Prompt before applying `AUTO_PIN` to `package.json`

まず、Corepack の AUTO_PIN の実装と既存のテストを見つけます。COREPACK_ENABLE_AUTO_PIN が 1 に設定されている場合に既存の package.json を更新する経路を追跡し、その更新前にプロンプトがどのように動作すべきかを判断します。ユーザーが既存の npm および Yarn のシナリオに影響を与えずに packageManager の変更を承認または拒否できれば完了です。

What would you like?

Corepack AUTO_PIN should prompt before adding a packageManager field to an existing package.json file. It may not be a desired change.

Why is this needed?

By default, and if the environment variable COREPACK_ENABLE_AUTO_PIN is not set to 0 If COREPACK_ENABLE_AUTO_PIN is set to 1, then Corepack adds a packageManager field to an existing package.json file if the field is not present.

Especially when working in a hybrid environment using package managers npm and Yarn in a mixture of projects, some of which are set up to work with Corepack and others are not, then some actions can lead to a packageManager field being added to an existing package.json file where this is not desired.

Consider the following scenario:

• Project-npm is configured for npm without Corepack (no packageManager field)
• Project-yarn-v1-corepack is configured for Yarn Classic with Corepack (packageManager field contains yarn@1.22.22+sha512...)

If my working directory cwd is in Project-npm and I execute yarn -v overlooking what project I am in, then my npm project becomes corrupted with the unwanted Yarn packageManager field. There is no prompt to allow me to recognize my mistake and prevent the package.json from being updated.

$ yarn -v
! The local project doesn't define a 'packageManager' field. Corepack will now add one referencing yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e.
! For more details about this field, consult the documentation at https://nodejs.org/api/packages.html#packagemanager

Other

• https://github.com/nodejs/corepack/issues/485 proposes to disable AUTO_PIN by default. This is a related suggestion and it contains descriptions of scenarios where AUTO_PIN is not wanted.
• AUTO_PIN was added in corepack@0.26.0 March 2024