Renovate is not updating versions of other packages in package.json when attempting to update pnpm v9.9.0 to v9.10.0 together with other packages and causes a lockfile mismatch

[ChristianIvicevic]

What would you like help with?

I think I found a bug

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

All of my projects using Renovate are currently failing during pnpm install in my GitHub action due to an updated lockfile that doesn't match the package.json because Renovate did not correctly update that as part of the PR. An example of a public PR that has this issue at the time of writing this is the following: ChristianIvicevic/adios-axios#38

Only the packageManager key is updated but the other updated dependency as part of the PR are not reflected in the package.json only in the lockfile.

I scrolled through the logs but there is no error or warning indicating problems.

Logs (if relevant)

I wasn't able to find the relevant parts of the logs so I decided to copy all of it: https://gist.github.com/ChristianIvicevic/ef9fb2e68a01bdd0fe75aaf72b36f8a6

[rarkins]

The package.json is modified in that PR. Please update your title/description to be more specific about which modifications you expect

[ChristianIvicevic]

It is not modified as expected. I just updated the title. I expect the package.json to have updated versions of the other dependencies listed in package.json which are not correctly done by Renovate.

[github-actions[bot]]

Hi there,

Please give us specific logs, so we can help you more.

If you self-host Renovate: make sure you run Renovate with LOG_LEVEL=debug to get the debug log messages! Next, open the debug-level logs and search for packageFiles with updates. This text marks the start of a structured log message that shows every package file, dependency, and update that Renovate found.

Find the relevant dependency/dependencies in the log message, and copy/paste those parts into this discussion. If you do not know which bits we need, you can copy/paste the full log message.

Read the Renovate docs, Troubleshooting to learn more about getting the docs, and getting the correct type of logs.

Thanks, the Renovate team

[ChristianIvicevic]

The specific section on "packageFiles with updates" is here: https://gist.github.com/ChristianIvicevic/ef9fb2e68a01bdd0fe75aaf72b36f8a6#file-gistfile1-txt-L421-L1072

An example of one update not appearing in the package.json in the PR is this: https://gist.github.com/ChristianIvicevic/ef9fb2e68a01bdd0fe75aaf72b36f8a6#file-gistfile1-txt-L715-L746

[rarkins]

I see there's been a lot of force pushes to that branch. Please tick the " If you want to rebase/retry this PR, check this box" checkbox, observe if the results remain the same, and capture the new logs if any thing is different. In cases like these we need the logs for when the commit was made.

[ChristianIvicevic]

The linked log is already the result of a previous run of using that particular checkbox. I just issued another run and the result is the same and the new logs just differ in timing metrics and commit SHAs but nothing significantly different. For reference here are the latest logs: https://gist.github.com/ChristianIvicevic/f12b3e33c3e7527754fed2ed323ac741

[ChristianIvicevic]

Additionally in both cases the logs do indicate the other dependencies are updated in the package.json but it seems like these changes are discarded erroneously during the process: https://gist.github.com/ChristianIvicevic/f12b3e33c3e7527754fed2ed323ac741#file-gistfile1-txt-L1141-L1153

[rarkins]

Thanks, I can confirm that this reproduces here: https://github.com/renovate-reproductions/31323/pull/1/files

@RahulGautamSingh my guess is that this is related to the work you did recently on updating packageManager with hashes. I think this is happening:

• Renovate makes changes to package.json (in memory)
• Renovate updates the corepack packageManager using install-tool node 20.17.0 && install-tool corepack 0.29.4 && corepack use pnpm@9.10.0 without having written the updated package.json to disk first
• Renovate overwrites the earlier package.json changes with the results from the corepack update
• Renovate then runs the pnpm install command to update lockfile but because the package.json is unchanged except for packageManager then all other updates are lost/missed

I will convert this to a high priority bug issue