nodejs / nodejs/corepack

Corepack incorrectly selects prerelease/dev versions of pnpm when no version is specified

Open
#774 1 comment 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
3.8k
Forks
279
Avg merge
1h 47m
Merged PRs (30d)
2

Description

After some discussion on the pnpm issue (https://github.com/pnpm/pnpm/issues/10214), it turns out the problem is not caused by a faulty pnpm release, pnpm v11 has changed its binary entry path from bin/pnpm.cjs to bin/pnpm.mjs., so the development build 11.0.0-dev.1005 is not faulty. Corepack is expecting the old path and fails.

So the issue appears to be:

  • Corepack’s version resolution prefers a dev build over the latest stable
  • Corepack seems to rely on a hardcoded pnpm binary path instead of reading the correct bin path from package.json.

As a workaround I'm currently using corepack use pnpm@10.22.0 or corepack use pnpm@latest (or latest-9, latest-10 etc.)

Leaving this update here so the root cause is clearer.

Originally posted by @tkesici in #772

Problem

When running corepack use pnpm, Corepack unexpectedly selects and installs a prerelease development build of pnpm (11.0.0-dev.1005) instead of the latest stable version .

This leads to failure because pnpm v11 is not stable yet and its structure differs from the current pnpm 10.x series.

Expected Behavior

If no version is specified, Corepack should prefer the latest stable release of pnpm (e.g 10.x)

Actual Behavior

corepack use pnpm resolves to: Installing pnpm@11.0.0-dev.1005...

Environment

Node.js: 20 (node:20-alpine)

Corepack: 0.34.4

OS: Alpine Linux

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the corepack use pnpm resolution path and how it reads pnpm's package.json; reproduce the behavior with the Node.js 20, Corepack 0.34.4, and Alpine environment described here. Done means an unspecified pnpm request selects the latest stable release and uses its current binary entry path rather than a hardcoded legacy path.

Written by the indexing model from the issue text.

Assessment

Tech stack
nodejs, typescript
Domain
cli, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.