Repository navigation
fix(docker): pin pnpm to a major in the generated Dockerfile - #61
Merged
Merged
Conversation
The Dockerfile installed pnpm with a bare `npm install -g pnpm`, so every image build took whatever was latest. pnpm 12.9.1 then failed `pnpm install --frozen-lockfile` with ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE on a project whose package.json declared devEngines.packageManager, a lockfile the previous release accepted. Every deploy of that project broke at once, with no change of its own. It now installs pnpm@<major of PNPM_PIN>, so 12 today: patches still arrive, a new major waits for a PNPM_PIN bump that the test suite has been run against. bun stays unpinned. shared:docker 1.2.1.
JoeyHoutenbos
force-pushed
the
fix/pin-pnpm-in-dockerfile
branch
from
October 5, 2026 16:01
b6accff to
361ead2
Compare
joris-sevenlab
approved these changes
Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The generated Dockerfile installs pnpm unpinned (
npm install -g pnpm), so an image build gets whatever is latest at that moment. On one of our projects that turned into pnpm 12.9.1, which failedpnpm install --frozen-lockfilewithERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE(it wanted to recorddevEngines.packageManagerin the lockfile). Every deploy of that project broke until it droppeddevEngines. A new pnpm major can do the same to any project, with no change on its side.PNPM_PIN_MAJORincore/constants/package-manager.ts: the major ofPNPM_PIN, the version this repo tests against.pmInstallGlobalCommands('pnpm')now emitsnpm install -g pnpm@12. Patches still arrive; a new major arrives only with aPNPM_PINbump. bun is unchanged.shared:docker1.2.0 → 1.2.1, sobattlestack pullbrings the pinned Dockerfile to existing projects.Not in this PR, as a separate decision: the CI template (
pm-template.ts) pinspnpm/action-setuptoversion: 10, belowPNPM_MIN(11.3.0) and a different major than the Dockerfile. Moving it toPNPM_PIN_MAJORgives one pnpm everywhere, but it changes CI behaviour for every project and for the plugins that copyversion: 10.Checked:
pnpm tsc,pnpm test(991 passed, 1 skipped),pnpm bump:check origin/main.