pnpm: lockfile error with patched dependencies

[haines]

What would you like help with?

I think I found a bug

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

We have created some patches using pnpm patch, so our package.json has a pnpm.patchedDependencies field.

This means that Renovate can't update the lockfile when it tries to bump a patched dependency. pnpm install fails with ERR_PNPM_PATCH_NOT_APPLIED unless I also set pnpm.allowNonAppliedPatches (which I don't want to do because I want to be aware that I need to either update or remove the patch when the dependency is bumped).

Somewhat frustratingly, Renovate won't raise a PR with the lock file errors immediately, because of this logic that waits for 2 hours after the most recent release to be included in the PR.

I would like Renovate to immediately raise a PR with lock file errors in this case, because waiting for 2 hours won't resolve the issue. This is particularly painful because we group all our non-major dependency updates together, which means that during the week it can take a while before 2 hours has elapsed since any of them have been released.

Logs (if relevant)

This log shows the error and that Renovate is deciding whether to raise the PR based on the release timestamp:

Logs

DEBUG: rawExec err (branch="renovate/left-pad-1.x")
{
  "err": {
    "cmd": "/bin/sh -c pnpm install --recursive --lockfile-only --ignore-scripts --ignore-pnpmfile",
    "stderr": "",
    "stdout": "Scope: all 2 workspace projects\npackages/app                             |  WARN  deprecated [email protected]\nProgress: resolved 1, reused 0, downloaded 0, added 0\n ERR_PNPM_PATCH_NOT_APPLIED  The following patches were not applied: [email protected]\n\nEither remove them from \"patchedDependencies\" or update them to match packages in your dependencies.\n",
    "options": {
      "cwd": "/tmp/renovate/repos/github/haines/renovate-pnpm-patched-dependencies",
      "encoding": "utf-8",
      "env": {
        "NPM_CONFIG_CACHE": "/tmp/renovate/cache/others/npm",
        "npm_config_store": "/tmp/renovate/cache/others/pnpm",
        "HOME": "/home/ubuntu",
        "PATH": "/home/ubuntu/.cargo/bin:/home/ubuntu/.local/bin:/go/bin:/home/ubuntu/bin:/home/ubuntu/.npm-global/bin:/home/ubuntu/.cargo/bin:/home/ubuntu/.local/bin:/go/bin:/home/ubuntu/bin:/home/ubuntu/.npm-global/bin:/home/ubuntu/.cargo/bin:/home/ubuntu/.local/bin:/go/bin:/home/ubuntu/bin:/home/ubuntu/.npm-global/bin:/home/ubuntu/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
        "LC_ALL": "C.UTF-8",
        "LANG": "C.UTF-8",
        "CONTAINERBASE_CACHE_DIR": "/tmp/renovate/cache/containerbase"
      },
      "maxBuffer": 10485760,
      "timeout": 900000
    },
    "exitCode": 1,
    "name": "ExecError",
    "message": "Command failed: pnpm install --recursive --lockfile-only --ignore-scripts --ignore-pnpmfile\n",
    "stack": "ExecError: Command failed: pnpm install --recursive --lockfile-only --ignore-scripts --ignore-pnpmfile\n\n    at ChildProcess.<anonymous> (/usr/local/renovate/lib/util/exec/common.ts:99:11)\n    at ChildProcess.emit (node:events:529:35)\n    at ChildProcess.emit (node:domain:489:12)\n    at Process.ChildProcess._handle.onexit (node:internal/child_process:292:12)"
  }
  "durationMs": 1097
}
DEBUG: No updated lock files in branch (branch="renovate/left-pad-1.x")
DEBUG: Branch timestamp: 2018-04-09T01:10:45.796Z (branch="renovate/left-pad-1.x")
DEBUG: PR is older than 2 hours, raise PR with lock file errors (branch="renovate/left-pad-1.x")

[rarkins]

Is your preferred solution that PRs are raised immediately with errors or is that a workaround? Is there any realistic way for Renovate to successfully update such dependencies without errors?

[haines]

Unfortunately, unlike patch-package, pnpm doesn't make it easy to apply an old patch to a new version if the patched files haven't changed (pnpm/pnpm#5686, particularly pnpm/pnpm#5686 (comment)). Until improvements land in pnpm that would make it feasible for Renovate to automatically update patched dependencies, I think raising a PR immediately with an error is the best thing Renovate could do here.

[viceice]

https://github.com/containerbase/base/blob/011629c5121b127ed1c526a42d09182e86f6a250/renovate.json#L162

we're doing something similar on our base image 🙃