summaryrefslogtreecommitdiff
path: root/cli/npm
AgeCommit message (Collapse)Author
2024-07-19fix(cli): Respect implied BYONM from DENO_FUTURE in `deno task` (#24652)Nathan Whitaker
Regression from https://github.com/denoland/deno/commit/04f9db5b2217fe06f88e76146aac6362ff0b0b86 Originally I thought to fix the issue in the PR we needed to explicitly pass through the `node-modules-dir` flag, but after applying the correct fix that david pointed out (setting `NPM_PROCESS_STATE`) that wasn't necessary (or correct). We had a test for deno task with BYONM, but it only tested with `"unstable": ["byonm"]` in deno.json, so it didn't catch this.
2024-07-18Reland "refactor(fetch): reimplement fetch with hyper instead of reqwest" ↵Bartek Iwańczuk
(#24593) Originally landed in https://github.com/denoland/deno/commit/f6fd6619e708a515831f707438368d81b0c9aa56. Reverted in https://github.com/denoland/deno/pull/24574. This reland contains a fix that sends "Accept: */*" header for calls made from "FileFetcher". Absence of this header made downloading source code from JSR broken. This is tested by ensuring this header is present in the test server that servers JSR packages. --------- Co-authored-by: Sean McArthur <sean@seanmonstar.com>
2024-07-16fix(cli): Create child node_modules for conflicting dependency versions, ↵Nathan Whitaker
respect aliases in package.json (#24609) Fixes #24419.
2024-07-15fix(node): Fix `--allow-scripts` with no `deno.json` (#24533)Nathan Whitaker
We would resolve the wrong package.json, resulting in an inability to run CJS (or other node-mode) scripts
2024-07-15fix(workspace): do not resolve to self for npm pkg depending on matching req ↵David Sherret
(#24591) Closes #24584
2024-07-13Revert "refactor(fetch): reimplement fetch with hyper instead of reqwest ↵Ryan Dahl
(#24237)" (#24574) This reverts commit f6fd6619e708a515831f707438368d81b0c9aa56. I'm seeing a difference between canary and 1.45.2. In `deno-docs/reference_gen` I can't download dax when running `deno task types` ``` ~/src/deno-docs/reference_gen# deno upgrade --canary Looking up latest canary version Found latest version f6fd6619e708a515831f707438368d81b0c9aa56 Downloading https://dl.deno.land/canary/f6fd6619e708a515831f707438368d81b0c9aa56/deno-aarch64-apple-darwin.zip Deno is upgrading to version f6fd6619e708a515831f707438368d81b0c9aa56 Archive: /var/folders/9v/kys6gqns6kl8nksyn4l1f9v40000gn/T/.tmpb5lDnq/deno.zip inflating: deno Upgraded successfully ~/src/deno-docs/reference_gen# deno -v deno 1.45.2+f6fd661 ~/src/deno-docs/reference_gen# rm -rf /Users/ry/Library/Caches/deno ~/src/deno-docs/reference_gen# deno task types Task types deno task types:deno && deno task types:node Task types:deno deno run --allow-read --allow-write --allow-run --allow-env --allow-sys deno-docs.ts error: JSR package manifest for '@david/dax' failed to load. expected value at line 1 column 1 at file:///Users/ry/src/deno-docs/reference_gen/deno-docs.ts:2:15 ~/src/deno-docs/reference_gen# deno upgrade --version 1.45.2 Downloading https://github.com/denoland/deno/releases/download/v1.45.2/deno-aarch64-apple-darwin.zip Deno is upgrading to version 1.45.2 Archive: /var/folders/9v/kys6gqns6kl8nksyn4l1f9v40000gn/T/.tmp3R7uhF/deno.zip inflating: deno Upgraded successfully ~/src/deno-docs/reference_gen# rm -rf /Users/ry/Library/Caches/deno ~/src/deno-docs/reference_gen# deno task types Task types deno task types:deno && deno task types:node Task types:deno deno run --allow-read --allow-write --allow-run --allow-env --allow-sys deno-docs.ts Task types:node deno run --allow-read --allow-write=. --allow-env --allow-sys node-docs.ts ```
2024-07-13refactor(fetch): reimplement fetch with hyper instead of reqwest (#24237)Sean McArthur
This commit re-implements `ext/fetch` and all dependent crates using `hyper` and `hyper-util`, instead of `reqwest`. The reasoning is that we want to have greater control and access to low level `hyper` APIs when implementing `fetch` API as well as `node:http` module. --------- Co-authored-by: Bartek Iwańczuk <biwanczuk@gmail.com>
2024-07-11fix(node): Ignore broken default install scripts (#24534)Nathan Whitaker
NPM inserts a default install script when a package has a `binding.gyp` file. It's possible, however, for the package to exclude the `binding.gyp` file when they publish, and in this case the install script will never succeed for a user of the package. This happens with `fsevents`, for instance. They don't include the `binding.gyp` file in their published tarball, but the default install script appears in the manifest served by `npm`. This causes us to warn that `fsevents` has an install script, but when you try to run it it fails due to `binding.gyp` not existing.
2024-07-11fix(npm): only warn about lifecycle scripts not being run when setting up ↵David Sherret
directory (#24530) Closes #24518
2024-07-10fix(check): CJS types importing dual ESM/CJS package should prefer CJS types ↵David Sherret
(#24492) Closes #16370
2024-07-10chore: tweak warning message for un-run install scripts (#24508)Nathan Whitaker
Previously when we printed out the packages that skipped install scripts, we didn't prefix them with `npm:`. When you pass `--allow-scripts` though, we require `npm:`, which means you can't just copy paste the package name from the warning message.
2024-07-10feat(node): Support executing npm package lifecycle scripts ↵Nathan Whitaker
(preinstall/install/postinstall) (#24487) Adds support for running npm package lifecycle scripts, opted into via a new `--allow-scripts` flag. With this PR, when running `deno cache` (or `DENO_FUTURE=1 deno install`) you can specify the `--allow-scripts=pkg1,pkg2` flag to run lifecycle scripts attached to the given packages. Note at the moment this only works when `nodeModulesDir` is true (using the local resolver). When a package with un-run lifecycle scripts is encountered, we emit a warning suggesting things may not work and to try running lifecycle scripts. Additionally, if a package script implicitly requires `node-gyp` and it's not found on the system, we emit a warning. Extra things in this PR: - Extracted out bits of `task.rs` into a separate module for reuse - Added a couple fields to `process.config` in order to support `node-gyp` (it relies on a few variables being there) - Drive by fix to downloading new npm packages to test registry --- TODO: - [x] validation for allow-scripts args (make sure it looks like an npm package) - [x] make allow-scripts matching smarter - [ ] figure out what issues this closes --- Review notes: - This adds a bunch of deps to our test registry due to using `node-gyp`, so it's pretty noisy
2024-07-09fix: make .setup-cache.bin in node_modules more reproducible (#24480)Zebreus
2024-07-09refactor: use concrete error types for node resolution (#24470)David Sherret
This will help clean up some of the code in the CLI because we'll be able to tell how the resolution failed (not part of this PR).
2024-07-04feat: npm workspace and better Deno workspace support (#24334)David Sherret
Adds much better support for the unstable Deno workspaces as well as support for npm workspaces. npm workspaces is still lacking in that we only install packages into the root node_modules folder. We'll make it smarter over time in order for it to figure out when to add node_modules folders within packages. This includes a breaking change in config file resolution where we stop searching for config files on the first found package.json unless it's in a workspace. For the previous behaviour, the root deno.json needs to be updated to be a workspace by adding `"workspace": ["./path-to-pkg-json-folder-goes-here"]`. See details in https://github.com/denoland/deno_config/pull/66 Closes #24340 Closes #24159 Closes #24161 Closes #22020 Closes #18546 Closes #16106 Closes #24160
2024-07-02feat(cli): Add `--frozen` flag to error out if lockfile is out of date (#24355)Nathan Whitaker
Closes #18296. Adds a `--frozen` (alias `--frozen-lockfile`) flag that errors out if the lockfile is out of date. This is useful for running in CI (where an out of date lockfile is usually a mistake) or to prevent accidental changes in dependencies. ![Screenshot 2024-06-26 at 7 11 13 PM](https://github.com/denoland/deno/assets/17734409/538404b8-b422-4f05-89e8-4c9b1c248576)
2024-06-28refactor(cli): Create wrapper around `deno_lockfile::Lockfile` (#24366)Nathan Whitaker
As suggested in https://github.com/denoland/deno/pull/24355#discussion_r1657875422. I wasn't able to hide the mutex stuff as much as I'd like (ended up just adding an escape hatch `inner()` method that locks the inner mutex), because you can't return references to the inner fields through a mutex. This is mostly motivated by the frozen lockfile changes
2024-06-26refactor: move PackageJson to deno_config (#24348)David Sherret
2024-06-11fix(npm): resolve dynamic npm imports individually (#24170)David Sherret
* https://github.com/denoland/deno_npm/pull/57 * https://github.com/denoland/deno_graph/pull/498 Closes https://github.com/denoland/deno/issues/17802
2024-06-08fix(check): attempt to resolve types from pkg before `@types` pkg (#24152)David Sherret
I've been meaning to fix this for ages, but I finally ran into it here: https://github.com/dsherret/ts-ast-viewer/actions/runs/9432038675/job/25981325408 We need to resolve the `@types` package as a fallback instead of eagerly resolving it.
2024-06-07fix: make writing to the deps cache more reliable (#24135)David Sherret
I was able to reproduce this locally. ``` [error] Failed to execute snippet: import { validate } from "@std/uuid"; import { assert, assertFalse } from "@std/assert"; assert(validate("6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b")); assertFalse(validate("not a UUID")); Download https://jsr.io/@std/uuid/meta.json Download https://jsr.io/@std/uuid/1.0.0-rc.1_meta.json Download https://jsr.io/@std/uuid/1.0.0-rc.1/mod.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/common.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/constants.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v1.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v3.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v4.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v5.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/_common.ts error: Access is denied. (os error 5) (for 'V:\.cache\deno\deps\https\jsr.io\2ae5bb614c7526d0876be0b76da1372fd51304ae27d6202ee94df720b3523d08') at file:///V:/deno_std/uuid/common.ts:43 [error] Failed to execute snippet: import { v5, NAMESPACE_DNS, NIL_UUID } from "@std/uuid"; import { assert, assertFalse } from "@std/assert"; const data = new TextEncoder().encode("deno.land"); const uuid = await v5.generate(NAMESPACE_DNS, data); assert(v5.validate(uuid)); assertFalse(v5.validate(NIL_UUID)); Download https://jsr.io/@std/uuid/meta.json Download https://jsr.io/@std/uuid/1.0.0-rc.1_meta.json Download https://jsr.io/@std/uuid/1.0.0-rc.1/mod.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/common.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/constants.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v1.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v3.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v4.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v5.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/_common.ts error: Access is denied. (os error 5) (for 'V:\.cache\deno\deps\https\jsr.io\63dd818c5fc1ac39c04df9b42bd9dd4bbc07f7d1b174e405d003731125778da1') at https://jsr.io/@std/uuid/1.0.0-rc.1/mod.ts:30:15 at file:///V:/deno_std/uuid/mod.ts:4 [error] Failed to execute snippet: import { isNil } from "@std/uuid"; import { assert, assertFalse } from "@std/assert"; assert(isNil("00000000-0000-0000-0000-000000000000")); assertFalse(isNil(crypto.randomUUID())); Download https://jsr.io/@std/uuid/meta.json Download https://jsr.io/@std/uuid/1.0.0-rc.1_meta.json Download https://jsr.io/@std/uuid/1.0.0-rc.1/mod.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/common.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/constants.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v1.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v3.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v4.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v5.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/_common.ts error: Access is denied. (os error 5) (for 'V:\.cache\deno\deps\https\jsr.io\fd3a12fc091d16ee29f10fa7a05eeeb8bd6c3cc014642e72478c757f00e7261e') at https://jsr.io/@std/uuid/1.0.0-rc.1/mod.ts:34:40 at file:///V:/deno_std/uuid/common.ts:23 [error] Failed to execute snippet: import { version } from "@std/uuid"; import { assertEquals } from "@std/assert/assert-equals"; assertEquals(version("d9428888-122b-11e1-b85c-61cd3cbb3210"), 1); assertEquals(version("6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b"), 4); Download https://jsr.io/@std/uuid/meta.json Download https://jsr.io/@std/uuid/1.0.0-rc.1_meta.json Download https://jsr.io/@std/uuid/1.0.0-rc.1/mod.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/common.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/constants.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v1.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v3.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v4.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/v5.ts Download https://jsr.io/@std/uuid/1.0.0-rc.1/_common.ts error: Access is denied. (os error 5) (for 'V:\.cache\deno\deps\https\jsr.io\2ae5bb614c7526d0876be0b76da1372fd51304ae27d6202ee94df720b3523d08') at file:///V:/deno_std/uuid/common.ts:66 4 errors found ``` It occurs when many Deno processes are writing to the deps cache at the same time. Fix is to use `atomic_write_with_retries` which is much more reliable (and the function that helped make the ecosystem tests more reliable too). After this change I no longer have this issue. Closes https://github.com/denoland/deno/issues/24073
2024-06-06refactor: remove `PermissionsContainer` in deno_runtime (#24119)David Sherret
Also removes permissions being passed in for node resolution. It was completely useless because we only checked it for reading package.json files, but Deno reading package.json files for resolution is perfectly fine. My guess is this is also a perf improvement because Deno is doing less work.
2024-06-06refactor: `NpmRegistryApi` - `#[async_trait(?Send)]` (#24126)David Sherret
2024-06-06fix(cli): Overwrite existing bin entries in `node_modules` (#24123)Nathan Whitaker
Previously we warned on unix and didn't touch them on windows, now we unconditionally overwrite them. This matches what npm does.
2024-06-05fix(npm): use configured auth for tarball urls instead of scope auth (#24111)David Sherret
Deno was using the scope auth for the tarball urls, which is not always correct. We are going to do a release immediately for this issue.
2024-06-05refactor(npm): improve locking around updating npm resolution (#24104)David Sherret
Introduces a `SyncReadAsyncWriteLock` to make it harder to write to the npm resolution without first waiting async in a queue. For the npm resolution, reading synchronously is fine, but when updating, someone should wait async, clone the data, then write the data at the end back.
2024-06-05fix: better handling of npm resolution occurring on workers (#24094)David Sherret
Closes https://github.com/denoland/deno/issues/24063
2024-06-03refactor: don't share `reqwest::HttpClient` across tokio runtimes (#24092)David Sherret
This also fixes several issues where we weren't properly creating http clients with the user's settings.
2024-06-03refactor: extract structs for downloading tarballs and npm registry ↵David Sherret
packuments (#24067)
2024-05-29fix(cli): Prefer npm bin entries provided by packages closer to the root ↵Nathan Whitaker
(#24024) Fixes #24012. In the case of multiple packages providing a binary with a same name, we were basically leaving the results undefined (since we set up things in parallel, and whichever got set up first won). In addition, we were warning about these cases, even though it's a situation that's expected to occur. Instead, in the case of a collision in the binary names, we prefer the binary provided by the package with the least depth in the dependency tree. While I was at it, I also took moved more code to `bin_entries.rs` since it was starting to get a bit cluttered.
2024-05-29fix: bump cache sqlite dbs to v2 for WAL journal mode change (#24030)David Sherret
In https://github.com/denoland/deno/pull/23955 we changed the sqlite db journal mode to WAL. This causes issues when someone is running an old version of Deno using TRUNCATE and a new version because the two fight against each other.
2024-05-28perf(cli): Improve concurrency when setting up `node_modules` and loading ↵Nathan Whitaker
cached npm package info (#24018) The same issue in two different places - doing blocking FS work in an async task, limiting the amount of work that happens concurrently. - When setting up node_modules, where we try to set up entries concurrently but were blocking other tasks from actually running. - When loading package info from the npm registry file cache, loading and deserializing is expensive and prevents concurrency. This was especially noticeable when loading an npm resolution snapshot from a lockfile (`snapshot_from_lockfile` in `deno_npm`). Installing deps in `deno-docs`: ``` ❯ hyperfine -i -p 'rm -rf node_modules/' '../d7/deno-main i' '../d7/target/release/deno i' Benchmark 1: ../d7/deno-main i Time (mean ± σ): 2.193 s ± 0.027 s [User: 0.589 s, System: 1.033 s] Range (min … max): 2.151 s … 2.242 s 10 runs Benchmark 2: ../d7/target/release/deno i Time (mean ± σ): 1.597 s ± 0.021 s [User: 0.977 s, System: 1.337 s] Range (min … max): 1.550 s … 1.627 s 10 runs Summary ../d7/target/release/deno i ran 1.37 ± 0.02 times faster than ../d7/deno-main i ``` Caching `npm:@11ty/eleventy`: ``` ❯ hyperfine -i -p 'rm -rf node_modules/' --warmup 5 '../../d7/deno-main cache npm:@11ty/eleventy' '../../d7/target/release/deno cache npm:@11ty/eleventy' Benchmark 1: ../../d7/deno-main cache npm:@11ty/eleventy Time (mean ± σ): 129.9 ms ± 2.2 ms [User: 27.5 ms, System: 101.3 ms] Range (min … max): 127.5 ms … 135.8 ms 10 runs Benchmark 2: ../../d7/target/release/deno cache npm:@11ty/eleventy Time (mean ± σ): 100.6 ms ± 1.3 ms [User: 38.8 ms, System: 233.8 ms] Range (min … max): 99.3 ms … 103.2 ms 10 runs Summary ../../d7/target/release/deno cache npm:@11ty/eleventy ran 1.29 ± 0.03 times faster than ../../d7/deno-main cache npm:@11ty/eleventy ``` --------- Co-authored-by: David Sherret <dsherret@gmail.com>
2024-05-28perf(cli): Optimize setting up `node_modules` on macOS (#23980)Nathan Whitaker
Hard linking (`linkat`) is ridiculously slow on mac. `copyfile` is better, but what's even faster is `clonefile`. It doesn't have the space savings that comes with hardlinking, but the performance difference is worth it imo. ``` ❯ hyperfine -i -p 'rm -rf node_modules/' '../../d7/target/release/deno cache npm:@11ty/eleventy' 'deno cache npm:@11ty/eleventy' Benchmark 1: ../../d7/target/release/deno cache npm:@11ty/eleventy Time (mean ± σ): 115.4 ms ± 1.2 ms [User: 27.2 ms, System: 87.3 ms] Range (min … max): 113.7 ms … 117.5 ms 10 runs Benchmark 2: deno cache npm:@11ty/eleventy Time (mean ± σ): 619.3 ms ± 6.4 ms [User: 34.3 ms, System: 575.6 ms] Range (min … max): 612.2 ms … 633.3 ms 10 runs Summary ../../d7/target/release/deno cache npm:@11ty/eleventy ran 5.37 ± 0.08 times faster than deno cache npm:@11ty/eleventy ```
2024-05-28feat(vendor): support modifying remote files in vendor folder without ↵David Sherret
checksum errors (#23979) Includes: * https://github.com/denoland/deno_graph/pull/486 * https://github.com/denoland/deno_graph/pull/488 * https://github.com/denoland/deno_lockfile/pull/25 * https://github.com/denoland/deno_lockfile/pull/22 * https://github.com/denoland/deno_graph/pull/483 * https://github.com/denoland/deno_graph/pull/470
2024-05-23fix(npm): set up node_modules/.bin/ entries for package that provide bin ↵Bartek Iwańczuk
entrypoints (#23496) Closes https://github.com/denoland/deno/issues/23036 --------- Co-authored-by: Nathan Whitaker <nathan@deno.com>
2024-05-23FUTURE: initial support for .npmrc file (#23560)Bartek Iwańczuk
This commit adds initial support for ".npmrc" files. Currently we only discover ".npmrc" files next to "package.json" files and discovering these files in user home dir is left for a follow up. This pass supports "_authToken" and "_auth" configuration for providing authentication. LSP support has been left for a follow up PR. Towards https://github.com/denoland/deno/issues/16105
2024-05-21fix(task): do not error if node_modules folder not exists (#23920)David Sherret
Revealed https://github.com/denoland/deno/issues/23919 Closes #23914
2024-05-14fix(npm): make tarball extraction more reliable (#23759)David Sherret
1. Extracts to a directory beside the destination. 2. Renames to the destination with retries.
2024-04-25fix(npm): do not panic hitting root dir while resolving npm package (#23556)David Sherret
Closes https://github.com/denoland/deno/issues/23029
2024-04-19refactor: move redirect handling into deno_graph (#23444)David Sherret
2024-04-17perf: v8 code cache (#23081)Igor Zinkovsky
This PR enables V8 code cache for ES modules and for `require` scripts through `op_eval_context`. Code cache artifacts are transparently stored and fetched using sqlite db and are passed to V8. `--no-code-cache` can be used to disable. --------- Co-authored-by: Bartek Iwańczuk <biwanczuk@gmail.com>
2024-04-15fix(check): cache bust when changing nodeModulesDir setting (#23355)David Sherret
2024-04-11fix(npm): local nodeModulesDir was sometimes resolving duplicates of same ↵David Sherret
package (#23320)
2024-04-10chore: update to Rust 1.77.2 (#23262)林炳权
update to Rust 1.77.2 --------- Co-authored-by: Matt Mastracci <matthew@mastracci.com>
2024-04-05perf(lsp): use lockfile to reduce npm pkg resolution time (#23247)David Sherret
This functionality was broken. The series of events was: 1. Load the npm resolution from the lockfile. 2. Discover only a subset of the specifiers in the documents. 3. Clear the npm snapshot. 4. Redo npm resolution with the new specifiers (~500ms). What this now does: 1. Load the npm resolution from the lockfile. 2. Discover only a subset of the specifiers in the documents and take into account the specifiers from the lockfile. 3. Do not redo resolution (~1ms).
2024-04-01perf(node): put pkg json into an `Rc` (#23156)David Sherret
Was doing a bit of debugging on why some stuff is not working in a personal project and ran a quick debug profile and saw it cloning the pkg json a lot. We should put this in an Rc.
2024-03-28fix(jsr): exclude yanked versions from 'deno add' and completions (#23113)Nayeem Rahman
2024-03-07perf: hard link npm cache (#22773)Divy Srivastava
2024-03-07perf(cli): use faster_hex (#22761)Matt Mastracci
`cli::util::checksum` was showing up on flame graphs because it was concatenating allocated strings. We can use `faster-hex` to improve it.
2024-03-06feat(unstable/pm): support npm packages in 'deno add' (#22715)Nayeem Rahman