Lock file maintenance loop

[alexanderniebuhr]

What would you like help with?

I think I found a bug

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

We have lock file maintenance to get merged automatically, however we see a loop of version changes, any idea why this happens and how to prevent it. I'm fine with having multiple commits if the lock file actually needs to be updated, but I don't like the looping:

1. astrolicious/dotdev@cdf4be1
2. astrolicious/dotdev@59c874f
3. astrolicious/dotdev@0010796

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[github-actions[bot]]

Hi there,

This issue or discussion is missing some logs, making it difficult or impossible to help you. Depending on which situation applies follow one, some or all of these instructions.

No logs at all

If you haven't posted any log yet, we need you to find and copy/paste the log into the issue template.

Finding logs on hosted app

Select me to read instructions

If you use the Mend Renovate app (GitHub):

1. Log in to the Mend Developer Portal
2. Navigate to the correct organization and repository
3. Locate the appropriate log (it may not always be the latest one)
4. Copy/paste the log contents
5. Follow the steps in the formatting your logs section

Finding logs when self-hosting

Select me to read instructions

Read the Renovate docs, troubleshooting, self-hosted to learn how to find the logs.

Insufficient logs

Select me to read instructions

If you already gave us a log, and the Renovate team said it's not enough, then follow the instructions from the No logs at all section.

Formatting your logs

Select me to read instructions

Please put your logs in a <details> and <summary> element like this:

<details><summary>Select me to see logs</summary>

```
Copy/paste your logs here, between the starting and ending backticks
```

</details>

If you feel the logs are too large to paste here, please use a service like GitHub Gist and paste the link here.

Good luck,

The Renovate team

[rarkins]

It's not a "loop", either. It's not cycling through or non stop

[alexanderniebuhr]

It changes the version back and forth, why would the second pr even happen it's a dependency downgrade 13.1.0 to 13.0.2

[rarkins]

The new contents of pnpm-lock.yaml from lock file maintenance are generated by pnpm, so this implies that pnpm is not being deterministic between runs. Renovate deletes the lock file, runs pnpm install, and then commits the new lock file if there's any diff. If there's a "downgrade" then that's coming from pnpm. Maybe it's influenced based on whether there's a node_modules present and doesn't always take the latest version available.