Newbie here. Every time that my workflow runs today (August 10, 2-7 AM GMT-5) with pnpm/update action, pnpm is downgraded regardless of update-deps (latest, ranges or false all tested) in pr's.
pnpm/setup installs correctly v11.21.0 (released August 9, 9:25 AM GMT-5) and pnpm/update uses that version too but in Update dependencies section pnpm is downgraded in the last line.
pnpm/update log Update dependencies section
dependencies:
+ x
- y
devDependencies:
- x
+ y
Done in 7.7s using pnpm v11.21.0
Checking for updates...
The current project has been updated to use pnpm v11.20.0
Current files:
update-deps.yml
name: Update Dependencies
on:
schedule:
- cron: "0 6 * * *" # Daily at 6 AM UTC
workflow_dispatch:
permissions:
contents: write
pull-requests: write
concurrency:
group: update-dependencies
cancel-in-progress: false
jobs:
update-dependencies:
if: github.repository == 'org/repo' # Don't run on forks
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.1
- uses: pnpm/setup@v2.0.1
- uses: pnpm/update@v0
with:
update-deps: false
refresh-lockfile: true
changesets: false
commit-message: "chore: update dependencies, Node.js and pnpm"
pr-title: "chore: update dependencies, Node.js and pnpm"
pr-body: |
This automated PR bumps the project's dependencies and pinned versions:
- Updates all dependencies to their latest versions and refreshes the lockfile.
- Bumps Node.js to the latest pinned release, propagated into the CI, release, and benchmark workflows via the meta-updater.
- Bumps pnpm to the latest release (`packageManager` and `devEngines.packageManager`).
- Updates the GitHub Actions pinned in the workflow files.
package.json
"devEngines": {
"runtime": {
"name": "node",
"version": "^24.19.0",
"onFail": "download"
},
"packageManager": {
"name": "pnpm",
"version": "11.21.0",
"onFail": "download"
}
},
pnpm-workspace.yaml
minimumReleaseAge: 4320 # 3 days in minutes
minimumReleaseAgeStrict: true
minimumReleaseAgeIgnoreMissingTime: false
minimumReleaseAgeExclude:
- '@pnpm/*'
- pnpm
trustPolicy: no-downgrade
trustPolicyIgnoreAfter: 262800 # ignore packages published 6 months ago
trustPolicyExclude:
- 'detect-port@1.6.1'
- 'semver@6.3.1'
trustLockfile: false
blockExoticSubdeps: true
verifyDepsBeforeRun: error
strictDepBuilds: true
dangerouslyAllowAllBuilds: false
allowBuilds:
'@swc/core': true
core-js-pure: true
core-js: true
Newbie here. Every time that my workflow runs today (August 10, 2-7 AM GMT-5) with pnpm/update action, pnpm is downgraded regardless of update-deps (latest, ranges or false all tested) in pr's.
pnpm/setup installs correctly v11.21.0 (released August 9, 9:25 AM GMT-5) and pnpm/update uses that version too but in Update dependencies section pnpm is downgraded in the last line.
pnpm/update log Update dependencies section
Current files:
update-deps.yml
package.json
pnpm-workspace.yaml