Repository: dependabot/dependabot-core

Issue #7258: Issues when updating git dependencies in PNPM
Created: 2023-05-08T18:42:26Z
Is there an existing issue for this?

 I have searched the existing issues

Package ecosystem
npm
Package manager version
PNPM
Language version
No response
Manifest location and content before the Dependabot update
I don't have a repro for this yet, but we're seeing issues in private repositories related to upgrading dependencies coming from git sources.
dependabot.yml content
No response
Updated dependency
No response
What you expected to see, versus what you actually saw
Updates should happen correctly without errors.
In particular, we see errors like the following:
 ERROR  Command failed with exit code 128: git ls-remote git+ssh://git@github.com/<repo>.git HEAD
error: cannot run ssh: No such file or directory
fatal: unable to fork

This error happened while installing the dependencies of <name>@<version>

pnpm: Command failed with exit code 128: git ls-remote git+ssh://git@github.com/<repo>.git HEAD
error: cannot run ssh: No such file or directory
fatal: unable to fork
    at makeError (/home/dependabot/.cache/node/corepack/pnpm/8.3.1/dist/pnpm.cjs:24230:17)
    at handlePromise (/home/dependabot/.cache/node/corepack/pnpm/8.3.1/dist/pnpm.cjs:24801:33)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async getRepoRefs (/home/dependabot/.cache/node/corepack/pnpm/8.3.1/dist/pnpm.cjs:110651:23)
    at async resolveRef (/home/dependabot/.cache/node/corepack/pnpm/8.3.1/dist/pnpm.cjs:110663:20)
    at async resolveGit (/home/dependabot/.cache/node/corepack/pnpm/8.3.1/dist/pnpm.cjs:110614:24)
    at async Object.resolve (/home/dependabot/.cache/node/corepack/pnpm/8.3.1/dist/pnpm.cjs:113185:173)
    at async run (/home/dependabot/.cache/node/corepack/pnpm/8.3.1/dist/pnpm.cjs:124970:23)
/home/dependabot/common/lib/dependabot/shared_helpers.rb:329:in `run_shell_command'
/home/dependabot/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb:58:in `run_pnpm_updater'
/home/dependabot/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb:42:in `block (2 levels) in run_pnpm_update'
/home/dependabot/common/lib/dependabot/shared_helpers.rb:181:in `with_git_configured'
/home/dependabot/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb:41:in `block in run_pnpm_update'
/home/dependabot/common/lib/dependabot/shared_helpers.rb:36:in `block in in_a_temporary_repo_directory'
/home/dependabot/common/lib/dependabot/shared_helpers.rb:36:in `chdir'
/home/dependabot/common/lib/dependabot/shared_helpers.rb:36:in `in_a_temporary_repo_directory'
/home/dependabot/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb:40:in `run_pnpm_update'
/home/dependabot/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb:25:in `updated_pnpm_lock_content'
/home/dependabot/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb:245:in `updated_pnpm_lock_content'
/home/dependabot/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb:174:in `pnpm_lock_changed?'
/home/dependabot/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb:207:in `block in updated_lockfiles'
/home/dependabot/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb:206:in `each'
/home/dependabot/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb:206:in `updated_lockfiles'
/home/dependabot/npm_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb:42:in `updated_dependency_files'
/home/dependabot/dependabot-updater/lib/dependabot/dependency_change_builder.rb:85:in `generate_dependency_files'
/home/dependabot/dependabot-updater/lib/dependabot/dependency_change_builder.rb:36:in `run'
/home/dependabot/dependabot-updater/lib/dependabot/dependency_change_builder.rb:25:in `create_from'
/home/dependabot/dependabot-updater/lib/dependabot/updater/operations/update_all_versions.rb:122:in `check_and_create_pull_request'
/home/dependabot/dependabot-updater/lib/dependabot/updater/operations/update_all_versions.rb:59:in `check_and_create_pr_with_error_handling'
/home/dependabot/dependabot-updater/lib/dependabot/updater/operations/update_all_versions.rb:34:in `block in perform'
/home/dependabot/dependabot-updater/lib/dependabot/updater/operations/update_all_versions.rb:34:in `each'
/home/dependabot/dependabot-updater/lib/dependabot/updater/operations/update_all_versions.rb:34:in `perform'
/home/dependabot/dependabot-updater/lib/dependabot/updater.rb:72:in `run'
/home/dependabot/dependabot-updater/lib/dependabot/update_files_command.rb:38:in `perform_job'
/home/dependabot/dependabot-updater/lib/dependabot/base_command.rb:52:in `run'
bin/update_files.rb:23:in `<main>'

I have not been able to reproduce this locally. Everytime I specify git+ssh on a package.json file, pnpm ignores it and uses https. However, that's not happening in these repositories for some reason.
Yarn & NPM have specific code to replace git+ssh with https in package.json before trying to update a lockfile, and then replacing back the updated https references with git+ssh again. So I guess this is a common problem in other package manager, so I will try to "blindly" fix it by applying the same fix.
Some preparatory work for that is at #7245.
In general, we should also review how updates behave with git dependencies, since I have not done any explicit testing with that.
Native package manager behavior
No response
Images of the diff or a link to the PR, issue, or logs
No response
Smallest manifest that reproduces the issue
No response

Duplicate issue #7851: Dependabot changed GitHub https dependency to ssh, breaking pnpm install
Created: 2023-08-20T02:32:21Z
Is there an existing issue for this?

 I have searched the existing issues

Package ecosystem
npm
Package manager version
pnpm 8.6.12
Language version
Node.js v20.5.1
Manifest location and content before the Dependabot update
pnpm-lock.yaml https://gist.github.com/advaith1/0e6ea682f1169e6062260fe02a965dd3
dependabot.yml content
I did not enable or configure Dependabot.
Updated dependency
github:advaith1/Spark#main, commit hash did not change
What you expected to see, versus what you actually saw
I did not enable Dependabot, but GitHub automatically enabled it on my repo and it created some PRs. All of these PRs modified an unrelated GitHub dependency from https to ssh, which broke installing, both locally and in CI.

This seems to be the opposite issue as #5071
Native package manager behavior
To fix the issue, I ran pnpm i github:advaith1/Spark#main, which reverted the change and converted the dependency back to https.
Images of the diff or a link to the PR, issue, or logs
The problematic Dependabot change in all 4 PRs:

The dependency updates Dependabot was doing:

Smallest manifest that reproduces the issue
No response

Closing comment (2024-04-22T22:18:25Z): Looks like a duplicate of #7258. See pnpm/pnpm#6050 and pnpm/pnpm#6530 for more details.