fix(cli,icongenie,create-quasar): pnpm >= 11 aborted installs over unapproved build scripts

Same defect just fixed in app-vite: pnpm 11 turned "Ignored build scripts"
into a fatal error (pnpm 10 only warned), so a dependency with an unapproved
build script anywhere in the tree made "pnpm add"/"pnpm install" exit 1 even
though the packages did install. That left "quasar upgrade" with the
package.json versions bumped and nothing installed to match, had icongenie
report "Failed to install @capacitor/splash-screen" for a package that is in
fact there, and made create-quasar declare a fresh project's install a failure
(dropping its lint and dev-command steps with it).

Their pnpm install/add params now carry --config.strict-dep-builds=false
(accepted by pnpm 9/10/11), which only drops the fatal exit: same resolution,
byte-identical lockfile, build scripts still not run, notice still printed. The
user resolves the ignored builds with "pnpm approve-builds" on their own time
and their own installs keep enforcing whatever they configured.

Author: rstoenescu

cli/lib/node-packager.js

@@ -275,16 +275,32 @@ class Yarn extends PackageManager {
   }
 }
 
+// pnpm >= 11 exits with an error when any dependency in the tree has a build
+// script that was not approved (pnpm 10 only warned about it), even though the
+// packages did get installed. "quasar upgrade" must not abort over that, with
+// the package.json versions already bumped but nothing installed to match —
+// the user resolves it with "pnpm approve-builds" on their own time, and their
+// own installs keep enforcing whatever they configured.
+// Unknown "--config.<key>" params are accepted by any pnpm version.
+const pnpmIgnoredBuildsParam = '--config.strict-dep-builds=false'
+
 class Pnpm extends PackageManager {
   name = 'pnpm'
   lockFiles = ['pnpm-lock.yaml']
 
   getInstallParams(env) {
-    return env === 'development' ? ['install'] : ['install', '--prod']
+    return env === 'development'
+      ? ['install', pnpmIgnoredBuildsParam]
+      : ['install', '--prod', pnpmIgnoredBuildsParam]
   }
 
   getInstallPackageParams(names, isDevDependency) {
-    return ['add', isDevDependency ? '--save-dev' : '', ...names]
+    return [
+      'add',
+      pnpmIgnoredBuildsParam,
+      isDevDependency ? '--save-dev' : '',
+      ...names
+    ]
   }
 
   getUninstallPackageParams(names) {

cli/lib/node-packager.test.js

@@ -59,20 +59,33 @@ describe('[node-packager.js]', () => {
       makeProjectDir('npm-params', 'package-lock.json')
     )
 
+    // pnpm >= 11 fails the command over unapproved build scripts anywhere in
+    // the tree, so every pnpm install params list opts out of that
+    const noStrictBuilds = '--config.strict-dep-builds=false'
+
     test('build the package manager specific install arguments', () => {
-      expect(pnpm.getInstallParams('development')).toEqual(['install'])
-      expect(pnpm.getInstallParams('production')).toEqual(['install', '--prod'])
+      expect(pnpm.getInstallParams('development')).toEqual([
+        'install',
+        noStrictBuilds
+      ])
+      expect(pnpm.getInstallParams('production')).toEqual([
+        'install',
+        '--prod',
+        noStrictBuilds
+      ])
       expect(npm.getInstallParams('development')).toEqual(['install'])
     })
 
     test('build the add/remove package arguments', () => {
       expect(pnpm.getInstallPackageParams(['quasar'], false)).toEqual([
         'add',
+        noStrictBuilds,
         '',
         'quasar'
       ])
       expect(pnpm.getInstallPackageParams(['quasar'], true)).toEqual([
         'add',
+        noStrictBuilds,
         '--save-dev',
         'quasar'
       ])

create-quasar/lib/utils.js

@@ -258,7 +258,16 @@ async function runCommand({
 async function installDeps(scope) {
   const hadError = await runCommand({
     cmd: scope.install,
-    args: ['install'],
+    args:
+      scope.install === 'pnpm'
+        ? // pnpm >= 11 exits with an error when any dependency in the tree has
+          // a build script that was not approved (pnpm 10 only warned about
+          // it), even though the packages did get installed — we would then
+          // wrongly declare the fresh project's install a failure. The user
+          // resolves those with "pnpm approve-builds" on their own time, and
+          // their own installs from here on keep enforcing it.
+          ['install', '--config.strict-dep-builds=false']
+        : ['install'],
     cwd: scope.projectFolder,
     message: `Installing dependencies using ${scope.install.toUpperCase()}...`,
     successMessage: 'Dependencies installed successfully!',

icongenie/lib/utils/package-manager.js

@@ -155,17 +155,30 @@ class Yarn extends PackageManager {
   }
 }
 
+// pnpm >= 11 exits with an error when any dependency in the tree has a build
+// script that was not approved (pnpm 10 only warned about it), even though the
+// packages did get installed — which would have us report "Failed to install"
+// for a package that is in fact there. The user resolves the ignored builds
+// with "pnpm approve-builds" on their own time; their own installs keep
+// enforcing whatever they configured. It is a no-op next to
+// "--dangerously-allow-all-builds" (nothing is ignored then), and unknown
+// "--config.<key>" params are accepted by any pnpm version.
+const pnpmIgnoredBuildsParam = '--config.strict-dep-builds=false'
+
 class Pnpm extends PackageManager {
   name = 'pnpm'
   lockFiles = ['pnpm-lock.yaml']
 
   getInstallParams(env) {
-    return env === 'development' ? ['install'] : ['install', '--prod']
+    return env === 'development'
+      ? ['install', pnpmIgnoredBuildsParam]
+      : ['install', '--prod', pnpmIgnoredBuildsParam]
   }
 
   getInstallPackageParams(names, isDevDependency, allowBuilds) {
     return [
       'add',
+      pnpmIgnoredBuildsParam,
       isDevDependency ? '--save-dev' : '',
       allowBuilds ? '--dangerously-allow-all-builds' : '',
       ...names