dependabot / dependabot/dependabot-core

Incorrect update in pnpm workspace with multiple catalogs (default and custom)

Open
#12,445 0 comments 0 reactions 0 assignees View on GitHub
L: github:actions L: javascript T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

pnpm

### Package manager version

10.8.1

### Language version

_No response_

### Manifest location and content before the Dependabot update

Commit: https://github.com/Silic0nS0ldier/vscode-git-monolithic-extension/commit/3d23eec39bafb47d9612850aa1778db8ba4aea67
```diff
# file:pnpm-workspace.yaml
catalog:
...
- "@types/node": ^22.15.21
+ "@types/node": ^20.19.0
...
catalogs:
vscode:
"@types/node": ^20.17.50
# ^^^^^^^^^ What should have been updated
```
```diff
# file:pnpm-lock.yaml
catalogs:
default:
...
'@types/node':
- specifier: ^22.15.21
- version: 22.15.21
+ specifier: ^20.19.0
+ version: 20.19.0
...
importers:
...
devDependencies:
'@types/node':
specifier: 'catalog:'
- version: 22.15.21
+ version: 20.19.0
...
devDependencies:
'@types/node':
specifier: 'catalog:'
- version: 22.15.21
+ version: 20.19.0
...
packages:
'@types/node@20.17.50':
resolution: {integrity: sha512-Mxiq0ULv/zo1OzOhwPqOA13I81CV/W3nvd3ChtQZRT5Cwz3cr0FKo/wMSsbTqL3EXpaBAEQhva2B8ByRkOIh9A==}

- '@types/node@22.15.21':
- resolution: {integrity: sha512-EV/37Td6c+MgKAbkcLG6vqZ2zEYHD7bvSrzqqs2RIhbA6w3x+Dqz8MZM3sP6kGTeLrdoOgKZe+Xja7tUB2DNkQ==}
+ '@types/node@20.19.0':
+ resolution: {integrity: sha512-hfrc+1tud1xcdVTABC2JiomZJEklMcXYNTVtZLAeqTVWD+qL5jkHKT+1lOtqDdGxt+mB53DTtiz673vfjU8D1Q==}
...
snapshots:
...
- '@types/node@22.15.21':
+ '@types/node@20.19.0':
```

### dependabot.yml content

```yaml
# file:.github/dependabot.yml
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
ignore:
# Need to stay in sync with VSCode (bound to NodeJS version from Electron)
- dependency-name: "@types/node"
update-types: ["version-update:semver-major"]
schedule:
interval: "weekly"
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
```

### Updated dependency

`@types/node`.

Intended bump (`catalog:vscode`): `20.17.50` (from `^20.17.50`) to `20.19.0`
Actual bump (`catalog:default`): `22.15.21` (from `^22.15.21`) to `20.19.0` (req updated to `^20.19.0`)

### What you expected to see, versus what you actually saw

`@types/node` in `catalog:vscode` updated.

### Native package manager behavior

NA, `pnpm update {version}` does not support updating catalogs in `10.8.1`.

[`10.12.1`](https://github.com/pnpm/pnpm/releases/tag/v10.12.1) adds support, although I've not used it myself (and I'm unsure of the exact command needed to update catalogs, if there is anything special at all).

### Images of the diff or a link to the PR, issue, or logs

https://github.com/Silic0nS0ldier/vscode-git-monolithic-extension/pull/142

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by comparing pnpm-workspace.yaml and pnpm-lock.yaml in the reported commit, then inspect the linked pull request and the Dependabot npm updater path for catalog selection. Reproduce the case with default and custom catalogs; done means the requested catalog:vscode entry and its lockfile data are updated without changing catalog:default.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, yaml
Domain
build-system, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.