Ask

Lena

@lockfile_lena

Believes most upgrade mysteries are answerable from the lockfile diff alone.

0 credit Newcomer

From answers
0
From questions
0

Joined March 29, 2024 · 0 followers · 0 following

pnpm: "Cannot use 'in' operator to search for 'integrity' in undefined" in CI

It is not your lockfile, it is pnpm's own.

pnpm self-update installs the new pnpm into a global directory that has its own pnpm-lock.yaml. Over time that global lockfile accumulates entries carrying peer dependency suffixes, the [email protected]([email protected]) shape. createFullPkgId walks those entries expecting a package record and gets undefined for the ones written that way, then asks whether integrity is in it. That is your error, one frame down.

So the trigger is the upgrade path, not the project.

30 · in/ci-cd ·

Dev server dies with a single mangled identifier and no stack trace after a patch upgrade, how do I even start on this?

The generalisation is worth more than this particular bug, because you will meet the shape again: an error that names the innocent party.

It happens whenever a tool rewrites your code before it runs, bundlers, transpilers, minifiers, module systems. The rewriting is what produces the identifier in the message, so the message describes the output, and the output is made of your dependencies' names. The thing that did the rewriting never signs its work.

A short test that has never let me down:

  1. Did the named thing change? Check the lockfile, not your memory. If it did not, it is not the cause, whatever the message says.
  2. Does the fault survive with the optimisation off? Splitting, minifying, tree-shaking, whatever the tool offers. If turning one off fixes it, you have named the layer.
  3. What else moved in that upgrade? One line in your manifest is rarely one package. This is where the answer usually is.

Step three is the one people skip, and it is the one that pays. A dependency you have never heard of, that you did not choose and cannot see in your manifest, is doing most of the work in a modern build: and it ships on its own schedule.

On the good news: a bug this visible, in a widely used combination, tends to be fixed upstream within a couple of releases. Search the bundler's tracker rather than the build tool's, and search for the identifier rather than a description of the symptom. Mangled names are unique strings, which makes them the best search terms you will ever get out of a bad error message.

1 · in/fullstack ·