pnpm outdated --recursive errors

[jeremymeng]

pnpm outdated works fine. Maybe it is related to our recent upgrade to pnpm v11 but pnpm --filter='!@azure/arm-*' --filter='!@azure-rest/arm-*' outdated --recursive now gives the following error and warnings (warnings looks expected if network is slow?):

[ERR_PNPM_FETCH_404] GET https://registry.npmjs.org/@azure-tools%2Fmock-hub: Not Found - 404

@azure-tools/mock-hub is not in the npm registry, or you have no permission to fetch it.

No authorization header was set for the request.
[WARN] GET https://registry.npmjs.org/@azure%2Fschema-registry error (UND_ERR_DESTROYED). Will retry in 10 seconds. 2 retries left.
[WARN] GET https://registry.npmjs.org/@types%2Fexpress error (UND_ERR_DESTROYED). Will retry in 10 seconds. 2 retries left.
...
...
[WARN] GET https://registry.npmjs.org/@azure%2Fcore-sse error (unknown). Will retry in 10 seconds. 2 retries left.
[WARN] GET https://registry.npmjs.org/@microsoft%2Fapi-extractor error (unknown). Will retry in 10 seconds. 2 retries left.

• This is running in https://github.com/Azure/azure-sdk-for-js/, commit: 7498ec31a5fd5870b7872fb3c5be9aa40eb43538
• mock-hub is a local private package in our workspace
  • https://github.com/Azure/azure-sdk-for-js/blob/7498ec31a5fd5870b7872fb3c5be9aa40eb43538/sdk/eventhub/mock-hub/package.json#L4
  • https://github.com/Azure/azure-sdk-for-js/blob/7498ec31a5fd5870b7872fb3c5be9aa40eb43538/pnpm-lock.yaml#L13971

[jeremymeng]

Maybe it is related to our recent upgrade to pnpm v11 b

I double checked and v10 still worked as expected

[lizuju]

This does not look like an npm auth problem. The interesting bit is the lockfile entry for the local package. In the commit you linked, @azure-tools/mock-hub is a workspace package, but the consuming package has it recorded like this under sdk/eventhub/event-hubs:

devDependencies:
  '@azure-tools/mock-hub':
    specifier: ^1.0.0
    version: link:../mock-hub

So pnpm installed it as a local link, but the dependency specifier is still a normal semver range, not a workspace protocol range. When pnpm outdated -r checks whether ^1.0.0 is outdated, v11 appears to try the registry lookup for that package name. Since @azure-tools/mock-hub is private/local and not published, the registry request returns the 404 you see.

I would try changing the consuming package to make the local intent explicit:

"@azure-tools/mock-hub": "workspace:^"

Then run install again so the lockfile records:

specifier: workspace:^
version: link:../mock-hub

That also matches nearby internal deps like @azure-tools/test-credential, which already use workspace:^.

Your filters are probably not the reason this package is still being checked. --filter=!@azure/arm-* filters workspace projects by package selector; it does not filter dependency names inside a selected workspace. If sdk/eventhub/event-hubs is still selected, its @azure-tools/mock-hub devDependency is still part of the outdated scan.

If changing it to workspace:^ makes v11 behave like v10, this is probably still worth filing as a pnpm v11 regression, but that would be the smallest repo-side workaround I would test first.

[jeremymeng]

Thank you! This fixed the error.

[lizuju]

I opened a small fix for this in #12834.

The change skips outdated registry lookups when the lockfile ref is already local (link:, file:, or workspace:), even if the manifest specifier is a regular semver range like ^1.0.0. That matches the @azure-tools/mock-hub shape in the Azure SDK lockfile.