potiuk opened a new issue, #72298: URL: https://github.com/apache/airflow/issues/72298
cc @jason810496 @uranusjr @bbovenzi @pierrejeambrun — as the recent maintainers of `.github/dependabot.yml` and the core UI dependencies. ### What happens Six UI workspaces pin security advisories via a `pnpm.overrides` block in `package.json`, which pnpm mirrors into an `overrides:` section at the top of `pnpm-lock.yaml`: - `airflow-core/src/airflow/ui/` - `airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui/` - `providers/edge3/src/airflow/providers/edge3/plugins/www/` - `providers/fab/src/airflow/providers/fab/www/` - `providers/common/ai/src/airflow/providers/common/ai/plugins/www/` - `dev/react-plugin-tools/react_plugin_template/` In some grouped dependabot updates the regenerated lockfile comes back **without that `overrides:` section**, while `package.json` still declares it. Every frozen install then fails: ``` ERR_PNPM_LOCKFILE_CONFIG_MISMATCH Cannot proceed with the frozen installation. The current "overrides" configuration doesn't match the value found in the lockfile ``` breaking `ts-compile-lint-ui`, `ts-compile-lint-edge-ui` and `compile-edge-assets`, i.e. the `CI image checks / Static checks` job. ### Confirmed cases - #72257 — dependabot's commit `3b6dfecb20` has no `overrides:` block; its parent does. - #72258 — same, restoring the block fixed static checks. - #72255 — same error signature, same fix. Not all dependabot PRs are affected: #72234 updated the core UI lockfile on `main` and left the block untouched. All three confirmed cases were PRs dependabot **recreated** after a `@dependabot rebase`; #72234 was an original PR. That correlation is suggestive but unproven, and identifying the actual trigger is part of this issue. ### Why it matters The overrides are security-advisory pins — tar, lodash / lodash-es, handlebars, minimatch, brace-expansion, ajv, flatted, js-yaml, prismjs, happy-dom, rollup and others. A lockfile that has lost them has silently lost those pins. Today the frozen-install failure blocks such a PR from merging, so the safety net is incidental rather than designed. ### Current workaround Regenerate on the dependabot branch with the pinned pnpm and push: ```bash npx [email protected] --dir <workspace> install --no-frozen-lockfile ``` Applied to #72257, #72255, #72258. Costs: it must be repeated per PR, and pushing to a dependabot branch removes the PR from dependabot's management, so it no longer auto-rebases. ### Follow-up work - [ ] Identify what makes dependabot drop the block on some updates but not others. - [ ] Decide the durable fix — configure dependabot to preserve the overrides, regenerate the lockfile in CI on dependabot branches, or relocate the advisory pins. - [ ] Add a check that compares each lockfile's `overrides:` against its `package.json` `pnpm.overrides` and fails with a clear message, instead of surfacing as `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` deep in a hook log. ### Acceptance criteria A grouped dependabot PR against any of the listed workspaces passes static checks without a human regenerating the lockfile, and its lockfile retains the full `overrides:` block. --- Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
