PNPM dependabot timeout #8008
Labels
Comments
|
Support told me that I just shouldn't have so many dependencies...? I have a total of 449 dependencies across 45 package.json files. It should be noted that this is probably more like 200 deps when you consider duplicates I think there is some fundamental flaw in the algorithm because this is not that many deps for it to timeout after 45 minutes. |
|
Hi, I have the same issue, but with a much smaller project ... pnpm version 8.7.6 Nothing incredibly complex, the usual front/back & a few packages ... I noticed that with dependabot running only against version: 2
updates:
- package-ecosystem: npm
directory: "/apps/front"
schedule:
interval: daily
labels:
- "dependencies"
groups:
pnpm-front:
patterns:
- "*"
ignore:
- dependency-name: "@workspaced-packages/*"It ignores my workspaced packages, only gets packages once and completes successfully with a grouped PR. See attached logs: But if I point dependabot to the root of the repository instead, with: version: 2
updates:
- package-ecosystem: npm
directory: "/"
schedule:
interval: daily
labels:
- "dependencies"
groups:
pnpm-all:
patterns:
- "*"
ignore:
- dependency-name: "@workspaced-packages/*"The dependabot job goes crazy: it doesn't ignore my ignored packages, and as soon as it tries to get one of them it goes into a package-fetch-loop-of-doom until it reaches the timeout ... See attached logs: I spared you 98% of the neverending loop that keeps fetching the same packages over and over, but ends with: |
|
This issue is still a thing... I just got another timeout issue |
|
I have split my updates in to minor and patch. |
1 task
|
This feature is still unusable for me. |
|
Since it's been a few months, I'll also add that dependabot updates with |
|
|
|
It may be unrelated but monorepos beyond the typical small-ish sizes in general are unusable with dependabot. We use |
|
We shipped a couple of performance improvements in the past two weeks, does this still timeout? |
|
@abdulapopoola The following are all recent logs from when I just retried: |
|
Thanks @jakeleventhal , the jobs seems to be completing but failing. I checked and these are all |
|
Sure, but see this as well for another update I just ran 
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
and others
Is there an existing issue for this?
Package ecosystem
npm (PNPM)
Package manager version
pnpm
8.7.4Language version
Node.js
18.17.1Manifest location and content before the Dependabot update
dependabot.yml content
Updated dependency
No response
What you expected to see, versus what you actually saw
A PR. Got a timeout instead
Native package manager behavior
No response
Images of the diff or a link to the PR, issue, or logs
No response
Smallest manifest that reproduces the issue
No response
The text was updated successfully, but these errors were encountered: