Make worker autoupdate an explicit choice

[kettanaito]

Scope

Improves an existing behavior

Compatibility

• This is a breaking change

Feature description

Current behavior

This package has a postinstall script that auto-copies the worker script to the consumer's specified directory. Executing arbitrary scripts in NPM packages is not a good idea.

Expected behavior

The consumer should instead include the auto-update functionality in their package.json as an explicit command they wish to have any time they reinstall dependencies:

{
  "scripts": {
    "postinstall": "npx msw update-worker"
  }
}

Possible CLI command names:

• update-worker
• autoupdate

[kettanaito]

Well, npx msw init already copies the worker. I don't even think this change is needed, it can be achieved as-is right now:

{
  "scripts": {
    "msw:update": "npx msw init ./public"
  }
}

[IanVS]

Is the worker auto-update intentional? If I have msw pinned to a specific version, why does this post-install step update the worker to the latest version, instead of the version I pinned it to?

[neurosnap]

With the recent security vulnerabilities leveraging postinstall to inject malicious code into app environments, this seems like an important change to make.

• https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
• https://www.nodejs-security.com/blog/npm-ignore-scripts-best-practices-as-security-mitigation-for-malicious-packages

[karlhorky]

This also affects all shadcn/ui commands, when pnpm strict-dep-builds: true configured (signals made by pnpm team that this will become default in future):

$ echo -e "# Fail on pnpm ignored build scripts\n# - https://github.com/pnpm/pnpm/pull/9071\nstrict-dep-builds=true" >> ~/.npmrc

$ cat ~/.npmrc
# Fail on pnpm ignored build scripts
# - https://github.com/pnpm/pnpm/pull/9071
strict-dep-builds=true

$ pnpm dlx shadcn@latest --help
...
 ERR_PNPM_IGNORED_BUILDS  Ignored build scripts: msw

Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts.

Workaround

Adding --allow-build=msw to the pnpm dlx command works around the error

$ pnpm --allow-build=msw dlx shadcn@latest --help     
Usage: shadcn [options] [command]

add items from registries to your project

Options:
  -v, --version                          display the version number
  -h, --help                             display help for command

Commands:
  init [options] [components...]         initialize your project and install dependencies
  add [options] [components...]          add a component to your project
  diff [options] [component]             check for updates against the registry
  view [options] <items...>              view items from the registry
  search|list [options] <registries...>  search items from registries
  migrate [options] [migration]          run a migration.
  info [options]                         get information about your project
  build [options] [registry]             build components for a shadcn registry
  mcp [options]                          MCP server and configuration commands
  registry:build [options] [registry]    builds the registry [EXPERIMENTAL]
  registry:mcp [options]                 starts the registry MCP server [DEPRECATED]
  help [command]                         display help for command

cc @shadcn

[kettanaito]

You should disable the postinstall script and use the MSW CLI directly to provision worker updates whenever suits best for your app (just call npx msw init with worker paths saved in package.json). The pieces are there and you can put them together as of today.

[karlhorky]

@kettanaito I'm not sure what you mean. MSW is not a dependency of my project, it's a dependency of shadcn, which is being run with pnpm dlx (same idea as npx).

Users don't decide what these other modules like shadcn do - and in shadcn's case it decides to use msw as a dependency (see shadcn@3.4.2/package.json), which runs the MSW postinstall script automatically upon download of shadcn, which happens on any command starting with pnpm dlx shadcn@latest.

You can see in the Next.js docs for shadcn/ui that there are many commands in the docs that start with that prefix.

[kettanaito]

@karlhorky, I was only referring to direct consumers of MSW in the post above. For indirect consumers, like ShadCN, there's nothing you can do. That was not to say we aren't going to remove the postinstall script. We certainly will! I was providing temporary measures for people wishing to move away from it right now (if that's applicable to their case).

Bear in mind that even for indirect consumers, if you disable postintall hooks on your package manager level (which PNPM allows you to do), nothing down the dependency tree will execute those hooks.