
 # Generated by pob: do not edit, it is overwritten on each pob run.
 [install]
-# Only install package versions published at least 3 days ago
-minimumReleaseAge = 259200 # seconds - in #23162 it'll allow "3d" too
+# Only install package versions published at least 2.5 days ago
+minimumReleaseAge = 216000 # seconds
 minimumReleaseAgeExcludes = [
   "@pob/root",
   "@pob/esbuild",

package/lib/generators/core/ci/templates/github-action-documentation-workflow.yml.ejs

@@ -24,8 +24,6 @@ jobs:
 <% } else if (packageManager === 'pnpm') { -%>
       - name: Install pnpm
         uses: pnpm/action-setup@v6
-        with:
-          version: 12
 
 <% } -%>
       - uses: actions/setup-node@v7

package/lib/generators/core/ci/templates/github-action-push-workflow-split.yml.ejs

@@ -25,8 +25,6 @@ jobs:
 <% } else if (packageManager === 'pnpm') { -%>
       - name: Install pnpm
         uses: pnpm/action-setup@v6
-        with:
-          version: 12
 
 <% } -%>
       - uses: actions/setup-node@v7
@@ -70,8 +68,6 @@ jobs:
 <% } else if (packageManager === 'pnpm') { -%>
       - name: Install pnpm
         uses: pnpm/action-setup@v6
-        with:
-          version: 12
 
 <% } -%>
       - uses: actions/setup-node@v7
@@ -117,8 +113,6 @@ jobs:
 <% } else if (packageManager === 'pnpm') { -%>
       - name: Install pnpm
         uses: pnpm/action-setup@v6
-        with:
-          version: 12
 
 <% } -%>
       - uses: actions/setup-node@v7
@@ -183,8 +177,6 @@ jobs:
 <% } else if (packageManager === 'pnpm') { -%>
       - name: Install pnpm
         uses: pnpm/action-setup@v6
-        with:
-          version: 12
 
 <% } -%>
       - uses: actions/setup-node@v7
@@ -259,8 +251,6 @@ jobs:
 <% } else if (packageManager === 'pnpm') { -%>
       - name: Install pnpm
         uses: pnpm/action-setup@v6
-        with:
-          version: 12
 
 <% } -%>
       - uses: actions/setup-node@v7

package/lib/generators/core/ci/templates/github-action-push-workflow.yml.ejs

@@ -28,8 +28,6 @@ jobs:
 <% } else if (packageManager === 'pnpm') { -%>
       - name: Install pnpm
         uses: pnpm/action-setup@v6
-        with:
-          version: 12
 
 <% } -%>
       - name: Use Node.js ${{ matrix.node-version }}

package/lib/generators/core/pnpm/CorePnpmGenerator.js

@@ -1,11 +1,48 @@
+import { execFileSync } from "node:child_process";
 import sortObject from "@pob/sort-object";
-import { FAILSAFE_SCHEMA, dump, loadAll } from "js-yaml";
-import { lt } from "semver";
+import { FAILSAFE_SCHEMA, dump, load, loadAll } from "js-yaml";
+import { satisfies } from "semver";
 import Generator from "yeoman-generator";
 import { writeAndFormat } from "../../../utils/writeAndFormat.js";
 
+const pnpmVersionRange = "^12.0.0";
+
+// pnpm 12 writes the pnpm version in a first document of pnpm-lock.yaml when
+// devEngines.packageManager is not ignored. Removes it when it has nothing
+// else (no config dependencies).
+const removePackageManagerLockfileDocument = (lockfile) => {
+  if (!lockfile.startsWith("---\n")) return lockfile;
+  const end = lockfile.indexOf("\n---\n", 4);
+  if (end === -1) return lockfile;
+  const envDocument = load(lockfile.slice(4, end), { schema: FAILSAFE_SCHEMA });
+  const importer = envDocument?.importers?.["."] ?? {};
+  const hasOtherEntries = Object.keys(importer).some(
+    (key) =>
+      key !== "packageManagerDependencies" && key !== "configDependencies",
+  );
+  if (
+    hasOtherEntries ||
+    Object.keys(importer.configDependencies ?? {}).length > 0
+  ) {
+    return lockfile;
+  }
+  return lockfile.slice(end + "\n---\n".length);
+};
+
+const getRunningPnpmVersion = (cwd) => {
+  try {
+    return execFileSync("pnpm", ["--version"], {
+      cwd,
+      encoding: "utf8",
+    }).trim();
+  } catch {
+    return null;
+  }
+};
+
 const minimumReleaseAgeExcludePackages = [
   "@pob/*",
+  "pob",
   "pob-dependencies",
   "check-package-dependencies",
   "alouette",
@@ -38,12 +75,24 @@ export default class CorePnpmGenerator extends Generator {
     const pkg = this.fs.readJSON(this.destinationPath("package.json"));
 
     if (this.options.enable) {
-      if (
-        pkg.packageManager &&
-        (!pkg.packageManager.startsWith("pnpm@") ||
-          lt(pkg.packageManager.slice("pnpm@".length), "12.0.0"))
-      ) {
-        delete pkg.packageManager;
+      // devEngines.packageManager is read by pnpm/action-setup. onFail is
+      // "ignore": otherwise pnpm writes its version in pnpm-lock.yaml and it
+      // has to be updated manually. The version is checked by engines.pnpm.
+      delete pkg.packageManager;
+      pkg.devEngines = {
+        ...pkg.devEngines,
+        packageManager: {
+          name: "pnpm",
+          version: pnpmVersionRange,
+          onFail: "ignore",
+        },
+      };
+
+      const lockfilePath = this.destinationPath("pnpm-lock.yaml");
+      if (this.fs.exists(lockfilePath)) {
+        const lockfile = this.fs.read(lockfilePath);
+        const newLockfile = removePackageManagerLockfileDocument(lockfile);
+        if (newLockfile !== lockfile) this.fs.write(lockfilePath, newLockfile);
       }
 
       const configString = this.fs.read(
@@ -81,7 +130,7 @@ export default class CorePnpmGenerator extends Generator {
         delete config.packages;
       }
       config.savePrefix = this.options.type === "app" ? "" : "^";
-      config.minimumReleaseAge = 1440 * 3; // 3 days in minutes
+      config.minimumReleaseAge = 1440 * 2.5; // 2.5 days in minutes
       config.minimumReleaseAgeExclude = minimumReleaseAgeExcludePackages;
       config.dedupePeerDependents = true;
       config.nodeLinker = "hoisted";
@@ -95,6 +144,10 @@ export default class CorePnpmGenerator extends Generator {
       if (pkg.packageManager?.startsWith("pnpm@")) {
         delete pkg.packageManager;
       }
+      if (pkg.devEngines?.packageManager?.name === "pnpm") {
+        delete pkg.devEngines.packageManager;
+        if (Object.keys(pkg.devEngines).length === 0) delete pkg.devEngines;
+      }
       this.fs.delete("pnpm-lock.yaml");
       this.fs.delete("pnpm-workspace.yaml");
     }
@@ -109,11 +162,23 @@ export default class CorePnpmGenerator extends Generator {
           `pnpm-workspace.yaml: set allowBuilds to true or false for ${this.pendingAllowBuilds.join(", ")}`,
         );
       }
+      // the running pnpm can be older than the version required by pob, for
+      // example in the @pob/root renovate workflow after a pnpm major update
+      const runningPnpmVersion = getRunningPnpmVersion(this.destinationPath());
+      const pnpmArgs =
+        runningPnpmVersion && satisfies(runningPnpmVersion, pnpmVersionRange)
+          ? []
+          : ["with", pnpmVersionRange];
+
       // pob just modified package.json: the lockfile must be allowed to update,
       // in particular in the automatic update GitHub Actions workflow (CI
       // defaults to frozen lockfile)
-      this.spawnSync("pnpm", ["install", "--no-frozen-lockfile"], {});
-      this.spawnSync("pnpm", ["dedupe"], {});
+      this.spawnSync(
+        "pnpm",
+        [...pnpmArgs, "install", "--no-frozen-lockfile"],
+        {},
+      );
+      this.spawnSync("pnpm", [...pnpmArgs, "dedupe"], {});
 
       this.fs.delete("package-lock.json");
       this.fs.delete("yarn.lock");
@@ -122,11 +187,11 @@ export default class CorePnpmGenerator extends Generator {
 
       if (pkg.scripts?.preversion) {
         try {
-          this.spawnSync("pnpm", ["run", "preversion"]);
+          this.spawnSync("pnpm", [...pnpmArgs, "run", "preversion"]);
         } catch {}
       } else if (pkg.scripts?.build) {
         try {
-          this.spawnSync("pnpm", ["run", "build"]);
+          this.spawnSync("pnpm", [...pnpmArgs, "run", "build"]);
         } catch {}
       }
     }

package/lib/generators/core/yarn/CoreYarnGenerator.js

@@ -183,7 +183,7 @@ export default class CoreYarnGenerator extends Generator {
       config.defaultSemverRangePrefix = this.options.type === "app" ? "" : "^";
       delete config.enableMessageNames; // was a config for yarn < 4
       config.nodeLinker = this.options.yarnNodeLinker;
-      config.npmMinimalAgeGate = 1440 * 3; // 3 days
+      config.npmMinimalAgeGate = 1440 * 2.5; // 2.5 days
       config.npmPreapprovedPackages = [
         "@pob/*",
         "pob-dependencies",

package/lib/generators/monorepo/workspaces/MonorepoWorkspacesGenerator.js

@@ -86,10 +86,13 @@ export default class MonorepoWorkspacesGenerator extends Generator {
       pkg.engines.yarn = "< 0.0.0";
       pkg.engines.npm = ">= 6.4.0";
     } else if (this.options.packageManager === "pnpm") {
+      // checks the version locally: devEngines.packageManager is ignored by
+      // pnpm (see pob:core:pnpm)
       if (!pkg.engines) pkg.engines = {};
       pkg.engines.pnpm = ">= 12.0.0";
       delete pkg.engines.yarn;
     } else if (pkg.engines) {
+      delete pkg.engines.pnpm;
       delete pkg.engines.yarn;
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pob",
-  "version": "39.0.0",
+  "version": "39.1.1",
   "description": "Pile of bones, library generator with git/babel/typescript/typedoc/readme/vitest",
   "keywords": [
     "skeleton"
@@ -58,7 +58,7 @@
     "yeoman-generator": "10.0.1"
   },
   "devDependencies": {
-    "@pob/root": "27.14.0",
+    "@pob/root": "27.15.0",
     "@types/node": "24.19.1",
     "@typescript/native": "npm:typescript@7.0.2",
     "@yeoman/types": "1.11.1"