node: Add support for pnpm by nukeop · Pull Request #511 · flatpak/flatpak-builder-tools

nukeop · 2026-02-24T10:45:19Z

Proposed in #383

This PR adds pnpm as a third package manager option for node. The provider parses pnpm lock file, downloads tarballs as flatpak file sources, and at build time, a bundled Python script extracts tarballs and populates pnpm's content-addressable store.

I did some manual testing on this with a real pnpm project. Should work with monorepos with internal dependencies too.

Limitations:

only v10 store, will need to be updated if new store version comes out
no patching support
git dependnecies are cloned but no lockfile patching to redirect to local paths. pnpm install --offline will probably fail for projects with git deps. Same approach as npm's jq-based patching would be needed
requiresBuild hardcoded to false, should be extracted from lockfile metadata. Will cause pnpm to skip native addon rebuilds

andersk · 2026-02-25T03:56:10Z

node/flatpak_node_generator/populate_pnpm_store.py

+            if not os.path.exists(cas_path):
+                os.makedirs(cas_dir, exist_ok=True)
+                with open(cas_path, 'wb') as out:
+                    out.write(data)


Needs os.chmod(cas_path, member.mode) or something to preserve executable files.

I did this:

if is_exec: os.chmod(cas_path, 0o755)

bbhtt · 2026-02-25T04:02:13Z

Before reviewing the code it would be nice if people can try this out for packaging their own projects. That way we can get a better idea of what works and doesn't, it'd get tested as well and you'd have some feedback.

You can keep seperate commits for now but once it is ready it should be split into logical parts with proper commit messages or one single commit.

andersk · 2026-02-25T06:08:13Z

I’ve been trying this on Zulip Desktop. I ran into two issues:

os.chmod(cas_path, member.mode) is needed as I described above.
I had to upgrade app-builder-lib and @electron/rebuild to remove a Git dependency on https://github.com/electron/node-gyp#06b29aafb7708acef8b3669835c8a7857ebc92d2 which this doesn’t support.

Other than that, this seems to work for me.

Build from source again flathub/org.zulip.Zulip#88

node/flatpak_node_generator/providers/pnpm.py

nukeop · 2026-02-25T11:24:44Z

Thank you for testing! I've fixed both issues. I'm glad it works for you!

As for commit naming, we can squash when merging, or I can just rebase and squash then.

bbhtt · 2026-02-26T01:36:09Z

node/flatpak_node_generator/providers/pnpm.py

+                'Please upgrade to pnpm 8+ and regenerate your lockfile.'
+            )
+
+        if not lockfile_version.startswith(_SUPPORTED_VERSIONS):


you should check the major version startswith will make unrelated versions pass through.
major = lockfile_version.split('.', 1)[0].

same for the one below.

Agreed, done

bbhtt · 2026-02-26T01:40:07Z

node/flatpak_node_generator/providers/pnpm.py

+            raise ValueError(f'{lockfile_path}: missing lockfileVersion field')
+
+        lockfile_version = str(raw_version)
+        if lockfile_version.startswith('5'):


same here, check the major version

is there any reason this is separate form the rest? is it for the different message? i'd merge it.

Good point. I changed that as you suggested.

bbhtt · 2026-02-26T01:54:40Z

node/flatpak_node_generator/populate_pnpm_store.py

+            print(
+                f'ERROR: {tarball_path} not found',
+                file=sys.stderr,
+            )
+            sys.exit(1)


can you raise an exception here instead of sys.exit?

bbhtt · 2026-02-26T01:56:27Z

node/flatpak_node_generator/populate_pnpm_store.py

+            pkg_name=info['name'],
+            pkg_version=info['version'],
+            integrity_hex=info['integrity_hex'],
+            requires_build=info.get('requires_build', False),


where is requires_build actually used?

I removed it altogether, I was weighing whether to support it during my implementation and decided to keep it out of scope for now, and maybe add in another iteration later.

bbhtt · 2026-02-26T02:03:41Z

node/flatpak_node_generator/providers/pnpm.py

+# All currently supported lockfile versions (v6/v7/v9) use store v10.
+# Needs to be updated when a new pnpm major changes the store layout
+_STORE_VERSION = 'v10'


this should probably be derived from the lockfile version instead of being hardcoded here. we might need to support multiple store versions instead of the latest one and i'm guessing they will be incompatible.

bbhtt · 2026-02-26T02:07:17Z

node/tests/test_pnpm.py

can you add tests for git resolution?

andersk · 2026-02-27T01:53:02Z

I had to upgrade app-builder-lib and @electron/rebuild to remove a Git dependency on https://github.com/electron/node-gyp#06b29aafb7708acef8b3669835c8a7857ebc92d2 which this doesn’t support.

I was able to hack around this without removing the dependency, as follows.

Add to generated-sources.json:

{
    "type": "file",
    "url": "https://codeload.github.com/electron/node-gyp/tar.gz/06b29aafb7708acef8b3669835c8a7857ebc92d2",
    "sha512": "3178339530c41277490774c16ef779b8540effc81a20da351df7a7f2f79fe6babf54754f781eb7baebffb8ee7ef0616c009feb6aebba5c1efd4ba2b8f9a5dcfb",
    "dest-filename": "@electron__node-gyp-10.2.0-electron.1.tgz",
    "dest": "flatpak-node/pnpm-tarballs"
},

Add to pnpm-manifest.json:
"@electron__node-gyp-10.2.0-electron.1.tgz":{"integrity_hex":"3178339530c41277490774c16ef779b8540effc81a20da351df7a7f2f79fe6babf54754f781eb7baebffb8ee7ef0616c009feb6aebba5c1efd4ba2b8f9a5dcfb","name":"@electron/node-gyp","requires_build":false,"version":"10.2.0-electron.1"},
Add to build-commands:
install -Dm644 ../flatpak-node/pnpm-store/v10/index/31/78339530c41277490774c16ef779b8540effc81a20da351df7a7f2f79fe6ba-@electron+node-gyp@10.2.0-electron.1.json ../flatpak-node/pnpm-store/v10/https+++codeload.github.com+electron+node-gyp+tar.gz+06b29aafb7708acef8b3669835c8a7857ebc92d2/integrity.json

Would this be easy to support automatically?

bbhtt · 2026-03-02T19:04:19Z

readme should be updated.

bbhtt · 2026-03-03T05:16:20Z

node/flatpak_node_generator/providers/pnpm.py

+import sys
+import types
+from pathlib import Path
+from typing import (


i just did a large refactor of moving to python 3.10+ and migrating to standard type hints so these should be updated.

bbhtt · 2026-03-03T05:18:49Z

node/pyproject.toml

 pytest-datadir = "^1.6.1"
 pytest-httpserver = "^1.1.3"
 pytest-xdist = "^3.6.1"
+types-pyyaml = "^6.0.12.20250915"


Suggested change

types-pyyaml = "^6.0.12.20250915"

types-pyyaml = ">=6.0.12.2,<7"

nukeop · 2026-03-05T11:25:00Z

I just rebased onto current master and fixed all the type issues. I also updated the node readme, and squashed all commits as suggested.

WhyKickAmooCow · 2026-03-12T11:55:54Z

I had to upgrade app-builder-lib and @electron/rebuild to remove a Git dependency on https://github.com/electron/node-gyp#06b29aafb7708acef8b3669835c8a7857ebc92d2 which this doesn’t support.

I was able to hack around this without removing the dependency, as follows.

* Add to `generated-sources.json`:
  ```
  {
      "type": "file",
      "url": "https://codeload.github.com/electron/node-gyp/tar.gz/06b29aafb7708acef8b3669835c8a7857ebc92d2",
      "sha512": "3178339530c41277490774c16ef779b8540effc81a20da351df7a7f2f79fe6babf54754f781eb7baebffb8ee7ef0616c009feb6aebba5c1efd4ba2b8f9a5dcfb",
      "dest-filename": "@electron__node-gyp-10.2.0-electron.1.tgz",
      "dest": "flatpak-node/pnpm-tarballs"
  },
  ```

* Add to `pnpm-manifest.json`:
  `"@electron__node-gyp-10.2.0-electron.1.tgz":{"integrity_hex":"3178339530c41277490774c16ef779b8540effc81a20da351df7a7f2f79fe6babf54754f781eb7baebffb8ee7ef0616c009feb6aebba5c1efd4ba2b8f9a5dcfb","name":"@electron/node-gyp","requires_build":false,"version":"10.2.0-electron.1"},`

* Add to `build-commands`:
  `install -Dm644 ../flatpak-node/pnpm-store/v10/index/31/78339530c41277490774c16ef779b8540effc81a20da351df7a7f2f79fe6ba-@electron+node-gyp@10.2.0-electron.1.json ../flatpak-node/pnpm-store/v10/https+++codeload.github.com+electron+node-gyp+tar.gz+06b29aafb7708acef8b3669835c8a7857ebc92d2/integrity.json`

Would this be easy to support automatically?

This looks like an issue with tarball/git sources in general. I am getting the same issue with the github:jeffvli/Node-MPV#32b4d64395289ad710c41d481d2707a7acfc228f package. Adding an integrity property to the dependency in the pnpm lock file gets me as far as:

Downloading https://codeload.github.com/jeffvli/Node-MPV/tar.gz/32b4d64395289ad710c41d481d2707a7acfc228f
Failed to download sources: module feishin: File name too long

when running a build with the generated sources.

nukeop · 2026-03-12T12:00:51Z

I'm gonna dedicate some time after this PR to make sure it supports anything pnpm can do. And if it can't, at least make sure there's a good reason for that. But in the interest of keeping scope manageable, I'd rather not add anything else to this one.

bbhtt · 2026-03-12T12:03:41Z

I can merge this once the lint issues are fixed (CI is failing). Seems it has worked for some projects and the rest can be iterated later.

nukeop · 2026-03-12T12:40:04Z

Ok, I had an old lock and didn't notice. Should be ok now

github-actions bot added the node label Feb 24, 2026

nukeop marked this pull request as ready for review February 24, 2026 14:41

nukeop requested a review from a team as a code owner February 24, 2026 14:41

nukeop mentioned this pull request Feb 24, 2026

Add support for pnpm in flatpak-node-generator #383

Closed

andersk reviewed Feb 25, 2026

View reviewed changes

andersk mentioned this pull request Feb 25, 2026

Build from source again flathub/org.zulip.Zulip#88

Merged

andersk reviewed Feb 25, 2026

View reviewed changes

node/flatpak_node_generator/providers/pnpm.py Outdated Show resolved Hide resolved

bbhtt reviewed Feb 26, 2026

View reviewed changes

Steve-Tech mentioned this pull request Mar 1, 2026

update Flatpak build TriliumNext/trilium-flathub#2

Draft

bbhtt reviewed Mar 3, 2026

View reviewed changes

Sewer56 mentioned this pull request Mar 3, 2026

NixOS package in the flake Nexus-Mods/Vortex#21315

Closed

nukeop force-pushed the master branch from 7e7b5e3 to 24c5e9c Compare March 5, 2026 10:56

nukeop mentioned this pull request Mar 5, 2026

Add chat.stoat.StoatDesktop flathub/flathub#7783

Draft

5 tasks

nukeop force-pushed the master branch from f99bb9b to 0ed58cf Compare March 5, 2026 11:22

yofukashino mentioned this pull request Mar 5, 2026

feat: use pnpm fenbyte/flathub#3

Merged

This was referenced Mar 5, 2026

Add app.fluxer.Fluxer flathub/flathub#7843

Open

Add org.jeffvli.feishin flathub/flathub#7033

Open

bbhtt self-assigned this Mar 9, 2026

Add pnpm support

69dabf0

nukeop force-pushed the master branch from 0ed58cf to 69dabf0 Compare March 12, 2026 12:39

bbhtt merged commit 37eb3e5 into flatpak:master Mar 12, 2026
4 checks passed

	types-pyyaml = "^6.0.12.20250915"
	types-pyyaml = ">=6.0.12.2,<7"

Conversation

nukeop commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bbhtt commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

andersk commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

nukeop commented Feb 25, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andersk commented Feb 27, 2026

Uh oh!

bbhtt commented Mar 2, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nukeop commented Mar 5, 2026

Uh oh!

WhyKickAmooCow commented Mar 12, 2026

Uh oh!

nukeop commented Mar 12, 2026

Uh oh!

bbhtt commented Mar 12, 2026

Uh oh!

nukeop commented Mar 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

nukeop commented Feb 24, 2026 •

edited

Loading

bbhtt commented Feb 25, 2026 •

edited

Loading

andersk commented Feb 25, 2026 •

edited

Loading