pnpm/pnpm · error · PnpmError

NO_PACKAGE_IN_DEPENDENCIES

NO_PACKAGE_IN_DEPENDENCIES

Error message

None of the specified packages were found in the dependencies.

What it means

During `pnpm update`, the requested specs are matched against the project manifest's direct dependencies via matchDependencies(updateMatch, manifest, includeDirect). When zero direct dependencies match, the command normally degrades to an indirect-deps update — but with the default depth of 0 there is nothing to update, so it throws NO_PACKAGE_IN_DEPENDENCIES instead of silently doing nothing. The vulnerability-audit mode (packageVulnerabilityAudit) builds its own matcher and hits the same branch.

Source

Thrown at pnpm11/installing/commands/src/installDeps.ts:388

      if (ignoreDeps?.length) {
        params = makeIgnorePatterns(ignoreDeps)
      }
    }
    updateMatch = params.length ? createMatcher(params) : null
  } else {
    updateMatch = null
  }
  if (opts.packageVulnerabilityAudit != null) {
    updateMatch = null
    updateMatching = createVulnerabilityUpdateMatching(opts.packageVulnerabilityAudit)
  }
  if (updateMatch != null) {
    const updateSpecs = params
    params = matchDependencies(updateMatch, manifest, includeDirect)
    if (params.length === 0) {
      if (opts.latest) return
      if (opts.depth === 0) {
        throw new PnpmError('NO_PACKAGE_IN_DEPENDENCIES',
          'None of the specified packages were found in the dependencies.')
      }
      // No direct dependencies matched, so we're updating indirect dependencies only
      // Don't update package.json in this case, and limit updates to only matching dependencies
      updatePackageManifest = false
      updateMatching = (pkgName: string) => updateMatch!(pkgName) != null
      warnAboutIgnoredVersionsOfIndirectUpdateSpecs(updateSpecs)
    }
  }

  if (opts.update && opts.latest && (!params || (params.length === 0))) {
    params = Object.keys(filterDependenciesByType(manifest, includeDirect))
  }
  if (opts.workspace) {
    params = toWorkspaceSpecs(params ?? [], {
      manifest,
      include: includeDirect,
      workspacePackages,

View on GitHub (pinned to 5b11d3a15b)

Solutions

Check the exact name in package.json (`pnpm ls --depth 0`) and fix the spelling of the spec.
If the dependency is transitive, use `pnpm update --depth <N>` (or --depth Infinity) so the indirect-deps branch applies instead of throwing.
If you want the newest version of a not-yet-installed package, `pnpm add <pkg>` instead of `pnpm update <pkg>`.
In workspaces, run with -r (and/or --filter) so other projects' manifests are matched too.

Example fix

# before
pnpm update lodash-es   # ERR_PNPM_NO_PACKAGE_IN_DEPENDENCIES (not a direct dep)
# after — update it transitively, or add it explicitly
pnpm update --depth 10 lodash-es
pnpm add lodash-es

Defensive patterns

Strategy: validation

Validate before calling

import { readFile } from 'node:fs/promises'

async function isDirectDependency (dir: string, name: string): Promise<boolean> {
  const manifest = JSON.parse(await readFile(`${dir}/package.json`, 'utf8'))
  return ['dependencies', 'devDependencies', 'optionalDependencies']
    .some(field => manifest[field] != null && Object.keys(manifest[field]).includes(name))
}

if (!(await isDirectDependency(projectDir, 'lodash-es'))) {
  throw new Error('not a direct dependency — use --depth or pnpm add')
}

Type guard

import util from 'node:util'

function isNoPackageInDependenciesError (err: unknown): boolean {
  return util.types.isNativeError(err) && 'code' in err && (err as { code?: string }).code === 'NO_PACKAGE_IN_DEPENDENCIES'
}

Try / catch

try {
  await update(['lodash-es'], { depth: 0 })
} catch (err) {
  if (isNoPackageInDependenciesError(err)) {
    // recover: rerun with depth > 0, or pnpm add the package
  } else {
    throw err
  }
}

Prevention

Derive update specs from the manifest's own dependency names instead of hardcoding them in scripts.
Remember depth 0 means direct dependencies only; pass --depth when targeting transitive packages.
In monorepos, use -r or --filter so specs are matched against every project's manifest.

When it happens

Trigger: A single-project `pnpm update <spec>` (not --latest, opts.depth === 0) where <spec> matches no entry in dependencies/devDependencies/optionalDependencies of the current package.json — e.g. the package is transitive only, lives in a different workspace project, or the name is misspelled. Also reachable with --audit fix style flows when no vulnerable direct dep matches.

Common situations: Typo in the package name; updating a package that was never added; trying to update a transitive dependency from the project root; forgetting -r in a monorepo so only the root project's manifest is searched.

Related errors

AI-assisted analysis of pnpm/pnpm@5b11d3a15b (2026-08-16). Data as JSON: /api/errors/e6f519ec6fd2d7c4. Report an issue: GitHub.