Default pnpm version bumped to 9.15.9

[avm99963]

I see that recently the pnpm version used by the aspect_rules_js module itself was increased to 9.15.9 in cbc33b5#diff-6136fc12446089c3db7360e923203dd114b6a1466252e71667c6791c20fe6bdcL34-R35.

As a result, all consumers of your module now use that version instead of the default v8 when they are using the default MODULE.bazel snippet that appears in the release notes. I figured out that this occurs because when several modules use the same pnpm repository name, the module extension selects the largest version:

rules_js/npm/private/pnpm_extension.bzl

Lines 78 to 90 in 3ba5536

	# Use "Minimal Version Selection" like bzlmod does for resolving module conflicts
	# Note, the 'sorted(list)' function in starlark doesn't allow us to provide a custom comparator
	if len(versions) > 1:
	selected = versions[0]
	selected_tuple = _parse_version(selected)
	for idx in range(1, len(versions)):
	if _parse_version(versions[idx]) > selected_tuple:
	selected = versions[idx]
	selected_tuple = _parse_version(selected)
	result.notes.append("NOTE: repo '{}' has multiple versions {}; selected {}".format(name, versions, selected))
	else:
	selected = versions[0]

I wanted to create this thread just in case this change wasn't intended (otherwise, sorry for the inconvenience!). I think this might be the case because of the following comment, but I don't know whether it is up to date:

rules_js/npm/private/pnpm_repository.bzl

Lines 9 to 10 in 3ba5536

	# Default to the latest pnpm v8 since pnpm v9 has breaking changes in the lockfile that have not yet been
	# tested at scale to ensure all corner cases are covered in the wild.

Also, out of curiosity, could you help me understand what's the use case for allowing different pnpm repo names?

Thanks! :)

CC: @jbedard

[jbedard]

Changing the default was definitely not intended until rules_js v3 😲

[jbedard]

I'll tag a 1.8.1 release soon to fix the pnpm default version thing once #2439 merges

[avm99963]

Thanks @jbedard! :)

[jbedard]

For multiple pnpm versions... some large monorepos might depend on multiple versions unfortunately 🤷

[avm99963]

That makes a lot of sense, thanks!