Support PNPM v11

[IanVS]

Is there an existing issue for this?

• I have searched the existing issues

Feature description

PNPM vesrion 11 is in release candidate stage, and I would like to use it in my project. However, I see that dependabot only supports up to v10 (https://docs.github.com/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories#supported-ecosystems-and-repositories).

[PikachuEXE]

https://github.com/pnpm/pnpm/releases/tag/v11.0.0 is out so this become more important now

[shimscho]

any updates?

[robaiken]

@IanVS thanks for opening this! Does anyone have example repos using PNPM 11 I can test against? Trying to get a feel for real-world usage before diving into the implementation. @PikachuEXE @shimscho

[shimscho]

Hi @robaiken, follow-up on this with a more careful data point.

Attempted v10.33.3 to v11.0.9 on a private NestJS + SvelteKit monorepo (around 1100 deps). After resolving four explicit allowBuilds decisions blocked by the new strictDepBuilds: true default (@nestjs/core, @scarf/scarf, @sentry/cli, protobufjs), local pnpm install, type-check, full build and the lint suite all came up green.

The honest answer is: I rolled back without ever running CI against the new toolchain, so I cannot tell you whether your existing pnpm 9 or 10 code path would have produced correct PRs on a v11 project. That CI verification is the actual gap, not the migration itself.

Two observations that might be useful for your test plan:

1. pnpm 11 auto-writes literal placeholder strings (set this to true or false) into pnpm-workspace.yaml for any postinstall not yet listed in allowBuilds. strictDepBuilds: true then blocks the install. Worth checking how Dependabot's install path handles that on first contact with a v11 project that hasn't been hand-configured.

2. The lockfile stayed on lockfileVersion: '9.0' after the first install with v11 in our case, because no re-resolution was triggered. So v9 lockfiles under pnpm 11 may be a common shape for a while, which could simplify the support story for you.

Happy to push to a test branch and share CI results if you have a reference setup in mind.

[robaiken]

Happy to push to a test branch and share CI results if you have a reference setup in mind.

@shimscho that would be amazing, thank you

[MattIPv4]

@robaiken https://github.com/alveusgg/alveusgg (monorepo) + https://github.com/alveusgg/extension (single package) are both on v11 if you need things to test against. We don't set devEngines, so we don't have the multi-document lockfiles though. We received a security update from Dependabot since updating, and it seemed correct.

[CleytonGoncalves]

2. [ERR_PNPM_NO_MATURE_MATCHING_VERSION] from pnpm 11's minimumReleaseAge: 1440 default will block Dependabot real time security PRs once v11 is supported. Worth flagging in docs.

Ideally, Dependabot would add a minimumReleaseAgeExclude entry to security-related PRs. That's how RenovateBot works too.

The reasoning is that the GHSA reports used by Dependabot are reviewed and go through much more scrutiny than regular releases, so it's better to update sooner rather than later given that it's a public vulnerability.

[vaskouk]

Hey! Any update here to support v11? Is in stable version now!

[robaiken]

@vaskouk We're updating pnpm 11 support at the moment as we use corepack to pull in package manager versions. If you're hitting a specific issue, could you share some logs or a repo so I can investigate further? I can't say our pnpm 11 support is fully stable yet, but I'm keen to see the errors people are getting so I can reproduce and fix them

[vaskouk]

@vaskouk We're updating pnpm 11 support at the moment as we use corepack to pull in package manager versions. If you're hitting a specific issue, could you share some logs or a repo so I can investigate further? I can't say our pnpm 11 support is fully stable yet, but I'm keen to see the errors people are getting so I can reproduce and fix them

I observed that pipeline failed today while trying to use pnpm audit --fix command in latest version of pnpm. Is this known ? Shall I share more logs from this ?