Broken Renovate PRs with bad packageManager changes
#36904
-
How are you running Renovate?A Mend.io-hosted app Please tell us more about your question or problemI am seeing PRs generated by Renovate that contain incorrect updates to The resulting PR had an "Artifact update problem" from Renovate, with the text
The change, while updating the version number, omitted the SHA512 hash: Minimal ReproLeading to this PR which demonstrates the issue. Logs (if relevant)Logs |
Beta Was this translation helpful? Give feedback.
Answered by
RahulGautamSingh
Dec 5, 2025
Replies: 11 comments 15 replies
-
|
Hi there, Please help this Discussion progress by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible. Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues. Please follow these steps:
If you need help with running Renovate on your minimal reproduction repository, please refer to our Running Renovate guide. The Renovate team |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Apologies for the delay. Producing a minimal repro was a slog, but it is now attached to the first post, along with the debug logs from the Renovate run. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Sorry for the bump, but this continues to be an issue in all my repositories. Every time pnpm puts out a new release, I get broken PRs on every repo. You can see a very minimal repro: here is the changed file. And here is the minimal repro repository. Renovate job log: |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Hi there, Please give your discussion a meaningful title. This helps others understand what your discussion is about, and increases the chances of getting help. Do not use titles like "Need config help", "Renovate is not working", etc. Try to summarize the specifics of your problem or question in the title. Thanks, the Renovate team |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Beta Was this translation helpful? Give feedback.
0 replies
-
|
I too had the same problem. I am not sure about the cause, but I am attaching the actual PRs in case it helps. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Sorry but I could not reproduce both the reproductions: |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
@MH4GF Thank you for adding your example - I'm glad I'm not hallucinating! @RahulGautamSingh Thank you for attempting to reproduce. Very interesting that it worked fine for you. For my part I have been trying to get closer to the problem. From my Renovate logs, I can see: Which is an error in the @MH4GF can you look in your renovate logs (https://developer.mend.io/github/liam-hq/liam -> find a job that caused the broken PR -> click it) and see if you can find a similar bit in the logs? Searching |
Beta Was this translation helpful? Give feedback.
12 replies
-
|
@RahulGautamSingh The piece of the puzzle I'm missing is that pnpm should not run install scripts by default. That was a big change in pnpm 10, to prevent supply chain attacks. I will keep working on a local repro, so we can maybe work out why install scripts are being run when Renovate does it. |
Beta Was this translation helpful? Give feedback.
-
pnpm is not running them by default. It is the |
Beta Was this translation helpful? Give feedback.
-
My bad, my terminology was off - I should have said "lifecycle scripts" not "install scripts". The chain of events is:
It is the part in italics where the error occurs in my logs. And that is the oddity: pnpm 10+ should not execute lifecycle scripts unless told to explicitly. |
Beta Was this translation helpful? Give feedback.
-
|
Okay. Got it then it's an issue with your setup not sure if we can help there |
Beta Was this translation helpful? Give feedback.
-
I'm going to keep investigating, because there is something funny happening when Renovate runs
This is what I meant about the "missing piece of the puzzle". I'll report back if/when I find anything new. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks everyone for the investigation! 🙏 It looks like the error message " demopackage.json{
"name": "liam-frontend",
"private": true,
"version": "0.0.1",
"devDependencies": {
},
"scripts": {
"prepare": "false" // <--- this is the point
},
"packageManager": "pnpm@10.12.1+sha512.f0dda8580f0ee9481c5c79a1d927b9164f2c478e90992ad268bbb2465a736984391d6333d2c327913578b2804af33474ca554ba29c04a8b13060a717675ae3ac"
}PR / screenshotloghoshinotsuyoshi_renovate-36904-pnpm-demo-2_2025-09-01_06-37_be5f9ffc-223a-4413-b646-53cdc1766e40.log |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
We have got the same problems as well |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
I have created an issue: #37772 discussing moving away from using the Thoughts & Contributions Welcome! |
Beta Was this translation helpful? Give feedback.
3 replies
-
Decided to give it a go, so added a comment in the issue |
Beta Was this translation helpful? Give feedback.
-
|
Thanks! I will take a look |
Beta Was this translation helpful? Give feedback.
-
Thanks! I can put up a PR as well, but won’t be able until Monday, so for now I just have the branch in my fork here |
Beta Was this translation helpful? Give feedback.
Answer selected by
RahulGautamSingh
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I have created an issue: #37772 discussing moving away from using the
corepack usecommand when updating thepackageManagerfield, which will fix the issue at the root.Thoughts & Contributions Welcome!