jdx/mise · error

pnpm lockfile dependency

Error message

pnpm lockfile dependency {name:?} at {version:?} has no package snapshot

What it means

resolve_package_keys looks up a dependency name+version in the lockfile's packages/snapshots section to find matching package keys. If no snapshot exists for that exact (name, version) pair, mise cannot build the dependency graph and bails. This typically means the lockfile's importer versions and snapshots section are out of sync.

Solutions

1. Run `pnpm install` to reconcile importers with the packages/snapshots section.
2. Delete pnpm-lock.yaml and reinstall if it is corrupted or badly merged.
3. Resolve merge conflicts in pnpm-lock.yaml by regenerating rather than hand-editing.
4. Pin the dependency to a version that exists in the lockfile snapshots.

Example fix

// before: hand-edited lockfile with importer version 2.0.0 but no snapshot
// after
$ rm pnpm-lock.yaml && pnpm install

// verify every importer version has a snapshot entry
for (const [name, version] of allImporterDeps()) {
  if (!lock.snapshots?.[`${name}@${version}`] && !lock.packages?.[`${name}@${version}`]) {
    console.warn(`missing snapshot for ${name}@${version}`);
  }
}

try {
  mise('run', 'task');
} catch (e) {
  if (/has no package snapshot/.test(e.message)) {
    execSync('pnpm install --frozen-lockfile=false', { stdio: 'inherit' });
  } else throw e;
}

When it happens

Trigger: dependency_package_keys resolved a version (e.g. from an importer) but the lockfile's packages map contains no entry with that name/version — often after partial lockfile edits or peer-resolution suffix mismatches.

Common situations: Hand-merged pnpm-lock.yaml conflicts where snapshots were dropped; stale lockfile after changing package.json without running pnpm install; version strings with peer suffixes (e.g. 1.0.0_peer_deps@x) whose snapshots differ.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• pnpm lockfile dependency
• lockfile attributed to unknown workspace project
• workspace provider attributed lockfile to foreign project
• workspace provider attributed lockfile to unknown project
• additional_artifacts must be an array in lockfile

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/951e302873a4270f. Report an issue: GitHub.

Appendix: source

Thrown at src/task/workspace/node.rs:444

    }
    let packages = candidates
        .into_iter()
        .flat_map(|candidate| {
            available
                .iter()
                .filter(move |package| {
                    *package == &candidate
                        || package
                            .strip_prefix(&candidate)
                            .is_some_and(|suffix| suffix.starts_with('('))
                })
                .cloned()
        })
        .collect::<BTreeSet<_>>();
    if !packages.is_empty() {
        return Ok(packages.into_iter().collect());
    }
    eyre::bail!("pnpm lockfile dependency {name:?} at {version:?} has no package snapshot")
}

fn workspace_tasks(
    manifest: &PackageJson,
    package_manager: &str,
    source: &Path,
    turbo: Option<&TurboJson>,
    workspace_root: &Path,
) -> BTreeMap<String, WorkspaceTask> {
    manifest
        .scripts
        .iter()
        .map(|(name, script)| {
            let command = shell_words::join([package_manager, "run", name, "--"]);
            (
                name.clone(),
                WorkspaceTask {
                    command,

View on GitHub (pinned to 533346cc37)