5 ms·
That’s weird, pnpm no longer automatically runs lifecycle scripts like preinstall [1], so unless they were running a very old version of pnpm, shouldn’t they ha
by sync 9mo ago
That’s weird, pnpm no longer automatically runs lifecycle scripts like preinstall [1], so unless they were running a very old version of pnpm, shouldn’t they have been protected from Shai-Hulud?
1: https://github.com/pnpm/pnpm/pull/8897 https://github.com/pnpm/pnpm/pull/8897
- e40 9mo agoYeah, I thought that was the main reason to use pnpm. Very confused.
- pverheggen 9mo agoMaybe the project itself had a postinstall script? It doesn't run lifecycle scripts of dependencies, but it still runs project-level ones.
- ItsHarper 9mo agoAt the end of the article, they talk about how they've since updated to the latest major version of pnpm, which is the one with that change
- agilob 9mo agoLet me understand it fully. That means they updated dependencies using old, out of date package manager. If pnpm was up to date, this would no have happened? Sounds totally like their fault then