PNPM v10 not supported in NX Webpack Pluginpackage.json generation

[estiller]

Current Behavior

Starting from PNPM v10, PNPM requires maintaining an onlyBuiltDependencies list in package.json for allow-listing dependencies that can have their post-install scripts executed (see https://github.com/pnpm/pnpm/releases/tag/v10.0.0).

We can use it, and it's okay, but when the NX Webpack plugin generates a minimal package.json for a specific app, it doesn't copy these definitions over to the generated files, potentially causing runtime issues for applications built using the generated file.

The package.json file is generated using this code: https://github.com/nrwl/nx/blob/master/packages/nx/src/plugins/js/package-json/create-package-json.ts

Expected Behavior

The NX Webpack plugin should copy over the onlyBuiltDependencies for the generated package.json files using PNPM.

GitHub Repo

https://github.com/estiller/nx-pnpm-v10-issue

Steps to Reproduce

1. Checkout the repo and run pnpm nx build demo on the main branch. This branch uses PNPM v9. Note that the generated package.json under dist/apps/demo is generated as expected.
2. Checkout the pnpm-10 branch (this is the relevant commit).
3. Run pnpm install and allow corepack to install the latest version of pnpm if it is not already available.
4. Execute pnpm nx build demo --skip-nx-cache.
5. Note the generated package.json under dist/apps/demo now uses PNPM v10, but the onlyBuiltDependencies field is not copied over.
6. Running pnpm install under the dist/apps/demo folder results in a warning, and post-install scripts are not executed.

Nx Report

❯ pnpm nx report

 NX   Report complete - copy this into the issue template

Node           : 22.11.0
OS             : darwin-arm64
Native Target  : aarch64-macos
pnpm           : 10.5.2

nx                 : 20.4.6
@nx/js             : 20.4.6
@nx/jest           : 20.4.6
@nx/eslint         : 20.4.6
@nx/workspace      : 20.4.6
@nx/devkit         : 20.4.6
@nx/eslint-plugin  : 20.4.6
@nx/nest           : 20.4.6
@nx/node           : 20.4.6
@nx/web            : 20.4.6
@nx/webpack        : 20.4.6
typescript         : 5.7.3
---------------------------------------
Registered Plugins:
@nx/webpack/plugin
@nx/eslint/plugin
@nx/jest/plugin

Failure Logs

When running pnpm install using the generated package.json under dist/apps/demo you get:

❯ cd dist/apps/demo
❯ pnpm install
Lockfile is up to date, resolution step is skipped
Packages: +111
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Progress: resolved 111, reused 105, downloaded 6, added 111, done

dependencies:
+ @nestjs/common 10.4.15
+ @nestjs/core 10.4.15
+ @nestjs/platform-express 10.4.15
+ reflect-metadata 0.1.14
+ rxjs 7.8.2

╭ Warning ───────────────────────────────────────────────────────────────────────────────────╮
│                                                                                            │
│   Ignored build scripts: @nestjs/core.                                                     │
│   Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts.   │
│                                                                                            │
╰────────────────────────────────────────────────────────────────────────────────────────────╯

Done in 799ms using pnpm v10.5.2

Package Manager Version

pnpm 10.5.2

Operating System

• macOS
• Linux
• Windows
• Other (Please specify)

Additional Information

See also the discussion on the PNPM repo - https://github.com/orgs/pnpm/discussions/9205