potiuk commented on PR #72257:
URL: https://github.com/apache/airflow/pull/72257#issuecomment-5464161991

   cc @jason810496 @uranusjr @bbovenzi — flagging you as the recent maintainers 
of `.github/dependabot.yml`, since the durable fix belongs in the 
dependabot/pnpm configuration rather than in this PR.
   
   **Heads-up: dependabot dropped this lockfile's `pnpm.overrides` — fix 
pushed**
   
   `package.json` here carries a `pnpm.overrides` block, which pnpm mirrors 
into `pnpm-lock.yaml`. Dependabot regenerated the lockfile **without applying 
those overrides**, so the `overrides:` section vanished from the lockfile 
entirely — it is present on the target branch. Every frozen install then fails 
with:
   
   ```
   ERR_PNPM_LOCKFILE_CONFIG_MISMATCH  Cannot proceed with the frozen 
installation.
   The current "overrides" configuration doesn't match the value found in the 
lockfile
   ```
   
   That is what broke `ts-compile-lint-edge-ui` and `compile-edge-assets` here.
   
   I regenerated the lockfile with the repo-pinned pnpm 10.28.1 and pushed it 
to this branch. `pnpm install --frozen-lockfile` now succeeds and the 
previously failing hooks pass locally.
   
   **Why this wants a maintainer's eye:** those overrides are security-advisory 
pins — tar, lodash / lodash-es, handlebars, minimatch, brace-expansion, ajv, 
flatted, js-yaml and others. Merged as dependabot generated it, this PR would 
have silently removed those pins from the lockfile in addition to breaking the 
build. This is not specific to this PR: it will recur on every UI dependabot PR 
in this repo until dependabot is configured or worked around to preserve the 
overrides.
   
   Two notes on the diff: it is large because re-resolution also drops stale 
`(supports-color@…)` peer suffixes — a full `pnpm install` produces 
byte-identical output, so this is not a `--lockfile-only` artifact. And because 
a human pushed to this branch, dependabot will no longer rebase it.
   
   ---
   Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to