fix: Corepack pnpm issue (#10840)

So, a while back Circle CI builds and Heroku builds started to fail. From all the threads I read, it seems like the [npm registry rotated it's signing keys](https://github.com/pnpm/pnpm/issues/9014#issuecomment-2616589753) New pnpm versions were signed with the new key. Corepack, however, bundles a static set of trusted keys (from Node’s release), so it continued verifying signatures only against the old key. When it encountered packages signed with the new key, Corepack’s integrity check failed with “Cannot find matching keyid” errors.This mismatch caused Corepack’s integrity check to fail with “Cannot find matching keyid” errors. Workarounds include the following 1. Updating Corepack (to 0.31.0), they [upgraded their package](https://github.com/nodejs/corepack/releases/tag/v0.31.0) to include the new integrity check keys. But we seldom control what's going on with the CI, also, updating this across our scripts is going to be a painful task. Besides Heroku has [made some fixes](https://github.com/heroku/buildpacks-nodejs/pull/1010) around this 2. Disabling integrity checks 🔥 #YOLO 3. Pinning `pnpm` to older versions, or pinning it to a newer version with the checksum in place. Doing the third one here, running `corepack use pnpm@9.15.5` fixes this, [ref](https://github.com/pnpm/pnpm/issues/9014#issuecomment-2623761494) We can get rid of this over time as CDN caches used by build systems are refreshed. But the change in this PR is not disruptive in anyway, only rigidly secure. Fixes: https://github.com/chatwoot/chatwoot/issues/10832 --- Here are the threads to follow - https://github.com/pnpm/pnpm/issues/9014 - https://github.com/pnpm/pnpm/issues/9029 - https://github.com/nodejs/corepack/issues/612 - https://github.com/nodejs/corepack/issues/616 - https://github.com/heroku/buildpacks-nodejs/pull/1010 --------- Co-authored-by: Vishnu Narayanan <vishnu@chatwoot.com>
2025-10-29 10:12:34 +00:00 · 2025-02-05 23:42:29 +05:30
parent 41c7683e04
commit f2a7e1da6b
8 changed files with 58 additions and 45 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -19,7 +19,7 @@ jobs:
    steps:
      - checkout
      - node/install:
-          node-version: '20.12'
+          node-version: '23.7'
      - node/install-pnpm
      - node/install-packages:
          pkg-manager: pnpm
--- a/.devcontainer/docker-compose.yml
+++ b/.devcontainer/docker-compose.yml
@@ -5,30 +5,30 @@
 version: '3'

 services:
-  base: 
+  base:
    build:
      context: ..
      dockerfile: .devcontainer/Dockerfile.base
      args:
-        VARIANT: "ubuntu-22.04"
-        NODE_VERSION: "20.9.0"
-        RUBY_VERSION: "3.3.3"
+        VARIANT: 'ubuntu-22.04'
+        NODE_VERSION: '23.7.0'
+        RUBY_VERSION: '3.3.3'
        # On Linux, you may need to update USER_UID and USER_GID below if not your local UID is not 1000.
-        USER_UID: "1000"
-        USER_GID: "1000"
+        USER_UID: '1000'
+        USER_GID: '1000'
    image: base:latest
-        
+
  app:
    build:
      context: ..
      dockerfile: .devcontainer/Dockerfile
      args:
-        VARIANT: "ubuntu-22.04"
-        NODE_VERSION: "20.9.0"
-        RUBY_VERSION: "3.3.3"
+        VARIANT: 'ubuntu-22.04'
+        NODE_VERSION: '23.7.0'
+        RUBY_VERSION: '3.3.3'
        # On Linux, you may need to update USER_UID and USER_GID below if not your local UID is not 1000.
-        USER_UID: "1000"
-        USER_GID: "1000"
+        USER_UID: '1000'
+        USER_GID: '1000'

    volumes:
      - ..:/workspace:cached
--- a/.github/workflows/frontend-fe.yml
+++ b/.github/workflows/frontend-fe.yml
@@ -23,12 +23,10 @@ jobs:
          bundler-cache: true

      - uses: pnpm/action-setup@v4
-        with:
-          version: 9.3.0

      - uses: actions/setup-node@v4
        with:
-          node-version: 20
+          node-version: 23
          cache: 'pnpm'

      - name: Install pnpm dependencies
--- a/.github/workflows/run_foss_spec.yml
+++ b/.github/workflows/run_foss_spec.yml
@@ -38,7 +38,6 @@ jobs:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
-          version: 9
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

@@ -48,7 +47,7 @@ jobs:

      - uses: actions/setup-node@v4
        with:
-          node-version: 20
+          node-version: 23
          cache: 'pnpm'

      - name: Install pnpm dependencies
--- a/.github/workflows/size-limit.yml
+++ b/.github/workflows/size-limit.yml
@@ -19,13 +19,11 @@ jobs:
        with:
          bundler-cache: true # runs 'bundle install' and caches installed gems automatically

-      - uses: pnpm/action-setup@v2
-        with:
-          version: 9.3.0
+      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
-          node-version: 20
+          node-version: 23
          cache: 'pnpm'

      - name: pnpm
@@ -39,7 +37,7 @@ jobs:
      - name: setup env
        run: |
          cp .env.example .env
- 
+
      - name: Run asset compile
        run: bundle exec rake assets:precompile
        env:
@@ -47,5 +45,3 @@ jobs:

      - name: Size Check
        run: pnpm run size
-
-
--- a/deployment/setup_20.04.sh
+++ b/deployment/setup_20.04.sh
@@ -177,7 +177,7 @@ function install_dependencies() {
  echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/redis.list
  mkdir -p /etc/apt/keyrings
  curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg
-  NODE_MAJOR=20
+  NODE_MAJOR=23
  echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list
  echo "deb http://apt.postgresql.org/pub/repos/apt/ $(lsb_release -cs)-pgdg 16" > /etc/apt/sources.list.d/pgdg.list
  wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
@@ -779,15 +779,15 @@ function upgrade_node() {
  # Parse major version number
  major_version=$(echo "$current_version" | cut -d. -f1)

-  if [ "$major_version" -ge 20 ]; then
-    echo "Node.js is already version $current_version (>= 20.x). Skipping Node.js upgrade."
+  if [ "$major_version" -ge 23 ]; then
+    echo "Node.js is already version $current_version (>= 23.x). Skipping Node.js upgrade."
    return
  fi

-  echo "Upgrading Node.js version to v20.x"
+  echo "Upgrading Node.js version to v23.x"
  mkdir -p /etc/apt/keyrings
  curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg
-  NODE_MAJOR=20
+  NODE_MAJOR=23
  echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list

  apt-get update
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,6 +1,12 @@
 # pre-build stage
+FROM node:23-alpine as node
 FROM ruby:3.3.3-alpine3.19 AS pre-builder

+ARG NODE_VERSION="23.7.0"
+ARG PNPM_VERSION="10.2.0"
+ENV NODE_VERSION=${NODE_VERSION}
+ENV PNPM_VERSION=${PNPM_VERSION}
+
 # ARG default to production settings
 # For development docker-compose file overrides ARGS
 ARG BUNDLE_WITHOUT="development:test"
@@ -25,18 +31,24 @@ RUN apk update && apk add --no-cache \
  tzdata \
  postgresql-dev \
  postgresql-client \
-  nodejs=20.15.1-r0 \
  git \
+  curl \
+  xz \
  && mkdir -p /var/app \
  && gem install bundler

-# Install pnpm and configure environment
-RUN wget -qO- https://get.pnpm.io/install.sh | ENV="$HOME/.shrc" SHELL="$(which sh)" sh - \
-    && echo 'export PNPM_HOME="/root/.local/share/pnpm"' >> /root/.shrc \
-    && echo 'export PATH="$PNPM_HOME:$PATH"' >> /root/.shrc \
-    && export PNPM_HOME="/root/.local/share/pnpm" \
-    && export PATH="$PNPM_HOME:$PATH" \
-    && pnpm --version
+COPY --from=node /usr/local/bin/node /usr/local/bin/
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+  && ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
+
+RUN npm install -g pnpm@${PNPM_VERSION}
+
+RUN echo 'export PNPM_HOME="/root/.local/share/pnpm"' >> /root/.shrc \
+  && echo 'export PATH="$PNPM_HOME:$PATH"' >> /root/.shrc \
+  && export PNPM_HOME="/root/.local/share/pnpm" \
+  && export PATH="$PNPM_HOME:$PATH" \
+  && pnpm --version

 # Persist the environment variables in Docker
 ENV PNPM_HOME="/root/.local/share/pnpm"
@@ -86,6 +98,10 @@ RUN rm -rf /gems/ruby/3.3.0/cache/*.gem \
 # final build stage
 FROM ruby:3.3.3-alpine3.19

+ARG NODE_VERSION="23.7.0"
+ARG PNPM_VERSION="10.2.0"
+ENV NODE_VERSION=${NODE_VERSION}
+ENV PNPM_VERSION=${PNPM_VERSION}

 ARG BUNDLE_WITHOUT="development:test"
 ENV BUNDLE_WITHOUT ${BUNDLE_WITHOUT}
@@ -114,11 +130,14 @@ RUN apk update && apk add --no-cache \
  vips \
  && gem install bundler

+COPY --from=node /usr/local/bin/node /usr/local/bin/
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+
 RUN if [ "$RAILS_ENV" != "production" ]; then \
-  apk add --no-cache nodejs=20.15.1-r0; \
-  # Install pnpm and configure environment
-  wget -qO- https://get.pnpm.io/install.sh | ENV="$HOME/.shrc" SHELL="$(which sh)" sh - \
-  && source /root/.shrc \
+  apk add --no-cache curl \
+  && ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+  && ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
+  && npm install -g pnpm@${PNPM_VERSION} \
  && pnpm --version; \
  fi

--- a/package.json
+++ b/package.json
@@ -139,8 +139,8 @@
    "vitest": "2.0.1"
  },
  "engines": {
-    "node": "20.x",
-    "pnpm": "9.x"
+    "node": "23.x",
+    "pnpm": "10.x"
  },
  "husky": {
    "hooks": {
@@ -162,5 +162,6 @@
    "*.scss": [
      "scss-lint"
    ]
-  }
+  },
+  "packageManager": "pnpm@10.2.0+sha512.0d27364e0139c6aadeed65ada153135e0ca96c8da42123bd50047f961339dc7a758fc2e944b428f52be570d1bd3372455c1c65fa2e7aa0bfbf931190f9552001"
 }