Dependabot and pnpm 12: The Lockfile Gap to Know

Dependabot now works with npm 12, pnpm 11 and 12, and Bun 1.4, but pnpm 12 has a catch that can quietly switch off your security alerts. GitHub's changelog entry from 20 October 2026 says that when pnpm writes pnpm-lock.yaml as two YAML documents, the dependency graph does not yet detect the dependencies in that file.

The practical effect, in GitHub's words: Dependabot version updates still work, but Dependabot alerts and security updates will not be created for those dependencies, and existing alerts for them may close. A closed alert looks like good news. Here it may mean the opposite.

What changed

The good part first. According to the changelog, you can upgrade your projects to npm 12, pnpm 11 or 12, or Bun 1.4 and keep receiving Dependabot updates. Support is available to all github.com users and will be included in GitHub Enterprise Server 3.24.

The caveat is narrow. It applies to pnpm 12 when it writes the lockfile as two YAML documents, which GitHub says is the pnpm 12 default for projects that pin a pnpm version. GitHub says it is working on adding support.

Why a lockfile gap matters

A lockfile records the exact version of every package your project installed. Dependabot alerts work by reading that record and matching versions against known vulnerabilities. If the dependency graph cannot read the file, there is nothing to match, so no alert fires. Our post on what a lockfile is and why AI agents change it covers the basics.

This is the dangerous kind of failure: nothing breaks, nothing turns red. The security tab simply gets quieter.

How to check whether you are affected

1. Find your pnpm version. Run pnpm --version, and check the packageManager field in package.json. The changelog ties the two-document format to projects that pin a pnpm version.

2. Open `pnpm-lock.yaml`. A YAML file can hold more than one document, separated by a line containing three dashes. If you see that separator partway through the file, it has two documents.

3. Open the dependency graph. On GitHub, go to the repository's Insights tab and then Dependency graph. If the list of pnpm dependencies is empty or far shorter than your lockfile, the graph is not reading it.

4. Compare alerts before and after the upgrade. If alerts closed right after you moved to pnpm 12 and you did not fix anything, treat that as a warning sign.

If all four look normal, you are probably fine. Check again when GitHub announces support for the format.

What to do while the gap exists

None of these is universally right. A hobby project with no users can accept the gap. An app that stores customer data should not.

If an AI coding agent handles your upgrades, tell it about this limit before it bumps the package manager. Our post on whether an agent should upgrade your dependencies explains why that decision benefits from a human. A pull request that moves you to pnpm 12 is a security-relevant change, not a routine version bump.

Related changes from the same week

GitHub also put its package firewall into public preview on 20 October, which screens installs rather than reading lockfiles. The two work at different points in the chain, so one does not replace the other. For a plain-language view of the alerts themselves, see what a Dependabot alert is and which ones matter. To follow changes like these as they land, see how to keep up with AI news.

Frequently asked questions

Does Dependabot support pnpm 12?

Yes, with a limitation. Dependabot version updates work with pnpm 11 and 12, but when pnpm 12 writes pnpm-lock.yaml as two YAML documents, the dependency graph does not yet detect those dependencies.

Will I still get security alerts on pnpm 12?

Not for dependencies in a lockfile the graph cannot read. GitHub says alerts and security updates will not be created for them, and existing alerts may close.

Does Dependabot support Bun 1.4 and npm 12?

Per the changelog, yes. You can upgrade to npm 12 or Bun 1.4 and keep receiving Dependabot updates.

Is the pnpm 12 gap going to be fixed?

GitHub says it is working on adding support. The entry gives no date, so check the changelog rather than assuming.