Dependabot Security Updates failing on strange version mismatch (in GitHub): pnpm support gap?

[p-bakker]

I enabled Dependabot security updates in GitHub and it created a couple of Dependabot Updates runs in CI, but they failed with errors like these:
Dependabot encountered '1' error(s) during execution, please check the logs for more details.
+-----------------------------------------------------------------------------+
| Errors |
+------------------------------+----------------------------------------------+
| Type | Details |
+------------------------------+----------------------------------------------+
| security_update_not_possible | { |
| | "dependency-name": "esbuild", |
| | "latest-resolvable-version": "0.27.4", |
| | "lowest-non-vulnerable-version": "0.28.1", |
| | "conflicting-dependencies": [] |
| | } |
+------------------------------+----------------------------------------------+

My AI 'collegue' been debugging this and thinks the issue is that DependaBot isn't taking pnpm-lock.yaml into account in the VulnerabilityAuditor.

I've looked for existing issues, but there are so many (and I'm not well-versed in Dependabot nor pnpm to understand everything) that I get lost

Any thoughts what this might be and whether this is a known issue or not?

Here's the (I think relevant) subsection of the logs:
updater | 2026/08/28 11:00:25 INFO <job_1544150711> Starting job processing
updater | 2026/08/28 11:00:25 INFO <job_1544150711> Job definition: {"job":{"command":"security","allowed-updates":[{"dependency-type":"direct","update-type":"all"}],"commit-message-options":{"prefix":"chore(deps)","prefix-development":null,"include-scope":null},"credentials-metadata":[{"type":"git_source","host":"github.com"}],"debug":null,"dependencies":["esbuild"],"dependency-groups":[],"dependency-group-to-refresh":null,"existing-pull-requests":[],"existing-group-pull-requests":[],"experiments":{"record-ecosystem-versions":true,"record-update-job-unknown-error":true,"azure-registry-backup":true,"enable-enhanced-error-details-for-updater":true,"gradle-lockfile-updater":true,"blocked-versions":true,"workflow-job-summary":true,"async-retry":true,"enable-npmrc-credential-generation":true,"proxy-read-only-git-credentials":true,"maven-wrapper-updater":true,"prioritize-scm-source":true},"ignore-conditions":[{"dependency-name":"@eslint/js","version-requirement":null,"update-types":["version-update:semver-major"],"source":".github/dependabot.yml","updated-at":"2026-08-26T10:02:50.000Z"},{"dependency-name":"@types/node","version-requirement":null,"update-types":["version-update:semver-major"],"source":".github/dependabot.yml","updated-at":"2026-08-26T10:02:50.000Z"},{"dependency-name":"eslint","version-requirement":null,"update-types":["version-update:semver-major"],"source":".github/dependabot.yml","updated-at":"2026-08-26T10:02:50.000Z"},{"dependency-name":"typescript","version-requirement":null,"update-types":["version-update:semver-major"],"source":".github/dependabot.yml","updated-at":"2026-08-26T10:02:50.000Z"}],"lockfile-only":false,"package-manager":"npm_and_yarn","requirements-update-strategy":null,"reject-external-code":false,"security-advisories":[{"dependency-name":"esbuild","patched-versions":[],"unaffected-versions":[],"affected-versions":[">= 0.17.0 < 0.28.1"]},{"dependency-name":"esbuild","patched-versions":[],"unaffected-versions":[],"affected-versions":[">= 0.27.3 < 0.28.1"]},{"dependency-name":"esbuild","patched-versions":[],"unaffected-versions":[],"affected-versions":["<= 0.24.2"]}],"security-updates-only":true,"source":{"provider":"github","repo":"xxxxxxxx","branch":null,"api-endpoint":"https://api.github.com/","hostname":"github.com","directories":["/."]},"updating-a-pull-request":false,"update-subdependencies":false,"vendor-dependencies":false,"enable-beta-ecosystems":false,"repo-private":true,"cooldown":{"default-days":7,"semver-major-days":0,"semver-minor-days":0,"semver-patch-days":0,"include":[],"exclude":[]},"multi-ecosystem-update":false,"exclude-paths":null}}

updater | 2026/08/28 11:00:27 INFO <job_1544150711> Detected package manager: pnpm
updater | 2026/08/28 11:00:27 INFO <job_1544150711> Resolving package manager for: pnpm
2026/08/28 11:00:27 INFO <job_1544150711> Fetching version for package manager: pnpm

2026/08/28 11:00:28 INFO <job_1544150711> Installed version of pnpm: 11.17.0
2026/08/28 11:00:28 INFO <job_1544150711> Installed version for pnpm: 11.17.0
updater | 2026/08/28 11:00:28 INFO <job_1544150711> Processing engine constraints for pnpm
updater | 2026/08/28 11:00:28 INFO <job_1544150711> No version requirement found for pnpm
updater | 2026/08/28 11:00:28 INFO <job_1544150711> Detected package manager: pnpm
updater | 2026/08/28 11:00:28 INFO <job_1544150711> Resolving package manager for: pnpm
updater | 2026/08/28 11:00:28 INFO <job_1544150711> Installed version for pnpm: 11.17.0
updater | 2026/08/28 11:00:28 INFO <job_1544150711> Processing engine constraints for pnpm
updater | 2026/08/28 11:00:28 INFO <job_1544150711> No version requirement found for pnpm
updater | 2026/08/28 11:00:28 INFO <job_1544150711> Found "packageManager" : "pnpm@11.24.0+sha512.bd27e345e976dcb0be0b7a1228217b049a817e21b1f355c90dbe7dc46671895a8bc1e6d06c24554505ea93ea0b45f489a27ec1bfbc8de6a9659fca0f16fa0000". Skipped checking "engines".
updater | 2026/08/28 11:00:28 INFO <job_1544150711> Requested version 11.24.0
2026/08/28 11:00:28 INFO <job_1544150711> Installing "pnpm@11.24.0"
updater | 2026/08/28 11:00:28 INFO <job_1544150711> Started process PID: 1238 with command: {} corepack install pnpm@11.24.0 --global --cache-only {}
proxy | 2026/08/28 11:00:29 [008] GET https://registry.npmjs.org:443/pnpm/-/pnpm-11.24.0.tgz
proxy | 2026/08/28 11:00:29 [008] 200 https://registry.npmjs.org:443/pnpm/-/pnpm-11.24.0.tgz
proxy | 2026/08/28 11:00:29 [010] GET https://registry.npmjs.org:443/pnpm/11.24.0
proxy | 2026/08/28 11:00:30 [010] 200 https://registry.npmjs.org:443/pnpm/11.24.0
updater | 2026/08/28 11:00:30 INFO <job_1544150711> Process PID: 1238 completed with status: pid 1238 exit 0

proxy | 2026/08/28 11:00:30 [014] GET /update_jobs/1544150711/blocked_versions?package-manager=npm_and_yarn
proxy | 2026/08/28 11:00:30 [014] 200 /update_jobs/1544150711/blocked_versions?package-manager=npm_and_yarn
updater | 2026/08/28 11:00:30 INFO <job_1544150711> Detected package manager: pnpm
2026/08/28 11:00:30 INFO <job_1544150711> Resolving package manager for: pnpm
updater | 2026/08/28 11:00:30 INFO <job_1544150711> Fetching version for package manager: pnpm

updater | 2026/08/28 11:00:31 INFO <job_1544150711> Installed version of pnpm: 11.24.0
2026/08/28 11:00:31 INFO <job_1544150711> Installed version for pnpm: 11.24.0
2026/08/28 11:00:31 INFO <job_1544150711> Processing engine constraints for pnpm
updater | 2026/08/28 11:00:31 INFO <job_1544150711> No version requirement found for pnpm
updater | 2026/08/28 11:00:31 INFO <job_1544150711> Running node command: node -v
updater | 2026/08/28 11:00:31 INFO <job_1544150711> Started process PID: 1264 with command: {} node -v {}
updater | 2026/08/28 11:00:31 INFO <job_1544150711> Process PID: 1264 completed with status: pid 1264 exit 0
updater | 2026/08/28 11:00:31 INFO <job_1544150711> Total execution time: 0.01 seconds
updater | 2026/08/28 11:00:31 INFO <job_1544150711> Command executed successfully: node -v
updater | 2026/08/28 11:00:31 INFO <job_1544150711> Using node version: 24.20.0
2026/08/28 11:00:31 INFO <job_1544150711> Processing engine constraints for node

updater | 2026/08/28 11:00:33 INFO <job_1544150711> Checking if esbuild 0.27.4 needs updating
proxy | 2026/08/28 11:00:33 [020] GET https://registry.npmjs.org:443/esbuild
proxy | 2026/08/28 11:00:33 [020] 200 https://registry.npmjs.org:443/esbuild
proxy | 2026/08/28 11:00:33 [022] HEAD https://registry.npmjs.org:443/esbuild/-/esbuild-0.28.2.tgz
proxy | 2026/08/28 11:00:33 [022] 200 https://registry.npmjs.org:443/esbuild/-/esbuild-0.28.2.tgz
updater | 2026/08/28 11:00:33 INFO <job_1544150711> Latest version is 0.28.2
updater | 2026/08/28 11:00:33 INFO <job_1544150711> VulnerabilityAuditor: starting audit
updater | 2026/08/28 11:00:33 INFO <job_1544150711> VulnerabilityAuditor: missing lockfile
proxy | 2026/08/28 11:00:33 [024] HEAD https://registry.npmjs.org:443/esbuild/-/esbuild-0.28.1.tgz
proxy | 2026/08/28 11:00:33 [024] 200 https://registry.npmjs.org:443/esbuild/-/esbuild-0.28.1.tgz

updater | 2026/08/28 11:00:36 INFO <job_1544150711> Started process PID: 1388 with command: {} pnpm update esbuild@0.28.2 --lockfile-only --no-save -r {}
updater | 2026/08/28 11:00:37 INFO <job_1544150711> Process PID: 1388 completed with status: pid 1388 exit 1
updater | 2026/08/28 11:00:37 INFO <job_1544150711> Total execution time: 1.36 seconds
updater | 2026/08/28 11:00:37 INFO <job_1544150711> Requirements to unlock update_not_possible
updater | 2026/08/28 11:00:37 INFO <job_1544150711> Requirements update strategy bump_versions
updater | 2026/08/28 11:00:37 INFO <job_1544150711> Started process PID: 1403 with command: node /opt/npm_and_yarn/dist/run.js
updater | 2026/08/28 11:00:38 INFO <job_1544150711> Process PID: 1403 completed with status: pid 1403 exit 1
updater | 2026/08/28 11:00:38 INFO <job_1544150711> Total execution time: 1.02 seconds
updater | 2026/08/28 11:00:38 INFO <job_1544150711> Started process PID: 1412 with command: {} git reset HEAD --hard {}
updater | 2026/08/28 11:00:38 INFO <job_1544150711> Process PID: 1412 completed with status: pid 1412 exit 0
2026/08/28 11:00:38 INFO <job_1544150711> Total execution time: 0.02 seconds
updater | 2026/08/28 11:00:38 INFO <job_1544150711> Started process PID: 1418 with command: {} git clean -fx {}
updater | 2026/08/28 11:00:38 INFO <job_1544150711> Process PID: 1418 completed with status: pid 1418 exit 0
updater | 2026/08/28 11:00:38 INFO <job_1544150711> Total execution time: 0.01 seconds
updater | 2026/08/28 11:00:38 INFO <job_1544150711> Started process PID: 1499 with command: {} pnpm update esbuild@0.28.2 --lockfile-only --no-save -r {}
updater | 2026/08/28 11:00:39 INFO <job_1544150711> Process PID: 1499 completed with status: pid 1499 exit 1

[Junaid-PK]

This looks like the current pnpm 11 support gap, rather than evidence that the auditor is ignoring a supported pnpm lockfile.

The job is installing the version pinned by the repository (pnpm@11.24.0). GitHub’s current Dependabot support table lists pnpm v7–v10, not v11: https://docs.github.com/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories#supported-ecosystems-maintained-by-github

pnpm 11 support is still tracked in #14794. In particular, pnpm 11 introduced a multi-document pnpm-lock.yaml format; Dependabot failing to parse that format was reported in #14919. That is consistent with the VulnerabilityAuditor: missing lockfile line in this log.

A practical workaround is to temporarily pin the project to pnpm 10, regenerate and commit pnpm-lock.yaml with that version, then rerun the security update. Otherwise, update esbuild manually to at least 0.28.1 while staying on pnpm 11.

There is also a second failure later in the log: pnpm update esbuild@0.28.2 --lockfile-only --no-save -r exits with status 1, but its stderr is not included here. If the update still fails after using pnpm 10, the lines immediately following that command should identify the remaining project-specific constraint.