fix(manager/npm): use --config.ignore-scripts=true for pnpm dedupe

docs/usage/configuration-options.md

@@ -2973,7 +2973,7 @@ Table with options:
 | `gomodUpdateImportPaths`     | Update source import paths on major module updates, using [mod](https://github.com/marwan-at-work/mod).                                                    |
 | `helmUpdateSubChartArchives` | Update subchart archives in the `/charts` folder.                                                                                                          |
 | `npmDedupe`                  | Run `npm dedupe` after `package-lock.json` updates.                                                                                                        |
-| `pnpmDedupe`                 | Run `pnpm dedupe` after `pnpm-lock.yaml` updates.                                                                                                          |
+| `pnpmDedupe`                 | Run `pnpm dedupe --ignore-scripts` after `pnpm-lock.yaml` updates.                                                                                         |
 | `yarnDedupeFewer`            | Run `yarn-deduplicate --strategy fewer` after `yarn.lock` updates.                                                                                         |
 | `yarnDedupeHighest`          | Run `yarn-deduplicate --strategy highest` (`yarn dedupe --strategy highest` for Yarn >=2.2.0) after `yarn.lock` updates.                                   |
 

lib/modules/manager/npm/post-update/__fixtures__/dedupe-ignore-scripts/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "dedupe-ignore-scripts",
+  "version": "1.0.0",
+  "engines": {
+    "pnpm": ">=8.8.0"
+  },
+  "engine-strict": true
+}

lib/modules/manager/npm/post-update/pnpm.spec.ts

@@ -77,7 +77,7 @@ describe('modules/manager/npm/post-update/pnpm', () => {
       {},
       { ...config, postUpdateOptions }
     );
-    expect(fs.readLocalFile).toHaveBeenCalledTimes(1);
+    expect(fs.readLocalFile).toHaveBeenCalledTimes(2);
     expect(res.lockFile).toBe('package-lock-contents');
     expect(execSnapshots).toMatchObject([
       {
@@ -89,6 +89,30 @@ describe('modules/manager/npm/post-update/pnpm', () => {
     ]);
   });
 
+  it('performs dedupe --ignore-scripts for pnpm >= 8.8.0', async () => {
+    const execSnapshots = mockExecAll();
+    const fileContent = Fixtures.get('dedupe-ignore-scripts/package.json');
+    fs.readLocalFile
+      .mockResolvedValueOnce(fileContent)
+      .mockResolvedValue('package-lock-contents');
+    const postUpdateOptions = ['pnpmDedupe'];
+    const res = await pnpmHelper.generateLockFile(
+      'some-dir',
+      {},
+      { ...config, postUpdateOptions }
+    );
+    expect(fs.readLocalFile).toHaveBeenCalledTimes(2);
+    expect(res.lockFile).toBe('package-lock-contents');
+    expect(execSnapshots).toMatchObject([
+      {
+        cmd: 'pnpm install --recursive --lockfile-only --ignore-scripts --ignore-pnpmfile',
+      },
+      {
+        cmd: 'pnpm dedupe --ignore-scripts',
+      },
+    ]);
+  });
+
   it('uses the new version if packageManager is updated', async () => {
     const execSnapshots = mockExecAll();
     fs.readLocalFile.mockResolvedValue('package-lock-contents');

lib/modules/manager/npm/post-update/pnpm.ts

@@ -1,5 +1,6 @@
 import is from '@sindresorhus/is';
 import { load } from 'js-yaml';
+import semver from 'semver';
 import upath from 'upath';
 import { GlobalConfig } from '../../../../config/global';
 import { TEMPORARY_ERROR } from '../../../../constants/error-messages';
@@ -39,6 +40,7 @@ export async function generateLockFile(
   let cmd = 'pnpm';
   try {
     const lazyPgkJson = lazyLoadPackageJson(lockFileDir);
+
     const pnpmToolConstraint: ToolConstraint = {
       toolName: 'pnpm',
       constraint:
@@ -79,8 +81,17 @@ export async function generateLockFile(
 
     // postUpdateOptions
     if (config.postUpdateOptions?.includes('pnpmDedupe')) {
-      logger.debug('Performing pnpm dedupe');
-      commands.push('pnpm dedupe');
+      const pnpmVersionFromPackageJson = getPackageManagerVersion(
+        'pnpm',
+        await lazyPgkJson.getValue()
+      );
+      const cleanedVersion = semver.coerce(pnpmVersionFromPackageJson);
+
+      if (cleanedVersion && semver.gte(cleanedVersion, '8.8.0')) {
+        commands.push('pnpm dedupe --ignore-scripts');
+      } else {
+        commands.push('pnpm dedupe');
+      }
     }
 
     if (upgrades.find((upgrade) => upgrade.isLockFileMaintenance)) {