action-setup@v6 does not install pnpm version specified in package_json_file

This is probably the same underlying cause as #225

When specifying package_json_file and that package.json file has a packageManager field that specifies the version of pnpm to use, the v6 release does not load the specified version.

This results in the following error, which we are currently seeing across tens of repos:

ERR_PNPM_BROKEN_LOCKFILE  The lockfile at "<path>/pnpm-lock.yaml" is broken: expected a single document in the stream, but found more

The packageManager field is set to pnpm 10 in the specified package.json file:

$ grep packageManager package.json
  "packageManager": "pnpm@10.28.1",

The GitHub Action is invoked with the package_json_file input argument only:

    - name: Setup pnpm
      uses: pnpm/action-setup@v6
      with:
        package_json_file: "${{ inputs.working-directory }}/package.json"

link #228 #226

My workflow includes an auto-commit step after formatting, so I noticed that the new v6.0 workflow causes the following content to be added to the beginning of pnpm-lock.yaml:

---
lockfileVersion: '9.0'

importers:

  .:
    configDependencies: {}
    packageManagerDependencies:
      '@pnpm/exe':
        specifier: 10.33.0
        version: 10.33.0
      pnpm:
        specifier: 10.33.0
        version: 10.33.0

packages:

  '@pnpm/exe@10.33.0':
    resolution: {integrity: sha512-sGsjztJBelzVMd0RhceDJ3p8Hk7eBcpu4G/TF6REzIvNdkKyxDT0czc1BWyo8Kbg+U0OBtK/TAGXN7Art4rTdg==}
    hasBin: true

  '@pnpm/linux-arm64@10.33.0':
    resolution: {integrity: sha512-oYb5NxEyImqaTkLVX/7jL59m9Vfmd07iLWzr4Pg2LIk4XEtAllNcnksNHcp5Uf+lFk/BggtpOdvC84TG3VnbFw==}
    cpu: [arm64]
    os: [linux]
    hasBin: true

  '@pnpm/linux-x64@10.33.0':
    resolution: {integrity: sha512-JYD2GXDF2roKpvTg5s032lYcUcT9lMedYlzxoqitWTjKlkMhl2gXRYpiDHdi2mWC5nFOJYlgYbUuy6jh3rXhng==}
    cpu: [x64]
    os: [linux]
    hasBin: true

  '@pnpm/macos-arm64@10.33.0':
    resolution: {integrity: sha512-3w9Pqpw0swnAbnEdAKumMuKj+TPaGratnqC49bC41vjR1pNs0UMwVdOxiIROUMQy5OHKPx0IH/wOOP0hkhJd+g==}
    cpu: [arm64]
    os: [darwin]
    hasBin: true

  '@pnpm/macos-x64@10.33.0':
    resolution: {integrity: sha512-SBeiLjU/9ORMIXAMsD6+Ltaaesniwh49FeFcG6kA64Zxr30U9SyzeZDnNOyWCGFjHeCmGfzCnSpNEN4VNo827g==}
    cpu: [x64]
    os: [darwin]
    hasBin: true

  '@pnpm/win-arm64@10.33.0':
    resolution: {integrity: sha512-8X3NQqmfNVZ+dCu+EfD7ZkAgDgIKKdAgBBKcvhvMoMJq/nWHOfqDLxewE9TQ7qzVLuUKG/9b/xBVRVjdtDOm0w==}
    cpu: [arm64]
    os: [win32]
    hasBin: true

  '@pnpm/win-x64@10.33.0':
    resolution: {integrity: sha512-wiPVvxmTuB6FFn+rZ4FfSk1WTn+cxiQ7MTJEEz1k9VZLN/yZujGrv/WLYH2JcwzVTgObfmQuBKeNgEUavEL0Qg==}
    cpu: [x64]
    os: [win32]
    hasBin: true

  pnpm@10.33.0:
    resolution: {integrity: sha512-EFaLtKavtYyes2MNqQzJUWQXq+vT+rvmc58K55VyjaFJHp21pUTHatjrdXD1xLs9bGN7LLQb/c20f6gjyGSTGQ==}
    engines: {node: '>=18.12'}
    hasBin: true

snapshots:

  '@pnpm/exe@10.33.0':
    optionalDependencies:
      '@pnpm/linux-arm64': 10.33.0
      '@pnpm/linux-x64': 10.33.0
      '@pnpm/macos-arm64': 10.33.0
      '@pnpm/macos-x64': 10.33.0
      '@pnpm/win-arm64': 10.33.0
      '@pnpm/win-x64': 10.33.0

  '@pnpm/linux-arm64@10.33.0':
    optional: true

  '@pnpm/linux-x64@10.33.0':
    optional: true

  '@pnpm/macos-arm64@10.33.0':
    optional: true

  '@pnpm/macos-x64@10.33.0':
    optional: true

  '@pnpm/win-arm64@10.33.0':
    optional: true

  '@pnpm/win-x64@10.33.0':
    optional: true

  pnpm@10.33.0: {}

---

So it reports that the file is broken.

fix: respect requested pnpm version when bootstrap differs

fix(ci): pin pnpm version to work around action-setup v6 bug

test: add strict version-match jobs to reproduce #225 / #227

ci: go back to v4.4.0 for `pnpm/action-setup`

chore(deps): update ci and dev tooling (major) (#1551)

fix(ci): bump pnpm/action-setup v5→v6 with explicit version pin (#429)

Revert pnpm/action-setup to v5; keep SHA pins

SHA-pin third-party GitHub Actions (#16)

For me, this was fixed by updating to pnpm@10.33.1. See also the discussing in #228

The latest version still has this issue: packageManager specifies 10.33.1, but v11 is actually used, causing the error "This version of pnpm requires at least Node.js v22.13".

https://github.com/HowieHz/howiehz-misc/actions/runs/24783370219/job/72520449729?pr=73

ci: temporarily specify pnpm version manually to avoid mismatch error

fix(ci): pin pnpm version to bypass action-setup@v6 detection bug

ci: revert pnpm/action-setup to v4 and fix first-interaction v3 inputs (

ci: derive pnpm version dynamically from packageManager

ci: match pnpm version exactly to packageManager pin (#155)

ci: match pnpm version exactly to packageManager pin (#128)

Workaround (extract version from `package.json` with `jq`)

One workaround that keeps package.json as the source of truth is to extract the plain semver version before running pnpm/action-setup@v6, then pass it through the action's version input.

In sql-formatter-org/sql-formatter#949, the repo has only devEngines.packageManager, with a version including an integrity metadata hash:

{
  "devEngines": {
    "packageManager": {
      "name": "pnpm",
      "version": "11.0.8+sha512.4c4097e1dd2d42372c4e7fa5a791ff28fc75a484c7ac192e64b1df0fdef17594ba982f9b4fed9adfb3c757846f565b799b2763fb3733d1de1bcb82cf46684912"
    }
  }
}

Using jq, read this devEngines.packageManager version and remove the hash:

# Work around pnpm/action-setup v6 resolving the wrong version from package.json
# https://github.com/pnpm/action-setup/issues/227
- name: Read pnpm version
  id: pnpm-version
  run: 'echo "version=$(jq --raw-output ''.devEngines.packageManager.version | split("+")[0]'' package.json)" >> "$GITHUB_OUTPUT"'

- uses: pnpm/action-setup@v6
  with:
    version: ${{ steps.pnpm-version.outputs.version }}

was this intended to be one of the breaking changes in v6?

fix(ci): resolve issues found during sandbox validation (#8)

Harden Renovate config for Actions, pnpm and pre-commit

Set up Renovate for automated, drift-safe dependency updates (#271)

build(frontend): declare the pnpm version once, in package.json

chore: 文档站 pnpm 包整体迁入 docs/，根目录去 node 化

Navigation Menu

action-setup@v6 does not install pnpm version specified in `package_json_file` #227

3 remaining items

Workaround (extract version from `package.json` with `jq`)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

action-setup@v6 does not install pnpm version specified in package_json_file #227

Description

Activity

HowieHz commented on Apr 14, 2026

Lukas-Kullmann commented on Apr 22, 2026

HowieHz commented on Apr 22, 2026

3 remaining items

karlhorky commented on May 14, 2026

Workaround (extract version from package.json with jq)

NullVoxPopuli commented on May 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

action-setup@v6 does not install pnpm version specified in `package_json_file` #227

Workaround (extract version from `package.json` with `jq`)