Thanks to visit codestin.com
Credit goes to Github.com

Skip to content

Conversation

@dominic-clerk
Copy link
Contributor

🔎 Previews:

What does this solve?

Safer defaults for increased supply chain security

Related to https://linear.app/clerk/issue/SEC-210/add-minimumreleaseage-to-all-projects-using-npm

Related to https://linear.app/clerk/issue/SEC-209/enforce-pnpm-10-in-vercel-environments

What changed?

Move to pnpm 10 and delay package updates

Checklist

  • I have clicked on "Files changed" and performed a thorough self-review
  • All existing checks pass

@dominic-clerk dominic-clerk requested a review from a team as a code owner November 26, 2025 11:32
@vercel
Copy link

vercel bot commented Nov 26, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (UTC)
clerk-docs Ready Ready Preview Dec 18, 2025 6:28pm

@NWylynko
Copy link
Contributor

NWylynko commented Dec 5, 2025

image The preview is broken
image The site can't load the redirects

The output folder is looking completely off from what it should be

Typical PR This PR
image image

@NWylynko NWylynko self-requested a review December 5, 2025 16:01
@dominic-clerk
Copy link
Contributor Author

Oh wow ok thanks I'll have a look

@dominic-clerk
Copy link
Contributor Author

I was thinking that maybe some of the lifecycle scripts were necessary so I allow-listed them but Vercel still refuses to see any of the settings I added to the workspace file and/or the package.json

╭ Warning ─────────────────────────────────────────────────────────────────────╮
│                                                                              │
│   Ignored build scripts: bun, esbuild.                                       │
│   Run "pnpm approve-builds" to pick which dependencies should be allowed     │
│   to run scripts.                                                            │
│                                                                              │
╰──────────────────────────────────────────────────────────────────────────────╯

I don't understand what's the problem and it all works fine locally. I'll give it another debugging round later.

@NWylynko
Copy link
Contributor

If buns causing issues can just use tsx which should work, thou it does mean slower builds.

@dominic-clerk
Copy link
Contributor Author

So it's really because Vercel is completely ignoring the fact that we allow-listed the bun lifecycle scripts.

I made this use tsx for now and I'll follow-up with Vercel support and try to figure out what's wrong here.

@dominic-clerk
Copy link
Contributor Author

@NWylynko ready for your review again 🙇

Comment on lines +3 to +4
onlyBuiltDependencies:
- bun
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this still needed?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It makes it so that pnpm run build actually works locally and I'd like to have it to show Vercel support the configuration that should work.

@NWylynko
Copy link
Contributor

It would be good to also update the contributing.md anywhere it says to use npm when working on the docs to instead use pnpm

@dominic-clerk
Copy link
Contributor Author

Good catch for the contributing ! I will modify this as well once this merges https://github.com/clerk/clerk?tab=readme-ov-file#5-optional-set-up-local-docs

@dominic-clerk
Copy link
Contributor Author

Ok now the test fails even though the last commit was unrelated :(

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants