[GH-ISSUE #186] vinext deploy silently runs npm install, downgrading dependencies in Yarn/pnpm workspaces #44

New issue

Closed

opened 2026-05-06 12:36:47 +02:00 by BreizhHardware · 1 comment

BreizhHardware commented

2026-05-06 12:36:47 +02:00

Owner

Originally created by @justinfinnn on GitHub (Feb 28, 2026).
Original GitHub issue: https://github.com/cloudflare/vinext/issues/186

Bug

vinext deploy internally runs npm install during the deploy process. In a Yarn or pnpm monorepo, this silently downgrades hoisted dependencies — in our case, React 19.2.0 was downgraded to 18.3.1 mid-deploy, causing:

Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './server.edge' is not defined by "exports" 
in .../node_modules/react-dom/package.json

This is because react-dom/server.edge is a React 19 export that doesn't exist in React 18.

Environment

vinext: 0.0.13
Package manager: Yarn 1 (workspace monorepo)
React: 19.2.0 (specified in root package.json + yarn.lock)

Steps to reproduce

Set up a Yarn workspace monorepo with React 19.2.0 pinned
Run vinext deploy
During deploy, vinext runs npm install internally
npm resolves React 18.x (ignoring yarn.lock), overwriting node_modules/react-dom
Build fails: ./server.edge not found in react-dom exports

Root cause

vinext deploy runs npm install regardless of which package manager the project uses. This conflicts with Yarn/pnpm lockfiles and can silently downgrade packages.

This is related to #109 (package manager detection) but specific to the deploy command and has a concrete breaking side effect beyond just using the wrong installer.

Workaround

Run next build + wrangler deploy separately — do not use vinext deploy:

# In package.json
"build": "next build",
"deploy": "yarn build && wrangler deploy"

Expected behavior

vinext deploy should respect the project's package manager (detect via lockfile: yarn.lock → yarn, pnpm-lock.yaml → pnpm, package-lock.json → npm). It should not run npm install in a Yarn or pnpm project.

See also: #109

Originally created by @justinfinnn on GitHub (Feb 28, 2026). Original GitHub issue: https://github.com/cloudflare/vinext/issues/186 ## Bug `vinext deploy` internally runs `npm install` during the deploy process. In a Yarn or pnpm monorepo, this silently downgrades hoisted dependencies — in our case, React 19.2.0 was downgraded to 18.3.1 mid-deploy, causing: ``` Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './server.edge' is not defined by "exports" in .../node_modules/react-dom/package.json ``` This is because `react-dom/server.edge` is a React 19 export that doesn't exist in React 18. ## Environment - vinext: 0.0.13 - Package manager: Yarn 1 (workspace monorepo) - React: 19.2.0 (specified in root package.json + yarn.lock) ## Steps to reproduce 1. Set up a Yarn workspace monorepo with React 19.2.0 pinned 2. Run `vinext deploy` 3. During deploy, vinext runs `npm install` internally 4. npm resolves React 18.x (ignoring yarn.lock), overwriting `node_modules/react-dom` 5. Build fails: `./server.edge` not found in react-dom exports ## Root cause `vinext deploy` runs `npm install` regardless of which package manager the project uses. This conflicts with Yarn/pnpm lockfiles and can silently downgrade packages. This is related to #109 (package manager detection) but specific to the `deploy` command and has a concrete breaking side effect beyond just using the wrong installer. ## Workaround Run `next build` + `wrangler deploy` separately — do not use `vinext deploy`: ```bash # In package.json "build": "next build", "deploy": "yarn build && wrangler deploy" ``` ## Expected behavior `vinext deploy` should respect the project's package manager (detect via lockfile: `yarn.lock` → yarn, `pnpm-lock.yaml` → pnpm, `package-lock.json` → npm). It should not run `npm install` in a Yarn or pnpm project. See also: #109

BreizhHardware closed this issue

2026-05-06 12:36:47 +02:00

BreizhHardware commented

2026-05-06 12:36:48 +02:00

Author

Owner

@solracnyc commented on GitHub (Feb 28, 2026):

We run a pnpm workspace monorepo and had to bypass vinext deploy because of workspace:* compatibility with npm-based install behavior.

Our reliable path has been:

vinext build
wrangler deploy --name <worker-name>

This has been stable for us on Cloudflare Workers with vinext ~0.0.15.

+1 on package-manager detection. PR #187 improves hints, but the core deploy behavior still appears to rely on npm install.

Happy to validate a candidate fix against our pnpm workspace app if that would be helpful.

@solracnyc commented on GitHub (Feb 28, 2026): We run a pnpm workspace monorepo and had to bypass `vinext deploy` because of `workspace:*` compatibility with npm-based install behavior. Our reliable path has been: ```bash vinext build wrangler deploy --name <worker-name> ``` This has been stable for us on Cloudflare Workers with vinext ~0.0.15. +1 on package-manager detection. PR #187 improves hints, but the core deploy behavior still appears to rely on `npm install`. Happy to validate a candidate fix against our pnpm workspace app if that would be helpful.

BreizhHardware referenced this issue

2026-05-06 12:38:51 +02:00

[PR #44] [CLOSED] feat(deploy): add --env support (wrangler env.*) #265

BreizhHardware referenced this issue

2026-05-06 12:38:52 +02:00

[PR #49] [MERGED] feat(deploy): add --env support with security and parsing improvements #269