chore: drop the dead .npmrc and fix the stale pnpm version in CONTRIBUTING#3750
Merged
Conversation
…UTING pnpm 11 reads nodeLinker / shamefullyHoist / linkWorkspacePackages from pnpm-workspace.yaml, not .npmrc. facebook#3700 migrated those three settings into the YAML but left .npmrc in place, so the file has been a no-op since. Verified by A/B: a directory with only .npmrc surfaces none of the three keys in `pnpm config list`, while one with only pnpm-workspace.yaml surfaces all three. Removing .npmrc here leaves nodeLinker: hoisted, shamefullyHoist: true and linkWorkspacePackages: true intact, and `pnpm install --frozen-lockfile` is a no-op ("Already up to date"). The file only carried those three keys, so it goes away entirely. It was also making every `npm` invocation in the repo print three "Unknown project config" warnings. Separately, facebook#3700 swept `pnpm@10` -> `pnpm@11` through CONTRIBUTING.md but the verification snippet spells the version as `10.x.x`, which the string replace never matched.
Han5991
requested review from
cixzhang,
ejhammond,
imdreamrunner,
josephfarina,
marie-lucas,
nynexman4464,
thedjpetersen and
vjeux
as code owners
July 10, 2026 10:28
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
meta-cla
Bot
added
the
CLA Signed
cixzhang
approved these changes
Jul 11, 2026
cixzhang
left a comment
cixzhang
left a comment
Contributor
There was a problem hiding this comment.
Reviewed via the review rubric — drop dead .npmrc + fix stale pnpm version in CONTRIBUTING — chore, verified matches pinned pnpm 11. Verified against main; no consumer API change. Approving.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two leftovers from #3700 (the pnpm 11 upgrade):
Delete
.npmrc. pnpm 11 readsnodeLinker/shamefullyHoist/linkWorkspacePackagesfrompnpm-workspace.yaml, not.npmrc. chore: upgrade pinned package manager to pnpm 11 #3700 migrated all three into the YAML (and says so in a comment there) but left.npmrcon disk, so the file has been a no-op ever since. It carried nothing else, so it goes away entirely.Fix
CONTRIBUTING.md. chore: upgrade pinned package manager to pnpm 11 #3700 sweptpnpm@10→pnpm@11through the doc, but the verification snippet spells the version as10.x.x, which the string replace never matched. A contributor following the doc today sees11.10.0and wonders whether they installed the wrong thing.Why it's safe
.npmrclooked load-bearing because both files declared the same values — nothing revealed which one was winning. Removing one shows it:pnpm config listreports the 3 keys?.npmrconlypnpm-workspace.yamlonly.npmrcdeletednodeLinkerdefaults toisolated, so if the value were coming from.npmrcit would have to show up. It doesn't. Hoisting stays on and thenode_moduleslayout is unchanged.pnpm install --frozen-lockfileon this branch:Already up to date, exit 0,pnpm-lock.yamluntouched.Every CI workflow runs
pnpm install --frozen-lockfileunder pnpm 11 (thenpm installstrings in the workflows are comments and log messages), so nothing in CI depended on.npmrceither.Bonus
The dead file was making every
npminvocation in the repo print:Out of scope
Three related things surfaced while digging, each worth its own PR:
packageManageranddevEngines.packageManagercoexist, so pnpm 11 warns"packageManager" will be ignoredon every command. Predates chore: upgrade pinned package manager to pnpm 11 #3700, and corepack still reads the field, so nothing breaks.@types/nodesits at^25.9.3(dependabot jumped it 22 → 25 in chore(deps-dev): bump @types/node from 22.19.6 to 25.6.0 #1473) while CI and the docs are on Node 24. Correcting the pin also needs adependabot.ymlguard, or the bot re-raises it.packages/cliandapps/example-vitesettypes: ["node"]in their tsconfigs without declaring@types/node— phantom deps that only resolve becauseshamefullyHoistis on.