Skip to content
This repository was archived by the owner on Sep 17, 2023. It is now read-only.

Commit 07ecd79

Browse files
committed
fix(make-depend)!: remove use of force-local
This commit removes hard-coded use of `lerna bootstrap`'s `--force-local`[^1] command, so that monorepos that don't want to opt in to this behavior are not forced to. For projects that wish to include the `--force-local` flag on every invocation to `lerna bootstrap`, perhaps to prevent dependency confusion attacks, we recommend specifying this in the lerna manifest. For example, your lerna.json could look like ``` { "packages": [ "packages/*" ], "command": { "bootstrap": { "forceLocal": true } } } ``` To prevent the case where a project was expecting `--force-local` to be applied, but not specifying this in the configuration file, we consider this a breaking change. [^1]: https://github.com/lerna/lerna/blob/main/commands/bootstrap/README.md#--force-local BREAKING CHANGE: do not specify `--force-local` in makefiles generated by `make-depend`
1 parent ad21fb2 commit 07ecd79

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

templates/makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ MAKEDEPEND = $(MONOREPO) make-depend \
1515

1616
{{ package_directory }}/node_modules: $(MONOREPO) $({{ unscoped_package_name.replace("-", "_").to_uppercase() }}_INTERNAL_DEPENDENCY_MANIFESTS_INCLUSIVE)
1717
@$(MAKEDEPEND)
18-
$(LERNA) bootstrap --force-local --scope={{ scoped_package_name }} --include-dependencies
18+
$(LERNA) bootstrap --scope={{ scoped_package_name }} --include-dependencies
1919
@touch $@
2020

2121
$({{ unscoped_package_name.replace("-", "_").to_uppercase() }}_INTERNAL_DEPENDENCY_MANIFESTS_INCLUSIVE):

0 commit comments

Comments
 (0)