Threads

Renovate opens PRs that bump versions in package.json but never update pnpm-lock.yml, so CI fails on pnpm install --frozen-lockfile. Reported against the hosted WhiteSource Renovate app. The root cause was in package file matching: Renovate failed to recognize pnpm workspace package files when packageFilters used leading ./ paths, so it never ran the pnpm lockfile maintenance step.

This was a Renovate bug fixed in version 31.43.2, upgrade to that release or later and the pnpm lockfile updates again. The fix corrected the packageFilters matching in lib/manager/npm/extract/pnpm.ts so paths with a leading ./ are recognized. If you self-host and pin Renovate, make sure you are past 31.43.2.

Source: https://github.com/renovatebot/renovate/issues/8323

Source: https://github.com/renovatebot/renovate/issues/8323