fix(lockfile): support CRLF line endings in env lockfiles by dipan-ck · Pull Request #11654 · pnpm/pnpm

dipan-ck · 2026-05-14T20:02:39Z

Summary

Normalize CRLF line endings before parsing YAML document separators
in streamed env lockfile reads.

Previously the parser only handled LF (\n) line endings, which
caused pnpm to report ERR_PNPM_BROKEN_LOCKFILE or outdated
lockfile errors when configDependencies lockfiles were checked
out with CRLF (\r\n) line endings on Windows.

Fixes #11612

Summary by CodeRabbit

Bug Fixes
- Fixed lockfile parsing failures when lockfiles use Windows CRLF line endings and include multiple YAML documents by normalizing line endings during parsing so document boundaries are detected reliably.
Tests
- Added coverage for CRLF line endings and BOM+CRLF combinations to ensure correct document extraction.
Chores
- Added a changeset declaring a patch release for the affected packages.

coderabbitai · 2026-05-14T20:02:55Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9ed46447-b350-443c-83e5-89992e0cfea8

📥 Commits

Reviewing files that changed from the base of the PR and between e397883 and f97d808.

📒 Files selected for processing (3)

.changeset/floppy-parents-teach.md
lockfile/fs/src/yamlDocuments.ts
lockfile/fs/test/yamlDocuments.test.ts

✅ Files skipped from review due to trivial changes (1)

.changeset/floppy-parents-teach.md

🚧 Files skipped from review as they are similar to previous changes (1)

lockfile/fs/src/yamlDocuments.ts

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (2)

**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (AGENTS.md)

**/*.{ts,tsx,js,jsx}: Use Standard Style with modifications: trailing commas are used, functions are preferred over classes, functions are declared after they are used (hoisting is relied upon).
Functions should have no more than two or three arguments. If a function needs more parameters, use a single options object instead.
Maintain import order: (1) Standard libraries, (2) External dependencies (sorted alphabetically), (3) Relative imports.

Files:

lockfile/fs/test/yamlDocuments.test.ts

**/*.test.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (AGENTS.md)

Do not use instanceof Error for error type checking in Jest tests. Use util.types.isNativeError() instead, as Jest runs tests in a VM context where instanceof checks can fail across realms.

Files:

lockfile/fs/test/yamlDocuments.test.ts

🧠 Learnings (1)

📚 Learning: 2026-05-14T09:04:00.133Z

Learnt from: zkochan
Repo: pnpm/pnpm PR: 11622
File: resolving/npm-resolver/test/publishedBy.test.ts:350-354
Timestamp: 2026-05-14T09:04:00.133Z
Learning: In the pnpm/pnpm repository, ESLint is the authoritative style linter. Do not raise review findings for missing trailing commas in multiline function calls (e.g., `fs.writeFileSync(...)`) when this repo’s ESLint configuration does not report them and lint passes. Prefer deferring to the ESLint results for this specific trailing-comma rule rather than enforcing it manually in code review.

Applied to files:

lockfile/fs/test/yamlDocuments.test.ts

🔇 Additional comments (1)

lockfile/fs/test/yamlDocuments.test.ts (1)

68-85: LGTM!

Also applies to: 105-114

📝 Walkthrough

Walkthrough

This PR normalizes CRLF to LF in lockfile YAML parsing (streamReadFirstYamlDocument and extractMainDocument) so document start/separator detection works on Windows, adds tests for CRLF and BOM+CRLF cases, and adds a changeset entry for a patch release.

Changes

CRLF handling in YAML parsing

Layer / File(s)	Summary
CRLF normalization in YAML document parsing `lockfile/fs/src/yamlDocuments.ts`, `lockfile/fs/test/yamlDocuments.test.ts`	`streamReadFirstYamlDocument` normalizes CRLF→LF in the Phase 1 initial buffer build and during Phase 2 separator search; `extractMainDocument` normalizes CRLF→LF before separator detection. Tests added cover CRLF and BOM+CRLF cases for first-document and main-document extraction.
Changeset entry `.changeset/floppy-parents-teach.md`	Patch-level changeset entry for `@pnpm/lockfile.fs` documenting the fix for parsing `pnpm-lock.yaml` with CRLF line endings and multiple YAML documents.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related issues

pnpm failed to parse pnpm-lock.yaml with configDependencies and CRLF line ending #11611: Fixes the CRLF parsing failure in the same yamlDocuments code path that caused pnpm to fail parsing pnpm-lock.yaml with configDependencies on Windows.

Possibly related PRs

pnpm/pnpm#11605: Related change that depends on CRLF→LF normalization in extractMainDocument for correct conflict/merge detection.

Suggested reviewers

zkochan

Poem

🐰
I munched on bytes beneath the moon,
Replaced each carriage with a tune,
Now YAML sings with lines aligned,
No broken docs or dash-defined,
A hoppity fix — CRLF resigned.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately summarizes the main change: adding support for CRLF line endings in lockfile parsing, which is the core focus of all code modifications.
Linked Issues check	✅ Passed	All code requirements from issue `#11612` are met: CRLF normalization is implemented in streamReadFirstYamlDocument and extractMainDocument, comprehensive tests cover CRLF and BOM+CRLF cases, and the changeset is properly documented.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to resolving the CRLF parsing issue: YAML document normalization logic, corresponding test coverage, and a changelog entry. No unrelated modifications detected.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

Generate code and open pull requests
Plan features and break down work
Investigate incidents and troubleshoot customer tickets together
Automate recurring tasks and respond to alerts with triggers
Summarize progress and report instantly

Built for teams:

Shared memory across your entire org—no repeating context
Per-thread sandboxes to safely plan and execute work
Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Normalize CRLF line endings before parsing YAML document separators in streamed env lockfile reads. Previously the parser assumed LF-only separators (`\n---\n`), which caused pnpm to report ERR_PNPM_BROKEN_LOCKFILE or outdated lockfile errors when configDependencies lockfiles were checked out with CRLF line endings on Windows. Fixes pnpm#11612

Add CRLF-handling tests for streamReadFirstYamlDocument (CRLF and BOM+CRLF) and extractMainDocument (CRLF in combined file and CRLF in content without separator). Hoist the duplicated CRLF replace in Phase 1 out of the if/else, drop two stray semicolons and a couple of blank lines.

welcome · 2026-05-15T08:15:45Z

Congrats on merging your first pull request! 🎉🎉🎉

* fix(lockfile): support CRLF line endings in env lockfiles Normalize CRLF line endings before parsing YAML document separators in streamed env lockfile reads. Previously the parser assumed LF-only separators (`\n---\n`), which caused pnpm to report ERR_PNPM_BROKEN_LOCKFILE or outdated lockfile errors when configDependencies lockfiles were checked out with CRLF line endings on Windows. Fixes pnpm#11612 * test(lockfile): cover CRLF normalization and clean up yamlDocuments Add CRLF-handling tests for streamReadFirstYamlDocument (CRLF and BOM+CRLF) and extractMainDocument (CRLF in combined file and CRLF in content without separator). Hoist the duplicated CRLF replace in Phase 1 out of the if/else, drop two stray semicolons and a couple of blank lines. * chore: include pnpm in changeset --------- Co-authored-by: Zoltan Kochan <z@kochan.io>

dipan-ck requested a review from zkochan as a code owner May 14, 2026 20:02

coderabbitai Bot approved these changes May 14, 2026

View reviewed changes

zkochan force-pushed the fix/crlf-lockfile-parse branch from fb49fd8 to e397883 Compare May 15, 2026 06:45

zkochan force-pushed the fix/crlf-lockfile-parse branch from a7482b0 to 2aa60d3 Compare May 15, 2026 06:55

chore: include pnpm in changeset

f97d808

zkochan approved these changes May 15, 2026

View reviewed changes

zkochan enabled auto-merge (squash) May 15, 2026 06:59

zkochan merged commit 6e93f35 into pnpm:main May 15, 2026
9 of 10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(lockfile): support CRLF line endings in env lockfiles#11654

fix(lockfile): support CRLF line endings in env lockfiles#11654
zkochan merged 3 commits into
pnpm:mainfrom
dipan-ck:fix/crlf-lockfile-parse

dipan-ck commented May 14, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 14, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

Uh oh!

welcome Bot commented May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dipan-ck commented May 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

Uh oh!

welcome Bot commented May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dipan-ck commented May 14, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 14, 2026 •

edited

Loading