Why PNPM marks my package with "version: link:"?

[tal-rofe]

I have an open source package, published in NPM. In this package, I used the same package,
https://github.com/tal-rofe/cz-vinyl

So as your can see, the package name is cz-vinyl, with latest version of 2.5.0.
Most important, my package.json file includes: "cz-vinyl": "2.5.0", so I use the package as self dependency.

In my package, I export some TypeScript types in package.json:

	"exports": {
		".": {
			"types": "./dist/config.d.ts",
			"require": "./dist/index.cjs"
		}
	},

However, when I have a TypeScript file, https://github.com/tal-rofe/cz-vinyl/blob/main/czvinyl.config.ts, where I do:

import type { CzVinylConfig } from 'cz-vinyl';

I get an error: Cannot find module 'cz-vinyl' or its corresponding type declarations.ts(2307). I didn't understand why is it the case, because I did export my TypeScript types in the package. Then I found out that PNPM uses this self package as link to the source code.

From pnpm-lock.yaml file:

  cz-vinyl:
    specifier: 2.5.0
    version: 'link:'

And when I look at ./node_modules/cz-vinyl Indeed I just see my source code, instead of the distributed files from NPM. I tested it in completely different repository: I installed cz-vinyl in other project, using PNPM, and I saw my distributed NPM code. And that I why I get the error I pasted here.

So, why does it even happen? And how can I make PNPM to use the NPM distributed code instead of linking directly to the source code?

[zkochan]

I don't understand how you got that. If I remove the lockfile and node_modules and run pnpm install, the dependency is installed, not linked.

You would get the package linked in a workspace, but your is not using the workspace feature. In a workspace you'd be able to disable this behaviour by setting the link-workspace-packages setting to false.

[tal-rofe]

I am not even sure anymore if it is indeed PNPM issue or not. But I can add another important details:

After what you wrote, I did the following:
pnpm remove cz-vinyl and then pnpm add -D cz-vinyl. Then I took a look in the pnpm-lock.yaml and it looked fine:

cz-vinyl:
    specifier: 2.5.1
    version: 2.5.1(@types/node@20.10.0)(inquirer@8.2.5)(typescript@5.3.2)

As you can see, there is no longer link:.

But, then I got pull request created by Renovate,
tal-rofe/cz-vinyl@2d75601#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbL84

And for some reason it changes it to link:.....

I tried to replicate it locally by doing pnpm add -D eslint-plugin-import@latest but I could not replicate it.
Very strange, I may open issue in Renovate.

[tal-rofe]

After another investigation I traced the Renovate logs, and found out what the process is:

1. Renovate modifies my package.json file with this change:

2. Renovate runs: pnpm install --recursive --lockfile-only --ignore-scripts --ignore-pnpmfile

3. Renovate updates my pnpm-lock.yaml with the new changes according to step 2.

I could replicate this issue locally:

1. Run git clone https://github.com/tal-rofe/cz-vinyl.git
2. Modified manually my package.json file as the same way Renovate did
3. Run locally pnpm install --recursive --lockfile-only --ignore-scripts --ignore-pnpmfile
4. I can see my pnpm-lock.yamlchanges:

Relevant Renovate logs:

Logs

DEBUG: npmrc file .npmrc found in repository (branch="renovate/eslint-plugin-import-2.x")
DEBUG: Generating pnpm-lock.yaml for . (branch="renovate/eslint-plugin-import-2.x")
DEBUG: Spawning pnpm install to create pnpm-lock.yaml (branch="renovate/eslint-plugin-import-2.x")
DEBUG: Using node constraint ">=14.16" from package.json (branch="renovate/eslint-plugin-import-2.x")
DEBUG: Setting CONTAINERBASE_CACHE_DIR to /tmp/renovate/cache/containerbase (branch="renovate/eslint-plugin-import-2.x")
DEBUG: Using containerbase dynamic installs (branch="renovate/eslint-plugin-import-2.x")
DEBUG: Resolved stable matching version (branch="renovate/eslint-plugin-import-2.x")
{
  "toolName": "node"
  "constraint": ">=14.16"
  "resolvedVersion": "v20.11.0"
}

DEBUG: Resolved stable matching version (branch="renovate/eslint-plugin-import-2.x")
{
  "toolName": "pnpm"
  "constraint": null
  "resolvedVersion": "8.14.1"
}

DEBUG: Executing command (branch="renovate/eslint-plugin-import-2.x")
{
  "command": "install-tool node v20.11.0"
}

DEBUG: exec completed (branch="renovate/eslint-plugin-import-2.x")
{
  "durationMs": 4484
  "stdout": "[14:50:55.991] INFO (64): Installing tool node@20.11.0...\nv20.11.0\n10.2.4\n0.23.0\n[14:50:59.897] INFO (64): Installed tool node in 3.9s.\n"
  "stderr": ""
}

DEBUG: Executing command (branch="renovate/eslint-plugin-import-2.x")
{
  "command": "install-tool pnpm 8.14.1"
}

DEBUG: exec completed (branch="renovate/eslint-plugin-import-2.x")
{
  "durationMs": 3485
  "stdout": "[14:51:00.449] INFO (116): Installing npm pnpm@8.14.1...\n8.14.1\n[14:51:02.768] INFO (116): Installed tool pnpm in 2.3s.\n"
  "stderr": ""
}

DEBUG: Executing command (branch="renovate/eslint-plugin-import-2.x")
{
  "command": "pnpm install --recursive --lockfile-only --ignore-scripts --ignore-pnpmfile"
}

DEBUG: exec completed (branch="renovate/eslint-plugin-import-2.x")
{
  "durationMs": 10440
  "stdout": "Progress: resolved 1, reused 0, downloaded 0, added 0\nProgress: resolved 34, reused 0, downloaded 33, added 0\nProgress: resolved 80, reused 0, downloaded 64, added 0\nProgress: resolved 198, reused 0, downloaded 184, added 0\nProgress: resolved 369, reused 0, downloaded 368, added 0\nProgress: resolved 468, reused 0, downloaded 467, added 0\nProgress: resolved 569, reused 0, downloaded 561, added 0\nProgress: resolved 733, reused 0, downloaded 727, added 0\nProgress: resolved 887, reused 0, downloaded 865, added 0\nProgress: resolved 960, reused 0, downloaded 938, added 0\nProgress: resolved 960, reused 0, downloaded 938, added 0, done\nDone in 10.3s\n"
  "stderr": ""
}

DEBUG: pnpm-lock.yaml needs updating (branch="renovate/eslint-plugin-import-2.x")
DEBUG: Updated 1 lock files (branch="renovate/eslint-plugin-import-2.x")
{
  "updatedArtifacts": [
    "pnpm-lock.yaml"
  ]
}

[tal-rofe]

@zkochan Please attention? At least feedback please?

[zkochan]

This probably happens because renovate runs pnpm install -r. Try to add .npmrc to the root of your repo with this setting: link-workspace-packages=false.