From 5f7a35a9b36bfc2a6d41a568bb797e46bd237abd Mon Sep 17 00:00:00 2001 From: Sefa Eyeoglu Date: Tue, 7 Jul 2026 12:15:00 +0200 Subject: [PATCH 1/2] remark42: switch to pnpm_9 pnpm_10 and later do not support the old lockfile format used by remark42. A future version will be compatible with pnpm 10 at least: https://github.com/umputun/remark42/commit/f5ccfaa0e1f6f9107ad1e21bcc3ef56cba192595 Signed-off-by: Sefa Eyeoglu --- pkgs/by-name/re/remark42/package.nix | 42 +++++++++++++++++++--------- 1 file changed, 29 insertions(+), 13 deletions(-) diff --git a/pkgs/by-name/re/remark42/package.nix b/pkgs/by-name/re/remark42/package.nix index df1192589b50..c461a9aae6d5 100644 --- a/pkgs/by-name/re/remark42/package.nix +++ b/pkgs/by-name/re/remark42/package.nix @@ -3,14 +3,15 @@ stdenv, fetchFromGitHub, buildGoModule, - nodejs_22, - pnpm_8, + nodejs-slim_22, + pnpm_9, fetchPnpmDeps, pnpmConfigHook, testers, }: let + pnpm = pnpm_9.override { nodejs-slim = nodejs-slim_22; }; version = "1.15.0"; src = fetchFromGitHub { @@ -26,34 +27,49 @@ let strictDeps = true; - pnpmRoot = "frontend"; + sourceRoot = "${src.name}/frontend"; nativeBuildInputs = [ - nodejs_22 - pnpm_8 + nodejs-slim_22 + pnpm pnpmConfigHook ]; pnpmDeps = fetchPnpmDeps { - inherit (finalAttrs) pname version src; - sourceRoot = "${finalAttrs.src.name}/frontend"; - pnpm = pnpm_8; - fetcherVersion = 3; - hash = "sha256-E2tUZXhcufuztXS+Z//uZk9omvaPrevNbGqVd41Lwhw="; + inherit (finalAttrs) + pname + version + src + sourceRoot + postPatch + ; + inherit pnpm; + fetcherVersion = 4; + hash = "sha256-wFrMoSeD87H1yfMD0jBcw60DKDeh4yjka5aWyHuQssA="; }; + postPatch = '' + substituteInPlace "package.json" "apps/remark42/package.json" \ + --replace-fail "pnpm@8.15.9" "pnpm@${pnpm.version}" + + substituteInPlace "apps/remark42/package.json" \ + --replace-fail '"pnpm": "8.*"' '"pnpm": "9.*"' + ''; + buildPhase = '' runHook preBuild - pushd "$pnpmRoot" + pnpm --filter ./apps/remark42 --fail-if-no-match run build - popd + runHook postBuild ''; installPhase = '' runHook preInstall + mkdir -p $out/web - cp -r "$pnpmRoot/apps/remark42/public/." $out/web/ + cp -r "apps/remark42/public/." $out/web/ + runHook postInstall ''; }); From 020298927184473939dbb61b2628ea3082e15d99 Mon Sep 17 00:00:00 2001 From: Sefa Eyeoglu Date: Tue, 7 Jul 2026 12:17:31 +0200 Subject: [PATCH 2/2] pnpm_8: drop Insecure and unmaintained. No consumers in nixpkgs anymore so it can go. Signed-off-by: Sefa Eyeoglu --- doc/languages-frameworks/javascript.section.md | 2 +- pkgs/development/tools/pnpm/default.nix | 16 ---------------- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 1 - 4 files changed, 2 insertions(+), 18 deletions(-) diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md index 19335a88da18..c506db3469c8 100644 --- a/doc/languages-frameworks/javascript.section.md +++ b/doc/languages-frameworks/javascript.section.md @@ -305,7 +305,7 @@ This package puts the corepack wrappers for pnpm and yarn in your PATH, and they ### pnpm {#javascript-pnpm} -pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions. +pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions. When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above: diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix index 6b7b4209bf59..4f5f52787ebb 100644 --- a/pkgs/development/tools/pnpm/default.nix +++ b/pkgs/development/tools/pnpm/default.nix @@ -6,22 +6,6 @@ let inherit (lib) mapAttrs' nameValuePair; variants = { - "8" = { - version = "8.15.9"; - hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY="; - knownVulnerabilities = [ - "CVE-2026-48995" - "CVE-2026-50014" - "CVE-2026-50015" - "CVE-2026-50016" - "CVE-2026-50017" - "CVE-2026-50573" - "CVE-2026-55699" - "CVE-2026-59194" - "CVE-2026-59195" - "CVE-2026-59196" - ]; - }; "9" = { version = "9.15.9"; hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc="; diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index c569d7201957..fcf6886f152c 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1843,6 +1843,7 @@ mapAliases { pltScheme = throw "'pltScheme' has been renamed to/replaced by 'racket'"; # Converted to throw 2025-10-27 plv8 = throw "'plv8' has been removed. Use 'postgresqlPackages.plv8' instead."; # Added 2025-07-19 pn = throw "'pn' has been removed as upstream was archived in 2020"; # Added 2025-10-17 + pnpm_8 = throw "'pnpm_8' has been removed as it hasn't been updated since 2024. Please use 'pnpm'"; # Added 2026-07-07 poac = throw "'poac' has been renamed to/replaced by 'cabinpkg'"; # Converted to throw 2025-10-27 pocket-updater-utility = throw "'pocket-updater-utility' has been renamed to/replaced by 'pupdate'"; # Converted to throw 2025-10-27 podofo010 = throw "'podofo010' has been renamed to 'podofo0'"; # Converted to throw 2025-10-27 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 8a89d44d2572..71844dc080a5 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -2801,7 +2801,6 @@ with pkgs; tdarr-node = tdarrPackages.node; inherit (callPackage ../development/tools/pnpm { }) - pnpm_8 pnpm_9 pnpm_10_29_2 pnpm_10_34_0