AskMeAnything
Ask
Ask
28
@green_builds ·

pnpm: "Cannot use 'in' operator to search for 'integrity' in undefined" in CI

Every workflow in the org went red this morning and nothing in the repositories changed. Same commit that passed yesterday fails now.

The step is the pnpm setup action, and the log is:

Running self-installer...
Checking for updates...
Switching pnpm from v11.7.0 to v11.12.0...
Error:  Cannot use 'in' operator to search for 'integrity' in undefined
pnpm: Cannot use 'in' operator to search for 'integrity' in undefined
    at createFullPkgId (file:///home/runner/setup-pnpm/node_modules/pnpm/dist/pnpm.mjs:154891:19)
    at lockfileToDepGraph (...)
    at hashDependencyPaths (...)
    at buildGraphFromPackages (...)

It never reaches our install step, so this is not our lockfile. It happens while the action is upgrading pnpm itself.

What I want to know before I start pinning things at random: what is actually undefined here, why did it start today, and is pinning a version the right move or am I papering over something in our own tree?

9 answers Share
Report

9 answers

BestTopNewOldControversial

Answering anonymously, a moderator will review it first.

  • @lockfile_lena · 2w ago · 3 replies
    @lockfile_lena ·

    It is not your lockfile, it is pnpm's own.

    pnpm self-update installs the new pnpm into a global directory that has its own pnpm-lock.yaml. Over time that global lockfile accumulates entries carrying peer dependency suffixes, the [email protected]([email protected]) shape. createFullPkgId walks those entries expecting a package record and gets undefined for the ones written that way, then asks whether integrity is in it. That is your error, one frame down.

    So the trigger is the upgrade path, not the project.

    30
    Share
    Reply

    Answering anonymously, a moderator will review it first.

    Report
    • @green_builds · 2w ago
      @green_builds OP ·

      That fits, the runner is a fresh machine every time and it still fails. It is failing on state it creates during the step itself.

      19
      Share
      Reply

      Answering anonymously, a moderator will review it first.

      Report
    • @peer_deps_pat · 2w ago
      @peer_deps_pat ·

      Worth adding that the same crash shows up with directory instead of integrity depending on which entry it hits first. Same root cause, different missing field, so do not assume they are separate bugs when you search.

      16
      Share
      Reply

      Answering anonymously, a moderator will review it first.

      Report
  • @pins_on_purpose · 2w ago · 3 replies
    @pins_on_purpose ·

    Fix and workarounds, in the order you should try them.

    Fixed in 11.13.0. If you can move forward, ask for that version explicitly and the crash goes away. This was confirmed by a lot of people once it landed.

    If you have to stay put, pin the version in the action rather than letting it resolve to latest. 11.11.0 was the version people fell back to during the outage.

    Pinning is the correct move here and not papering over anything, because the failure is in the upgrade, not in your dependencies.

    27
    Share
    Reply

    Answering anonymously, a moderator will review it first.

    Report
    • @electron_dan · 2w ago · 2 replies
      @electron_dan ·

      One caveat on falling back to 11.11.0: it has its own problem with Electron builds. If you ship a desktop app, go to 11.10.0 instead, or you swap one red pipeline for another.

      14
      Share
      Reply

      Answering anonymously, a moderator will review it first.

      Report
      • @pins_on_purpose · 2w ago
        @pins_on_purpose ·

        Fair, I had not hit that and I would have sent someone straight into it. Amending: 11.13.0 if you can move, 11.10.0 if you cannot and you ship Electron.

        1
        Share
        Reply

        Answering anonymously, a moderator will review it first.

        Report
  • @runner_logs · 2w ago
    @runner_logs ·

    Why it started with no change on your side: the setup action asks for the latest pnpm by default and runs the self installer to get there. 11.12.0 went out, every run started upgrading into it, and every run hit the same crash at the same moment. Nobody merged anything. That is what an ecosystem wide breakage looks like from inside one repository.

    1
    Share
    Reply

    Answering anonymously, a moderator will review it first.

    Report
  • @peer_deps_pat · 2w ago
    @peer_deps_pat ·

    General shape worth taking away from this one: a step that upgrades a tool as part of running it is a step that can break with no commit behind it. Anything that says latest in a pipeline is an unpinned dependency wearing a convenience flag.

    1
    Share
    Reply

    Answering anonymously, a moderator will review it first.

    Report
  • @runner_logs · last wk.
    @runner_logs ·

    Check the line above the error before you debug anything. If it says it is switching versions, the crash is in the switch.

    1
    Share
    Reply

    Answering anonymously, a moderator will review it first.

    Report