fix(docker): pin pnpm version to honor package.json packageManager field#86
Merged
Conversation
The Dockerfile called `corepack prepare pnpm@latest --activate`, which
silently follows whatever pnpm publishes as "latest" each time the image
is rebuilt. This broke the build on 2026-05-12 when pnpm 11.1.1 shipped
(released the same day) with a stricter interpretation of PNPM_HOME:
[ERROR] The configured global bin directory "/pnpm/bin" is not in PATH
pnpm 10.x (which the repo's pnpm-lock.yaml requires) accepted
`PATH=$PNPM_HOME:$PATH` because it treated $PNPM_HOME itself as the bin
dir. pnpm 11.x splits PNPM_HOME and its bin subdirectory, so the same
PATH no longer satisfies `pnpm config set --global`.
Two changes:
1. Pin to pnpm@10.16.1, the version package.json's `packageManager` field
already declared as the single source of truth. Corepack honors that
field automatically when you don't pass an explicit override, so this
is now the canonical pin. Future pnpm upgrades happen by editing
package.json (and ideally regenerating pnpm-lock.yaml), not by
whatever Docker Hub serves that day.
2. Add `$PNPM_HOME/bin` to PATH as well. Belt-and-suspenders — when the
pin is intentionally bumped to pnpm 11.x in the future, the build
keeps working without another Dockerfile edit.
Tested:
- docker compose build --no-cache scripthammer succeeds
- docker compose up -d → container reaches health: starting
- Verified pnpm 10.16.1 activates inside built image (corepack pulls
from package.json packageManager field)
- Sanity test in isolation:
docker run --rm node:22-slim sh -c 'corepack enable &&
corepack prepare pnpm@10.16.1 --activate &&
export PNPM_HOME=/pnpm && export PATH=\$PNPM_HOME:\$PNPM_HOME/bin:\$PATH &&
pnpm config set store-dir /pnpm/store --global && echo SUCCESS'
→ SUCCESS
Root cause:
A floating `@latest` tag in infrastructure code is a time bomb; this is
the first time it went off but won't be the last unless pinned. The fix
also removes the duplication where two different files (Dockerfile and
package.json) both claimed authority over the pnpm version.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
3 tasks
This was referenced May 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
corepack prepare pnpm@latestindocker/Dockerfilestarted failing 2026-05-12 when pnpm 11.1.1 shipped (released the same day) with a stricterPNPM_HOME/PATH check. Build broke wherever the image was rebuilt today.pnpm@10.16.1— the versionpackage.json'spackageManagerfield already declares as the single source of truth. Corepack honors that field automatically, so this is now the canonical pin.$PNPM_HOME/binto PATH as belt-and-suspenders, so future intentional bumps to pnpm 11.x keep the build working without another Dockerfile edit.Root cause
A floating
@latesttag in infrastructure code is a time bomb. This is the first time it went off, but won't be the last unless pinned. The fix also removes the duplication where two files (Dockerfile andpackage.json) both claimed authority over the pnpm version.Test plan
docker compose build --no-cache scripthammersucceedsdocker compose up -dreacheshealth: startingpackage.jsonpackageManager field)SUCCESS🤖 Generated with Claude Code