pnpm v12 env lockfile document is parsed as an empty dependency graph

[notluquis]

Summary

pnpm 12 can write pnpm-lock.yaml as a YAML stream with an environment document first and the dependency graph second. The current dependency-graph parser treats the first document as the whole lockfile, reports zero project dependencies, and closes alerts without an actual dependency update.

Upstream format discussion and repro: pnpm/pnpm#13805

Minimal reproduction

{
  "name": "repro-envdoc",
  "version": "1.0.0",
  "private": true,
  "packageManager": "pnpm@12.0.0-rc.5",
  "dependencies": { "is-odd": "3.0.1" }
}

Run:

pnpm install --lockfile-only
grep -c '^---$' pnpm-lock.yaml # 2

Both YAML documents declare lockfileVersion: '9.0'. The first contains packageManagerDependencies; the second contains the project's dependencies.

A parser must load the YAML stream rather than a single document. For the project graph, pnpm recommends selecting the final document (yaml.loadAll(content).at(-1)). A complete scanner should also read the environment document, because configDependencies are real packages.

Impact and workaround

In https://github.com/notluquis/bioalergia, GitHub's dependency graph reported zero dependencies for every manifest while the two-document lockfile was present. pmOnFail: ignore restores the legacy single-document lockfile, which is the current workaround. This issue still reproduces with pnpm 12.0.0-rc.5.

[v-HaripriyaC]

12 writes pnpm-lock.yaml as a YAML stream — an environment document (packageManagerDependencies, configDependencies) first, then the real project graph second. Both declare lockfileVersion: '9.0'. A parser that calls single-document yaml.load gets the environment doc, sees no dependencies/importers, and reports zero packages. The reporter saw alerts auto-close on notluquis/bioalergia with no actual update; workaround is pmOnFail: ignore to force the legacy single-document lockfile. Upstream context: pnpm/pnpm#13805. Rob want to take a look?