dependabot / dependabot/dependabot-core
tool_version_not_supported pnpm with engine-strict in .npmrc
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
npm
### Package manager version
pnpm ^10.4.1
### Language version
node 22.14.0
Hey there,
we can reproduce the error with:
```
github/dependabot-action@ghes-3.15
```
package.json:
```
{
"name": "dependabot-test",
"version": "1.0.0",
"engines": {
"node": "22.14.0",
"pnpm": "^10.4.1"
},
"private": true,
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC",
"description": "",
"dependencies": {
"pinia": "^3.0.3",
"vue": "3.4"
},
"devDependencies": {
"cross-env": "7.0.0"
},
"packageManager": "pnpm@10.4.1+sha512.c753b6c3ad7afa13af388fa6d808035a008e30ea9993f58c6663e2bc5ff21679aa834db094987129aa4d488b86df57f7b634981b2f827cdcacc698cc0cfb88af"
}
```
and .npmrc
```
engine-strict=true
registry=https://registry.npmjs.org
```
logs:
```
updater | 2025/08/28 19:42:46 INFO Latest version is 3.5.20
updater | 2025/08/28 19:42:46 INFO Adding dependencies as handled: (vue).
updater | 2025/08/28 19:42:48 INFO Requirements to unlock own
updater | 2025/08/28 19:42:48 INFO Requirements update strategy bump_versions
updater | 2025/08/28 19:42:48 INFO Updating vue from 3.4.38 to 3.5.20
proxy | 2025/08/28 19:42:49 [028] POST [https://***:443/_dependabot/update_jobs/1020426/record_update_job_error](https://***/_dependabot/update_jobs/1020426/record_update_job_error)
proxy | 2025/08/28 19:42:49 [028] 204 [https://***:443/_dependabot/update_jobs/1020426/record_update_job_error](https://***/_dependabot/update_jobs/1020426/record_update_job_error)
updater | 2025/08/28 19:42:49 INFO Handled error whilst updating vue: tool_version_not_supported {"tool-name": "Node", "detected-version": "22.14.0", "supported-versions": "v20.19.3"}
```
Any hints or remarks?
If we remove `engine-strict` it works, but we are working in a big monorepo with a lot of developers.
Best regards
### dependabot.yml content
```
version: 2
updates:
- package-ecosystem: npm
directory: '/'
schedule:
interval: daily
open-pull-requests-limit: 3
groups:
node-dependencies:
patterns:
- '*'
update-types:
- 'minor'
- 'patch'
ignore:
- dependency-name: '*'
update-types: ['version-update:semver-major']
```
### What you expected to see, versus what you actually saw
Dependabot creates PR with dependency updates without any error and the used tooling versions.
Contributor guide
Research direction
Reproduce the failure using the package.json, .npmrc, and dependabot.yml examples, with pnpm 10.4.1 and Node 22.14.0. Start by tracing npm ecosystem handling of engine-strict and the reported Node version, then verify that a dependency update completes with the configured tooling versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100