CircleCI-Public / CircleCI-Public/node-orb
install-pnpm latest-version detection breaks when pnpm package.json has a dependency key ending in "version" (@pnpm/engine.runtime.system-version)
- Dominant language
- Shell
- Stars
- 57
- Forks
- 76
- PR merge metrics
- No merged PRs in 30d
Description
## Orb version:
circleci/node@7.2.1 (also present on master / install-pnpm.sh)
## What happened:
When `install-pnpm: true` is used without pinning `pnpm-version`, the latest-version
detection in `src/scripts/install-pnpm.sh` breaks.
It parses pnpm's package.json from jsdelivr with:
curl -s https://cdn.jsdelivr.net/npm/pnpm/package.json | sed -n 's/.*version": "\(.*\)".*/\1/p'
As of pnpm 11.12.0, package.json contains a dependency whose key ends in `version`
(`@pnpm/engine.runtime.system-version`), so the `sed` matches two lines:
$ curl -s https://cdn.jsdelivr.net/npm/pnpm/package.json | sed -n 's/.*version": "\(.*\)".*/\1/p'
11.12.0
1100.0.3
This makes the script run `npm install -g pnpm@11.12.0\n1100.0.3`, which fails:
npm error code ETARGET
npm error notarget No matching version found for pnpm@11.12.0
npm error notarget 1100.0.3.
Every job that installs pnpm via the orb without a pinned version currently fails
at the "Install pnpm" step.
## Expected behavior:
The orb should detect only the top-level `version` field, e.g. by parsing the JSON
properly instead of a line-based regex:
PNPM_ORB_VERSION=$(curl -s https://cdn.jsdelivr.net/npm/pnpm/package.json | jq -r '.version')
## Additional Information:
This is a different code path from #258 (which was about `installation_check()`
matching an already-installed major-version-only pin, fixed by #259) — this bug is
in `get_pnpm_version()`'s latest-version auto-detection instead, so it's filed as a
new issue rather than reopening #258.
Workaround: pin the version explicitly, e.g. `pnpm-version: "11.5.1"`.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in src/scripts/install-pnpm.sh at get_pnpm_version() and reproduce the latest-version extraction against pnpm's package.json. Ensure the detected value contains only the top-level version, then verify that the Install pnpm path no longer produces a multiline pnpm version; the issue does not name a specific test file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- shell
- Domain
- ci-cd, devops
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100