Widen engines.pnpm to >=9.6.0 so Dependabot's pnpm 11 can run - #411
Merged
Merged
Conversation
Dependabot's npm_and_yarn image now runs pnpm 11.17.0. pnpm always enforces the root project's engines.pnpm field, so with the previous range (^9.6.0 || ^10.8.0) it fails with ERR_PNPM_UNSUPPORTED_ENGINE and Dependabot reports "does not support your pnpm version" on every rebase attempt (see #389). Dependabot does try to activate a pnpm 10 via corepack to satisfy the range, but falls back to its bundled 11.x when that activation fails. Drop the ceiling, keep the floor. Verified with pnpm 10.28.0 and pnpm 11.17.0 using `pnpm install --frozen-lockfile --lockfile-only`; pnpm 11 leaves pnpm-lock.yaml unchanged. The root entry in package-lock.json is synced via `npm install --package-lock-only`. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
engines.pnpmfrom^9.6.0 || ^10.8.0to>=9.6.0inpackage.json, and sync the mirrored root entry inpackage-lock.json.Why
After #410 fixed the lockfile parse error, Dependabot got further and now fails on #389 with "Dependabot does not support your pnpm version".
Dependabot's image runs pnpm 11.17.0. pnpm always enforces the root project's
engines.pnpm, so it refuses to install:Dependabot maps that exact message to its "unsupported pnpm version" error. It does try to activate a pnpm 10 via corepack to satisfy the range, but falls back to its bundled 11.x when that fails, so a
packageManagerpin would most likely hit the same fallback.>=9.6.0keeps the floor from #28 and drops the ceiling that only Dependabot trips on. An explicit|| ^11.0.0would break again when Dependabot moves to pnpm 12.Verification
pnpm install --frozen-lockfile --lockfile-onlypasses with pnpm 10.28.0.npx pnpm@11.17.0), where it failed before.pnpm-lock.yamlbyte-identical, so no lockfile churn for anyone on pnpm 10.Follow-up
After merge, comment
@dependabot rebaseon #389.🤖 Generated with Claude Code