@pnpm/hooks.read-package-hook 1100.1.3 → 1100.2.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @pnpm/hooks.read-package-hook
 
+## 1100.2.0
+
+### Minor Changes
+
+- `overrides` now also govern peers that pnpm auto-installs. Previously an override only rewrote dependencies declared in a manifest, so a peer nobody declares — installed because `autoInstallPeers` is on — resolved against its declared peer range and could bring in a second copy of the very package the override pinned. For example, with `overrides: { react: npm:react@19.2.0 }` and a lone `lucide-react` dependency, pnpm installed `react@18.3.1`; it now installs the pinned `react@19.2.0` [#13320](https://github.com/pnpm/pnpm/issues/13320).
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/types@1101.7.0
+
 ## 1100.1.3
 
 ### Patch Changes

package/lib/createVersionsOverrider.d.ts

@@ -11,4 +11,19 @@ export interface CreateVersionsOverriderOptions {
      */
     convergeDeclaredRanges?: Map<string, Set<string>>;
 }
+/**
+ * Resolves the specifier an override imposes on a single dependency edge, or
+ * `undefined` when no override claims it. `'-'` means the edge is removed.
+ *
+ * Edges that have no declaring manifest — a peer pnpm auto-installs — reach
+ * the overrides through this function instead of through the read-package
+ * hook, so parent-scoped overrides (`parent>child`) never apply to them.
+ */
+export type DependencyOverrider = (name: string, bareSpecifier: string, dir?: string) => string | undefined;
+/**
+ * `undefined` when no override in the set could ever claim an undeclared
+ * dependency, so the resolver skips the per-peer call in the common case of a
+ * project with no overrides — or with parent-scoped ones only.
+ */
+export declare function createDependencyOverrider(overrides: VersionOverrideWithoutRawSelector[], rootDir: string): DependencyOverrider | undefined;
 export declare function createVersionsOverrider(overrides: VersionOverrideWithoutRawSelector[], rootDir: string, opts?: CreateVersionsOverriderOptions): ReadPackageHook;

package/lib/createVersionsOverrider.js

@@ -4,13 +4,27 @@ import normalizePath from 'normalize-path';
 import { partition } from 'ramda';
 import semver from 'semver';
 import { isIntersectingRange } from './isIntersectingRange.js';
+/**
+ * `undefined` when no override in the set could ever claim an undeclared
+ * dependency, so the resolver skips the per-peer call in the common case of a
+ * project with no overrides — or with parent-scoped ones only.
+ */
+export function createDependencyOverrider(overrides, rootDir) {
+    const { genericVersionOverrides, convergeVersions } = splitOverrides(overrides, rootDir);
+    if (genericVersionOverrides.length === 0 && convergeVersions.size === 0)
+        return undefined;
+    return (name, bareSpecifier, dir) => {
+        const versionOverride = pickVersionOverride({ versionOverrides: [], genericVersionOverrides }, name, bareSpecifier);
+        if (versionOverride) {
+            return versionOverride.newBareSpecifier === '-'
+                ? '-'
+                : resolveOverriddenBareSpecifier(versionOverride, dir);
+        }
+        return convergeBareSpecifier(convergeVersions, name, bareSpecifier);
+    };
+}
 export function createVersionsOverrider(overrides, rootDir, opts) {
-    const [convergeOverrides, explicitOverrides] = partition(({ converge }) => converge === true, overrides);
-    const [versionOverrides, genericVersionOverrides] = partition(({ parentPkg }) => parentPkg != null, explicitOverrides.map((override) => ({
-        ...override,
-        localTarget: createLocalTarget(override, rootDir),
-    })));
-    const convergeVersions = new Map(convergeOverrides.map((override) => [override.targetPkg.name, override.newBareSpecifier]));
+    const { versionOverrides, genericVersionOverrides, convergeVersions } = splitOverrides(overrides, rootDir);
     return ((manifest, dir) => {
         const versionOverridesWithParent = versionOverrides.filter(({ parentPkg }) => {
             return (parentPkg.name === manifest.name &&
@@ -23,6 +37,18 @@ export function createVersionsOverrider(overrides, rootDir, opts) {
         return manifest;
     });
 }
+function splitOverrides(overrides, rootDir) {
+    const [convergeOverrides, explicitOverrides] = partition(({ converge }) => converge === true, overrides);
+    const [versionOverrides, genericVersionOverrides] = partition(({ parentPkg }) => parentPkg != null, explicitOverrides.map((override) => ({
+        ...override,
+        localTarget: createLocalTarget(override, rootDir),
+    })));
+    return {
+        versionOverrides,
+        genericVersionOverrides,
+        convergeVersions: new Map(convergeOverrides.map((override) => [override.targetPkg.name, override.newBareSpecifier])),
+    };
+}
 function createLocalTarget(override, rootDir) {
     let protocol;
     if (override.newBareSpecifier.startsWith('file:')) {
@@ -55,8 +81,7 @@ function overrideDepsOfPkg({ manifest, dir }, versionOverrides, genericVersionOv
 }
 function overrideDeps({ versionOverrides, genericVersionOverrides, dir, convergeOpts }, deps, peerDeps) {
     for (const [name, bareSpecifier] of Object.entries(peerDeps ?? deps)) {
-        const versionOverride = pickMostSpecificVersionOverride(versionOverrides.filter(({ targetPkg }) => targetPkg.name === name && isIntersectingRange(targetPkg.bareSpecifier, bareSpecifier))) ??
-            pickMostSpecificVersionOverride(genericVersionOverrides.filter(({ targetPkg }) => targetPkg.name === name && isIntersectingRange(targetPkg.bareSpecifier, bareSpecifier)));
+        const versionOverride = pickVersionOverride({ versionOverrides, genericVersionOverrides }, name, bareSpecifier);
         if (!versionOverride) {
             convergeDep(convergeOpts, { deps, peerDeps }, name, bareSpecifier);
             continue;
@@ -70,9 +95,7 @@ function overrideDeps({ versionOverrides, genericVersionOverrides, dir, converge
             }
             continue;
         }
-        const newBareSpecifier = versionOverride.localTarget
-            ? `${versionOverride.localTarget.protocol}${resolveLocalOverride(versionOverride.localTarget, dir)}`
-            : versionOverride.newBareSpecifier;
+        const newBareSpecifier = resolveOverriddenBareSpecifier(versionOverride, dir);
         if (peerDeps == null || !isValidPeerRange(newBareSpecifier)) {
             deps[versionOverride.targetPkg.name] = newBareSpecifier;
         }
@@ -81,6 +104,30 @@ function overrideDeps({ versionOverrides, genericVersionOverrides, dir, converge
         }
     }
 }
+function convergeDep(convergeOpts, { deps, peerDeps }, name, bareSpecifier) {
+    recordConvergeDeclaredRange(convergeOpts, name, bareSpecifier);
+    const convergeVersion = convergeBareSpecifier(convergeOpts.convergeVersions, name, bareSpecifier);
+    if (convergeVersion == null)
+        return;
+    if (peerDeps == null) {
+        deps[name] = convergeVersion;
+    }
+    else {
+        peerDeps[name] = convergeVersion;
+    }
+}
+function recordConvergeDeclaredRange({ convergeVersions, convergeDeclaredRanges }, name, bareSpecifier) {
+    if (convergeDeclaredRanges == null)
+        return;
+    if (!convergeVersions.has(name) || semver.validRange(bareSpecifier, true) == null)
+        return;
+    let ranges = convergeDeclaredRanges.get(name);
+    if (ranges == null) {
+        ranges = new Set();
+        convergeDeclaredRanges.set(name, ranges);
+    }
+    ranges.add(bareSpecifier);
+}
 /**
  * A convergence override (`"pkg@": "<version>"`) rewrites a dependency edge
  * only when its version satisfies the edge's declared range, so incompatible
@@ -88,26 +135,21 @@ function overrideDeps({ versionOverrides, genericVersionOverrides, dir, converge
  * `workspace:`, `catalog:`, `npm:`, git/URL, and dist-tag specifiers have no
  * defined "satisfies" relation and are left untouched.
  */
-function convergeDep({ convergeVersions, convergeDeclaredRanges }, { deps, peerDeps }, name, bareSpecifier) {
+function convergeBareSpecifier(convergeVersions, name, bareSpecifier) {
     const convergeVersion = convergeVersions.get(name);
     if (convergeVersion == null || semver.validRange(bareSpecifier, true) == null)
-        return;
-    if (convergeDeclaredRanges != null) {
-        let ranges = convergeDeclaredRanges.get(name);
-        if (ranges == null) {
-            ranges = new Set();
-            convergeDeclaredRanges.set(name, ranges);
-        }
-        ranges.add(bareSpecifier);
-    }
-    if (!semver.satisfies(convergeVersion, bareSpecifier, true))
-        return;
-    if (peerDeps == null) {
-        deps[name] = convergeVersion;
-    }
-    else {
-        peerDeps[name] = convergeVersion;
-    }
+        return undefined;
+    return semver.satisfies(convergeVersion, bareSpecifier, true) ? convergeVersion : undefined;
+}
+function pickVersionOverride({ versionOverrides, genericVersionOverrides }, name, bareSpecifier) {
+    const matches = (override) => override.targetPkg.name === name && isIntersectingRange(override.targetPkg.bareSpecifier, bareSpecifier);
+    return pickMostSpecificVersionOverride(versionOverrides.filter(matches)) ??
+        pickMostSpecificVersionOverride(genericVersionOverrides.filter(matches));
+}
+function resolveOverriddenBareSpecifier(versionOverride, dir) {
+    return versionOverride.localTarget
+        ? `${versionOverride.localTarget.protocol}${resolveLocalOverride(versionOverride.localTarget, dir)}`
+        : versionOverride.newBareSpecifier;
 }
 function resolveLocalOverride({ specifiedViaRelativePath, absolutePath }, pkgDir) {
     return specifiedViaRelativePath && pkgDir

package/lib/index.d.ts

@@ -1 +1,2 @@
 export { createReadPackageHook, getEffectivePackageExtensions } from './createReadPackageHook.js';
+export { createDependencyOverrider, type DependencyOverrider } from './createVersionsOverrider.js';

package/lib/index.js

@@ -1,2 +1,3 @@
 export { createReadPackageHook, getEffectivePackageExtensions } from './createReadPackageHook.js';
+export { createDependencyOverrider } from './createVersionsOverrider.js';
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/hooks.read-package-hook",
-  "version": "1100.1.3",
+  "version": "1100.2.0",
   "description": "Creates the default package reader hook used by pnpm",
   "keywords": [
     "pnpm",
@@ -32,19 +32,19 @@
     "@pnpm/deps.peer-range": "1100.1.1",
     "@pnpm/error": "1100.1.0",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.2",
-    "@pnpm/types": "1101.6.0",
+    "@pnpm/types": "1101.7.0",
     "@yarnpkg/extensions": "2.0.6",
     "normalize-path": "^3.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "semver": "^7.8.4"
+    "semver": "^7.8.5"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/hooks.read-package-hook": "1100.1.3",
+    "@pnpm/hooks.read-package-hook": "1100.2.0",
     "@types/normalize-path": "^3.0.2",
-    "@types/ramda": "0.31.1",
+    "@types/ramda": "0.32.0",
     "@types/semver": "7.7.1",
-    "@yarnpkg/core": "4.8.0"
+    "@yarnpkg/core": "4.9.0"
   },
   "engines": {
     "node": ">=22.13"