From bf0e09a509e8e0a74167b0307d129202bc3f40d2 Mon Sep 17 00:00:00 2001
From: Paul Gschwendtner <paulgschwendtner@gmail.com>
Date: Sun, 23 Feb 2025 12:19:04 +0100
Subject: [PATCH] fix: runtime dependency missing as explicit dependency
 (#5101)

* fix: runtime dependency missing as explicit dependency

Currently, when `@verdaccio/signature` is loaded, in particular the `signature.js` file, the `@verdaccio/config` module is being loaded but it's not an explicit dependency. It's just a dev dependency. This is problematic with e.g. pnpm as package manager which intentionally tries to prevent such "leaking"/"escaping" of dependencies.

* lock file

---------

Co-authored-by: Juan Picado <juanpicado19@gmail.com>
---
 .changeset/ninety-geese-do.md   | 5 +++++
 packages/signature/package.json | 2 +-
 pnpm-lock.yaml                  | 6 +++---
 3 files changed, 9 insertions(+), 4 deletions(-)
 create mode 100644 .changeset/ninety-geese-do.md

diff --git a/.changeset/ninety-geese-do.md b/.changeset/ninety-geese-do.md
new file mode 100644
index 000000000..c55086563
--- /dev/null
+++ b/.changeset/ninety-geese-do.md
@@ -0,0 +1,5 @@
+---
+'@verdaccio/config': patch
+---
+
+fix: runtime dependency missing as explicit dependency
diff --git a/packages/signature/package.json b/packages/signature/package.json
index e20f4513c..39c7264e8 100644
--- a/packages/signature/package.json
+++ b/packages/signature/package.json
@@ -38,11 +38,11 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
+    "@verdaccio/config": "workspace:8.0.0-next-8.9",
     "jsonwebtoken": "9.0.2",
     "debug": "4.4.0"
   },
   "devDependencies": {
-    "@verdaccio/config": "workspace:8.0.0-next-8.9",
     "@verdaccio/types": "workspace:13.0.0-next-8.3"
   },
   "funding": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 4f02617a9..aa5730918 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1610,6 +1610,9 @@ importers:
 
   packages/signature:
     dependencies:
+      '@verdaccio/config':
+        specifier: workspace:8.0.0-next-8.9
+        version: link:../config
       debug:
         specifier: 4.4.0
         version: 4.4.0(supports-color@5.5.0)
@@ -1617,9 +1620,6 @@ importers:
         specifier: 9.0.2
         version: 9.0.2
     devDependencies:
-      '@verdaccio/config':
-        specifier: workspace:8.0.0-next-8.9
-        version: link:../config
       '@verdaccio/types':
         specifier: workspace:13.0.0-next-8.3
         version: link:../core/types