Fix duplicate js-yaml@5.3.0 entries in pnpm-lock.yaml - #410
Merged
Merged
Conversation
Dependabot's lockfile update in #393 added a second js-yaml@5.3.0 block to both the packages and snapshots sections, leaving the file with duplicated YAML mapping keys. pnpm rejects it with ERR_PNPM_BROKEN_LOCKFILE, and Dependabot reports "can't parse your pnpm-lock.yaml" on every rebase attempt (see #389). Remove the duplicate blocks. Verified with `pnpm install --frozen-lockfile --lockfile-only`; a non-frozen lockfile-only install makes no further changes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
js-yaml@5.3.0blocks from thepackagesandsnapshotssections ofpnpm-lock.yaml. Nothing else changes.Why
Dependabot's lockfile update in #393 left
pnpm-lock.yamlwith duplicated YAML mapping keys. pnpm rejects the file:Dependabot uses pnpm's lockfile reader, so every rebase attempt on #389 fails with "Dependabot can't parse your pnpm-lock.yaml", and the daily Dependabot run has been failing since #393 merged.
Verification
pnpm install --frozen-lockfile --lockfile-onlypasses on this branch.pnpm install --lockfile-onlymakes no further changes, so no resolved versions move.package-lock.jsonis untouched and already in sync with npm.Follow-up
After merge, comment
@dependabot rebaseon #389.🤖 Generated with Claude Code