fix(cache): stop tracking pnpm's workspace state files

[wan9chi]

Motivation

node_modules/.pnpm-workspace-state-v1.json records pnpm's dependency check before pnpm run and pnpm exec, which pnpm 11 runs by default (verify-deps-before-run: install). Every task that runs pnpm run reads it. pnpm rewrites it with a new lastValidatedTimestamp whenever it rechecks dependencies, which happens when a manifest is newer than the last check, for example after switching branches away and back. It also holds absolute project directories. So a cached task missed with 'node_modules/.pnpm-workspace-state-v1.json' modified after any other pnpm command had rechecked, and across checkouts.

Changes

• node_modules/.pnpm-workspace-state-*.json files in any node_modules directory are skipped when recording tracked accesses, next to .git, so they're neither inputs nor outputs. The pattern also covers future versions of the file and pnpm workspaces nested inside the vite-task workspace.
• Whether pnpm's check passes doesn't change what a cached task outputs. If it fails, pnpm runs pnpm install inside the task, which modifies node_modules. The file's settings mirror config files the nested pnpm reads anyway.
• The e2e test runs a real pnpm run task. It stays a cache hit after an uncached pnpm run rechecks dependencies and rewrites the state file, and without the skip it misses. To run pnpm's JavaScript build at a pinned version, vite-task-tools now depends on the pnpm npm package, kept in sync with packageManager. The test is ignored by default, like the other Node-backed fixtures.

🤖 Generated with Claude Code

[github-actions]

fspy benchmark

linux

dynamic/launch             change  -0.28%  [ -3.69% ..  +3.52%]  overhead   +46.51%
dynamic/access             change  +0.00%  [ -1.73% ..  +1.39%]  overhead    +7.37%
dynamic/access-relative    change  +0.06%  [ -3.69% ..  +3.31%]  overhead   +54.18%
dynamic/access-contended   change  +0.37%  [ -2.90% ..  +4.09%]  overhead   +11.53%
static/launch              change  +1.33%  [ -4.28% ..  +7.61%]  overhead  +157.83%
static/access              change  +0.96%  [ -6.04% ..  +9.23%]  overhead  +760.23%
static/access-relative     change  +1.14%  [ -5.80% ..  +8.29%]  overhead +1170.66%
static/access-contended    change  +0.77%  [ -2.56% ..  +5.30%]  overhead +2625.25%

macos

dynamic/launch             change  -0.26%  [ -2.66% ..  +2.86%]  overhead  +216.99%
dynamic/access             change  +0.00%  [ -3.73% ..  +4.32%]  overhead    +4.40%
dynamic/access-relative    change  -0.10%  [ -3.80% ..  +2.67%]  overhead  +257.35%
dynamic/access-contended   change  -1.01%  [ -5.47% ..  +4.59%]  overhead    +4.72%

windows

dynamic/launch             change  -0.20%  [ -2.52% ..  +1.20%]  overhead   +24.25%
dynamic/access             change  +0.00%  [ -0.98% ..  +0.78%]  overhead    +1.01%
dynamic/access-relative    change  -0.19%  [ -0.76% ..  +0.58%]  overhead    +0.99%
dynamic/access-contended   change  +0.19%  [ -0.74% ..  +0.73%]  overhead    +1.15%

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​pnpm@​11.24.0

View full report