Skip to content

pnpm downgraded in package.json when updating dependencies #5

Description

@n3xSU5

Newbie here. Every time that my workflow runs today (August 10, 2-7 AM GMT-5) with pnpm/update action, pnpm is downgraded regardless of update-deps (latest, ranges or false all tested) in pr's.

pnpm/setup installs correctly v11.21.0 (released August 9, 9:25 AM GMT-5) and pnpm/update uses that version too but in Update dependencies section pnpm is downgraded in the last line.

pnpm/update log Update dependencies section

dependencies:
+ x
- y
devDependencies:
- x
+ y
Done in 7.7s using pnpm v11.21.0
Checking for updates...
The current project has been updated to use pnpm v11.20.0

Current files:

update-deps.yml

name: Update Dependencies

on:
  schedule:
    - cron: "0 6 * * *" # Daily at 6 AM UTC
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

concurrency:
  group: update-dependencies
  cancel-in-progress: false

jobs:
  update-dependencies:
    if: github.repository == 'org/repo' # Don't run on forks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7.0.1
      - uses: pnpm/setup@v2.0.1
      - uses: pnpm/update@v0
        with:
          update-deps: false
          refresh-lockfile: true
          changesets: false
          commit-message: "chore: update dependencies, Node.js and pnpm"
          pr-title: "chore: update dependencies, Node.js and pnpm"
          pr-body: |
            This automated PR bumps the project's dependencies and pinned versions:

            - Updates all dependencies to their latest versions and refreshes the lockfile.
            - Bumps Node.js to the latest pinned release, propagated into the CI, release, and benchmark workflows via the meta-updater.
            - Bumps pnpm to the latest release (`packageManager` and `devEngines.packageManager`).
            - Updates the GitHub Actions pinned in the workflow files.

package.json

"devEngines": {
    "runtime": {
      "name": "node",
      "version": "^24.19.0",
      "onFail": "download"
    },
    "packageManager": {
      "name": "pnpm",
      "version": "11.21.0",
      "onFail": "download"
    }
  },

pnpm-workspace.yaml

minimumReleaseAge: 4320 # 3 days in minutes
minimumReleaseAgeStrict: true
minimumReleaseAgeIgnoreMissingTime: false
minimumReleaseAgeExclude:
  - '@pnpm/*'
  - pnpm

trustPolicy: no-downgrade
trustPolicyIgnoreAfter: 262800 # ignore packages published 6 months ago
trustPolicyExclude:
  - 'detect-port@1.6.1'
  - 'semver@6.3.1'

trustLockfile: false
blockExoticSubdeps: true
verifyDepsBeforeRun: error

strictDepBuilds: true
dangerouslyAllowAllBuilds: false
allowBuilds:
  '@swc/core': true
  core-js-pure: true
  core-js: true

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions