Minimal reproduction: pnpm recursive install --prod ERR_PNPM_MISSING_HOISTED_LOCATIONS with node-linker=hoisted

.npmrc

node-linker=hoisted

README.md

pnpm ERR_PNPM_MISSING_HOISTED_LOCATIONS reproduction

This is a minimal, customer-independent reproduction of a pnpm bug in a single-package project using node-linker=hoisted.

After pnpm creates a normal install, pnpm recursive install --prod fails while reconstructing the production dependency graph. The equivalent non-recursive pnpm install --prod succeeds.

Reproduce

Requirements: npm/npx and internet access. The runner downloads the selected Node and pnpm versions and creates disposable state under .work/.

bash reproduce.sh

The default is Node 22.14.0 with pnpm 10.34.5. To test another pnpm version:

bash reproduce.sh 9.4.0
bash reproduce.sh 11.22.0

Exit status 0 means the exact bug reproduced and the non-recursive workaround succeeded. Exit status 2 means the recursive command succeeded, so the bug was not present for that pnpm version.

The failing command reports:

ERR_PNPM_MISSING_HOISTED_LOCATIONS @opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1) is not found in hoistedLocations inside node_modules/.modules.yaml

Direct commands

Inside a clean copy of this directory:

pnpm install --prod=false --no-frozen-lockfile
pnpm recursive install --prod

Expected: the second command should complete successfully.

Actual on affected pnpm versions: the second command fails with ERR_PNPM_MISSING_HOISTED_LOCATIONS even though this is not a workspace and the equivalent pnpm install --prod succeeds.

Version matrix

Tested on macOS arm64 with Node 22.14.0:

pnpm	Result
9.4.0	Reproduces
9.15.9	Reproduces
10.15.1	Reproduces
10.34.5	Reproduces
11.22.0	Does not reproduce
11.23.0	Does not reproduce

This appears related to pnpm issue #6584, but that report requires a workspace with shared-workspace-lockfile=false. This reproduction uses a single package, fails specifically through the recursive command, and continues to fail on the latest pnpm 10 release tested.

Upstream report: pnpm/pnpm#14131

package.json

{
  "name": "pnpm-missing-hoisted-locations-repro",
  "version": "1.0.0",
  "private": true,
  "dependencies": {
    "@opentelemetry/api": "1.9.0",
    "@opentelemetry/sdk-trace-base": "2.9.0",
    "@sentry/electron": "7.17.0"
  }
}

reproduce.sh

#!/usr/bin/env bash

set -u -o pipefail

repro_root="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
pnpm_version="${1:-10.34.5}"
node_version="${NODE_VERSION:-22.14.0}"

case "$pnpm_version" in
  *[!0-9A-Za-z._-]*)
    printf 'Invalid pnpm version: %s\n' "$pnpm_version" >&2
    exit 1
    ;;
esac

work_root="$repro_root/.work"
case_dir="$work_root/pnpm-$pnpm_version"

mkdir -p "$work_root"
rm -rf "$case_dir"
mkdir -p "$case_dir"
cp "$repro_root/package.json" "$repro_root/.npmrc" "$case_dir/"
cd "$case_dir" || exit 1

node_runner=(
  env npm_config_loglevel=error
  npx --yes
  --package "node@$node_version"
  --package "pnpm@$pnpm_version"
  node
)
pnpm_runner=(
  env npm_config_loglevel=error
  npx --yes
  --package "node@$node_version"
  --package "pnpm@$pnpm_version"
  pnpm
)

printf 'Node: '
"${node_runner[@]}" --version || exit 1
printf 'pnpm: '
"${pnpm_runner[@]}" --version || exit 1

printf '\n1. Creating the hoisted development install\n'
"${pnpm_runner[@]}" install --prod=false --no-frozen-lockfile || exit 1

printf '\n2. Reinstalling recursively with production dependencies only\n'
recursive_output="$("${pnpm_runner[@]}" recursive install --prod 2>&1)"
recursive_status=$?
printf '%s\n' "$recursive_output"

if [ "$recursive_status" -eq 0 ]; then
  printf '\nResult: the bug did not reproduce with pnpm %s.\n' "$pnpm_version"
  exit 2
fi

case "$recursive_output" in
  *ERR_PNPM_MISSING_HOISTED_LOCATIONS*'@opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1)'*)
    ;;
  *)
    printf '\nResult: recursive install failed, but not with the expected error.\n' >&2
    exit 1
    ;;
esac

printf '\n3. Verifying the equivalent non-recursive command succeeds\n'
"${pnpm_runner[@]}" install --prod || exit 1

printf '\nResult: reproduced on pnpm %s; the non-recursive workaround succeeds.\n' "$pnpm_version"