pnpm manager can't authenticate git+https:// dependencies during lockfile regeneration. (Mend-hosted)

[Paras-compro]

What would you like help with?

None

Please share the URL to the organisation you're creating this request for

No response

Additional information

Summary:
My package.json has private dependencies specified as git+https:// URLs (not registry packages), e.g.:

"private-git-dep": "git+https://github.com/myorg/private-git-dep.git#branch"

I added a PAT token in Mend's secrets (PRIVATE_GITHUB_REPO_TOKEN) and configured hostRules for the git host
hostRules: [
{ matchHost: "github.com", token: "{{ secrets.PRIVATE_GITHUB_REPO_TOKEN }}", hostType: "github" }
]
Also tried path-scoped matchHost: "https://github.com/myorg", with and without hostType. Same result every time.

Log snippet
Error: ERR_PNPM_GIT_RESOLVE_FAILED
Failed to resolve git dependency "git+https://github.com/myorg/private-git-dep.git#branch":
git ls-remote failed: fatal: could not read Username for 'https://github.com/myorg/private-git-dep.git'

Below is the actual error object:

{
"name": "renovate",
"hostname": "jr-microvm",
"pid": 1118,
"level": 20,
"logContext": "04457212-21ce-40c5-b429-81be691373ba",
"repository": "org_name/repo_name",
"branch": "renovate/patch-dependencies",
"baseBranch": "branch-name",
"commands": [
  "pnpm install --lockfile-only --ignore-scripts --ignore-pnpmfile --no-frozen-lockfile"
],
"err": {
  "cmd": "pnpm install --lockfile-only --ignore-scripts --ignore-pnpmfile --no-frozen-lockfile",
  "stderr": "Error: ERR_PNPM_GIT_RESOLVE_FAILED\n\n  × installing dependencie...",
  "stdout": "? Verifying lockfile against supply-chain policies (1277 entries)...\n.                                        | [WARN] deprecated plyr@3.5.6\n.                                        | [WARN] deprecated tslint@6.1.3\n.                                        | [WARN] deprecated @angular/animations@21.2.25. 20.2.0-next.2 is not deprecated.\n.                                        | [WARN] deprecated @angular/platform-browser-dynamic@21.2.25. 22.2.3 is not deprecated.\n✗ Lockfile failed supply-chain policy check (1277 entries in 2.4s)",
  "options": {
    "cwd": "/tmp/renovate/repos/github/org_name/repo_name",
    "env": [
      "NPM_CONFIG_CACHE",
      "npm_config_store",
      "npm_config_cache_dir",
      "npm_config_store_dir",
      "pnpm_config_cache_dir",
      "pnpm_config_store_dir",
      "HOME",
      "PATH",
      "LC_ALL",
      "LANG",
      "CI",
      "CONTAINERBASE_CACHE_DIR"
    ],
    "maxBuffer": 10485760,
    "timeout": 900000,
    "stdin": "pipe",
    "stdout": "pipe",
    "stderr": "pipe"
  },
  "exitCode": 1,
  "name": "ExecError",
  "message": "Command failed: pnpm install --lockfile-only --ignore-scripts --ignore-pnpmfile --no-frozen-lockfile\nError: ERR_PNPM_GIT_RESOLVE_FAILED\n\n  × installing dependencies\n  ├─▶ Failed to resolve dependency tree: Failed to resolve git dependency\n  │   \"git+https://**redacted**@git+https://**redacted**@github.com:\".insteadOf \"https://\n        github.com/\"\n\n",
  "stack": "ExecError: Command failed: pnpm install --lockfile-only --ignore-scripts --ignore-pnpmfile --no-frozen-lockfile\nError: ERR_PNPM_GIT_RESOLVE_FAILED\n\n  × installing dependencies\n  ├─▶ Failed to resolve dependency tree: Failed to resolve git dependency\n  │   \"git+https://**redacted**@git+https://**redacted**@github.com:\".insteadOf \"https://\n        github.com/\"\n\n\n    at ChildProcess.<anonymous> (file:///usr/local/renovate/lib/util/exec/common.ts:186:13)\n    at ChildProcess.emit (node:events:526:24)\n    at ChildProcess.emit (node:domain:489:12)\n    at ChildProcess.emit (node:domain:489:24)",
  "stdout": "? Verifying lockfile against supply-chain policies (1277 entries)...\n.                                        | [WARN] deprecated plyr@3.5.6\n.                                        | [WARN] deprecated tslint@6.1.3\n.                                        | [WARN] deprecated @angular/animations@21.2.25. 20.2.0-next.2 is not deprecated.\n.                                        | [WARN] deprecated @angular/platform-browser-dynamic@21.2.25. 22.2.3 is not deprecated.\n✗ Lockfile failed supply-chain policy check (1277 entries in 2.4s)",
  "stderr": "Error: ERR_PNPM_GIT_RESOLVE_FAILED\n\n  × installing dependencies\n  ├─▶ Failed to resolve dependency tree: Failed to resolve git dependency\n  │   \"git+https://github.com/comprodls/module-app-micro-base.git#new-branch-\n  │   for-ob\": git ls-remote failed: fatal: could not read Username for\n  │   'https://**redacted**@git+https://github.com/\n  │   comprodls/module-app-micro-base.git#new-branch-for-ob\n  ╰─▶ Failed to resolve git dependency \"git+https://github.com/comprodls/\n      module-app-micro-base.git#new-branch-for-ob\": git ls-remote failed:\n      fatal: could not read Username for 'https://**redacted**@github.com:\".insteadOf \"https://\n        github.com/\"\n\n",
  "type": "pnpm",
  "msg": "lock file error",
  "time": "2026-10-22T07:05:41.254Z",
  "v": 0
}
}

I went through the private-packages docs section by section. Every manager has its own documented credential mechanism for artifact updates (e.g. gomod writes GIT_CONFIG_* env vars from hostRules) — but there's no equivalent documented for npm/pnpm when the dependency is a git+https:// URL rather than a registry package.

Is this a known limitation, or is there an undocumented way to get npm/pnpm's artifact-update step to pass git credentials the way gomod does?

[Muguett-DBY]

There is an existing PR for this: #40162. It adds Git authentication to pnpm's lockfile-update environment, and is still open.

I checked current main at 4ebd20e. The distinction you noticed is real:

• pnpm.generateLockFile() builds its child environment without the Git-auth helper.
• processHostRules() converts npm/untyped rules into registry configuration. Removing hostType, or changing it to npm, does not turn that into credentials for git ls-remote.

So I would not keep changing the host rule expecting a registry setting to fix this path. For the Mend-hosted run, the missing piece needs to be addressed in the runner/package-manager integration. The existing PR is the useful place to track it. Publishing the dependency to an npm registry would use the supported registry-auth path, if that is an acceptable alternative for your project.

There may also be a separate malformed URL/rewrite in the example: the error contains git+https://...@git+https://... and part of an .insteadOf command. That is not an ordinary clean GitHub URL. Check any custom rewrite or dependency URL configuration separately; the excerpt alone cannot establish which layer produced it. Don't put a PAT into package.json or the lockfile to work around this.

This is a source check, not a reproduction of your hosted job. The Renovate and pnpm versions from the job would help tie it to a specific released implementation.