diff --git a/docs/usage/configuration-options.md b/docs/usage/configuration-options.md index 10e321938d28c92f841b4ebbe75eed178d6a041f..2b20190736cf7232a8cef81cd9cc0611d10529b8 100644 --- a/docs/usage/configuration-options.md +++ b/docs/usage/configuration-options.md @@ -2973,7 +2973,7 @@ Table with options: | `gomodUpdateImportPaths` | Update source import paths on major module updates, using [mod](https://github.com/marwan-at-work/mod). | | `helmUpdateSubChartArchives` | Update subchart archives in the `/charts` folder. | | `npmDedupe` | Run `npm dedupe` after `package-lock.json` updates. | -| `pnpmDedupe` | Run `pnpm dedupe` after `pnpm-lock.yaml` updates. | +| `pnpmDedupe` | Run `pnpm dedupe --ignore-scripts` after `pnpm-lock.yaml` updates. | | `yarnDedupeFewer` | Run `yarn-deduplicate --strategy fewer` after `yarn.lock` updates. | | `yarnDedupeHighest` | Run `yarn-deduplicate --strategy highest` (`yarn dedupe --strategy highest` for Yarn >=2.2.0) after `yarn.lock` updates. | diff --git a/lib/modules/manager/npm/post-update/__fixtures__/dedupe-ignore-scripts/package.json b/lib/modules/manager/npm/post-update/__fixtures__/dedupe-ignore-scripts/package.json new file mode 100644 index 0000000000000000000000000000000000000000..048343493143838d0d7faea14b23355045698c05 --- /dev/null +++ b/lib/modules/manager/npm/post-update/__fixtures__/dedupe-ignore-scripts/package.json @@ -0,0 +1,9 @@ +{ + "name": "dedupe-ignore-scripts", + "version": "1.0.0", + "engines": { + "pnpm": ">=8.8.0" + }, + "engine-strict": true, + "packageManager": "pnpm@8.8.0" +} diff --git a/lib/modules/manager/npm/post-update/pnpm.spec.ts b/lib/modules/manager/npm/post-update/pnpm.spec.ts index 064af1bdae74d426730abb3a2c2434db34967a72..2c21264cf29aa00d4536268dd64bb6b18707872c 100644 --- a/lib/modules/manager/npm/post-update/pnpm.spec.ts +++ b/lib/modules/manager/npm/post-update/pnpm.spec.ts @@ -77,7 +77,7 @@ describe('modules/manager/npm/post-update/pnpm', () => { {}, { ...config, postUpdateOptions } ); - expect(fs.readLocalFile).toHaveBeenCalledTimes(1); + expect(fs.readLocalFile).toHaveBeenCalledTimes(2); expect(res.lockFile).toBe('package-lock-contents'); expect(execSnapshots).toMatchObject([ { @@ -89,6 +89,30 @@ describe('modules/manager/npm/post-update/pnpm', () => { ]); }); + it('performs dedupe --ignore-scripts for pnpm >= 8.8.0', async () => { + const execSnapshots = mockExecAll(); + const fileContent = Fixtures.get('dedupe-ignore-scripts/package.json'); + fs.readLocalFile + .mockResolvedValueOnce(fileContent) + .mockResolvedValue('package-lock-contents'); + const postUpdateOptions = ['pnpmDedupe']; + const res = await pnpmHelper.generateLockFile( + 'some-dir', + {}, + { ...config, postUpdateOptions } + ); + expect(fs.readLocalFile).toHaveBeenCalledTimes(2); + expect(res.lockFile).toBe('package-lock-contents'); + expect(execSnapshots).toMatchObject([ + { + cmd: 'pnpm install --recursive --lockfile-only --ignore-scripts --ignore-pnpmfile', + }, + { + cmd: 'pnpm dedupe --ignore-scripts', + }, + ]); + }); + it('uses the new version if packageManager is updated', async () => { const execSnapshots = mockExecAll(); fs.readLocalFile.mockResolvedValue('package-lock-contents'); diff --git a/lib/modules/manager/npm/post-update/pnpm.ts b/lib/modules/manager/npm/post-update/pnpm.ts index 15ff68359615da39924e842429ae28d24e5129e4..4cf288caaa6a778db1d5b5d609e5b28530bd7e7a 100644 --- a/lib/modules/manager/npm/post-update/pnpm.ts +++ b/lib/modules/manager/npm/post-update/pnpm.ts @@ -1,5 +1,6 @@ import is from '@sindresorhus/is'; import { load } from 'js-yaml'; +import semver from 'semver'; import upath from 'upath'; import { GlobalConfig } from '../../../../config/global'; import { TEMPORARY_ERROR } from '../../../../constants/error-messages'; @@ -39,6 +40,7 @@ export async function generateLockFile( let cmd = 'pnpm'; try { const lazyPgkJson = lazyLoadPackageJson(lockFileDir); + const pnpmToolConstraint: ToolConstraint = { toolName: 'pnpm', constraint: @@ -79,8 +81,19 @@ export async function generateLockFile( // postUpdateOptions if (config.postUpdateOptions?.includes('pnpmDedupe')) { - logger.debug('Performing pnpm dedupe'); - commands.push('pnpm dedupe'); + const pnpmVersionFromPackageJson = getPackageManagerVersion( + 'pnpm', + await lazyPgkJson.getValue() + ); + + if ( + pnpmVersionFromPackageJson && + semver.gte(pnpmVersionFromPackageJson, '8.8.0') + ) { + commands.push('pnpm dedupe --ignore-scripts'); + } else { + commands.push('pnpm dedupe'); + } } if (upgrades.find((upgrade) => upgrade.isLockFileMaintenance)) {