Renovate exits silently mid-run starting from 43.195.11 while processing terraform files

[motoki317]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.195.11 is the first observed failing, 43.195.10 is the last observed working.

Please tell us more about your question or problem

Since 43.195.11, the Renovate GitHub Actions step exits cleanly but seems to stop part-way through - only 1 of our 4 configured repos is processed. No exception, no WARN/ERROR, no unhandled rejection logged; the process just ends, so we only noticed because PRs stopped appearing.

The last debug line in every failed run is from terraform-providers hash calculation:

DEBUG: Calculating hashes for 13 builds (repository=…, branch=renovate/github-github-6.x-lockfile)

In good runs (before 43.195.11) the same line appears, hashes finish, processing continues. Reproduces under RENOVATE_DRY_RUN=full, so the issue is probably not in the write-path.

Setup (possibly relevant)

Self-hosted runner; 4 private repos are configured to be proceesed by Renovate; first is a Terraform monorepo.
aws-eks-addon / aws-rds datasources and ECR hostRules are in place, so we can update AWS EKS addons / RDS versions / private ECR images along with Terraform provider versions.
I didn't have time for a minimal reproduction example - so I'm merely sharing what I have encountered in my setup here.

Relevant workflow step (our repository is private):

      - name: Renovate
        uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
        with:
          renovate-image: "ghcr.io/renovatebot/renovate"
          renovate-version: "43.195.11" # The first "bad" version
          docker-user: root
          configurationFile: "${{ env.RENOVATE_CONFIG_FILE }}"
          token: "${{ steps.generate-token.outputs.token }}"
          env-regex: "^(?:RENOVATE_\\w+|LOG_LEVEL|AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_REGION|GHCR_PAT)$"
        env:
          GHCR_PAT: ${{ secrets.RENOVATE_GHCR_PAT }}
          AWS_ACCESS_KEY_ID: ${{ secrets.RENOVATE_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.RENOVATE_AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ap-northeast-1

Speculation (low confidence)

Between 43.195.10 → 43.195.11 the only source change is jsonata 2.2.0 → 2.2.1, but the lockfile re-resolution also moved @aws-sdk/core from 3.974.8 to 3.974.11 for the client-{ec2,ecr,s3} snapshots. 3.974.11 is deprecated by AWS (aws-sdk-js-v3#8031) and the notice is in Renovate's own lockfile. AWS's stated reason (JSON-RPC-1.0 errors) does not match the clients Renovate uses, so this may be unrelated - but it is the only behavioural change we could spot in that window.

Questions

• Has anyone seen silent early exits on terraform-heavy runs since 43.195.11?
• If I should give out more information, please ask me

Logs (if relevant)

Logs

Bad run (43.195.11)

DEBUG: Using queue: host=github.com, concurrency=16 (repository=..., branch=renovate/github-github-6.x-lockfile)
DEBUG: Got 14 zip hashes for integrations/github@6.12.1 (repository=..., branch=renovate/github-github-6.x-lockfile)
DEBUG: Calculating hashes for 13 builds (repository=..., branch=renovate/github-github-6.x-lockfile)
(↑ This is the last line output from the Renovate container)

(~2 s between the last Renovate line and Post-job cleanup. No further Renovate output; the Action step concluded success.)

Good run (43.195.10)

DEBUG: Getting zip hashes for 1 shasum URL(s) for integrations/github@6.12.1 (repository=..., branch=renovate/github-github-6.x-lockfile)
DEBUG: Got 14 zip hashes for integrations/github@6.12.1 (repository=..., branch=renovate/github-github-6.x-lockfile)
DEBUG: Calculating hashes for 13 builds (repository=..., branch=renovate/github-github-6.x-lockfile)
DEBUG: Writing updates to github/.terraform.lock.hcl (repository=..., branch=renovate/github-github-6.x-lockfile)
DEBUG: Updated 1 package files (repository=..., branch=renovate/github-github-6.x-lockfile)
... (normal DEBUG logs continue)

[RahulGautamSingh]

Looking into it

[jamietanna]

Related: #43641, #43656

[reduckted]

Playwright had an issue with Node v24.16 (and v26).

• [Bug]: playwright install chromium hangs after download completes on Node.js 24.16.0 (extract-zip) microsoft/playwright#41000

It links to this Node.js issue:

• Node 24.16.0: extract-zip hangs extracting nodejs/node#63487

Maybe Renovate is hitting the same problem?

[MalteJoe]

I have managed to reproduce this error locally and can confirm the suspicion of @reduckted: The last invocation Renovate does, is calling extract-zip right here:

https://github.com/renovatebot/renovate/blob/43.200.1/lib/modules/manager/terraform/lockfile/hash.ts#L89

More specifically it silently exits as soon as the terraform provider binary is extracted, e.g.

https://github.com/grafana/terraform-provider-grafana/releases/download/v4.36.2/terraform-provider-grafana_4.36.2_darwin_amd64.zip contains a binary file terraform-provider-grafana_v4.36.2 which seems to crash just before completing extraction. When extracting that zip normally, filesize is shown as 97.4 MB, but in the extracted folder it is only 97.2 MB.

It seems like that task is then silently quit and as soon as NodeJS' microtask queue is empty, it quits with exit code 0.

Judging by the comments in nodejs/node#63487 it looks like extract-zip fails only on large files (~50MB+) with Node 24.16.0. Also it may not be maintained any more, so we might want to replace that anyway? There are only two calls to extract in the Renovate codebase; this one, and another one in nuget/v3 (which therefore might have similar problems for large dependency files)

One alternative might be overriding the peer dependency yauzl as suggested here: thejoshwolfe/yauzl#169 (comment)

[MalteJoe]

I created a PR for the override: #43687

[viceice]

• build: replace extract-zip with adm-zip #43709

🤗