Skip to content

fix(install): regenerate lockfile with --force on global install - #33970

Merged
nathanwhit merged 5 commits into
denoland:mainfrom
nathanwhit:fix/install-force-lockfile
May 12, 2026
Merged

nathanwhit merged 5 commits into
denoland:mainfrom
nathanwhit:fix/install-force-lockfile

Conversation

@nathanwhit

Copy link
Copy Markdown
Member

Summary

Fixes #33934.

When deno install --global --force (or --reload) was used, the auto-generated lockfile at <bin>/.<name>/deno.lock still pinned the old version, so version resolution returned the previously locked version instead of the latest.

This change removes the stale lockfile before re-running resolution in setup_config_dir when --force or --reload is specified. The user is explicitly asking for a fresh install in those cases, so honoring a stale auto-generated lockfile is a footgun.

Test plan

  • Added install_force_regenerates_lockfile unit test
  • Added install_reload_regenerates_lockfile unit test
  • cargo build --bin deno passes
  • ./tools/format.js + ./tools/lint.js clean

…tall

When `deno install --global --force` (or --reload) was used, the
auto-generated lockfile at `<bin>/.<name>/deno.lock` still pinned the
old version, so resolution returned the previously locked version
instead of the latest. Remove the stale lockfile before re-running
resolution so --force / --reload actually picks up newer versions.

Closes denoland#33934
@deno-cla-assistant

deno-cla-assistant Bot commented May 11, 2026 •

Copy link
Copy Markdown

Deno Individual Contributor License Agreement

All contributors have signed the CLA. Thank you!

Re-run CLA check


This is an automated message from CLA Assistant

@fibibot fibibot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix is well-scoped — deletion is limited to dir.join("deno.lock") inside the per-install config dir (~/.deno/bin/.<name>/), and the if lockfile_path.exists() guard handles the fresh-install case cleanly.

Two test nits:

  • install_reload_regenerates_lockfile sets reload: true and force: true. Since force || flags.reload short-circuits on the first true, the test doesn't actually exercise the reload-only path — passing force: false here would isolate it.
  • The same test calls rustls::crypto::aws_lc_rs::default_provider().install_default() while install_force_regenerates_lockfile doesn't. Both fetch from http://localhost:4545 (no TLS), so the rustls init looks cargo-culted — unless there's a code path I'm missing that lands on a TLS request.

Holding approval until CI is green (12 shards still in_progress at the head SHA).

@nathanwhit nathanwhit changed the title fix(install): regenerate lockfile with --force/--reload on global install fix(install): regenerate lockfile with --force on global install May 11, 2026

@fibibot fibibot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fdcb6e9d narrows the condition from force || flags.reload → force only. The linked issue #33934 explicitly lists both flags in the expected behaviour ("When --force (or --reload) is specified... the lockfile should be regenerated"). Was the reload removal intentional, or a misread of my prior nit about test isolation? The nit was "make the reload test actually exercise reload-only", not "drop reload from scope."

If --force-only is what you want, two test follow-ups:

  • install_reload_regenerates_lockfile still has force: true, so it's now a misleadingly-named force test. Either rename it or convert it to assert that force: false, reload: true does NOT remove the lockfile — that pins the new (narrowed) behaviour and prevents accidental reflow back to force || reload.
  • The rustls::default_provider().install_default() call in that test is now even more orphaned (no TLS path at all).

Holding approval until the scope question is settled and CI lands green.

@nathanwhit
nathanwhit enabled auto-merge (squash) May 11, 2026 22:19

@fibibot fibibot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

537d8416 renames the test to install_reload_preserves_lockfile, flips force: false, asserts post_reload_content == stale_lockfile, and drops the orphaned rustls init. That pins the narrowed --force-only scope and prevents accidental drift back to force || reload — both prior nits resolved and the scope question is answered by the test itself.

Heads-up on the linked issue: #33934's expected-behaviour section still names both flags, so if @bartlomieju wants --reload to also clear the lockfile that's a maintainer call — code is internally consistent either way.

Holding approval until CI lands green on 537d8416 (most shards still in_progress).

@lunadogbot

Copy link
Copy Markdown
Contributor

tools::installer::global::tests::install_reload_preserves_lockfile fails on all 3 platforms (cli/tools/installer/global.rs:1240): Could not find '[email protected]' in the list of packages. The test name and error match this PR's switch to --force lockfile regeneration — looks PR-introduced, not a flake.

@nathanwhit
nathanwhit merged commit 7a7b8d6 into denoland:main May 12, 2026
136 checks passed
littledivy pushed a commit to crowlKats/deno that referenced this pull request Jun 10, 2026
…oland#33970)

## Summary

Fixes denoland#33934.

When `deno install --global --force` (or `--reload`) was used, the
auto-generated lockfile at `<bin>/.<name>/deno.lock` still pinned the
old version, so version resolution returned the previously locked
version instead of the latest.

This change removes the stale lockfile before re-running resolution in
`setup_config_dir` when `--force` or `--reload` is specified. The user
is explicitly asking for a fresh install in those cases, so honoring a
stale auto-generated lockfile is a footgun.

## Test plan

- [x] Added `install_force_regenerates_lockfile` unit test
- [x] Added `install_reload_regenerates_lockfile` unit test
- [x] `cargo build --bin deno` passes
- [x] `./tools/format.js` + `./tools/lint.js` clean

---------

Co-authored-by: Bartek Iwańczuk <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

deno install --global --reload --force still uses stale lockfile, installs outdated version

4 participants