Skip to content

Replace npx with pnpm exec#1300

Merged
N2D4 merged 4 commits into
devfrom
no-npx
Apr 9, 2026
Merged

Replace npx with pnpm exec#1300
N2D4 merged 4 commits into
devfrom
no-npx

Conversation

@N2D4
Copy link
Copy Markdown
Contributor

@N2D4 N2D4 commented Mar 31, 2026

Note

Low Risk
Low risk: changes are limited to CI/dev tooling command invocations and workspace release timing; main risk is CI failures if pnpm exec resolution differs from pnpx.

Overview
Standardizes command execution across CI and local scripts by replacing pnpx usage with pnpm exec in GitHub workflows (service readiness wait-on) and root/package scripts (e.g., wait-on, SDK generation, and init-stack scaffolding test runs).

Updates tooling dependencies to match the new invocation style (adds create-next-app, create-vite, sv, and only-allow to packages/init-stack devDeps; adjusts lockfile), and changes pnpm-workspace.yaml release gating by removing the exclusion list and increasing minimumReleaseAge to 10080.

Reviewed by Cursor Bugbot for commit edfff3b. Bugbot is set up for automated code reviews on this repo. Configure here.

Summary by CodeRabbit

  • Chores
    • Switched package-runner usage from pnpx to pnpm exec across CI workflows, project scripts, and local tooling.
    • Added local scaffolding/dev tooling as devDependencies to support the execution changes.
    • Increased workspace minimum release age and removed the prior exclusion list for release timing.

Copilot AI review requested due to automatic review settings March 31, 2026 20:38
@vercel
Copy link
Copy Markdown

vercel Bot commented Mar 31, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
stack-auth-hosted-components Ready Ready Preview, Comment Apr 9, 2026 0:15am
stack-backend Ready Ready Preview, Comment Apr 9, 2026 0:15am
stack-dashboard Ready Ready Preview, Comment Apr 9, 2026 0:15am
stack-demo Ready Ready Preview, Comment Apr 9, 2026 0:15am
stack-docs Ready Ready Preview, Comment Apr 9, 2026 0:15am
2 Skipped Deployments
Project Deployment Actions Updated (UTC)
stack-preview-backend Ignored Ignored Preview Apr 9, 2026 0:15am
stack-preview-dashboard Ignored Ignored Preview Apr 9, 2026 0:15am

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Mar 31, 2026

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fcb71641-859e-45da-a809-11239796af46

📥 Commits

Reviewing files that changed from the base of the PR and between 2e0180c and edfff3b.

📒 Files selected for processing (1)
  • package.json

📝 Walkthrough

Walkthrough

Replaced pnpx invocations with pnpm exec across GitHub Actions workflows and npm scripts; updated packages/init-stack/package.json scripts and added devDependencies; increased minimumReleaseAge in pnpm-workspace.yaml and removed minimumReleaseAgeExclude.

Changes

Cohort / File(s) Summary
GitHub Workflows
/.github/workflows/db-migration-backwards-compatibility.yaml, /.github/workflows/e2e-api-tests-local-emulator.yaml, /.github/workflows/e2e-api-tests.yaml, /.github/workflows/e2e-custom-base-port-api-tests.yaml
Replaced pnpx wait-on ... with pnpm exec wait-on ... in service readiness/wait steps; endpoints and step structure unchanged.
Root package.json scripts
package.json
Replaced pnpx/pnpx --package=tsx usages with pnpm exec equivalents in multiple scripts (pre-no-codegen, pre-preinstall, restart-dev-in-background, wait-until-clickhouse-is-ready, generate-sdks).
Init Stack package scripts & deps
packages/init-stack/package.json
Swapped pnpx ... calls for pnpm exec ... in scaffolding/test scripts (sv/create, create-next-app, create-vite flows); added devDependencies (create-next-app, create-vite, sv, only-allow).
Workspace configuration
pnpm-workspace.yaml
Bumped minimumReleaseAge from 288010080 and removed the minimumReleaseAgeExclude block.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

Poem

🐰 I hopped through scripts with nimble feet,
Swapped pnpx trails for pnpm exec neat,
Workspace clocks stretched, exclusions shed,
Scaffolds now called where once they led,
✨🥕

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title 'Replace npx with pnpm exec' directly and clearly summarizes the main change: switching from npx/pnpx to pnpm exec across workflows and scripts.
Description check ✅ Passed The description provides substantial detail about the changes, risks, and rationale, though it differs from the minimal template provided which only references CONTRIBUTING.md guidelines.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch no-npx

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the monorepo tooling scripts to stop using pnpx/npx-style invocations and instead run commands via pnpm exec, aiming for more consistent package-manager usage across local dev and CI.

Changes:

  • Replaced pnpx with pnpm exec in root scripts (e.g., only-allow, tsx, wait-on).
  • Replaced pnpx wait-on ... with pnpm exec wait-on ... in multiple GitHub Actions workflows.
  • Adjusted workspace minimumReleaseAge configuration in pnpm-workspace.yaml.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
pnpm-workspace.yaml Changes workspace-level minimumReleaseAge configuration.
package.json Switches root scripts from pnpx to pnpm exec for only-allow, tsx, and wait-on.
packages/init-stack/package.json Switches init-stack test-run scaffolding commands from pnpx to pnpm exec.
.github/workflows/e2e-custom-base-port-api-tests.yaml Uses pnpm exec wait-on when waiting for services.
.github/workflows/e2e-api-tests.yaml Uses pnpm exec wait-on when waiting for services.
.github/workflows/e2e-api-tests-local-emulator.yaml Uses pnpm exec wait-on when waiting for services.
.github/workflows/db-migration-backwards-compatibility.yaml Uses pnpm exec wait-on when waiting for services.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread package.json Outdated
Comment on lines +7 to +8
"pre-no-codegen": "pnpm exec only-allow pnpm",
"pre-preinstall": "pnpm exec only-allow pnpm && node -e \"if(process.env.STACK_SKIP_TEMPLATE_GENERATION !== 'true') require('child_process').execSync('pnpm exec tsx ./scripts/generate-sdks.ts', {stdio: 'inherit'})\"",
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

preinstall/pre-preinstall now calls pnpm exec only-allow and pnpm exec tsx. Lifecycle preinstall runs before dependencies are installed on a fresh clone, so these binaries may not exist yet and pnpm install can fail. Consider using pnpm dlx only-allow pnpm and pnpm dlx tsx ... (or keep pnpx here), or replace only-allow with a small inline Node check that doesn't depend on installed packages.

Suggested change
"pre-no-codegen": "pnpm exec only-allow pnpm",
"pre-preinstall": "pnpm exec only-allow pnpm && node -e \"if(process.env.STACK_SKIP_TEMPLATE_GENERATION !== 'true') require('child_process').execSync('pnpm exec tsx ./scripts/generate-sdks.ts', {stdio: 'inherit'})\"",
"pre-no-codegen": "pnpm dlx only-allow pnpm",
"pre-preinstall": "pnpm dlx only-allow pnpm && node -e \"if(process.env.STACK_SKIP_TEMPLATE_GENERATION !== 'true') require('child_process').execSync('pnpm dlx tsx ./scripts/generate-sdks.ts', {stdio: 'inherit'})\"",

Copilot uses AI. Check for mistakes.
Comment on lines +25 to +30
"test-run-js:manual": "rimraf test-run-output && pnpm exec sv create test-run-output --no-install && pnpm run init-stack:local test-run-output",
"test-run-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --no-browser",
"test-run-next:manual": "rimraf test-run-output && pnpm exec create-next-app test-run-output && pnpm run init-stack:local test-run-output",
"test-run-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
"test-run-keys-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-keys-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These scripts switched from pnpx to pnpm exec sv ..., but sv is not listed as a dependency/devDependency anywhere in the repo, so pnpm exec sv will fail. If the intent is to run Svelte's generator without adding it as a dependency, use pnpm dlx sv ... (or keep pnpx).

Suggested change
"test-run-js:manual": "rimraf test-run-output && pnpm exec sv create test-run-output --no-install && pnpm run init-stack:local test-run-output",
"test-run-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --no-browser",
"test-run-next:manual": "rimraf test-run-output && pnpm exec create-next-app test-run-output && pnpm run init-stack:local test-run-output",
"test-run-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
"test-run-keys-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-keys-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-js:manual": "rimraf test-run-output && pnpm dlx sv create test-run-output --no-install && pnpm run init-stack:local test-run-output",
"test-run-js": "rimraf test-run-output && pnpm dlx sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --no-browser",
"test-run-next:manual": "rimraf test-run-output && pnpm exec create-next-app test-run-output && pnpm run init-stack:local test-run-output",
"test-run-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
"test-run-keys-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-keys-js": "rimraf test-run-output && pnpm dlx sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",

Copilot uses AI. Check for mistakes.
Comment on lines +27 to +32
"test-run-next:manual": "rimraf test-run-output && pnpm exec create-next-app test-run-output && pnpm run init-stack:local test-run-output",
"test-run-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
"test-run-keys-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-keys-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-react": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser --npm",
"test-run-react:manual": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --react"
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These scripts now use pnpm exec create-next-app / pnpm exec create-vite, but those packages are not present in workspace dependencies, so the commands won't be found. Either add create-next-app and create-vite as (dev)dependencies of this package, or use pnpm dlx create-next-app@latest ... / pnpm dlx create-vite@latest ... (or keep pnpx).

Suggested change
"test-run-next:manual": "rimraf test-run-output && pnpm exec create-next-app test-run-output && pnpm run init-stack:local test-run-output",
"test-run-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
"test-run-keys-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-keys-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-react": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser --npm",
"test-run-react:manual": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --react"
"test-run-next:manual": "rimraf test-run-output && pnpm dlx create-next-app@latest test-run-output && pnpm run init-stack:local test-run-output",
"test-run-next": "rimraf test-run-output && pnpm dlx create-next-app@latest test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
"test-run-keys-next": "rimraf test-run-output && pnpm dlx create-next-app@latest test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-keys-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-react": "rimraf test-run-output && pnpm dlx create-vite@latest test-run-output --template react-ts && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser --npm",
"test-run-react:manual": "rimraf test-run-output && pnpm dlx create-vite@latest test-run-output --template react-ts && pnpm run init-stack:local test-run-output --react"

Copilot uses AI. Check for mistakes.
Comment thread pnpm-workspace.yaml
- '@next/swc-win32-arm64-msvc'
- '@next/swc-win32-ia32-msvc'
- '@next/swc-win32-x64-msvc'
minimumReleaseAge: 10080
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR is titled "Replace npx with pnpm exec", but this change also modifies minimumReleaseAge (and removes the previous exclude list). If this behavior change is intended, it should be called out in the PR description/title or split into a separate PR to keep the scope focused.

Copilot uses AI. Check for mistakes.
Comment thread packages/init-stack/package.json
Comment thread pnpm-workspace.yaml
- '@next/swc-win32-arm64-msvc'
- '@next/swc-win32-ia32-msvc'
- '@next/swc-win32-x64-msvc'
minimumReleaseAge: 10080
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Next release-age exclusions were unintentionally removed

Medium Severity

pnpm-workspace.yaml now keeps only minimumReleaseAge: 10080 and removes minimumReleaseAgeExclude. That drops prior exceptions for next and @next/swc-*, so recently published Next.js toolchain packages can be blocked for seven days during installs or lockfile refreshes.

Fix in Cursor Fix in Web

Comment thread package.json
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/init-stack/package.json`:
- Around line 25-32: The scripts using pnpm exec (see package.json script names
test-run-js:manual, test-run-js, test-run-next:manual, test-run-next,
test-run-keys-next, test-run-keys-js, test-run-react, test-run-react:manual)
invoke scaffolding tools (sv, create-next-app, create-vite) that are not
installed locally; change those invocations from "pnpm exec" to "pnpm dlx" so
pnpm will download and run the tooling on-demand (replace each "pnpm exec
<tool>" with "pnpm dlx <tool>" while leaving the rest of each command
unchanged).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bbd2f94b-3faf-4113-a7ed-0574900cd4ce

📥 Commits

Reviewing files that changed from the base of the PR and between 300970c and efaaf9d.

📒 Files selected for processing (7)
  • .github/workflows/db-migration-backwards-compatibility.yaml
  • .github/workflows/e2e-api-tests-local-emulator.yaml
  • .github/workflows/e2e-api-tests.yaml
  • .github/workflows/e2e-custom-base-port-api-tests.yaml
  • package.json
  • packages/init-stack/package.json
  • pnpm-workspace.yaml

Comment on lines +25 to +32
"test-run-js:manual": "rimraf test-run-output && pnpm exec sv create test-run-output --no-install && pnpm run init-stack:local test-run-output",
"test-run-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --no-browser",
"test-run-next:manual": "rimraf test-run-output && pnpm exec create-next-app test-run-output && pnpm run init-stack:local test-run-output",
"test-run-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
"test-run-keys-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-keys-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-react": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser --npm",
"test-run-react:manual": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --react"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify that sv, create-next-app, and create-vite are not dependencies

echo "=== Checking packages/init-stack/package.json for scaffolding tools ==="
cat packages/init-stack/package.json | jq '.dependencies + .devDependencies | keys[]' 2>/dev/null | grep -E '(sv|create-next-app|create-vite)' || echo "Not found in init-stack"

echo ""
echo "=== Checking root package.json for scaffolding tools ==="
cat package.json | jq '.dependencies + .devDependencies | keys[]' 2>/dev/null | grep -E '(sv|create-next-app|create-vite)' || echo "Not found in root"

echo ""
echo "=== Search for these packages anywhere in the monorepo ==="
rg -l '"(sv|create-next-app|create-vite)"' --glob '*/package.json' --glob 'package.json' 2>/dev/null || echo "No matches found"

Repository: stack-auth/stack-auth

Length of output: 313


🏁 Script executed:

# Check the git diff for the package.json file
cd packages/init-stack && git diff HEAD package.json | head -100

Repository: stack-auth/stack-auth

Length of output: 47


🏁 Script executed:

cd packages/init-stack && git log --oneline -10 package.json

Repository: stack-auth/stack-auth

Length of output: 100


🏁 Script executed:

cd packages/init-stack && git show HEAD:package.json | sed -n '25,32p'

Repository: stack-auth/stack-auth

Length of output: 1342


🏁 Script executed:

head -35 packages/init-stack/package.json | tail -11

Repository: stack-auth/stack-auth

Length of output: 2039


🏁 Script executed:

git show efaaf9d5:packages/init-stack/package.json | head -35 | tail -11

Repository: stack-auth/stack-auth

Length of output: 2039


🏁 Script executed:

git show efaaf9d5^:packages/init-stack/package.json | head -35 | tail -11

Repository: stack-auth/stack-auth

Length of output: 104


🏁 Script executed:

git show efaaf9d5 --stat

Repository: stack-auth/stack-auth

Length of output: 50378


🌐 Web query:

pnpm exec vs pnpx difference behavior uninstalled packages

💡 Result:

  • pnpm exec <cmd>: runs a command in the context of the current project by adding the project’s node_modules/.bin to PATH, so it can execute binaries from already-installed dependencies. If the binary/package isn’t installed in the project, it typically won’t be found. [1]

  • pnpx <pkg-or-cmd> (deprecated) / pnpm dlx <pkg>: runs a package without adding it to your project dependencies by fetching it from the registry and running it in a temporary/hotloaded environment—so it works even when the package is not installed in your project. [2] Older pnpx also had behavior around installing missing packages (with prompts / yes/no flags). [3]

  • Status / recommendation: pnpx was slated for removal; pnpm recommends using pnpm exec (local, installed) and pnpm dlx (temporary, not installed) instead. [4]

Sources: [1] [2] [3] [4]
[1] (dimava.github.io) [2] (dimava.github.io) [3] (app.unpkg.com) [4] (newreleases.io)

Citations:


Replace pnpm exec with pnpm dlx for scaffolding tools that aren't installed.

Changing from pnpx (or npx) to pnpm exec breaks these test scripts. pnpm exec only runs binaries from locally installed packages, but sv, create-next-app, and create-vite are not dependencies of this package or the monorepo root. These are scaffolding tools meant to be downloaded on-demand.

pnpm dlx is pnpm's replacement for npx—it downloads and runs packages temporarily without requiring installation. Use it for these commands:

Recommended fix
-    "test-run-js:manual": "rimraf test-run-output && pnpm exec sv create test-run-output --no-install && pnpm run init-stack:local test-run-output",
-    "test-run-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --no-browser",
-    "test-run-next:manual": "rimraf test-run-output && pnpm exec create-next-app test-run-output && pnpm run init-stack:local test-run-output",
-    "test-run-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
-    "test-run-keys-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
-    "test-run-keys-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
-    "test-run-react": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser --npm",
-    "test-run-react:manual": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --react"
+    "test-run-js:manual": "rimraf test-run-output && pnpm dlx sv create test-run-output --no-install && pnpm run init-stack:local test-run-output",
+    "test-run-js": "rimraf test-run-output && pnpm dlx sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --no-browser",
+    "test-run-next:manual": "rimraf test-run-output && pnpm dlx create-next-app@latest test-run-output && pnpm run init-stack:local test-run-output",
+    "test-run-next": "rimraf test-run-output && pnpm dlx create-next-app@latest test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
+    "test-run-keys-next": "rimraf test-run-output && pnpm dlx create-next-app@latest test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
+    "test-run-keys-js": "rimraf test-run-output && pnpm dlx sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
+    "test-run-react": "rimraf test-run-output && pnpm dlx create-vite@latest test-run-output --template react-ts && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser --npm",
+    "test-run-react:manual": "rimraf test-run-output && pnpm dlx create-vite@latest test-run-output --template react-ts && pnpm run init-stack:local test-run-output --react"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"test-run-js:manual": "rimraf test-run-output && pnpm exec sv create test-run-output --no-install && pnpm run init-stack:local test-run-output",
"test-run-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --no-browser",
"test-run-next:manual": "rimraf test-run-output && pnpm exec create-next-app test-run-output && pnpm run init-stack:local test-run-output",
"test-run-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
"test-run-keys-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-keys-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-react": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser --npm",
"test-run-react:manual": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --react"
"test-run-js:manual": "rimraf test-run-output && pnpm dlx sv create test-run-output --no-install && pnpm run init-stack:local test-run-output",
"test-run-js": "rimraf test-run-output && pnpm dlx sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --no-browser",
"test-run-next:manual": "rimraf test-run-output && pnpm dlx create-next-app@latest test-run-output && pnpm run init-stack:local test-run-output",
"test-run-next": "rimraf test-run-output && pnpm dlx create-next-app@latest test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
"test-run-keys-next": "rimraf test-run-output && pnpm dlx create-next-app@latest test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-keys-js": "rimraf test-run-output && pnpm dlx sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-react": "rimraf test-run-output && pnpm dlx create-vite@latest test-run-output --template react-ts && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser --npm",
"test-run-react:manual": "rimraf test-run-output && pnpm dlx create-vite@latest test-run-output --template react-ts && pnpm run init-stack:local test-run-output --react"
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@packages/init-stack/package.json` around lines 25 - 32, The scripts using
pnpm exec (see package.json script names test-run-js:manual, test-run-js,
test-run-next:manual, test-run-next, test-run-keys-next, test-run-keys-js,
test-run-react, test-run-react:manual) invoke scaffolding tools (sv,
create-next-app, create-vite) that are not installed locally; change those
invocations from "pnpm exec" to "pnpm dlx" so pnpm will download and run the
tooling on-demand (replace each "pnpm exec <tool>" with "pnpm dlx <tool>" while
leaving the rest of each command unchanged).

Comment thread packages/init-stack/package.json
@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented Mar 31, 2026

Greptile Summary

This PR replaces all uses of pnpx (alias for pnpm dlx) with pnpm exec across GitHub Actions workflows and package.json scripts, and also bumps minimumReleaseAge in pnpm-workspace.yaml from 2880 to 10080 (48 hours → 7 days) while removing the per-package exclusion list.

The substitution is correct for packages that are installed as workspace dependencies (wait-on, only-allow, tsx — all present in the root devDependencies/dependencies), but incorrect for the scaffold CLI tools used in packages/init-stack test scripts. pnpm exec only resolves binaries from node_modules/.bin; it does not download packages from the registry. sv, create-next-app, and create-vite are not installed anywhere in the workspace, so every test-run-* script that uses them will fail with a command-not-found error. Those calls should remain pnpm dlx (the direct equivalent of the old pnpx).

Key changes:

  • Workflow files (4 files): pnpx wait-onpnpm exec wait-on — safe, wait-on is a workspace devDependency.
  • Root package.json: pnpx only-allow, pnpx tsx, pnpx wait-onpnpm exec equivalents — safe, all three are workspace dependencies.
  • packages/init-stack/package.json: Scaffold tools (create-next-app, create-vite, sv) switched to pnpm execbreaks all affected test-run-* scripts since these tools are not installed locally.
  • pnpm-workspace.yaml: minimumReleaseAge raised to 7 days with no per-package exclusions; packages previously exempt (next, AI SDKs) are now subject to the full hold window.

Confidence Score: 4/5

Not safe to merge as-is: the init-stack test-run scripts for Next.js, SvelteKit, and Vite are broken by the incorrect pnpm exec substitution for uninstalled scaffold tools.

One clear P1 defect — pnpm exec sv, pnpm exec create-next-app, and pnpm exec create-vite will fail at runtime because those packages are not installed as workspace dependencies. The rest of the pnpxpnpm exec replacements (wait-on, only-allow, tsx) are correct because those packages are installed. The score would be 5 if the init-stack scaffold calls used pnpm dlx instead.

packages/init-stack/package.json — the 8 test-run-* scripts that call pnpm exec sv, pnpm exec create-next-app, and pnpm exec create-vite need to be changed to pnpm dlx.

Important Files Changed

Filename Overview
packages/init-stack/package.json Scaffold tool scripts (sv, create-next-app, create-vite) incorrectly changed from pnpm dlx to pnpm exec — these packages are not workspace dependencies and will fail to run.
package.json All commands switched from pnpx to pnpm exec are backed by installed workspace dependencies (only-allow, tsx, wait-on), so the changes are safe.
pnpm-workspace.yaml Removed exclusion list and increased minimumReleaseAge from 2880 (48 hours) to 10080 (7 days); packages like next and AI SDKs are now subject to the 7-day hold.
.github/workflows/e2e-api-tests.yaml pnpx wait-on replaced with pnpm exec wait-on; safe because wait-on is a workspace devDependency.
.github/workflows/e2e-api-tests-local-emulator.yaml pnpx wait-on replaced with pnpm exec wait-on; safe because wait-on is a workspace devDependency.
.github/workflows/e2e-custom-base-port-api-tests.yaml pnpx wait-on replaced with pnpm exec wait-on; safe because wait-on is a workspace devDependency.
.github/workflows/db-migration-backwards-compatibility.yaml pnpx wait-on replaced with pnpm exec wait-on; safe because wait-on is a workspace devDependency.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["pnpx / pnpm dlx"] -->|"Downloads & runs\nfrom registry\n(no install needed)"| B["✅ Works for\nnon-installed packages\ncreate-next-app, sv, create-vite"]
    C["pnpm exec"] -->|"Looks up binary\nin node_modules/.bin"| D{Package installed?}
    D -->|"Yes"| E["✅ Runs binary\n(wait-on, only-allow, tsx)"]
    D -->|"No"| F["❌ Command not found\n(sv, create-next-app, create-vite)"]
    subgraph "Root workspace devDeps / deps"
        G["wait-on ✅"]
        H["only-allow ✅"]
        I["tsx ✅"]
    end
    subgraph "NOT in any workspace deps"
        J["sv ❌"]
        K["create-next-app ❌"]
        L["create-vite ❌"]
    end
Loading

Reviews (1): Last reviewed commit: "Replace npx with pnpm exec" | Re-trigger Greptile

Comment on lines +25 to +32
"test-run-js:manual": "rimraf test-run-output && pnpm exec sv create test-run-output --no-install && pnpm run init-stack:local test-run-output",
"test-run-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --no-browser",
"test-run-next:manual": "rimraf test-run-output && pnpm exec create-next-app test-run-output && pnpm run init-stack:local test-run-output",
"test-run-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
"test-run-keys-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-keys-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-react": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser --npm",
"test-run-react:manual": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --react"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 pnpm exec cannot locate uninstalled scaffold tools

pnpm exec only runs binaries that are already present in node_modules/.bin. The tools sv (SvelteKit CLI), create-next-app, and create-vite are not listed as dependencies anywhere in the workspace (neither in this package's devDependencies nor in the root package.json). Calling pnpm exec sv create, pnpm exec create-next-app, and pnpm exec create-vite will therefore fail with a "command not found" error for anyone running these test scripts.

The original pnpx <pkg> (alias for pnpm dlx) was correct here because it fetches and executes packages from the registry without requiring them to be installed locally. These scaffold tools are one-off CLI tools and are intentionally kept out of the dependency tree.

Affected scripts: test-run-js:manual, test-run-js, test-run-next:manual, test-run-next, test-run-keys-next, test-run-keys-js, test-run-react, test-run-react:manual.

The fix is to replace pnpm exec with pnpm dlx (and restore the @latest version tags for create-next-app and create-vite):

Suggested change
"test-run-js:manual": "rimraf test-run-output && pnpm exec sv create test-run-output --no-install && pnpm run init-stack:local test-run-output",
"test-run-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --no-browser",
"test-run-next:manual": "rimraf test-run-output && pnpm exec create-next-app test-run-output && pnpm run init-stack:local test-run-output",
"test-run-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
"test-run-keys-next": "rimraf test-run-output && pnpm exec create-next-app test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-keys-js": "rimraf test-run-output && pnpm exec sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-react": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser --npm",
"test-run-react:manual": "rimraf test-run-output && pnpm exec create-vite test-run-output --template react-ts && pnpm run init-stack:local test-run-output --react"
"test-run-js:manual": "rimraf test-run-output && pnpm dlx sv create test-run-output --no-install && pnpm run init-stack:local test-run-output",
"test-run-js": "rimraf test-run-output && pnpm dlx sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --no-browser",
"test-run-next:manual": "rimraf test-run-output && pnpm dlx create-next-app@latest test-run-output && pnpm run init-stack:local test-run-output",
"test-run-next": "rimraf test-run-output && pnpm dlx create-next-app@latest test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser",
"test-run-keys-next": "rimraf test-run-output && pnpm dlx create-next-app@latest test-run-output --app --ts --no-src-dir --tailwind --use-npm --eslint --import-alias '##@#/*' --turbopack && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-keys-js": "rimraf test-run-output && pnpm dlx sv create test-run-output --template minimal --types ts --no-add-ons --no-install && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --js --client --npm --project-id my-project-id --publishable-client-key my-publishable-client-key",
"test-run-react": "rimraf test-run-output && pnpm dlx create-vite@latest test-run-output --template react-ts && pnpm run init-stack:local test-run-output --on-question error --no-warn-uncommitted-changes --no-browser --npm",
"test-run-react:manual": "rimraf test-run-output && pnpm dlx create-vite@latest test-run-output --template react-ts && pnpm run init-stack:local test-run-output --react"

@vercel
Copy link
Copy Markdown

vercel Bot commented Mar 31, 2026

Deployment failed with the following error:

Invalid request: `attribution.gitUser` should NOT have additional property `isBot`.

Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 2e0180c. Configure here.

Comment thread package.json Outdated
"pre-no-codegen": "pnpx only-allow pnpm",
"pre-preinstall": "pnpx only-allow pnpm && node -e \"if(process.env.STACK_SKIP_TEMPLATE_GENERATION !== 'true') require('child_process').execSync('pnpx --package=tsx tsx ./scripts/generate-sdks.ts', {stdio: 'inherit'})\"",
"pre-no-codegen": "pnpm exec only-allow pnpm",
"pre-preinstall": "pnpx only-allow pnpm && node -e \"if(process.env.STACK_SKIP_TEMPLATE_GENERATION !== 'true') require('child_process').execSync('pnpm exec tsx ./scripts/generate-sdks.ts', {stdio: 'inherit'})\"",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pnpm exec tsx fails during preinstall on fresh installs

High Severity

The pre-preinstall script (which runs as the preinstall hook) changed from pnpx --package=tsx tsx to pnpm exec tsx. Unlike pnpx, pnpm exec only runs binaries already installed in node_modules/.bin/ — it does not download packages on-the-fly. During preinstall, no dependencies are installed yet, so pnpm exec tsx will fail on any fresh clone, after pnpm clean, or in CI without a cached node_modules. The STACK_SKIP_TEMPLATE_GENERATION guard only covers Docker builds, not developer or CI workflows.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 2e0180c. Configure here.

@N2D4 N2D4 merged commit d6c0679 into dev Apr 9, 2026
21 of 30 checks passed
@N2D4 N2D4 deleted the no-npx branch April 9, 2026 00:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants