add support for pnpm lockfile v9.0 mapping to pnpm v10#13088
Merged
a-schur merged 6 commits intodependabot:mainfrom Sep 29, 2025
Merged
add support for pnpm lockfile v9.0 mapping to pnpm v10#13088a-schur merged 6 commits intodependabot:mainfrom
a-schur merged 6 commits intodependabot:mainfrom
Conversation
robaiken
approved these changes
Sep 29, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What are you trying to accomplish?
respect the version constraint and install the correct version of pnpm, dont fall back to the lockfile version guessed version
new constants of pnpm versions need to be added and mapping logic needs updating
this is a fix for 13045
Anything you want to highlight for special attention from reviewers?
How will you know you've accomplished your goal?
Added support for pnpm lockfile version 9.0 created a test that verifies pnpm lockfile version 9.0 maps to pnpm runtime version 10.
Added test fixtures - created a test fixture file (pnpm_lock_9.0_content.json) that simulates a GitHub API response containing a pnpm-lock.yaml file with lockfileVersion 9.0.
Extended version mapping logic test ensures that when Dependabot encounters a pnpm-lock.yaml file with lockfileVersion 9.0, it correctly determines it needs to use pnpm version 10+ to handle the update process.
Checklist