From a6c960c085a6cb5ec0caaef0b42c400ac08fff5d Mon Sep 17 00:00:00 2001
From: "Azat S." <to@azat.io>
Date: Mon, 26 Oct 2026 20:49:40 +0800
Subject: [PATCH] Parse multi-document lockfile

---
 server/loader/versions/pnpm.ts | 37 ++++++++++++++++++----------------
 server/test/pnpm.test.ts       | 33 ++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 17 deletions(-)

diff --git a/server/loader/versions/pnpm.ts b/server/loader/versions/pnpm.ts
index 089d074..e85cdf5 100644
--- a/server/loader/versions/pnpm.ts
+++ b/server/loader/versions/pnpm.ts
@@ -1,5 +1,5 @@
 import { basename } from 'node:path'
-import { parse } from 'yaml'
+import { parseAllDocuments } from 'yaml'
 
 import { type Dependency, dependencyType } from '../../../common/types.ts'
 import type { VersionsLoader } from './common.ts'
@@ -32,23 +32,26 @@ export const pnpm = {
     let directDeps = getDirectDependencies(packageJsonFiles)
 
     for (let file of lockFiles) {
-      let lock = parse(file.content)
-      if (isLockFile9(lock)) {
-        for (let pkg in lock.packages) {
-          let { name, version } = splitPackage(pkg)
-          dependencies.push(
-            dependencyType({
-              direct: directDeps.has(name),
-              from: 'pnpm',
-              name,
-              source: file.path,
-              type: 'npm',
-              version
-            })
-          )
+      for (let doc of parseAllDocuments(file.content)) {
+        if (doc.errors[0]) throw doc.errors[0]
+        let lock = doc.toJS()
+        if (isLockFile9(lock)) {
+          for (let pkg in lock.packages) {
+            let { name, version } = splitPackage(pkg)
+            dependencies.push(
+              dependencyType({
+                direct: directDeps.has(name),
+                from: 'pnpm',
+                name,
+                source: file.path,
+                type: 'npm',
+                version
+              })
+            )
+          }
+        } else {
+          throw new Error('Unknown pnpm lock file')
         }
-      } else {
-        throw new Error('Unknown pnpm lock file')
       }
     }
 
diff --git a/server/test/pnpm.test.ts b/server/test/pnpm.test.ts
index f6e47f8..5989bcd 100644
--- a/server/test/pnpm.test.ts
+++ b/server/test/pnpm.test.ts
@@ -89,3 +89,36 @@ test('shows nested dependency updates in pnpm', async () => {
     }
   ])
 })
+
+test('supports pnpm lock file with config dependencies', async () => {
+  await run('pnpm add --config nanoevents@9.1.0')
+  await run('pnpm add nanoid@5.1.4')
+  await run('git add .')
+  await run('git commit -m "Add dependencies"')
+  await run('pnpm add nanoid@5.1.5')
+
+  await cliJsonMatch([
+    {
+      after: '5.1.5',
+      before: '5.1.4',
+      name: 'nanoid'
+    }
+  ])
+})
+
+test('shows config dependency changes with pnpm', async () => {
+  await run('pnpm add --config nanoid@5.1.4')
+  await run('pnpm add nanoevents@9.1.0')
+  await run('git add .')
+  await run('git commit -m "Add dependencies"')
+  await run('pnpm add --config nanoid@5.1.5')
+
+  await cliJsonMatch([
+    {
+      after: '5.1.5',
+      before: '5.1.4',
+      from: 'pnpm',
+      name: 'nanoid'
+    }
+  ])
+})