figmar/apes-sidebar
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docs: 供应链策略说明改为「命令链无法完全规避，24h 后自动消失」

Browse Source
This commit is contained in:
Menghuan1918
2026-08-14 00:21:01 +08:00
parent 1b7c8ba497
commit 3d88752eb1
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3 -1
View File
@@ -61,7 +61,9 @@ cd ~/.dsh/profiles/web \
不带 `@<版本>` 时，pnpm 解析 npm 的 `latest` 标签（最新发布版）。`dsh plugin add` 完成：`pnpm add` 登记依赖 → 识别 `dsh.bundle.patch` 自动注册到 `dsh.profile.bundles` → 下次启动自动挂载（无需手写 `cordis.patch.yml`）。
> ⚠️ pnpm 11 的两道供应链策略：① `strict-dep-builds` 拦截 node-pty/protobufjs 构建脚本（首次 `pnpm approve-builds --all` 一次即可，包其实已装上、node-pty 预编译产物可直接用）；② `minimumReleaseAge` 拒绝 <24h 的新版本（pnpm 会自动补 `minimumReleaseAgeExclude`，重跑一次即可）。
> ⚠️ pnpm 11 的两道供应链策略，命令链无法完全规避：
> - `strict-dep-builds` 拦截 node-pty/protobufjs 的构建脚本：首次装报 `Ignored build scripts`（包其实已装上、node-pty 预编译产物可直接用），`pnpm approve-builds --all` 一次即可。
> - `minimumReleaseAge` 拒绝发布 <24h 的新版本：这是 pnpm 的策略、命令链无法完全规避，仅因插件刚发布不久才会触发，**24 小时后自动消失**（触发时重跑一次，pnpm 会自动补 `minimumReleaseAgeExclude`）。
### 更新
README_EN.md
+3 -1
View File
@@ -61,7 +61,9 @@ cd ~/.dsh/profiles/web \
Without `@<version>`, pnpm resolves npm's `latest` tag (the newest release). `dsh plugin add` runs `pnpm add` to register the dependency, detects `dsh.bundle.patch`, auto-appends the plugin to `dsh.profile.bundles`, and the next boot mounts it — no hand-written `cordis.patch.yml` mount line.
> ⚠️ pnpm 11's two supply-chain policies: ① `strict-dep-builds` blocks node-pty/protobufjs build scripts (run `pnpm approve-builds --all` once; the package is already installed and node-pty's prebuilds work as-is); ② `minimumReleaseAge` rejects releases younger than 24h (pnpm auto-appends a `minimumReleaseAgeExclude` entry — just re-run once).
> ⚠️ pnpm 11's two supply-chain policies, which no command chain can fully dodge:
> - `strict-dep-builds` blocks node-pty/protobufjs build scripts: the first install reports `Ignored build scripts` (the package is already installed and node-pty's prebuilds work as-is); run `pnpm approve-builds --all` once.
> - `minimumReleaseAge` rejects releases younger than 24h: this is a pnpm policy that no command chain can fully avoid — it only triggers because the plugin was just published, and **it disappears on its own after 24 hours** (if it fires, just re-run once; pnpm auto-appends a `minimumReleaseAgeExclude` entry).
### Updating