fix: remove chownr and mkdirp-infer-owner - #5710
Merged
Merged
Conversation
- @npmcli/config@6.0.1 - @npmcli/disparity-colors@3.0.0 - @npmcli/git@4.0.1 - @npmcli/installed-package-contents@2.0.0 - @npmcli/map-workspaces@3.0.0 - @npmcli/metavuln-calculator@5.0.0 - @npmcli/move-file@3.0.0 - @npmcli/node-gyp@3.0.0 - @npmcli/package-json@3.0.0 - @npmcli/promise-spawn@4.0.0 - @npmcli/query@3.0.0 - @npmcli/run-script@5.0.0 - bin-links@4.0.1 - cacache@17.0.1 - ignore-walk@6.0.0 - init-package-json@4.0.1 - json-parse-even-better-errors@3.0.0 - make-fetch-happen@11.0.1 - normalize-package-data@5.0.0 - npm-audit-report@4.0.0 - npm-install-checks@6.0.0 - npm-packlist@7.0.1 - npm-pick-manifest@8.0.1 - npm-profile@7.0.1 - npm-registry-fetch@14.0.2 - npmlog@7.0.0 - pacote@15.0.1 - parse-conflict-json@3.0.0 - proc-log@3.0.0 - read-package-json-fast@3.0.1 - read-package-json@6.0.0 - ssri@10.0.0 - treeverse@3.0.0 - validate-npm-package-name@5.0.0 - write-file-atomic@5.0.0 Removed dependencies: - `@npmcli/fs`
closes npm/statusboard#540 BREAKING CHANGE: npm will no longer attempt to modify ownership of files it creates
lukekarrys
approved these changes
Oct 18, 2022
This was referenced Nov 5, 2022
4 tasks
zkochan
added a commit
to pnpm/pnpm
that referenced
this pull request
Aug 5, 2026
…13495) pnpm keeps global packages and configuration in the invoking user's home directory, so 'sudo pnpm add -g', 'sudo pnpm setup', and 'sudo pnpm self-update' never do what the user wants: they target root's home and leave root-owned files behind. Other package managers settled on the same direction - npm 9 removed its SUDO_UID chown machinery (npm/cli#5710) and tells users not to use sudo, and Homebrew refuses root outright. Both stacks detect the same situation: effective uid 0, SUDO_USER naming a non-root user, and a command that mutates home-directory state - setup, self-update, or a global write (add, remove, update, runtime, approve-builds, bare link, config set/delete resolving to the global scope). They differ only in severity, because refusing these commands is a breaking change: pnpm v11 warns and names the v12 removal, so existing provisioning scripts keep working, while pacquet (v12) fails with ERR_PNPM_SUDO_NOT_SUPPORTED. Read-only global commands (bin, root, prefix, list, outdated, config get, ...) still work, and plain root sessions without SUDO_USER are unaffected. The TypeScript check lives in pnpm11/pnpm/src/checkSudo.ts and runs once the reporter is initialized, so the warning is not published to a bus nobody is subscribed to yet. The pacquet check lives in crates/cli/src/cli_args/sudo_guard.rs and runs before the pre-command package-manager switch, so pnpm never delegates to a downloaded CLI as root either. Related to #13096.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes npm/statusboard#540
BREAKING CHANGE: npm will no longer attempt to modify ownership of files it creates
this builds on #5707, land that first