potiuk commented on PR #72257: URL: https://github.com/apache/airflow/pull/72257#issuecomment-5464161991
cc @jason810496 @uranusjr @bbovenzi — flagging you as the recent maintainers of `.github/dependabot.yml`, since the durable fix belongs in the dependabot/pnpm configuration rather than in this PR. **Heads-up: dependabot dropped this lockfile's `pnpm.overrides` — fix pushed** `package.json` here carries a `pnpm.overrides` block, which pnpm mirrors into `pnpm-lock.yaml`. Dependabot regenerated the lockfile **without applying those overrides**, so the `overrides:` section vanished from the lockfile entirely — it is present on the target branch. Every frozen install then fails with: ``` ERR_PNPM_LOCKFILE_CONFIG_MISMATCH Cannot proceed with the frozen installation. The current "overrides" configuration doesn't match the value found in the lockfile ``` That is what broke `ts-compile-lint-edge-ui` and `compile-edge-assets` here. I regenerated the lockfile with the repo-pinned pnpm 10.28.1 and pushed it to this branch. `pnpm install --frozen-lockfile` now succeeds and the previously failing hooks pass locally. **Why this wants a maintainer's eye:** those overrides are security-advisory pins — tar, lodash / lodash-es, handlebars, minimatch, brace-expansion, ajv, flatted, js-yaml and others. Merged as dependabot generated it, this PR would have silently removed those pins from the lockfile in addition to breaking the build. This is not specific to this PR: it will recur on every UI dependabot PR in this repo until dependabot is configured or worked around to preserve the overrides. Two notes on the diff: it is large because re-resolution also drops stale `(supports-color@…)` peer suffixes — a full `pnpm install` produces byte-identical output, so this is not a `--lockfile-only` artifact. And because a human pushed to this branch, dependabot will no longer rebase it. --- Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
