CircleCI-Public / CircleCI-Public/node-orb

install-pnpm latest-version detection breaks when pnpm package.json has a dependency key ending in "version" (@pnpm/engine.runtime.system-version)

Open Beginner friendly
#262 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
57
Forks
76
PR merge metrics
No merged PRs in 30d

Description

## Orb version:

circleci/node@7.2.1 (also present on master / install-pnpm.sh)

## What happened:

When `install-pnpm: true` is used without pinning `pnpm-version`, the latest-version
detection in `src/scripts/install-pnpm.sh` breaks.

It parses pnpm's package.json from jsdelivr with:

curl -s https://cdn.jsdelivr.net/npm/pnpm/package.json | sed -n 's/.*version": "\(.*\)".*/\1/p'

As of pnpm 11.12.0, package.json contains a dependency whose key ends in `version`
(`@pnpm/engine.runtime.system-version`), so the `sed` matches two lines:

$ curl -s https://cdn.jsdelivr.net/npm/pnpm/package.json | sed -n 's/.*version": "\(.*\)".*/\1/p'
11.12.0
1100.0.3

This makes the script run `npm install -g pnpm@11.12.0\n1100.0.3`, which fails:

npm error code ETARGET
npm error notarget No matching version found for pnpm@11.12.0
npm error notarget 1100.0.3.

Every job that installs pnpm via the orb without a pinned version currently fails
at the "Install pnpm" step.

## Expected behavior:

The orb should detect only the top-level `version` field, e.g. by parsing the JSON
properly instead of a line-based regex:

PNPM_ORB_VERSION=$(curl -s https://cdn.jsdelivr.net/npm/pnpm/package.json | jq -r '.version')

## Additional Information:

This is a different code path from #258 (which was about `installation_check()`
matching an already-installed major-version-only pin, fixed by #259) — this bug is
in `get_pnpm_version()`'s latest-version auto-detection instead, so it's filed as a
new issue rather than reopening #258.

Workaround: pin the version explicitly, e.g. `pnpm-version: "11.5.1"`.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in src/scripts/install-pnpm.sh at get_pnpm_version() and reproduce the latest-version extraction against pnpm's package.json. Ensure the detected value contains only the top-level version, then verify that the Install pnpm path no longer produces a multiline pnpm version; the issue does not name a specific test file.

Written by the indexing model from the issue text.

Assessment

Tech stack
shell
Domain
ci-cd, devops
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.