{"record":{"id":"e6f519ec6fd2d7c4","repo":"pnpm/pnpm","slug":"no-package-in-dependencies","errorCode":"NO_PACKAGE_IN_DEPENDENCIES","errorMessage":"None of the specified packages were found in the dependencies.","messagePattern":"None of the specified packages were found in the dependencies\\.","errorType":"exception","errorClass":"PnpmError","httpStatus":null,"severity":"error","filePath":"pnpm11/installing/commands/src/installDeps.ts","lineNumber":388,"sourceCode":"      if (ignoreDeps?.length) {\n        params = makeIgnorePatterns(ignoreDeps)\n      }\n    }\n    updateMatch = params.length ? createMatcher(params) : null\n  } else {\n    updateMatch = null\n  }\n  if (opts.packageVulnerabilityAudit != null) {\n    updateMatch = null\n    updateMatching = createVulnerabilityUpdateMatching(opts.packageVulnerabilityAudit)\n  }\n  if (updateMatch != null) {\n    const updateSpecs = params\n    params = matchDependencies(updateMatch, manifest, includeDirect)\n    if (params.length === 0) {\n      if (opts.latest) return\n      if (opts.depth === 0) {\n        throw new PnpmError('NO_PACKAGE_IN_DEPENDENCIES',\n          'None of the specified packages were found in the dependencies.')\n      }\n      // No direct dependencies matched, so we're updating indirect dependencies only\n      // Don't update package.json in this case, and limit updates to only matching dependencies\n      updatePackageManifest = false\n      updateMatching = (pkgName: string) => updateMatch!(pkgName) != null\n      warnAboutIgnoredVersionsOfIndirectUpdateSpecs(updateSpecs)\n    }\n  }\n\n  if (opts.update && opts.latest && (!params || (params.length === 0))) {\n    params = Object.keys(filterDependenciesByType(manifest, includeDirect))\n  }\n  if (opts.workspace) {\n    params = toWorkspaceSpecs(params ?? [], {\n      manifest,\n      include: includeDirect,\n      workspacePackages,","sourceCodeStart":370,"sourceCodeEnd":406,"githubUrl":"https://github.com/pnpm/pnpm/blob/5b11d3a15b9022a2109cb18ed96a5d652630371f/pnpm11/installing/commands/src/installDeps.ts#L370-L406","documentation":"During `pnpm update`, the requested specs are matched against the project manifest's direct dependencies via matchDependencies(updateMatch, manifest, includeDirect). When zero direct dependencies match, the command normally degrades to an indirect-deps update — but with the default depth of 0 there is nothing to update, so it throws NO_PACKAGE_IN_DEPENDENCIES instead of silently doing nothing. The vulnerability-audit mode (packageVulnerabilityAudit) builds its own matcher and hits the same branch.","triggerScenarios":"A single-project `pnpm update <spec>` (not --latest, opts.depth === 0) where <spec> matches no entry in dependencies/devDependencies/optionalDependencies of the current package.json — e.g. the package is transitive only, lives in a different workspace project, or the name is misspelled. Also reachable with --audit fix style flows when no vulnerable direct dep matches.","commonSituations":"Typo in the package name; updating a package that was never added; trying to update a transitive dependency from the project root; forgetting -r in a monorepo so only the root project's manifest is searched.","solutions":["Check the exact name in package.json (`pnpm ls --depth 0`) and fix the spelling of the spec.","If the dependency is transitive, use `pnpm update --depth <N>` (or --depth Infinity) so the indirect-deps branch applies instead of throwing.","If you want the newest version of a not-yet-installed package, `pnpm add <pkg>` instead of `pnpm update <pkg>`.","In workspaces, run with -r (and/or --filter) so other projects' manifests are matched too."],"exampleFix":"# before\npnpm update lodash-es   # ERR_PNPM_NO_PACKAGE_IN_DEPENDENCIES (not a direct dep)\n# after — update it transitively, or add it explicitly\npnpm update --depth 10 lodash-es\npnpm add lodash-es","handlingStrategy":"validation","validationCode":"import { readFile } from 'node:fs/promises'\n\nasync function isDirectDependency (dir: string, name: string): Promise<boolean> {\n  const manifest = JSON.parse(await readFile(`${dir}/package.json`, 'utf8'))\n  return ['dependencies', 'devDependencies', 'optionalDependencies']\n    .some(field => manifest[field] != null && Object.keys(manifest[field]).includes(name))\n}\n\nif (!(await isDirectDependency(projectDir, 'lodash-es'))) {\n  throw new Error('not a direct dependency — use --depth or pnpm add')\n}","typeGuard":"import util from 'node:util'\n\nfunction isNoPackageInDependenciesError (err: unknown): boolean {\n  return util.types.isNativeError(err) && 'code' in err && (err as { code?: string }).code === 'NO_PACKAGE_IN_DEPENDENCIES'\n}","tryCatchPattern":"try {\n  await update(['lodash-es'], { depth: 0 })\n} catch (err) {\n  if (isNoPackageInDependenciesError(err)) {\n    // recover: rerun with depth > 0, or pnpm add the package\n  } else {\n    throw err\n  }\n}","preventionTips":["Derive update specs from the manifest's own dependency names instead of hardcoding them in scripts.","Remember depth 0 means direct dependencies only; pass --depth when targeting transitive packages.","In monorepos, use -r or --filter so specs are matched against every project's manifest."],"tags":["update","dependencies","cli-usage","workspace"],"backgroundTag":null,"analyzedSha":"5b11d3a15b9022a2109cb18ed96a5d652630371f","analyzedAt":"2026-08-16T13:18:59.198Z","schemaVersion":2},"datasetVersion":"2026-08-16T18:17:16.020Z"}