dependabot / dependabot/dependabot-core
Unexpected error running `yarn npm audit` command with arguments that don't exist
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
npm (yarn)
### Package manager version
4.13.0
### Language version
_No response_
### Manifest location and content before the Dependabot update
_No response_
### dependabot.yml content
[dependabot.yml](https://github.com/user-attachments/files/28034130/dependabot.yml)
### Updated dependency
_No response_
### What you expected to see, versus what you actually saw
Expected: dependabot process would run for a security error and either explain that a change could not be made, or it would make a PR to make the updated.
Actual: "Dependabot encountered an unknown error"
Logs show an attempt to call `corepack yarn npm audit --fix --mode update-lockfile`. The `--fix` and `--mode` arguments do not exist on yarn (https://yarnpkg.com/cli/npm/audit#options). The yarn cli errors on unknown arguments.
This call appears to have been added by #14589, which appears to have assumed the same arguments from npm and pnpm audit commands are also used by yarn.
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
```
updater | 2026/05/19 22:49:12 ERROR Error running package manager command: corepack yarn npm audit --fix --mode update-lockfile, Error: Unknown Syntax Error: Unsupported option name ("--fix").
$ yarn npm audit [-A,--all] [-R,--recursive] [--environment #0] [--json] [--no-deprecations] [--severity #0] [--exclude #0] [--ignore #0]
updater | 2026/05/19 22:49:12 INFO yarn npm audit --fix failed or partially fixed — continuing with any changes made
proxy | 2026/05/19 22:49:12 [302] POST /update_jobs/1375217414/record_update_job_unknown_error
proxy | 2026/05/19 22:49:12 [302] 204 /update_jobs/1375217414/record_update_job_unknown_error
proxy | 2026/05/19 22:49:13 [304] POST /update_jobs/1375217414/record_update_job_error
proxy | 2026/05/19 22:49:13 [304] 204 /update_jobs/1375217414/record_update_job_error
proxy | 2026/05/19 22:49:13 [306] POST /update_jobs/1375217414/increment_metric
proxy | 2026/05/19 22:49:13 [306] 204 /update_jobs/1375217414/increment_metric
proxy | 2026/05/19 22:49:13 [308] POST /update_jobs/1375217414/record_update_job_unknown_error
proxy | 2026/05/19 22:49:13 [308] 204 /update_jobs/1375217414/record_update_job_unknown_error
updater | 2026/05/19 22:49:13 ERROR Error processing brace-expansion (Dependabot::NpmAndYarn::FileUpdater::NoChangeError)
updater | 2026/05/19 22:49:13 ERROR No files were updated! Package manager: yarn
2026/05/19 22:49:13 ERROR /home/dependabot/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb:52:in 'Dependabot::NpmAndYarn::FileUpdater#updated_dependency_files'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::NpmAndYarn::FileUpdater#_on_method_added'
updater | 2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/dependency_change_builder.rb:155:in 'Dependabot::DependencyChangeBuilder#generate_dependency_files'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::DependencyChangeBuilder#_on_method_added'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/dependency_change_builder.rb:74:in 'Dependabot::DependencyChangeBuilder#run'
updater | 2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::DependencyChangeBuilder#_on_method_added'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/dependency_change_builder.rb:44:in 'Dependabot::DependencyChangeBuilder.create_from'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::DependencyChangeBuilder._on_method_added'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/group_update_creation.rb:249:in 'Dependabot::Updater::GroupUpdateCreation#create_change_for'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::Updater::GroupUpdateCreation#_on_method_added'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/group_update_creation.rb:137:in 'block in Dependabot::Updater::GroupUpdateCreation#compile_all_dependency_changes_for'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/group_update_creation.rb:104:in 'Array#each'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/group_update_creation.rb:104:in 'Dependabot::Updater::GroupUpdateCreation#compile_all_dependency_changes_for'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::Updater::GroupUpdateCreation#_on_method_added'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/create_group_update_pull_request.rb:119:in 'block in Dependabot::Updater::Operations::CreateGroupUpdatePullRequest#dependency_change'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/create_group_update_pull_request.rb:116:in 'Array#each'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/create_group_update_pull_request.rb:116:in 'Enumerable#filter_map'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/create_group_update_pull_request.rb:116:in 'Dependabot::Updater::Operations::CreateGroupUpdatePullRequest#dependency_change'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::Updater::Operations::CreateGroupUpdatePullRequest#_on_method_added'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/create_group_update_pull_request.rb:63:in 'Dependabot::Updater::Operations::CreateGroupUpdatePullRequest#perform'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::Updater::Operations::CreateGroupUpdatePullRequest#_on_method_added'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/group_update_all_versions.rb:120:in 'Dependabot::Updater::Operations::GroupUpdateAllVersions#run_grouped_update_for'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::Updater::Operations::GroupUpdateAllVersions#_on_method_added'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/group_update_all_versions.rb:106:in 'block in Dependabot::Updater::Operations::GroupUpdateAllVersions#run_grouped_dependency_updates'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/group_update_all_versions.rb:105:in 'Array#each'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/group_update_all_versions.rb:105:in 'Dependabot::Updater::Operations::GroupUpdateAllVersions#run_grouped_dependency_updates'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::Updater::Operations::GroupUpdateAllVersions#_on_method_added'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater/operations/group_update_all_versions.rb:62:in 'Dependabot::Updater::Operations::GroupUpdateAllVersions#perform'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::Updater::Operations::GroupUpdateAllVersions#_on_method_added'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:56:in 'Dependabot::Updater#run'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::Updater#_on_method_added'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/update_files_command.rb:53:in 'block in Dependabot::UpdateFilesCommand#perform_job'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/opentelemetry-api-1.9.0/lib/opentelemetry/trace/tracer.rb:37:in 'block in OpenTelemetry::Trace::Tracer#in_span'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/opentelemetry-api-1.9.0/lib/opentelemetry/trace.rb:70:in 'block in OpenTelemetry::Trace#with_span'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/opentelemetry-api-1.9.0/lib/opentelemetry/context.rb:88:in 'OpenTelemetry::Context.with_value'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/opentelemetry-api-1.9.0/lib/opentelemetry/trace.rb:70:in 'OpenTelemetry::Trace#with_span'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/opentelemetry-api-1.9.0/lib/opentelemetry/trace/tracer.rb:37:in 'OpenTelemetry::Trace::Tracer#in_span'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/update_files_command.rb:30:in 'Dependabot::UpdateFilesCommand#perform_job'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation.rb:294:in 'T::Private::Methods::CallValidation.validate_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/_methods.rb:257:in 'block in Dependabot::UpdateFilesCommand#_on_method_added'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/lib/dependabot/base_command.rb:42:in 'Dependabot::BaseCommand#run'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation_2_7.rb:652:in 'UnboundMethod#bind_call'
2026/05/19 22:49:13 ERROR /home/dependabot/dependabot-updater/vendor/ruby/3.4.0/gems/sorbet-runtime-0.6.13208/lib/types/private/methods/call_validation_2_7.rb:652:in 'block in Dependabot::BaseCommand#create_validator_procedure_fast0'
2026/05/19 22:49:13 ERROR bin/update_files.rb:48:in ''
```
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.