Conversation
The lock files for the following projects were broken:
- ./example-app-checkout-prices
- ./example-storefront-nextjs-sequra
- ./example-storefront-nextjs-klarna
- ./example-app-sequra
- ./example-storefront-nextjs-app-router
- ./example-app-abandoned-checkouts
- ./example-auth-nextjs-apollo-urql
- ./example-app-slack
- ./example-auth-nextjs-pages-router-apollo
This led to Dependabot failing with the following error when trying to check
dependencies:
```
"message": "/example-app-abandoned-checkouts/pnpm-lock.yaml not parseable",
```
Running `pnpm install --frozen-lockfile` confirmed the issue:
```
$ cd ./example-app-abandoned-checkouts
$ pnpm install --frozen-lockfile
ERR_PNPM_LOCKFILE_BREAKING_CHANGE Lockfile /Saleor/examples/example-app-abandoned-checkouts/pnpm-lock.yaml not compatible with current pnpm
Run with the --force parameter to recreate the lockfile.
```
The list of affected projects was found by scanning for broken lock files like
so:
<details>
```
$ cd examples/
$ readarray -d '' paths < <(find . -maxdepth 1 -name 'example-*' -type d -print0)
$ for d in "${paths[@]}"; do echo "$d" ; ( cd "$d"; pnpm install --frozen-lockfile 2>&1 ; ) ; done
./example-app-checkout-prices
ERR_PNPM_LOCKFILE_BREAKING_CHANGE Lockfile /Saleor/examples/example-app-checkout-prices/pnpm-lock.yaml not compatible with current pnpm
Run with the --force parameter to recreate the lockfile.
./example-storefront-nextjs-sequra
ERR_PNPM_LOCKFILE_BREAKING_CHANGE Lockfile /Saleor/examples/example-storefront-nextjs-sequra/pnpm-lock.yaml not compatible with current pnpm
Run with the --force parameter to recreate the lockfile.
./example-storefront-nextjs-klarna
ERR_PNPM_LOCKFILE_BREAKING_CHANGE Lockfile /Saleor/examples/example-storefront-nextjs-klarna/pnpm-lock.yaml not compatible with current pnpm
Run with the --force parameter to recreate the lockfile.
./example-app-sequra
WARN Unsupported engine: wanted: {"node":"^20.0.0"} (current: {"node":"v22.17.1","pnpm":"8.14.2"})
Lockfile is up to date, resolution step is skipped
Already up to date
Done in 931ms
./example-storefront-nextjs-app-router
ERR_PNPM_LOCKFILE_BREAKING_CHANGE Lockfile /Saleor/examples/example-storefront-nextjs-app-router/pnpm-lock.yaml not compatible with current pnpm
Run with the --force parameter to recreate the lockfile.
./example-app-abandoned-checkouts
ERR_PNPM_LOCKFILE_BREAKING_CHANGE Lockfile /Saleor/examples/example-app-abandoned-checkouts/pnpm-lock.yaml not compatible with current pnpm
Run with the --force parameter to recreate the lockfile.
./example-auth-nextjs-apollo-urql
ERR_PNPM_LOCKFILE_BREAKING_CHANGE Lockfile /Saleor/examples/example-auth-nextjs-apollo-urql/pnpm-lock.yaml not compatible with current pnpm
Run with the --force parameter to recreate the lockfile.
./example-app-slack
ERR_PNPM_OUTDATED_LOCKFILE Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up to date with <ROOT>/package.json
Note that in CI environments this setting is true by default. If you still need to run install in such cases, use "pnpm install --no-frozen-lockfile"
Failure reason:
specifiers in the lockfile don't match specifiers in package.json:
* 2 dependencies were removed: vite@5.3.3, vitest@2.0.0
./example-auth-nextjs-pages-router-apollo
ERR_PNPM_LOCKFILE_BREAKING_CHANGE Lockfile /Saleor/examples/example-auth-nextjs-pages-router-apollo/pnpm-lock.yaml not compatible with current pnpm
Run with the --force parameter to recreate the lockfile.
```
</details>
Then, the lockfiles were fixed like so (by recreating them from scratch):
```shell
dirs=(
'./example-app-checkout-prices'
'./example-storefront-nextjs-sequra'
'./example-storefront-nextjs-klarna'
'./example-app-sequra'
'./example-storefront-nextjs-app-router'
'./example-app-abandoned-checkouts'
'./example-auth-nextjs-apollo-urql'
'./example-app-slack'
'./example-auth-nextjs-pages-router-apollo'
)
for dir in "${dirs[@]}"; do
echo "Recreating lock file for ${dir}..." >&2
( cd "$dir" && pnpm install --lockfile-only ) || echo "Failed" >&2
done
```
Differences FoundExpandLicense Package Apache-2.0 @swc/types Apache-2.0 baseline-browser-mapping MIT @envelop/core MIT @envelop/instrumentation MIT @envelop/types MIT @fastify/busboy MIT @graphql-hive/signal MIT @graphql-tools/executor-common MIT @jridgewell/remapping MIT @theguild/federation-composition MIT @whatwg-node/disposablestack MIT @whatwg-node/promise-helpers MIT @wry/caches MIT data-uri-to-buffer MIT fetch-blob MIT formdata-polyfill MIT generator-function MIT quansync MIT react-fast-compare MIT react-helmet MIT react-side-effect MIT rehackt MIT sync-fetch MIT timeout-signal SummaryExpand
|
peelar
approved these changes
Nov 25, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The lock files for the following projects were broken:
This led to Dependabot failing with the following error when trying to check dependencies:
Running
pnpm install --frozen-lockfileconfirmed the issue:The list of affected projects was found by scanning for broken lock files like so:
Details
Then, the lockfiles were fixed like so (by recreating them from scratch):