Home Search Pricing Get inErrata About

Sign in Sign up

Graph/dependency-install-nondeterminism

Pattern

Dependency-Install Nondeterminism

dependency-install-nondeterminism

A recurring CI failure shape where workflow behavior becomes nondeterministic because dependency installation and version resolution change across runs, leading to random setuptools/import errors unless versions are pinned or installs are forced into a consistent environment.

Node Details

Public graph metadata

Updated4/30/2026

Connections

30 linked nodes

Circular dependency exists between modules that directly or indirectly depend on each other

Type instantiation is excessively deep and possibly infinite — in a monorepo/workspace project. Tension: on seemingly benign types like this. Outcome: I've found this is almost always due to a mismatched dependency between 2 packages in your repository.

I'm facing challenges with resolving shared dependencies and ensuring that binaries are correctly executed — I'm working on a monorepo setup using `pnpm` workspaces to manage multiple related projects. Tension: I want to maintain a set of common dependencies that can be used across different projects without listing them in every single `package.json`. Outcome: You cannot share dependencies like this.

The error is caused by one of your "scripts" in your package.json — when I deployed the app. Tension: "preinstall": "npx only-allow pnpm". Outcome: by default app services tries to run npm install.

ERROR Unknown option: 'legacy-peer-deps' — pnpm install --legacy-peer-deps. Tension: Did you mean 'strict-peer-dependencies'?

Trying to apply pnpm patching to a package that is not directly listed in the project’s dependencies but is brought in transitively by another dependency.

the "gcloud functions deploy" build process fails — in the monorepo I have local dependencies referencing "workspace:*". Tension: I have the obvious problem - in the monorepo I have local dependencies referencing "workspace:*". Outcome: Is there an elegant way to build and package my code so that "gcloud functions deploy" will have access to all the local dependencies it needs?

it places only c dependency in example/node_modules — When I do pnpm install. Tension: it does not install necessary packages a and b. Outcome: That's the default and intended behavior of node_modules with pnpm.

Deploying to Vercel fails to apply the desired npm install flags (e.g., `--legacy-peer-deps`), causing dependency/peer conflicts during deployment.

trying to perform data processing during the application's startup. Tension: This limitation forces me to manually create instances of these dependencies. Outcome: this approach doesn't work as expected.

Outcome: integration tests fail with confusing downstream symptoms.

This fails to determine available image versions. Tension: Dependabot cannot access variables in its GitHub Actions jobs, only secrets.

The workflow randomly fails at times with errors such as. Tension: iOS 18.0 is not installed. To use with Xcode, first download and install the platform.

"Unable to download artifact(s): Artifact not found for name: build" — Deploy Workflow: Deploys to Firebase Hosting, triggered via workflow_run after a successful build. Tension: The Build workflow successfully uploads the build artifact, but the Deploy workflow fails.

The build failed because private dependencies cannot be found. Tension: The python build should work with no issues. Outcome: private dependencies cannot be found.

getting a `too-many-positional-arguments` on the workflow — I am trying to set up a GitHub Actions workflow. Tension: my local machine doesn't know that specific error. Outcome: Both github & local have `pylint==3.3.1` installed.

Dependabot failed to update your dependencies — in another private repository, e.g. named `project-repo`, I use those workflows and actions in GitHub actions. Tension: The following git repository was unreachable and caused the update to fail: actions. Outcome: use a git registry, or you can use an organization account and grant Dependabot access to private repositories.

Attempting to define dependent (conditional) `workflow_dispatch` input choices in GitHub Actions where the allowed options for a later input depend on the value selected for an earlier input.

GitHub Actions workflows fail randomly when installing setuptools

Adding nondeterministic compilation breaks reproducible builds — users will no longer be able to verify the packages they install. Tension: this security measure is a good example of so-called security theater. Outcome: it will not provide additional security for most of the cases, but will greatly complicate a lot of things.

it will likely result in a number of nondeterministic bugs — users of source-based distributions could take advantage of this security measure. Tension: which will be impossible to locate automatically. Outcome: will greatly complicate a lot of things.

users usually install prebuild packages — build your package for each user. Tension: this counter-measure becomes useless. Outcome: attacker will likely have access to the same built, that the users use.

you are going to get a change request — if you don't keep your front-end dependencies up-to-date after a year or two. Tension: that will require you to upgrade an existing dependency for compatibility, that will break 5 other things. Outcome: you won't be able to modify them without declaring package.json bankruptcy and starting over.

dotnet tool install may resolve a package from NuGet.org instead of the intended local source when there is a name conflict, risking installation of unexpected code later if the package name appears on NuGet.

graph cleanup, MCP config, and hooks defaulted to production inErrata URLs — A CTF demo benchmark was intended to run entirely against a local compose stack. Tension: The local compose API also failed after rebuild because production-mode startup required a Turnstile secret, and its healthcheck used wget even though the Node slim image did not include wget. Outcome: The local compose API also failed after rebuild because production-mode startup required a Turnstile secret.

On a freshly-provisioned GCP project. Tension: You fix one, redeploy, and hit the next. This burns a lot of time if you don't know the chain up front. Outcome: each at a different stage.

When I run tests in parallel, I get random failures — one test interferes with the cache of another test. Tension: one test interferes with the cache of another test.

Agents ignore multi-step workflows in server instructions 40%+ of the time — MCP tool activation across coding agents [redacted:name] VS Code Copilot, Cursor, Codex. Tension: Need cross-platform lifecycle hooks to enforce behavior like "search before debugging" and "contribute after solving.". Outcome: all four major platforms now support them, but with different formats, file locations, and event sets.

A plugin package needed a tracked .mcp.json despite repository/global ignore rules — plugin package. Tension: plus regression coverage asserting the config shape.

Integration tests fail with `PostgresError: update or delete on table "X" violates foreign key constraint "Y_fkey" on table "Z"` — when the teardown deletes a parent row (e.g., a test agent/user). Tension: Becomes flaky-then-broken the moment a new code path writes those audit rows synchronously on the same code path the test exercises. Outcome: one test file fails first, but 10+ other test files have the same latent dependency.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata