pnpm v10 blocks lifecycle scripts, does msw require explicit opt-in?

[jgarplind]

Since pnpm v10, scripts are automatically blocked, as can be read about here: https://github.com/pnpm/pnpm/releases/tag/v10.0.0

It says right in the announcement that the best way to handle this is to explictly allow some packages via pnpm config, so it's not a big problem.

When looking into what msw uses , I think it is pretty easily tracked to https://github.com/mswjs/msw/blob/main/config/scripts/postinstall.js and it seems to keep the mockServiceWorker.js script up-to-date.

So I just wanted to confirm whether this still is part of msw's base functionality, and thus should be explicitly opted in for pnpm 10 users?

... On a slight tangent, I could go on to say that I'm running msw 2.6.9, but the version mentioned in my mockServiceWorker.js file is 1.1.0, so I'm a bit confused as to whether:

• msw doesn't update the mockServiceWorker.js that often, or
• Something about my repo is not compatible with msw's assumptions (and has not been since v1.1.0)

Grateful for any clarifications to let me and fellow msw-users continue to use it happily with pnpm 10 and beyond, thanks!

[kettanaito]

Hi, @jgarplind. Thanks for bringing this up!

MSW has a postinstall script to keep the worker script at msw.workerDirectory up-to-date when you change the package's version, just like you said.

I agree with PNPM here, and there's an issue open to make this auto-update an explicit choice (#1297). In that proposal, the postinstall script is removed in favor of a new command in MSW's CLI (or the repurposing of the existing command). Basically, it shifts the auto-update responsibility to the consumer to add their own postinstall script (that should still be allowed for projects):

// my-app/package.json
{
  "scripts": {
    "postinstall": "npx msw init"
  }
}

Would this suggestion work for you?

[jgarplind]

Sounds reasonable! The most important thing to me is to understand MSW's stance, so I don't end up doing a hacky workaround.

With your response you provided clarity which makes your suggested solution perfectly fine!

I'll implement it soon and let you know in case of any hiccups.

[jgarplind]

Seems to work fine both locally and in CI.

Since pnpm emits a warning every time a build script is ignored, do you think it is reasonable to add msw to https://pnpm.io/package_json#pnpmneverbuiltdependencies? I can see a risk where future scripts are ignored despite that not being the intention, but if the direction of MSW is to not add new lifecycle scripts, I suppose we can safely add it.

[kettanaito]

Sure, you can add msw to that list on your end. That sounds reasonable to me.