fix(deps): restore node-addon-api and node-gyp for sharp's native build fallback - #4673
Merged
Merged
Conversation
…ld fallback PR #4660 (#4621) removed these as "unused" based on a source-grep that found zero import statements -- but sharp's own install script falls back to building its native binding from source via node-gyp when no matching prebuilt binary is available for the current platform/arch/Node version, and that build-from-source path explicitly requires node-addon-api. A source grep can't see this: npm's own postinstall/build machinery pulls these in, not application code. Confirmed as a live, reproducible regression: `npm ci` on a clean checkout of current main fails outright with "sharp: Please add node-addon-api to your dependencies" on this platform (macOS arm64, Node 26). CI apparently didn't catch it because its runner has a matching prebuilt sharp binary available, so the source-build fallback never triggers there -- but any local dev setup (or self-hoster) on a platform without one does hit it. @hookform/resolvers's removal (also part of #4660/#4621) is unaffected and stays removed -- unrelated to this failure mode. Fixes #4672
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4673 +/- ##
=======================================
Coverage 94.13% 94.13%
=======================================
Files 434 434
Lines 38542 38542
Branches 14056 14056
=======================================
Hits 36282 36282
Misses 1601 1601
Partials 659 659 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
PR #4660 (#4621) removed
node-addon-api/node-gypbased on a source-grep finding zero importstatements — correct about application code, but it missed that
sharp's own install script needsnode-addon-apias a build-from-source fallback when no matching prebuilt native binary is available forthe current platform/arch/Node combination.
node-gypperforms that build. Neither is ever imported bysource — npm's own postinstall/build machinery pulls them in.
Verified regression
Reproduced on a completely clean, unmodified checkout of current
main:npm cifails outright withsharp: Please add node-addon-api to your dependencieson macOS arm64 / Node 26. CI didn't catch itbecause its runner apparently has a matching prebuilt
sharpbinary cached, so the source-build fallbacknever triggers there — but any local dev setup or self-hoster on a platform without one hits this
immediately.
Fix
Restore both dependencies, regenerate the lockfile. Confirmed
rm -rf node_modules && npm cinowsucceeds cleanly, and
npm run typecheckpasses.@hookform/resolvers's removal (also from #4660) isunrelated and stays removed.
Fixes #4672