Why could renovate start drop pnpmfileChecksum from the lockfile?

[karfau]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

We just updated our pnpm version to 9.7.0 and the next PR created by renovate just drops the pnpmfileChecksum key from the pnpm-lock.yaml file.
Of course dependency installation fails since it runs with --frozen-lockfile.

Have you seen this before?
Any ideas how to fix that?

Will check the logs and add them later.

Logs

https://gist.github.com/karfau/0db8457bdadbcd80b1c55a39fa97e769

[github-actions[bot]]

Hi there,

This issue or discussion is missing some logs, making it difficult or impossible to help you. Depending on which situation applies follow one, some or all of these instructions.

No logs at all

If you haven't posted any log yet, we need you to find and copy/paste the log into the issue template.

Finding logs on hosted app

Select me to read instructions

If you use the Mend Renovate app (GitHub):

1. Log in to the Mend Developer Portal
2. Navigate to the correct organization and repository
3. Locate the appropriate log (it may not always be the latest one)
4. Copy/paste the log contents
5. Follow the steps in the formatting your logs section

Finding logs when self-hosting

Select me to read instructions

Read the Renovate docs, troubleshooting, self-hosted to learn how to find the logs.

Insufficient logs

Select me to read instructions

If you already gave us a log, and the Renovate team said it's not enough, then follow the instructions from the No logs at all section.

Formatting your logs

Select me to read instructions

Please put your logs in a <details> and <summary> element like this:

<details><summary>Select me to see logs</summary>

```
Copy/paste your logs here, between the starting and ending backticks
```

</details>

If you feel the logs are too large to paste here, please use a service like GitHub Gist and paste the link here.

Good luck,

The Renovate team

[karfau]

I've added the relevant logs.

[rarkins]

They need to be the logs from when the pnpm command was run. Please filter it to only the logs for the branch prior to the pnpm command being run.

[karfau]

thx, found it and updated the post

[HonkingGoose]

I found this upstream bugreport:

• Issue with pnpmfileChecksum and frozen-lockfile pnpm/pnpm#7951

And somebody linked a PR to that bugreport:

• Try adding ignoreScripts to fix pnpmfileChecksum update issue WordPress/openverse#4592

The PR author wrote this:

2. The operative fix (hopefully) related to the linked issue is adding ignoreScripts: false to the monorepo's renovate configuration. Check out the docs on this setting: "Set this to false if allowScripts=true and you wish to run scripts when updating lock files.". We have allow scripts set to true, because pnpmfile.cjs needs to be part of the update process to lock TypeScript correctly (although, hopefully not for much longer if Nuxt 3 manages to liberate us to modern TS without this hack). In any case, we have that, and pnpmfile.cjs apparently is part of how pnpm computes the pnpmfileChecksum (check out this potentially related issue: pnpm/pnpm#7951). Hopefully the issue is that renovate has thus far been ignore pnpmfile.cjs for lockfile updates? It seems like a stretch to me, like I'm somehow misunderstanding what Renovate means by "lockfile updates", but it's worth a shot to try and fix it, I think.

[karfau]

@rarkins I'm not sure I understand your statement.
Do you mean that renovate behaves as if ignoreScripts:true is configured by default?

One more aspect that I do not understand is that the PR completely drops the pnpmfileChecksum key from the lockfile, it isn't producing a wrong one:

[rarkins]

Look at the pnpm command which is run by renovate.

Any changes to the lock file are by pnpm and not renovate itself

[karfau]

I assume you are referring to

renovate/lib/modules/manager/npm/post-update/pnpm.ts

Line 102 in 56e5ea0

commands.push('pnpm dedupe --config.ignore-scripts=true');

?
Understood, will try the ignoreScripts option and report back if this also fixes our case.

[karfau]

Here is the pnpm command executed in when the PR was created that triggered my question:
https://gist.github.com/karfau/0db8457bdadbcd80b1c55a39fa97e769#file-renovate-a552879a-log-L20535

[karfau]

Even after applying the ignoreScripts=false setting the PR that is being produced does not contain the pnpmfileChecksum field in pnpm-lock.yaml.
I will add another log entry to the post.

[rarkins]

I don't have time to continue discussing any further here, so I will leave this final summary:

Renovate is not removing any checksum from the lock file - the pnpm command is. Most likely it's a pnpm bug if it only just started happening. Potentially the bug doesn't exist yet and you need to be the one to report it.

I will mark this as the answer, please reply to it with any further details you find regarding pnpm behavior.

[narwold]

This is a major blocker for us right now as it turns out. We are NOT on self-hosted and can't use allowScripts. Thus Renovate insists on removing pnpmfileChecksum. This is because Renovate uses --ignore-pnpmfile. Yes, pnpm changed behavior, but this is typical of package managers. With ignore-pnpmfile in .npmrc, we can't take advantage of some critical pnpmfile behavior that we use for local development. Without it, the lockfile generated by non-renovate doesn't agree with what Renovate generates. So it's a bit of a conundrum on our side.

On the pnpm side, I think they should separate the lockfile generation from the actual execution of the script so that we can solve this problem granularly. On the Renovate side, I think the flags should be configurable to avoid this sort of thing.

I do understand that --ignore-pnpmfile is there to avoid running scripts on your environment.

[rarkins]

Scripts can now be enabled for paying customers on Mend.io hosted apps, please get in touch with Mend.io sales about "Renovate Enterprise Cloud" if interested. We don't plan to allow script execution for free users as the risk is too high

[HonkingGoose]

I'm putting @rarkins's information in the docs. See:

• docs(config options): rewrite ignoreScripts #32171