@pnpm/hooks.read-package-hook 1100.2.4 → 1100.3.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @pnpm/hooks.read-package-hook
 
+## 1100.3.0
+
+### Minor Changes
+
+- `pnpm update` no longer moves the range a project declares for a dependency that `overrides` also lists, even when the override repeats that range verbatim. Previously the updated `package.json` disagreed with the lockfile, so the next `pnpm install --frozen-lockfile` failed with a specifier mismatch [#14224](https://github.com/pnpm/pnpm/issues/14224).
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/types@1102.1.0
+
+## 1100.2.5
+
+### Patch Changes
+
+- Fixed an issue where package overrides were written into the metadata cache, causing removed overrides to keep applying on subsequent installs [pnpm/pnpm#13918](https://github.com/pnpm/pnpm/issues/13918).
+
+- Updated dependencies:
+  - @pnpm/config.parse-overrides@1100.1.4
+  - @pnpm/error@1100.1.3
+  - @pnpm/types@1102.0.0
+
 ## 1100.2.4
 
 ### Patch Changes

package/lib/createVersionsOverrider.d.ts

@@ -1,5 +1,5 @@
 import type { VersionOverride as VersionOverrideBase } from '@pnpm/config.parse-overrides';
-import type { ReadPackageHook } from '@pnpm/types';
+import { type DependenciesOrPeersField, type ProjectManifest, type ReadPackageHook } from '@pnpm/types';
 export type VersionOverrideWithoutRawSelector = Omit<VersionOverrideBase, 'selector'>;
 export interface CreateVersionsOverriderOptions {
     /**
@@ -26,4 +26,29 @@ export type DependencyOverrider = (name: string, bareSpecifier: string, dir?: st
  * project with no overrides — or with parent-scoped ones only.
  */
 export declare function createDependencyOverrider(overrides: VersionOverrideWithoutRawSelector[], rootDir: string): DependencyOverrider | undefined;
+/**
+ * What an override needs to read to decide whether it claims a dependency: the
+ * parent half of a `parent>child` key is matched against the manifest's own
+ * name and version. Workspace projects may declare neither, so this is wider
+ * than {@link PackageManifest}.
+ */
+export type OverridableManifest = Pick<ProjectManifest, 'name' | 'version' | DependenciesOrPeersField>;
+/**
+ * Whether an override claims a dependency declared as `bareSpecifier` —
+ * whether or not it rewrites the text. The specifier is part of the question:
+ * a range-scoped override (`foo@^2`) claims one declaration of `foo` and not
+ * another, so an alias alone cannot answer it.
+ */
+export type OverriddenDependencyMatcher = (alias: string, bareSpecifier: string) => boolean;
+/**
+ * Builds an {@link OverriddenDependencyMatcher} for one manifest: a
+ * `parent>child` override key is matched against that manifest's own name and
+ * version, so a project asks only about the overrides that govern its own
+ * declarations. Binding to the manifest also selects those once, rather than
+ * once per dependency asked about.
+ *
+ * `undefined` when no override in the set could claim anything, so a caller
+ * with none configured skips the work entirely.
+ */
+export declare function createOverriddenDependencyMatcher(overrides: VersionOverrideWithoutRawSelector[], rootDir: string): ((manifest: OverridableManifest) => OverriddenDependencyMatcher) | undefined;
 export declare function createVersionsOverrider(overrides: VersionOverrideWithoutRawSelector[], rootDir: string, opts?: CreateVersionsOverriderOptions): ReadPackageHook;

package/lib/createVersionsOverrider.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { isValidPeerRange } from '@pnpm/deps.peer-range';
+import { DEPENDENCIES_OR_PEER_FIELDS } from '@pnpm/types';
 import normalizePath from 'normalize-path';
 import { partition } from 'ramda';
 import semver from 'semver';
@@ -23,20 +24,57 @@ export function createDependencyOverrider(overrides, rootDir) {
         return convergeBareSpecifier(convergeVersions, name, bareSpecifier);
     };
 }
+/**
+ * Builds an {@link OverriddenDependencyMatcher} for one manifest: a
+ * `parent>child` override key is matched against that manifest's own name and
+ * version, so a project asks only about the overrides that govern its own
+ * declarations. Binding to the manifest also selects those once, rather than
+ * once per dependency asked about.
+ *
+ * `undefined` when no override in the set could claim anything, so a caller
+ * with none configured skips the work entirely.
+ */
+export function createOverriddenDependencyMatcher(overrides, rootDir) {
+    const { versionOverrides, genericVersionOverrides, convergeVersions } = splitOverrides(overrides, rootDir);
+    if (versionOverrides.length === 0 && genericVersionOverrides.length === 0 && convergeVersions.size === 0) {
+        return undefined;
+    }
+    return (manifest) => {
+        const overridesForManifest = {
+            versionOverrides: pickOverridesOfParent(versionOverrides, manifest),
+            genericVersionOverrides,
+        };
+        return (alias, bareSpecifier) => pickVersionOverride(overridesForManifest, alias, bareSpecifier) != null ||
+            convergeBareSpecifier(convergeVersions, alias, bareSpecifier) != null;
+    };
+}
 export function createVersionsOverrider(overrides, rootDir, opts) {
     const { versionOverrides, genericVersionOverrides, convergeVersions } = splitOverrides(overrides, rootDir);
     return ((manifest, dir) => {
-        const versionOverridesWithParent = versionOverrides.filter(({ parentPkg }) => {
-            return (parentPkg.name === manifest.name &&
-                (!parentPkg.bareSpecifier || semver.satisfies(manifest.version, parentPkg.bareSpecifier)));
-        });
-        overrideDepsOfPkg({ manifest, dir }, versionOverridesWithParent, genericVersionOverrides, {
+        const versionOverridesWithParent = pickOverridesOfParent(versionOverrides, manifest);
+        // The manifest may come from a shared cache, so the fields the overrides
+        // rewrite are cloned instead of mutated in place.
+        const clonedManifest = { ...manifest };
+        for (const depsField of DEPENDENCIES_OR_PEER_FIELDS) {
+            if (manifest[depsField] != null) {
+                clonedManifest[depsField] = { ...manifest[depsField] };
+            }
+        }
+        overrideDepsOfPkg({ manifest: clonedManifest, dir }, versionOverridesWithParent, genericVersionOverrides, {
             convergeVersions,
             convergeDeclaredRanges: opts?.convergeDeclaredRanges,
         });
-        return manifest;
+        return clonedManifest;
     });
 }
+/**
+ * The parent-scoped overrides (`parent>child`) whose parent half this manifest
+ * answers to. The rest never govern its dependencies.
+ */
+function pickOverridesOfParent(versionOverrides, manifest) {
+    return versionOverrides.filter(({ parentPkg }) => (parentPkg.name === manifest.name &&
+        (!parentPkg.bareSpecifier || (manifest.version != null && semver.satisfies(manifest.version, parentPkg.bareSpecifier)))));
+}
 function splitOverrides(overrides, rootDir) {
     const [convergeOverrides, explicitOverrides] = partition(({ converge }) => converge === true, overrides);
     const [versionOverrides, genericVersionOverrides] = partition(({ parentPkg }) => parentPkg != null, explicitOverrides.map((override) => ({

package/lib/index.d.ts

@@ -1,2 +1,2 @@
 export { createReadPackageHook, getEffectivePackageExtensions } from './createReadPackageHook.js';
-export { createDependencyOverrider, type DependencyOverrider } from './createVersionsOverrider.js';
+export { createDependencyOverrider, createOverriddenDependencyMatcher, type DependencyOverrider, type OverriddenDependencyMatcher } from './createVersionsOverrider.js';

package/lib/index.js

@@ -1,3 +1,3 @@
 export { createReadPackageHook, getEffectivePackageExtensions } from './createReadPackageHook.js';
-export { createDependencyOverrider } from './createVersionsOverrider.js';
+export { createDependencyOverrider, createOverriddenDependencyMatcher } from './createVersionsOverrider.js';
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/hooks.read-package-hook",
-  "version": "1100.2.4",
+  "version": "1100.3.0",
   "description": "Creates the default package reader hook used by pnpm",
   "keywords": [
     "pnpm",
@@ -28,11 +28,11 @@
   ],
   "dependencies": {
     "@pnpm/config.matcher": "1100.0.2",
-    "@pnpm/config.parse-overrides": "1100.1.3",
+    "@pnpm/config.parse-overrides": "1100.1.4",
     "@pnpm/deps.peer-range": "1100.1.1",
-    "@pnpm/error": "1100.1.2",
+    "@pnpm/error": "1100.1.3",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.2",
-    "@pnpm/types": "1101.9.0",
+    "@pnpm/types": "1102.1.0",
     "@yarnpkg/extensions": "2.0.7",
     "normalize-path": "^3.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
@@ -40,7 +40,7 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/hooks.read-package-hook": "1100.2.4",
+    "@pnpm/hooks.read-package-hook": "1100.3.0",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.32.0",
     "@types/semver": "7.8.0",