pnpmBuildHook: missing `verifyDepsBeforeRun` config with pnpm 11

Nixpkgs version

• Unstable (26.11)

Describe the bug

I use pnpmBuildHook with a package with pnpm 11. In this package, I intentionally limit the installation to a couple of workspace packages so that the node_modules folder doesn't get too big.

With that said, that led me to a bug in pnpm (https://github.com/pnpm/pnpm/issues/11865) where pnpm run and pnpm exec check the node_modules against the lockfile before every execution and this is done across all workspace projects instead of only the filtered ones due to this bug. This then fails because there is no internet connection to download the missing dependencies in the sandbox.

Even though this is a bug in pnpm, I imagine that nixpkgs isn't really interested in this behavior either way because we are the ones responsible for doing node_modules management when using pnpmBuildHooks. Besides, this might be a problem in sandboxes where network restrictions are more relaxed (looking at you, Darwin).

With that said, my proposal is that we set the pnpm_config_verify_deps_before_run environment variable to false. We already do similar stuff with pnpm_config_trust_lockfile and pnpm_config_pm_on_fail.

Steps to reproduce

nix build github:limwa/nix-t3code/20572c0e703b1442a591aed4601cf1022deafaca#t3code-nightly

Expected behaviour

Running pnpm run inside a Nix sandbox shouldn't fail when using filters for specific workspace packages.

Screenshots

No response

Relevant log output

Additional context

No response

System metadata

• system: "x86_64-linux"
• host os: Linux 7.1.3, NixOS, 26.11 (Zokor), 26.11.20260712.702252e
• multi-user?: yes
• sandbox: yes
• version: nix-env (Lix, like Nix) 2.95.2 System type: x86_64-linux Additional system types: aarch64-linux, i686-linux, riscv64-linux Features: gc, signed-caches System configuration file: /etc/nix/nix.conf User configuration files: /home/lima/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/home/lima/.local/share/flatpak/exports/etc/xdg/nix/nix.conf:/var/lib/flatpak/exports/etc/xdg/nix/nix.conf:/home/lima/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/home/lima/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/lima/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf:/nix/store/qxw7d65lw7wgadf8jzxs5hhr29ir1kv1-gnome-settings-daemon-50.1/etc/xdg/nix/nix.conf Store directory: /nix/store State directory: /nix/var/nix Data directory: /nix/store/2nw76vyah7afirff1b87c1a8k0bwidwd-lix-2.95.2/share
• channels(root): "home-manager, nixos, nixos-hardware"
• nixpkgs: /run/current-system/nixpkgs

Notify maintainers

@Scrumplex @gepbird

---

Note for maintainers: Please tag this issue in your pull request description. (i.e. Resolves #ISSUE.)

I assert that this issue is relevant for Nixpkgs

• I assert that this is a bug and not a support request.
• I assert that this is not a duplicate of an existing issue.
• I assert that I have read the NixOS Code of Conduct and agree to abide by it.
• I assert that I have read the automation/AI policy and that this issue report complies with it.

Is this issue important to you?

Add a 👍 reaction to issues you find important.

Locate the pnpmBuildHook implementation and the nearby configuration assignments for pnpm_config_trust_lockfile and pnpm_config_pm_on_fail. Confirm how the hook invokes pnpm, apply the requested verify_deps_before_run setting, and use the provided nix build reproduction to verify filtered workspace builds no longer fail in the sandbox.