@pnpm/installing.deps-resolver 1100.1.4 → 1100.1.6

package/lib/hoistPeers.js

@@ -62,7 +62,8 @@ export function getHoistableOptionalPeers(allMissingOptionalPeers, allPreferredV
         if (!allPreferredVersions[missingOptionalPeerName])
             continue;
         let maxSatisfyingVersion;
-        for (const [version, specType] of Object.entries(allPreferredVersions[missingOptionalPeerName])) {
+        for (const [version, selector] of Object.entries(allPreferredVersions[missingOptionalPeerName])) {
+            const specType = typeof selector === 'string' ? selector : selector.selectorType;
             if (specType === 'version' &&
                 ranges.every(range => semver.satisfies(version, range)) &&
                 (!maxSatisfyingVersion || semver.gt(version, maxSatisfyingVersion))) {

package/lib/resolvePeers.js

@@ -244,7 +244,8 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
         const _parentPkgsMatch = parentPkgsMatch.bind(null, ctx.dependenciesTree);
         for (const [newParentPkgName, newParentPkg] of Object.entries(newParentPkgs)) {
             if (parentPkgs[newParentPkgName]) {
-                if (!_parentPkgsMatch(parentPkgs[newParentPkgName], newParentPkg)) {
+                if (!_parentPkgsMatch(parentPkgs[newParentPkgName], newParentPkg) ||
+                    inheritedParentPkgBreaksPeerDiamond(ctx, parentPkgs, parentPkgs[newParentPkgName], newParentPkg, children)) {
                     newParentPkg.occurrence = parentPkgs[newParentPkgName].occurrence + 1;
                     parentPkgs[newParentPkgName] = newParentPkg;
                 }
@@ -361,8 +362,15 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
     };
     async function calculateDepPath(peerIds, pendingPeerNodes, cycles) {
         const cyclicPeerAliases = new Set();
+        const pendingPeerAliases = new Set(pendingPeerNodes.map(({ alias }) => alias));
         for (const cycle of cycles) {
-            if (cycle.includes(currentAlias)) {
+            // A cycle has to be short-circuited at this level whenever any of
+            // its members is involved in the current resolution — either as
+            // currentAlias or among the pending peers we are about to await.
+            // When a cycle member hits the `findHit` cache instead of running
+            // its own calculateDepPath, only the awaiting siblings at this
+            // level can release the cached promise. See pnpm/pnpm#11999.
+            if (cycle.includes(currentAlias) || cycle.some((alias) => pendingPeerAliases.has(alias))) {
                 for (const peerAlias of cycle) {
                     cyclicPeerAliases.add(peerAlias);
                 }
@@ -445,6 +453,59 @@ function parentPkgsMatch(dependenciesTree, currentParentPkg, newParentPkg) {
         return true;
     return currentParentResolvedPkg.name === newParentResolvedPkg.name;
 }
+// A package that is both inherited from an ancestor and present among the
+// current node's own children is normally not duplicated: the inherited
+// instance is reused (see https://github.com/pnpm/pnpm/issues/8370). That reuse
+// is unsafe when a sibling peer-depends both this package and one of this
+// package's own peer dependencies. The sibling must see a single, consistent
+// instance of that shared peer, but the inherited instance resolved it in a
+// different context. In that case the node's own child has to be used instead.
+// See https://github.com/pnpm/pnpm/issues/12079
+function inheritedParentPkgBreaksPeerDiamond(ctx, parentPkgs, inheritedParentPkg, ownChildParentPkg, children) {
+    if (inheritedParentPkg.nodeId == null || ownChildParentPkg.nodeId == null)
+        return false;
+    if (inheritedParentPkg.nodeId === ownChildParentPkg.nodeId)
+        return false;
+    const inheritedContext = ctx.parentPkgsOfNode.get(inheritedParentPkg.nodeId);
+    if (inheritedContext == null)
+        return false;
+    const parentPkg = ctx.dependenciesTree.get(ownChildParentPkg.nodeId)?.resolvedPackage;
+    if (parentPkg == null)
+        return false;
+    const conflictingPeers = new Set();
+    for (const peerName of Object.keys(parentPkg.peerDependencies)) {
+        if (!ctx.allPeerDepNames.has(peerName))
+            continue;
+        const inheritedPeer = inheritedContext[peerName];
+        const currentPeer = parentPkgs[peerName];
+        if (inheritedPeer == null || currentPeer == null)
+            continue;
+        if (parentPeerDiffers(ctx.dependenciesTree, currentPeer, inheritedPeer)) {
+            conflictingPeers.add(peerName);
+        }
+    }
+    if (conflictingPeers.size === 0)
+        return false;
+    for (const childNodeId of Object.values(children)) {
+        const childPeerDependencies = ctx.dependenciesTree.get(childNodeId)?.resolvedPackage?.peerDependencies;
+        if (childPeerDependencies == null || childPeerDependencies[parentPkg.name] == null)
+            continue;
+        for (const peerName of conflictingPeers) {
+            if (childPeerDependencies[peerName] != null)
+                return true;
+        }
+    }
+    return false;
+}
+function parentPeerDiffers(dependenciesTree, currentPeer, inheritedPeer) {
+    if (inheritedPeer.pkgIdWithPatchHash != null) {
+        if (currentPeer.nodeId == null || (typeof currentPeer.nodeId === 'string' && currentPeer.nodeId.startsWith('link:'))) {
+            return true;
+        }
+        return dependenciesTree.get(currentPeer.nodeId)?.resolvedPackage?.pkgIdWithPatchHash !== inheritedPeer.pkgIdWithPatchHash;
+    }
+    return currentPeer.version !== inheritedPeer.version;
+}
 function findHit(ctx, parentPkgs, pkgIdWithPatchHash) {
     const cacheItems = ctx.peersCache.get(pkgIdWithPatchHash);
     if (!cacheItems)

package/lib/updateLockfile.js

@@ -25,7 +25,19 @@ export function updateLockfile({ dependenciesGraph, lockfile, prefix, registries
     return pruneSharedLockfile(lockfile, { warn, dependenciesGraph });
 }
 function toLockfileDependency(pkg, opts) {
-    const lockfileResolution = toLockfileResolution({ name: pkg.name, version: pkg.version }, pkg.resolution, opts.registry, opts.lockfileIncludeTarballUrl);
+    let lockfileResolution = toLockfileResolution({ name: pkg.name, version: pkg.version }, pkg.resolution, opts.registry, opts.lockfileIncludeTarballUrl);
+    if ('tarball' in lockfileResolution &&
+        lockfileResolution.integrity == null &&
+        lockfileResolution.type === undefined) {
+        const prevResolution = opts.prevSnapshot?.resolution;
+        if (prevResolution != null &&
+            'tarball' in prevResolution &&
+            prevResolution.type === undefined &&
+            prevResolution.tarball === lockfileResolution.tarball &&
+            prevResolution.integrity != null) {
+            lockfileResolution = { ...lockfileResolution, integrity: prevResolution.integrity };
+        }
+    }
     const newResolvedDeps = updateResolvedDeps(opts.updatedDeps, opts.depGraph);
     const newResolvedOptionalDeps = updateResolvedDeps(opts.updatedOptionalDeps, opts.depGraph);
     const result = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.1.4",
+  "version": "1100.1.6",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -32,7 +32,7 @@
     "normalize-path": "^3.0.0",
     "p-defer": "^4.0.1",
     "path-exists": "^5.0.0",
-    "promise-share": "^2.0.0",
+    "promise-share": "^2.0.1",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^7.0.1",
     "safe-promise-defer": "^2.0.0",
@@ -40,30 +40,30 @@
     "semver-range-intersect": "^0.3.1",
     "validate-npm-package-name": "7.0.2",
     "version-selector-type": "^3.0.0",
+    "@pnpm/catalogs.resolver": "1100.0.0",
     "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/constants": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.1.2",
     "@pnpm/core-loggers": "1100.1.2",
     "@pnpm/deps.graph-hasher": "1100.2.2",
-    "@pnpm/deps.path": "1100.0.5",
+    "@pnpm/constants": "1100.0.0",
     "@pnpm/deps.peer-range": "1100.0.1",
-    "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/hooks.types": "1100.0.9",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/config.version-policy": "1100.1.2",
     "@pnpm/fetching.pick-fetcher": "1100.0.9",
     "@pnpm/lockfile.preferred-versions": "1100.0.12",
-    "@pnpm/lockfile.types": "1100.0.8",
+    "@pnpm/hooks.types": "1100.0.9",
     "@pnpm/lockfile.utils": "1100.0.10",
-    "@pnpm/patching.config": "1100.0.5",
     "@pnpm/lockfile.pruner": "1100.0.8",
-    "@pnpm/pkg-manifest.reader": "1100.0.5",
-    "@pnpm/resolving.npm-resolver": "1101.3.3",
-    "@pnpm/error": "1100.0.0",
     "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/resolving.resolver-base": "1100.3.1",
+    "@pnpm/pkg-manifest.utils": "1100.2.1",
+    "@pnpm/lockfile.types": "1100.0.8",
+    "@pnpm/pkg-manifest.reader": "1100.0.5",
+    "@pnpm/resolving.npm-resolver": "1101.4.0",
+    "@pnpm/types": "1101.2.0",
     "@pnpm/store.controller-types": "1100.1.2",
+    "@pnpm/deps.path": "1100.0.5",
     "@pnpm/workspace.spec-parser": "1100.0.0",
-    "@pnpm/pkg-manifest.utils": "1100.2.1",
-    "@pnpm/types": "1101.2.0"
+    "@pnpm/patching.config": "1100.0.5",
+    "@pnpm/resolving.resolver-base": "1100.3.1"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1001.0.1"
@@ -74,8 +74,8 @@
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/validate-npm-package-name": "^4.0.2",
-    "@pnpm/installing.deps-resolver": "1100.1.4",
-    "@pnpm/logger": "1100.0.0"
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/installing.deps-resolver": "1100.1.6"
   },
   "engines": {
     "node": ">=22.13"