build: stop distributing Corepack by aduh95 · Pull Request #57617 · nodejs/node

aduh95 · 2025-03-25T14:28:26Z

ljharb

Is there a reason to keep the ability to build node with corepack? that doesn't seem in line with the TSC decision.

ljharb · 2025-03-25T16:08:54Z

+    dest='with_corepack',
    default=None,
-    help='do not install the bundled Corepack')
+    help='do install the bundled Corepack')


Suggested change

help='do install the bundled Corepack')

help='bundle Corepack')

Suggested change

help='do install the bundled Corepack')

help='do install the bundled Corepack (experimental, will be removed without notice)')

"do install" at the front of the sentence doesn't read like proper english to me, and there is no "bundled corepack" anymore to install - this flag causes it to be bundled.

I agree that "bundled Corepack" is weird, maybe "vendored" would be more appropriate?

the problem is the "the" - there is no "bundled corepack" anymore. the flag causes corepack to BE bundled, and "bundle" is a verb, which is why "bundle corepack" seems like the best/proper phrasing to me (with or without the experimental note)

aduh95 · 2025-03-25T16:24:13Z

that doesn't seem in line with the TSC decision.

What makes you think that?

Is there a reason to keep the ability to build node with corepack?

Yes, so we can keep it up-to-date across the release lines

ljharb · 2025-03-25T16:32:32Z

My read of the TSC decision is to not include corepack in any way whatsoever in 25+, not to make it optionally bundled and just change the default. iow, it's meant to be removed entirely.

Yes, so we can keep it up-to-date across the release lines

This commit will only be landing in v25+, though. Won't existing release lines lack this commit, and continue to build it with corepack by default?

aduh95 · 2025-03-25T16:40:12Z

iow, it's meant to be removed entirely.

No, it was very explicit that the decision was about including (or not) a corepack executable in the distribution. Removing the vendored version from the repo would not be reasonable until 24.x is EOL. Anyway, does it matter?

Won't existing release lines lack this commit, and continue to build it with corepack by default?

That's correct, and in line with the TSC decision linked in the OP.

ljharb · 2025-03-25T16:44:13Z

Right - node < 25 should continue to bundle corepack unchanged. node 25+ shouldn't even offer the option to build it with corepack, because the TSC decision was to "not include the corepack executable" - not to "not include the corepack executable by default".

If the option to build node with corepack remains in 25+, more people may be encouraged to compile node themselves rather than using the official binaries, which would magnify support burden for the project, and proliferate variants of node which could cause compatibility concerns down the line.

targos · 2025-03-25T16:53:16Z

It's true that there's a risk to see unofficial distributions like the one from homebrew to keep including corepack. But this PR can be followed up by another one that removes it completely.

ljharb · 2025-03-25T16:54:59Z

That's true, it just seems like a silly unnecessary step :-)

aduh95 · 2025-03-25T16:57:09Z

Commits need to land on main first, so there's no way we remove the vendor version for the time being, not without giving us a lot more work. If folks go as far as to compile node themself rather than downloading Corepack in any other possible way, I don't think we can do anything for them, they might also patch this repo to re-add Corepack you know.

ljharb · 2025-03-25T16:59:33Z

main won't ever touch < 25 though in its entirety - the vendored version can be removed from main and it shouldn't affect any of the other release lines - or is there some complex interaction that i'm missing?

marco-ippolito · 2025-03-25T20:29:20Z

I mean we could keep corepack in the deps folder but remove the ability to build it. This allows the automation to keep updating it and just cherry-pick commits into old release lines and at some point we remove it completely.
But it should not be possible to build node with corepack otherwise redistributors will enable it, so I think we should remove completely the ability to build.
Also isn't this semver major?

aduh95 · 2025-03-25T22:04:20Z

otherwise redistributors will enable it

Should we care?

marco-ippolito · 2025-03-25T22:16:23Z

otherwise redistributors will enable it

Should we care?

I think we should

ljharb · 2025-03-25T22:55:43Z

I also already explained above why we should care.

aduh95 · 2025-03-26T11:07:07Z

I'm not convinced. If we want folks to stop using Corepack, we should spend time on building an alternative, not spend time on making their life harder. Also I'm not even convinced it would be more effective: I'm a maintainer of Nixpkgs Node.js packages, and I can tell you it is as easy to pass a configure flag than it is to revert a specific commit for redistributors, so I'm afraid your concern is not addressable.
TL;DR, I'm not going to do it, it's not worth my time, let's please move on.

marco-ippolito · 2025-03-26T11:25:41Z

I'll ping @nodejs/tsc for visibility as I think it's worth being aligned on this decision

RaisinTen

Whether to remove the ability to build corepack is a separate decision. This change is already a step in the right direction and is aligned with the vote results, so LGTM.

Refs: - nodejs/TSC#1697 (comment) - nodejs#57617

Closes nodejs#57763. Refs: - nodejs/TSC#1697 (comment) - nodejs#57617 - nodejs#57763

Closes nodejs#57763. Refs: - nodejs/TSC#1697 (comment) - nodejs#57617 - nodejs#57763 PR-URL: nodejs#59835 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

assert: * (SEMVER-MAJOR) move assert.fail with multiple arguments to eol (James M Snell) #58532 * (SEMVER-MAJOR) move CallTracker to EOL (James M Snell) #58006 assert,util: * (SEMVER-MAJOR) fail promise comparison in deep equal checks (Ruben Bridgewater) #59448 * (SEMVER-MAJOR) handle invalid dates as equal in deep comparison (Ruben Bridgewater) #57627 async_hooks: * (SEMVER-MAJOR) move `asyncResource` property on bound function to EOL (James M Snell) #58618 buffer: * (SEMVER-MAJOR) move SlowBuffer to EOL (Filip Skokan) #58220 build: * (SEMVER-MAJOR) bump minimum Clang version to 19 (Michaël Zasso) #59048 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #58064 * (SEMVER-MAJOR) stop distributing Corepack (Antoine du Hamel) #57617 child_process: * (SEMVER-MAJOR) move _channel to end-of-life (James M Snell) #58527 crypto: * (SEMVER-MAJOR) runtime-deprecate default shake128/256 output lengths (Filip Skokan) #59008 * (SEMVER-MAJOR) move deprecated hash and mgf1Hash options to EOL (James M Snell) #58706 * (SEMVER-MAJOR) runtime deprecate ECDH.setPublicKey() (James M Snell) #58620 deps: * (SEMVER-MAJOR) V8: backport 1d3362c55396 (Shu-yu Guo) #58064 * (SEMVER-MAJOR) V8: cherry-pick 4f38995c8295 (Shu-yu Guo) #58064 * (SEMVER-MAJOR) V8: cherry-pick 044b9b6f589d (Rezvan Mahdavi Hezaveh) #58064 * (SEMVER-MAJOR) V8: cherry-pick d2ad518a0b57 (Joyee Cheung) #58064 * (SEMVER-MAJOR) V8: revert 6d6c1e680c7b (Michaël Zasso) #58064 * (SEMVER-MAJOR) V8: revert e3cddbedb205 (Michaël Zasso) #58064 * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58064 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #58064 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58064 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #58064 * (SEMVER-MAJOR) fix FP16 bitcasts.h (Stefan Stojanovic) #58064 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #58064 * (SEMVER-MAJOR) update V8 to 13.7.152.9 (Michaël Zasso) #58064 dgram: * (SEMVER-MAJOR) move deprecated APIs to EOL (James M Snell) #58474 dns: * (SEMVER-MAJOR) move falsy hostname in lookup to end-of-life (James M Snell) #58619 fs: * (SEMVER-MAJOR) move FileHandle close on GC to EOL (James M Snell) #58536 * (SEMVER-MAJOR) move rmdir recursive option to end-of-life (James M Snell) #58616 * (SEMVER-MAJOR) make `processReadResult()` and `readSyncRecursive()` private (Livia Medeiros) #58672 * (SEMVER-MAJOR) move fs stream open method to eol (James M Snell) #58529 * (SEMVER-MAJOR) remove `fs.F_OK`, `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) #55862 http: * (SEMVER-MAJOR) deprecate writeHeader (Sebastian Beltran) #59060 lib: * (SEMVER-MAJOR) expose global ErrorEvent (Richie Bendall) #58920 * (SEMVER-MAJOR) deprecate `_stream_*` modules (Dario Piotrowicz) #58337 * (SEMVER-MAJOR) deprecate _tls_common and _tls_wrap (Dario Piotrowicz) #57643 module: * (SEMVER-MAJOR) move Module._debug to end-of-life (James M Snell) #58473 node-api: * (SEMVER-MAJOR) add warning for NAPI_EXPERIMENTAL (Miguel Marcondes Filho) #58280 perf_hooks: * (SEMVER-MAJOR) move deprecated accessors to EOF (James M Snell) #58531 process: * (SEMVER-MAJOR) move multipleResolves event to EOL (James M Snell) #58707 repl: * (SEMVER-MAJOR) eol deprecate instantiating without new (Aviv Keller) #59495 src: * (SEMVER-MAJOR) store `Local` for `CallbackScope` on stack (Anna Henningsen) #59705 * (SEMVER-MAJOR) remove node.h APIs to make callback without an async context (Chengzhong Wu) #58471 * (SEMVER-MAJOR) remove deprecated node::EmitBeforeExit and node::EmitExit (Chengzhong Wu) #58469 * (SEMVER-MAJOR) remove deprecated node::CreatePlatform and node::FreePlatform (Chengzhong Wu) #58470 * (SEMVER-MAJOR) remove deprecated node::InitializeNodeWithArgs (Chengzhong Wu) #58470 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 138 (Michaël Zasso) #58064 src,permission: * (SEMVER-MAJOR) add --allow-net permission (Rafael Gonzaga) #58517 tls: * (SEMVER-MAJOR) move IP-address servername deprecation to eol (James M Snell) #58533 tools: * (SEMVER-MAJOR) update V8 gypfiles for 13.7 (Michaël Zasso) #58064 url: * (SEMVER-MAJOR) move bad port deprecation in legacy url to end-of-life (James M Snell) #58617 util,console: * (SEMVER-MAJOR) colorize regexp groups, character classes, etc (Ruben Bridgewater) #59710 worker: * (SEMVER-MAJOR) move terminate callback to end-of-life (James M Snell) #58528 PR-URL: #59896

assert: * (SEMVER-MAJOR) move assert.fail with multiple arguments to eol (James M Snell) #58532 * (SEMVER-MAJOR) move CallTracker to EOL (James M Snell) #58006 assert,util: * (SEMVER-MAJOR) fail promise comparison in deep equal checks (Ruben Bridgewater) #59448 * (SEMVER-MAJOR) handle invalid dates as equal in deep comparison (Ruben Bridgewater) #57627 async_hooks: * (SEMVER-MAJOR) move `asyncResource` property on bound function to EOL (James M Snell) #58618 buffer: * (SEMVER-MAJOR) move SlowBuffer to EOL (Filip Skokan) #58220 build: * (SEMVER-MAJOR) bump minimum Clang version to 19 (Michaël Zasso) #59048 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #58064 * (SEMVER-MAJOR) stop distributing Corepack (Antoine du Hamel) #57617 child_process: * (SEMVER-MAJOR) move _channel to end-of-life (James M Snell) #58527 crypto: * (SEMVER-MAJOR) runtime-deprecate default shake128/256 output lengths (Filip Skokan) #59008 * (SEMVER-MAJOR) move deprecated hash and mgf1Hash options to EOL (James M Snell) #58706 * (SEMVER-MAJOR) runtime deprecate ECDH.setPublicKey() (James M Snell) #58620 deps: * (SEMVER-MAJOR) V8: backport 1d3362c55396 (Shu-yu Guo) #58064 * (SEMVER-MAJOR) V8: cherry-pick 4f38995c8295 (Shu-yu Guo) #58064 * (SEMVER-MAJOR) V8: cherry-pick 044b9b6f589d (Rezvan Mahdavi Hezaveh) #58064 * (SEMVER-MAJOR) V8: cherry-pick d2ad518a0b57 (Joyee Cheung) #58064 * (SEMVER-MAJOR) V8: revert 6d6c1e680c7b (Michaël Zasso) #58064 * (SEMVER-MAJOR) V8: revert e3cddbedb205 (Michaël Zasso) #58064 * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58064 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #58064 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58064 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #58064 * (SEMVER-MAJOR) fix FP16 bitcasts.h (Stefan Stojanovic) #58064 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #58064 * (SEMVER-MAJOR) update V8 to 13.7.152.9 (Michaël Zasso) #58064 dgram: * (SEMVER-MAJOR) move deprecated APIs to EOL (James M Snell) #58474 dns: * (SEMVER-MAJOR) move falsy hostname in lookup to end-of-life (James M Snell) #58619 fs: * (SEMVER-MAJOR) move FileHandle close on GC to EOL (James M Snell) #58536 * (SEMVER-MAJOR) move rmdir recursive option to end-of-life (James M Snell) #58616 * (SEMVER-MAJOR) make `processReadResult()` and `readSyncRecursive()` private (Livia Medeiros) #58672 * (SEMVER-MAJOR) move fs stream open method to eol (James M Snell) #58529 * (SEMVER-MAJOR) remove `fs.F_OK`, `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) #55862 http: * (SEMVER-MAJOR) deprecate writeHeader (Sebastian Beltran) #59060 lib: * (SEMVER-MAJOR) expose global ErrorEvent (Richie Bendall) #58920 * (SEMVER-MAJOR) deprecate `_stream_*` modules (Dario Piotrowicz) #58337 * (SEMVER-MAJOR) deprecate _tls_common and _tls_wrap (Dario Piotrowicz) #57643 module: * (SEMVER-MAJOR) move Module._debug to end-of-life (James M Snell) #58473 node-api: * (SEMVER-MAJOR) add warning for NAPI_EXPERIMENTAL (Miguel Marcondes Filho) #58280 perf_hooks: * (SEMVER-MAJOR) move deprecated accessors to EOF (James M Snell) #58531 process: * (SEMVER-MAJOR) move multipleResolves event to EOL (James M Snell) #58707 repl: * (SEMVER-MAJOR) eol deprecate instantiating without new (Aviv Keller) #59495 src: * (SEMVER-MAJOR) store `Local` for `CallbackScope` on stack (Anna Henningsen) #59705 * (SEMVER-MAJOR) remove node.h APIs to make callback without an async context (Chengzhong Wu) #58471 * (SEMVER-MAJOR) remove deprecated node::EmitBeforeExit and node::EmitExit (Chengzhong Wu) #58469 * (SEMVER-MAJOR) remove deprecated node::CreatePlatform and node::FreePlatform (Chengzhong Wu) #58470 * (SEMVER-MAJOR) remove deprecated node::InitializeNodeWithArgs (Chengzhong Wu) #58470 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 138 (Michaël Zasso) #58064 src,permission: * (SEMVER-MAJOR) add --allow-net permission (Rafael Gonzaga) #58517 tls: * (SEMVER-MAJOR) move IP-address servername deprecation to eol (James M Snell) #58533 tools: * (SEMVER-MAJOR) update V8 gypfiles for 13.7 (Michaël Zasso) #58064 url: * (SEMVER-MAJOR) move bad port deprecation in legacy url to end-of-life (James M Snell) #58617 util,console: * (SEMVER-MAJOR) colorize regexp groups, character classes, etc (Ruben Bridgewater) #59710 worker: * (SEMVER-MAJOR) move terminate callback to end-of-life (James M Snell) #58528 PR-URL: #59896 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

assert: * (SEMVER-MAJOR) move assert.fail with multiple arguments to eol (James M Snell) #58532 * (SEMVER-MAJOR) move CallTracker to EOL (James M Snell) #58006 assert,util: * (SEMVER-MAJOR) fail promise comparison in deep equal checks (Ruben Bridgewater) #59448 * (SEMVER-MAJOR) handle invalid dates as equal in deep comparison (Ruben Bridgewater) #57627 async_hooks: * (SEMVER-MAJOR) move `asyncResource` property on bound function to EOL (James M Snell) #58618 buffer: * (SEMVER-MAJOR) move SlowBuffer to EOL (Filip Skokan) #58220 build: * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #59805 * (SEMVER-MAJOR) bump minimum Clang version to 19 (Michaël Zasso) #59048 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #58064 * (SEMVER-MAJOR) stop distributing Corepack (Antoine du Hamel) #57617 child_process: * (SEMVER-MAJOR) move _channel to end-of-life (James M Snell) #58527 crypto: * (SEMVER-MAJOR) runtime-deprecate default shake128/256 output lengths (Filip Skokan) #59008 * (SEMVER-MAJOR) move deprecated hash and mgf1Hash options to EOL (James M Snell) #58706 * (SEMVER-MAJOR) runtime deprecate ECDH.setPublicKey() (James M Snell) #58620 deps: * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #59805 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077 * (SEMVER-MAJOR) update V8 to 14.1.146.11 (Michaël Zasso) #59805 * (SEMVER-MAJOR) V8: backport 1d3362c55396 (Shu-yu Guo) #58064 * (SEMVER-MAJOR) V8: cherry-pick 4f38995c8295 (Shu-yu Guo) #58064 * (SEMVER-MAJOR) V8: cherry-pick 044b9b6f589d (Rezvan Mahdavi Hezaveh) #58064 * (SEMVER-MAJOR) V8: cherry-pick d2ad518a0b57 (Joyee Cheung) #58064 * (SEMVER-MAJOR) V8: revert 6d6c1e680c7b (Michaël Zasso) #58064 * (SEMVER-MAJOR) V8: revert e3cddbedb205 (Michaël Zasso) #58064 * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58064 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #58064 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58064 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #58064 * (SEMVER-MAJOR) fix FP16 bitcasts.h (Stefan Stojanovic) #58064 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #58064 * (SEMVER-MAJOR) update V8 to 13.7.152.9 (Michaël Zasso) #58064 dgram: * (SEMVER-MAJOR) move deprecated APIs to EOL (James M Snell) #58474 dns: * (SEMVER-MAJOR) move falsy hostname in lookup to end-of-life (James M Snell) #58619 doc,src,test: * (SEMVER-MAJOR) replace use of deprecated `GetIsolate` (Michaël Zasso) #59805 fs: * (SEMVER-MAJOR) move FileHandle close on GC to EOL (James M Snell) #58536 * (SEMVER-MAJOR) move rmdir recursive option to end-of-life (James M Snell) #58616 * (SEMVER-MAJOR) make `processReadResult()` and `readSyncRecursive()` private (Livia Medeiros) #58672 * (SEMVER-MAJOR) move fs stream open method to eol (James M Snell) #58529 * (SEMVER-MAJOR) remove `fs.F_OK`, `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) #55862 http: * (SEMVER-MAJOR) deprecate writeHeader (Sebastian Beltran) #59060 lib: * (SEMVER-MAJOR) use validators for argument validation (Nam Yooseong) #59416 * (SEMVER-MAJOR) expose global ErrorEvent (Richie Bendall) #58920 * (SEMVER-MAJOR) deprecate `_stream_*` modules (Dario Piotrowicz) #58337 * (SEMVER-MAJOR) deprecate _tls_common and _tls_wrap (Dario Piotrowicz) #57643 module: * (SEMVER-MAJOR) move Module._debug to end-of-life (James M Snell) #58473 node-api: * (SEMVER-MAJOR) add warning for NAPI_EXPERIMENTAL (Miguel Marcondes Filho) #58280 perf_hooks: * (SEMVER-MAJOR) move deprecated accessors to EOF (James M Snell) #58531 process: * (SEMVER-MAJOR) move multipleResolves event to EOL (James M Snell) #58707 repl: * (SEMVER-MAJOR) eol deprecate instantiating without new (Aviv Keller) #59495 src: * (SEMVER-MAJOR) update crypto.getCipherInfo() to use DictionaryTemplate (James M Snell) #60036 * (SEMVER-MAJOR) fix calls to v8::Object::wrap (Andreas Haas) #59805 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 141 (Michaël Zasso) #59805 * (SEMVER-MAJOR) improve performance of dotenv ToObject (James M Snell) #60038 * (SEMVER-MAJOR) use std::string_view from node_report (iknoom) #60006 * (SEMVER-MAJOR) unflag --experimental-webstorage by default (Daniel M Brasil) #57666 * (SEMVER-MAJOR) store `Local` for `CallbackScope` on stack (Anna Henningsen) #59705 * (SEMVER-MAJOR) remove node.h APIs to make callback without an async context (Chengzhong Wu) #58471 * (SEMVER-MAJOR) remove deprecated node::EmitBeforeExit and node::EmitExit (Chengzhong Wu) #58469 * (SEMVER-MAJOR) remove deprecated node::CreatePlatform and node::FreePlatform (Chengzhong Wu) #58470 * (SEMVER-MAJOR) remove deprecated node::InitializeNodeWithArgs (Chengzhong Wu) #58470 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 138 (Michaël Zasso) #58064 src,permission: * (SEMVER-MAJOR) add --allow-net permission (Rafael Gonzaga) #58517 test: * (SEMVER-MAJOR) update cppgc-object addon config (StefanStojanovic) #59805 * (SEMVER-MAJOR) spin longer for sequential/test-worker-prof (Michaël Zasso) #59805 * (SEMVER-MAJOR) remove `--always-turbofan` flag (Michaël Zasso) #59805 * (SEMVER-MAJOR) update snapshot for V8 14.1 (Michaël Zasso) #59805 test,win: * (SEMVER-MAJOR) split addon tests (StefanStojanovic) #59805 tls: * (SEMVER-MAJOR) move IP-address servername deprecation to eol (James M Snell) #58533 tools: * (SEMVER-MAJOR) update V8 gypfiles for 14.0 (Michaël Zasso) #59805 * (SEMVER-MAJOR) update V8 gypfiles for 13.9 (Michaël Zasso) #59805 * (SEMVER-MAJOR) update V8 gypfiles for 13.8 (Michaël Zasso) #59805 * (SEMVER-MAJOR) enable leaptiering for aix/ibmi (Abdirahim Musse) #59805 * (SEMVER-MAJOR) update V8 gypfiles for 13.7 (Michaël Zasso) #58064 url: * (SEMVER-MAJOR) move bad port deprecation in legacy url to end-of-life (James M Snell) #58617 util,console: * (SEMVER-MAJOR) colorize regexp groups, character classes, etc (Ruben Bridgewater) #59710 worker: * (SEMVER-MAJOR) move terminate callback to end-of-life (James M Snell) #58528 PR-URL: #59896 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

Node 25 stopped distributing Corepack (nodejs/node#57617), so the package manager pin and runtime tooling need to resolve pnpm dynamically. - Workflows move to Node 25 on PR runs (full matrix on push), and the installer-test job provisions pnpm via `corepack prepare --activate` so the smoke test runs the pinned version. The upgrade-from-latest- release workflow now checks out the newest release tag instead of `ref: develop #FIXME`, finally exercising what its name implies. - bin/functions.sh adds ensure_pnpm / run_pnpm / exec_pnpm. When neither pnpm nor Corepack is present, it auto-bootstraps Corepack via npm so fresh Node 25 installs from nodejs.org keep the prior `./bin/run.sh` ergonomics. - The updater (preflight + executor + rollback) and the plugin migration code share a single resolver, src/node/updater/pnpm.ts, that prefers `pnpm` and falls back to `corepack pnpm`. The resolver passes `shell: true` on Windows so the corepack.cmd shim resolves correctly. - package.json scripts use `corepack pnpm --filter` so the pinned 11.1.2 is used even when a different global pnpm is on PATH, and engines.pnpm enforces >=11.1.2. CI/runner images still bundle Corepack independent of the Node version, so the green CI on the original PR was masking the underlying gap; this change makes the operational paths work in environments where Corepack isn't pre-installed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

@DmytroConvert

Addresses all three findings from @DmytroConvert's review on #60. 1. The Corepack cliff (blocking). Confirmed and the date is exact: Node stopped distributing Corepack as of 25.0.0 — nodejs/node doc/contributing/distribution.md, "History": "corepack ... is no longer distributed as of Node.js 25.0.0" — and nodejs/Release schedule.json puts v26 at lts: 2026-10-28. So `node-version: 'lts/*'` plus `corepack enable` was a release job with ~2.5 months of life left. (One correction to the review: nodejs/node#57617 is closed, not merged; the doc is the citation that holds.) Fixed by removing the Corepack dependency rather than reinstalling it. `yarn set version 4.18.0 --yarn-path` commits the 4.18.0 binary under .yarn/releases and points yarnPath at it in .yarnrc.yml. Every yarn honours yarnPath, including the Yarn 1.22.x GitHub runners preinstall, so `yarn` resolves to 4.18.0 with no reference to Corepack and no coupling to which Node `lts/*` picks. The `corepack enable` step is deleted. Measured against the runner's actual classic Yarn 1.22.22, in this repo: yarn --version -> 4.18.0 (1.22.22 without yarnPath) install --immutable, cold -> exit 0 install --immutable, drifted -> exit 1, YN0028 lockfile would have been modified So --immutable is now genuinely enforced through the same entry point that used to silently rewrite the lockfile. Preferred over `npm install -g corepack@latest` because that fetches an unpinned global on every release run — new floating surface in a PR whose point is removing exactly that. Preferred over pinning node-version: '24' because that reschedules the failure to 2028-04-30 rather than removing it. The vendored binary is byte-identical to upstream 4.18.0 from three independent sources — this file, Corepack's npm-sourced cache, and a fresh fetch of repo.yarnpkg.com/4.18.0/packages/yarnpkg-cli/bin/yarn.js: sha256 fb8b1d20be72a0b544a35bcec4c7ed0ff55a9b173c01f191b02ba164b2051db5 .gitignore needed `.yarn/*` rather than `.yarn/` — git cannot re-include a path whose parent directory is excluded, so `!.yarn/releases` was inert under the old pattern and the binary would have been silently left out of the commit. .yarn/cache and friends stay ignored. A new .gitattributes marks `.yarn/ export-ignore` so the 3.6 MB does not reach consumers through Composer's dist archive; it is scoped to .yarn/ only, since excluding anything else would change what consumers receive. 2. The .yarnrc.yml comment overstated the gate. Correct — npmMinimalAgeGate is enforced at resolution, not install, which the review verified in both directions. Reworded to say "refuse to RESOLVE", and to spell out what it does not cover: a frozen `yarn install --immutable` never consults it, and a Dependabot PR arrives with the lockfile already resolved. It guards the act of choosing a version, not CI. 3. @semantic-release/release-notes-generator was locked twice. Correct — package.json asked for ^14.0.0 (14.1.0) while semantic-release 25 wants ^14.1.0 (14.1.1). Bumped the devDependency to ^14.1.0; the lock now carries one copy at 14.1.1. Also restores two things `yarn set version` silently changed: it rewrote packageManager without the +sha512 integrity hash, and stripped the comment from .yarnrc.yml. Both are back. Still zero vulnerabilities: all 88 alerts (79 open + 9 auto-dismissed) re-checked against the new lockfile, none remain. Verified: composer validate, monorepo-builder validate, php-cs-fixer, phpstan, 648 unit tests, 474 cross-SDK parity tests, composer audit on both locks, yarn npm audit, semantic-release --dry-run loading every plugin, and `install --immutable` driven by classic Yarn as CI will drive it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

build: stop distributing Corepack

2369ae9

aduh95 added dont-land-on-v18.x dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. labels Mar 25, 2025

nodejs-github-bot added build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. labels Mar 25, 2025

jasnell approved these changes Mar 25, 2025

View reviewed changes

aduh95 added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels Mar 25, 2025

ljharb reviewed Mar 25, 2025

View reviewed changes

ljharb added the semver-major PRs that contain breaking changes and should be released in the next major version. label Mar 25, 2025

Update configure.py

d2daeb7

RaisinTen approved these changes Mar 26, 2025

View reviewed changes

anonrig approved these changes Mar 26, 2025

View reviewed changes

aduh95 mentioned this pull request Apr 6, 2025

build: remove nocorepack vcbuild flag #57772

Merged

ljharb added a commit to ljharb/node that referenced this pull request Sep 5, 2025

build: remove the rest of corepack

1a8b814

Refs: - nodejs/TSC#1697 (comment) - nodejs#57617

ljharb mentioned this pull request Sep 10, 2025

build: remove corepack from release tarballs #59835

Merged

ljharb added a commit to ljharb/node that referenced this pull request Sep 10, 2025

build: remove corepack from release tarballs

2aca11d

Closes nodejs#57763. Refs: - nodejs/TSC#1697 (comment) - nodejs#57617 - nodejs#57763

RafaelGSS mentioned this pull request Sep 15, 2025

2025-10-15, Version 25.0.0 (Current) #59896

Merged

9 tasks

NatoBoram mentioned this pull request Nov 3, 2025

Update Docker examples pnpm/pnpm.io#719

Open

JohnMcLear mentioned this pull request May 15, 2026

Support Node 25 ether/etherpad#7747

Merged

njzjz mentioned this pull request Jun 27, 2026

[bot-automerge] basedpyright v1.39.9 conda-forge/basedpyright-feedstock#65

Open

3 tasks

nynexman4464 mentioned this pull request Jun 30, 2026

[Bug] CONTRIBUTING corepack guidance is confusing with Node 25 facebook/astryx#3288

Closed

crippledgeek mentioned this pull request Jul 21, 2026

Upgrade rdlp-desktop to pnpm 11 and migrate the build-script allowlist to allowBuilds crippledgeek/rdlp#616

Closed

5 tasks

torumakabe mentioned this pull request Jul 28, 2026

fix: stop chezmoi ps1 scripts from loading the PowerShell profile torumakabe/dotfiles#126

Merged

tregismoreira mentioned this pull request Jul 31, 2026

Move the published image to node 24 LTS and drop corepack tregismoreira/warehousd#22

Merged

jss79 mentioned this pull request Aug 1, 2026

Add CLAUDE.md and document how to get pnpm getlibero/libero#3

Merged

DmytroConvert mentioned this pull request Aug 8, 2026

chore(deps): take Dependabot to zero — every alert resolved, none introduced convertcom/php-sdk#60

Merged

borlafu mentioned this pull request Aug 10, 2026

fix: patch sharp libvips CVEs and move overrides where pnpm reads them borlafu/whatsapp-count-me-in#72

Merged

8 tasks

	help='do install the bundled Corepack')
	help='bundle Corepack')

	help='do install the bundled Corepack')
	help='do install the bundled Corepack (experimental, will be removed without notice)')

Uh oh!

Uh oh!

Conversation

aduh95 commented Mar 25, 2025

Uh oh!

ljharb left a comment

Choose a reason for hiding this comment

Uh oh!

ljharb Mar 25, 2025

Choose a reason for hiding this comment

Uh oh!

aduh95 Mar 26, 2025

Choose a reason for hiding this comment

Uh oh!

ljharb Mar 26, 2025

Choose a reason for hiding this comment

Uh oh!

aduh95 Mar 26, 2025

Choose a reason for hiding this comment

Uh oh!

ljharb Mar 26, 2025

Choose a reason for hiding this comment

Uh oh!

aduh95 commented Mar 25, 2025

Uh oh!

ljharb commented Mar 25, 2025

Uh oh!

aduh95 commented Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ljharb commented Mar 25, 2025

Uh oh!

targos commented Mar 25, 2025

Uh oh!

ljharb commented Mar 25, 2025

Uh oh!

aduh95 commented Mar 25, 2025

Uh oh!

ljharb commented Mar 25, 2025

Uh oh!

marco-ippolito commented Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aduh95 commented Mar 25, 2025

Uh oh!

marco-ippolito commented Mar 25, 2025

Uh oh!

ljharb commented Mar 25, 2025

Uh oh!

aduh95 commented Mar 26, 2025

Uh oh!

marco-ippolito commented Mar 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

RaisinTen left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

15 participants

aduh95 commented Mar 25, 2025 •

edited

Loading

marco-ippolito commented Mar 25, 2025 •

edited

Loading

marco-ippolito commented Mar 26, 2025 •

edited

Loading