pnpm root -g Prints a Warning Before the Path: Fix CI Parsers

What broke in pnpm 11#

The pnpm issue that exposed this problem used a project declaring packageManager: "[email protected]". In that environment, pnpm root -g printed a warning and then the global module path on stdout. A consumer that expected a single path could store the warning as the root, or pass both lines to a later filesystem command.

Reproduce the boundary without exposing credentials:

1
pnpm --version
2
pnpm root -g > pnpm-root.stdout 2> pnpm-root.stderr
3
sed -n '1,5p' pnpm-root.stdout
4
sed -n '1,5p' pnpm-root.stderr

The exact warning text and global directory depend on the pnpm version and platform. The important observation is which stream contains each line, not the absolute path on one developer’s machine.

Make the parser fail safely#

If you must support a pnpm version that mixes reporter output into stdout, reject anything other than one non-empty path. This turns a silent wrong-directory install into an actionable CI failure:

1
set -eu
2

3
root_output="$(pnpm root -g 2>pnpm-root.stderr)"
4
root_lines="$(printf '%s\n' "$root_output" | sed '/^[[:space:]]*$/d' | wc -l | tr -d ' ')"
5

6
if [ "$root_lines" -ne 1 ] || [ ! -d "$root_output" ]; then
7
  printf '%s\n' 'pnpm root -g did not return one existing directory:' >&2
8
  printf '%s\n' "$root_output" >&2
9
  cat pnpm-root.stderr >&2
10
  exit 1
11
fi
12

13
printf 'Global root: %s\n' "$root_output"

This guard deliberately fails on the affected behavior because the output is ambiguous. It also catches a changed path format before a later command writes to the wrong location. If the command is only used for a human diagnostic, do not parse it at all.

Test the pnpm 12 RC separately#

The pnpm 12.0.0-rc.1 release is the first useful verification target for the stream change. Pin it in an isolated job or temporary checkout:

1
corepack [email protected] --version
2
corepack [email protected] root -g > pnpm-root.stdout 2> pnpm-root.stderr
3
cat pnpm-root.stdout
4
cat pnpm-root.stderr >&2

The expected shape is one path on stdout and any warning on stderr. Test both root -g and the command your automation actually uses, such as bin -g or prefix -g; a passing smoke test for one command does not prove that every reporter path has the same contract.

When you compare the RC with your current pnpm version, record the result in CI logs without printing private registry configuration. Then run the real install with the project’s lockfile:

1
corepack [email protected] install --frozen-lockfile

Keep the release candidate pinned in that test job. If the repository is not intentionally evaluating pnpm 12, keep the current version and use the output validation above until the project approves a stable upgrade.

Prefer configuration over global path scraping#

Many scripts use pnpm root -g to locate globally installed CLIs. Before adding more parsing, ask whether the tool can be a project dependency and invoked through pnpm exec. A local dependency gives CI a lockfile-visible version and removes the need to discover a machine-wide directory:

1
pnpm add --save-dev some-cli
2
pnpm exec some-cli --version

If a tool must remain global, keep the global-path check in one small wrapper and test it on every supported pnpm version. Do not put a global path into a committed lockfile, and do not assume that the path is shared across macOS, Windows, Linux, containers, or Corepack installations.

This is the same reproducibility boundary that matters when pnpm installs Git dependencies in CI. The pnpm Git dependency guide covers the related URL and credential contract.

FAQ#