pnpm dedupe fails if package.json engines is not pinned

[anomiex]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us what version of Renovate you run.

37.18.4

If you're self-hosting Renovate, select which platform you are using.

github.com

Was this something which used to work for you, and then stopped?

It used to work, and then stopped

Describe the problem

When using renovate with a value for .engines.pnpm in package.json that is not a pinned version and postUpdateOptions: [ 'pnpmDedupe' ] set, Renovate complains in the PR

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

undefined

Minimal reproduction: https://github.com/anomiex/renovate-test/
Example: anomiex/renovate-test#17 (comment)

The trace in the log points to

renovate/lib/modules/manager/npm/post-update/pnpm.ts

Line 91 in df273f7

semver.gte(pnpmVersionFromPackageJson, '8.8.0')

which was added in #24505. I suspect this will start happening on your hosted app as well once that is updated to 37.9.0 or greater; currently it appears to still be on 37.8.1 so the issue does not occur there.

Relevant debug logs

Logs

DEBUG: Spawning pnpm install to create pnpm-lock.yaml (repository=anomiex/renovate-test, branch=renovate-sh/chalk-5.x)
DEBUG: No node constraint found - using latest (repository=anomiex/renovate-test, branch=renovate-sh/chalk-5.x)
DEBUG: lock file error (repository=anomiex/renovate-test, branch=renovate-sh/chalk-5.x)
       "cmd": "pnpm",
       "err": {
         "message": "Invalid Version: ^8.6.0",
         "stack": "TypeError: Invalid Version: ^8.6.0\n    at new SemVer (/opt/containerbase/tools/renovate/37.18.4/node_modules/semver/classes/semver.js:38:13)\n    at compare (/opt/containerbase/tools/renovate/37.18.4/node_modules/semver/functions/compare.js:3:3)\n    at Object.gte (/opt/containerbase/tools/renovate/37.18.4/node_modules/semver/functions/gte.js:2:30)\n    at Object.generateLockFile (/opt/containerbase/tools/renovate/37.18.4/node_modules/renovate/lib/modules/manager/npm/post-update/pnpm.ts:91:16)\n    at getAdditionalFiles (/opt/containerbase/tools/renovate/37.18.4/node_modules/renovate/lib/modules/manager/npm/post-update/index.ts:663:17)\n    at processBranch (/opt/containerbase/tools/renovate/37.18.4/node_modules/renovate/lib/workers/repository/update/branch/index.ts:471:31)\n    at writeUpdates (/opt/containerbase/tools/renovate/37.18.4/node_modules/renovate/lib/workers/repository/process/write.ts:159:17)\n    at update (/opt/containerbase/tools/renovate/37.18.4/node_modules/renovate/lib/workers/repository/process/extract-update.ts:214:11)\n    at Object.renovateRepository (/opt/containerbase/tools/renovate/37.18.4/node_modules/renovate/lib/workers/repository/index.ts:76:19)\n    at attributes.repository (/opt/containerbase/tools/renovate/37.18.4/node_modules/renovate/lib/workers/global/index.ts:184:11)\n    at start (/opt/containerbase/tools/renovate/37.18.4/node_modules/renovate/lib/workers/global/index.ts:169:7)\n    at /opt/containerbase/tools/renovate/37.18.4/node_modules/renovate/lib/renovate.ts:18:22"
       },
       "stdout": undefined,
       "stderr": undefined,
       "type": "pnpm"

Have you created a minimal reproduction repository?

I have linked to a minimal reproduction in the description above

[rarkins]

Reverting in #25208

FYI @liby

[liby]

I will use semver.coerce to handle the version strings properly and resolve this issue.

[rarkins]

I think it will be more accurate if you use semver.intersects('>=8.8.0', ...) as otherwise a range like >=6.0.0 <9.0.0 will return 6.0.0, and ^8.0.0 will return 8.0.0.

[liby]

#25210 (comment)

[karlhorky]

I think pnpm dedupe still fails when there is no engines configured in package.json (see ExecError: Command failed: pnpm dedupe below).

Is engines in package.json a prerequisite for Renovate with pnpm? If yes, then maybe it can be communicated somewhere.

DEBUG: rawExec err (branch="renovate/dependency-upgrades-non-major")
{
  "err": {
    "cmd": "/bin/sh -c pnpm dedupe --config.ignore-scripts=true",
    "stderr": "",
    "stdout": "\u001b[?25l\u001b[36m?\u001b[39m \u001b[1mThe modules directory at \"/tmp/renovate/repos/github/karlhorky/project/node_modules\" will be removed and reinstalled from scratch. Proceed?\u001b[22m \u001b[2m(Y/n)\u001b[22m \u001b[2m‣\u001b[22m \u001b[36mtrue\u001b[39m\u001b[4D",
    "options": {
      "cwd": "/tmp/renovate/repos/github/karlhorky/project",
      "encoding": "utf-8",
      "env": {
        "NPM_CONFIG_CACHE": "/runner/cache/others/npm",
        "npm_config_store": "/runner/cache/others/pnpm",
        "npm_config_cache_dir": "/runner/cache/others/pnpm-cache",
        "npm_config_store_dir": "/runner/cache/others/pnpm-store",
        "HOME": "/home/ubuntu",
        "PATH": "/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
        "LC_ALL": "C.UTF-8",
        "LANG": "C.UTF-8",
        "CONTAINERBASE_CACHE_DIR": "/runner/cache/containerbase"
      },
      "maxBuffer": 10485760,
      "timeout": 900000
    },
    "signal": "SIGTERM",
    "name": "ExecError",
    "message": "Command failed: pnpm dedupe --config.ignore-scripts=true\nInterrupted by SIGTERM",
    "stack": "ExecError: Command failed: pnpm dedupe --config.ignore-scripts=true\nInterrupted by SIGTERM\n    at ChildProcess.<anonymous> (/usr/local/renovate/lib/util/exec/common.ts:111:11)\n    at ChildProcess.emit (node:events:530:35)\n    at ChildProcess.emit (node:domain:489:12)\n    at Process.ChildProcess._handle.onexit (node:internal/child_process:293:12)"
  }
  "durationMs": 900024
}

The behavior that I observed was that Renovate then does not create any PRs and doesn't show any errors anywhere either.

[karlhorky]

Workaround

Adding the following engines config block to package.json caused Renovate to avoid the pnpm dedupe error and start creating PRs again in one of my projects:

  "engines": {
    "node": ">=22.16.0"
  }

However, it appears that this doesn't work in all projects. (reference 1, reference 2)