dependabot / dependabot/dependabot-core
Incorrect update in pnpm workspace with multiple catalogs (default and custom)
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
pnpm
### Package manager version
10.8.1
### Language version
_No response_
### Manifest location and content before the Dependabot update
Commit: https://github.com/Silic0nS0ldier/vscode-git-monolithic-extension/commit/3d23eec39bafb47d9612850aa1778db8ba4aea67
```diff
# file:pnpm-workspace.yaml
catalog:
...
- "@types/node": ^22.15.21
+ "@types/node": ^20.19.0
...
catalogs:
vscode:
"@types/node": ^20.17.50
# ^^^^^^^^^ What should have been updated
```
```diff
# file:pnpm-lock.yaml
catalogs:
default:
...
'@types/node':
- specifier: ^22.15.21
- version: 22.15.21
+ specifier: ^20.19.0
+ version: 20.19.0
...
importers:
...
devDependencies:
'@types/node':
specifier: 'catalog:'
- version: 22.15.21
+ version: 20.19.0
...
devDependencies:
'@types/node':
specifier: 'catalog:'
- version: 22.15.21
+ version: 20.19.0
...
packages:
'@types/node@20.17.50':
resolution: {integrity: sha512-Mxiq0ULv/zo1OzOhwPqOA13I81CV/W3nvd3ChtQZRT5Cwz3cr0FKo/wMSsbTqL3EXpaBAEQhva2B8ByRkOIh9A==}
- '@types/node@22.15.21':
- resolution: {integrity: sha512-EV/37Td6c+MgKAbkcLG6vqZ2zEYHD7bvSrzqqs2RIhbA6w3x+Dqz8MZM3sP6kGTeLrdoOgKZe+Xja7tUB2DNkQ==}
+ '@types/node@20.19.0':
+ resolution: {integrity: sha512-hfrc+1tud1xcdVTABC2JiomZJEklMcXYNTVtZLAeqTVWD+qL5jkHKT+1lOtqDdGxt+mB53DTtiz673vfjU8D1Q==}
...
snapshots:
...
- '@types/node@22.15.21':
+ '@types/node@20.19.0':
```
### dependabot.yml content
```yaml
# file:.github/dependabot.yml
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
ignore:
# Need to stay in sync with VSCode (bound to NodeJS version from Electron)
- dependency-name: "@types/node"
update-types: ["version-update:semver-major"]
schedule:
interval: "weekly"
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
```
### Updated dependency
`@types/node`.
Intended bump (`catalog:vscode`): `20.17.50` (from `^20.17.50`) to `20.19.0`
Actual bump (`catalog:default`): `22.15.21` (from `^22.15.21`) to `20.19.0` (req updated to `^20.19.0`)
### What you expected to see, versus what you actually saw
`@types/node` in `catalog:vscode` updated.
### Native package manager behavior
NA, `pnpm update {version}` does not support updating catalogs in `10.8.1`.
[`10.12.1`](https://github.com/pnpm/pnpm/releases/tag/v10.12.1) adds support, although I've not used it myself (and I'm unsure of the exact command needed to update catalogs, if there is anything special at all).
### Images of the diff or a link to the PR, issue, or logs
https://github.com/Silic0nS0ldier/vscode-git-monolithic-extension/pull/142
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Start by comparing pnpm-workspace.yaml and pnpm-lock.yaml in the reported commit, then inspect the linked pull request and the Dependabot npm updater path for catalog selection. Reproduce the case with default and custom catalogs; done means the requested catalog:vscode entry and its lockfile data are updated without changing catalog:default.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, yaml
- Domain
- build-system, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100