dependabot / dependabot/dependabot-core

tool_version_not_supported pnpm with engine-strict in .npmrc

Open
#12,976 0 comments 1 reaction 0 assignees View on GitHub
L: javascript T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

npm

### Package manager version

pnpm ^10.4.1

### Language version

node 22.14.0

Hey there,
we can reproduce the error with:

```
github/dependabot-action@ghes-3.15
```

package.json:
```
{
"name": "dependabot-test",
"version": "1.0.0",
"engines": {
"node": "22.14.0",
"pnpm": "^10.4.1"
},
"private": true,
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC",
"description": "",
"dependencies": {
"pinia": "^3.0.3",
"vue": "3.4"
},
"devDependencies": {
"cross-env": "7.0.0"
},
"packageManager": "pnpm@10.4.1+sha512.c753b6c3ad7afa13af388fa6d808035a008e30ea9993f58c6663e2bc5ff21679aa834db094987129aa4d488b86df57f7b634981b2f827cdcacc698cc0cfb88af"
}

```
and .npmrc

```
engine-strict=true
registry=https://registry.npmjs.org
```

logs:
```
updater | 2025/08/28 19:42:46 INFO Latest version is 3.5.20
updater | 2025/08/28 19:42:46 INFO Adding dependencies as handled: (vue).
updater | 2025/08/28 19:42:48 INFO Requirements to unlock own
updater | 2025/08/28 19:42:48 INFO Requirements update strategy bump_versions
updater | 2025/08/28 19:42:48 INFO Updating vue from 3.4.38 to 3.5.20
proxy | 2025/08/28 19:42:49 [028] POST [https://***:443/_dependabot/update_jobs/1020426/record_update_job_error](https://***/_dependabot/update_jobs/1020426/record_update_job_error)
proxy | 2025/08/28 19:42:49 [028] 204 [https://***:443/_dependabot/update_jobs/1020426/record_update_job_error](https://***/_dependabot/update_jobs/1020426/record_update_job_error)
updater | 2025/08/28 19:42:49 INFO Handled error whilst updating vue: tool_version_not_supported {"tool-name": "Node", "detected-version": "22.14.0", "supported-versions": "v20.19.3"}
```

Any hints or remarks?

If we remove `engine-strict` it works, but we are working in a big monorepo with a lot of developers.

Best regards

### dependabot.yml content

```
version: 2

updates:
- package-ecosystem: npm
directory: '/'
schedule:
interval: daily
open-pull-requests-limit: 3
groups:
node-dependencies:
patterns:
- '*'
update-types:
- 'minor'
- 'patch'
ignore:
- dependency-name: '*'
update-types: ['version-update:semver-major']
```

### What you expected to see, versus what you actually saw

Dependabot creates PR with dependency updates without any error and the used tooling versions.

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure using the package.json, .npmrc, and dependabot.yml examples, with pnpm 10.4.1 and Node 22.14.0. Start by tracing npm ecosystem handling of engine-strict and the reported Node version, then verify that a dependency update completes with the configured tooling versions.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.