@pnpm/installing.deps-resolver 1100.1.5 → 1100.2.0

package/lib/hoistPeers.js

@@ -62,7 +62,8 @@ export function getHoistableOptionalPeers(allMissingOptionalPeers, allPreferredV
         if (!allPreferredVersions[missingOptionalPeerName])
             continue;
         let maxSatisfyingVersion;
-        for (const [version, specType] of Object.entries(allPreferredVersions[missingOptionalPeerName])) {
+        for (const [version, selector] of Object.entries(allPreferredVersions[missingOptionalPeerName])) {
+            const specType = typeof selector === 'string' ? selector : selector.selectorType;
             if (specType === 'version' &&
                 ranges.every(range => semver.satisfies(version, range)) &&
                 (!maxSatisfyingVersion || semver.gt(version, maxSatisfyingVersion))) {

package/lib/index.js

@@ -84,7 +84,14 @@ export async function resolveDependencies(importers, opts) {
         }
         return {
             binsDir: project.binsDir,
+            declaredDirectDependencies: new Set([
+                ...Object.keys(project.manifest == null ? {} : getAllDependenciesFromManifest(project.manifest)),
+                ...project.wantedDependencies.flatMap(({ alias, isNew }) => isNew && alias != null ? [alias] : []),
+            ]),
             directNodeIdsByAlias: resolvedImporter.directNodeIdsByAlias,
+            explicitlyRequestedDirectDependencies: new Set(project.wantedDependencies.flatMap(({ alias, bareSpecifier, isNew, prevSpecifier, updateSpec }) => alias != null && (isNew === true || updateSpec === true || (prevSpecifier != null && bareSpecifier !== prevSpecifier))
+                ? [alias]
+                : [])),
             id: project.id,
             linkedDependencies: resolvedImporter.linkedDependencies,
             manifest: project.manifest,
@@ -93,7 +100,7 @@ export async function resolveDependencies(importers, opts) {
             topParents,
         };
     }));
-    const { dependenciesGraph, dependenciesByProjectId, peerDependencyIssuesByProjects, } = await resolvePeers({
+    const peerResolutionOpts = {
         allPeerDepNames,
         dependenciesTree,
         dedupePeerDependents: opts.dedupePeerDependents,
@@ -107,7 +114,19 @@ export async function resolveDependencies(importers, opts) {
         resolvedImporters,
         peersSuffixMaxLength: opts.peersSuffixMaxLength,
         workspaceProjectIds: new Set([...opts.allProjectIds, ...Object.keys(opts.wantedLockfile.importers)]),
-    });
+    };
+    const initiallyResolvedPeers = await resolvePeers(peerResolutionOpts);
+    // A second pass reuses the peer contexts already recorded in the lockfile so a
+    // writable install does not rewrite dependency instances whose locked provider
+    // is still valid and present. It can only differ from the first pass for nodes
+    // that carry a locked peer context, so it is skipped when none do (e.g. a fresh
+    // install) to avoid resolving peers twice for no benefit.
+    const { dependenciesGraph, dependenciesByProjectId, peerDependencyIssuesByProjects, } = treeHasLockedPeerContexts(dependenciesTree)
+        ? await resolvePeers({
+            ...peerResolutionOpts,
+            resolvedPeerProviderPaths: initiallyResolvedPeers.pathsByNodeId,
+        })
+        : initiallyResolvedPeers;
     const linkedDependenciesByProjectId = {};
     await Promise.all(projectsToResolve.map(async (project, index) => {
         const resolvedImporter = resolvedImporters[project.id];
@@ -237,6 +256,13 @@ export async function resolveDependencies(importers, opts) {
         resolutionPolicyViolations,
     };
 }
+function treeHasLockedPeerContexts(dependenciesTree) {
+    for (const node of dependenciesTree.values()) {
+        if (node.lockedPeerContext != null)
+            return true;
+    }
+    return false;
+}
 function addDirectDependenciesToLockfile(newManifest, projectSnapshot, linkedPackages, directDependencies, excludeLinksFromLockfile) {
     const newProjectSnapshot = {
         dependencies: {},

package/lib/resolveDependencies.d.ts

@@ -4,7 +4,7 @@ import { type PatchGroupRecord } from '@pnpm/patching.config';
 import type { PatchInfo } from '@pnpm/patching.types';
 import { type DirectoryResolution, type PkgResolutionId, type PreferredVersions, type Resolution, type ResolutionPolicyViolation, type WorkspacePackages } from '@pnpm/resolving.resolver-base';
 import type { PackageResponse, PkgRequestFetchResult, StoreController } from '@pnpm/store.controller-types';
-import type { AllowBuild, AllowedDeprecatedVersions, PackageManifest, PackageVersionPolicy, PinnedVersion, PkgIdWithPatchHash, ReadPackageHook, Registries, SupportedArchitectures, TrustPolicy } from '@pnpm/types';
+import type { AllowBuild, AllowedDeprecatedVersions, DepPath, PackageManifest, PackageVersionPolicy, PinnedVersion, PkgIdWithPatchHash, ReadPackageHook, Registries, SupportedArchitectures, TrustPolicy } from '@pnpm/types';
 import { type WantedDependency } from './getNonDevWantedDependencies.js';
 import { type NodeId } from './nextNodeId.js';
 import type { CatalogLookupMetadata } from './resolveDependencyTree.js';
@@ -20,6 +20,9 @@ export interface ChildrenMap {
 export type DependenciesTreeNode<T> = {
     children: (() => ChildrenMap) | ChildrenMap;
     installable: boolean;
+    dependencyNamesWhoseCurrentProviderMustWin?: Set<string>;
+    lockedPeerContext?: LockedPeerContext;
+    previousDepPath?: DepPath;
 } & ({
     resolvedPackage: T & {
         name: string;
@@ -56,6 +59,8 @@ export interface PendingNode {
     resolvedPackage: ResolvedPackage;
     depth: number;
     installable: boolean;
+    lockedPeerContext?: LockedPeerContext;
+    previousDepPath?: DepPath;
     parentIds: PkgResolutionId[];
 }
 export interface ChildrenByParentId {
@@ -153,6 +158,8 @@ export interface PkgAddress extends PkgAddressOrLinkBase {
     missingPeersOfChildren?: MissingPeersOfChildren;
     publishedAt?: string;
     saveCatalogName?: string;
+    lockedPeerContext?: LockedPeerContext;
+    previousDepPath?: DepPath;
 }
 export type PkgAddressOrLink = PkgAddress | LinkedDependency;
 export interface PeerDependency {
@@ -192,7 +199,7 @@ export interface ResolvedPackage {
         libc?: string[];
     };
 }
-type ParentPkg = Pick<PkgAddress, 'nodeId' | 'installable' | 'rootDir' | 'optional' | 'pkgId' | 'resolvedVia'>;
+type ParentPkg = Pick<PkgAddress, 'nodeId' | 'installable' | 'rootDir' | 'optional' | 'pkgId' | 'resolvedVia' | 'lockedPeerContext' | 'previousDepPath'>;
 export type ParentPkgAliases = Record<string, PkgAddress | true>;
 export type UpdateMatchingFunction = (pkgName: string, version?: string) => boolean;
 interface ResolvedDependenciesOptions {
@@ -245,9 +252,14 @@ export declare function resolveDependencies(ctx: ResolutionContext, preferredVer
     updateDepth?: number;
 }>, options: ResolvedDependenciesOptions): Promise<ResolvedDependenciesResult>;
 export declare function createNodeIdForLinkedLocalPkg(lockfileDir: string, pkgDir: string): NodeId;
+export interface LockedPeerContext {
+    [peerName: string]: DepPath;
+}
 type InfoFromLockfile = {
+    depPath: DepPath;
     pkgId: PkgResolutionId;
     dependencyLockfile?: PackageSnapshot;
+    lockedPeerContext?: LockedPeerContext;
     name?: string;
     version?: string;
     resolution?: Resolution;

package/lib/resolveDependencies.js

@@ -505,6 +505,10 @@ async function resolveDependenciesOfDependency(ctx, preferredVersions, options,
         });
         return { resolveDependencyResult };
     }
+    if (update === false && extendedWantedDep.infoFromLockfile != null) {
+        resolveDependencyResult.previousDepPath = extendedWantedDep.infoFromLockfile.depPath;
+        resolveDependencyResult.lockedPeerContext = extendedWantedDep.infoFromLockfile.lockedPeerContext;
+    }
     if (!resolveDependencyResult.isNew) {
         return {
             resolveDependencyResult,
@@ -600,6 +604,17 @@ async function resolveChildren(ctx, { parentPkg, parentIds, dependencyLockfile,
         }, {}),
         depth: parentDepth,
         installable: parentPkg.installable,
+        dependencyNamesWhoseCurrentProviderMustWin: new Set(pkgAddresses
+            .filter((child) => {
+            const previousRef = dependencyLockfile?.dependencies?.[child.alias] ??
+                dependencyLockfile?.optionalDependencies?.[child.alias];
+            if (previousRef == null || child.isLinkedDependency)
+                return true;
+            return child.previousDepPath !== dp.refToRelative(previousRef, child.alias);
+        })
+            .map(({ alias }) => alias)),
+        lockedPeerContext: parentPkg.lockedPeerContext,
+        previousDepPath: parentPkg.previousDepPath,
         resolvedPackage: ctx.resolvedPkgsById[parentPkg.pkgId],
     });
     return resolvingPeers;
@@ -678,6 +693,18 @@ function referenceSatisfiesWantedSpec(opts, wantedDep, preferredRef) {
     }
     return semver.satisfies(version, wantedDep.bareSpecifier, true);
 }
+function getLockedPeerContext(dependencyLockfile) {
+    if (dependencyLockfile.peerDependencies == null)
+        return undefined;
+    const lockedPeerContext = {};
+    for (const peerName of Object.keys(dependencyLockfile.peerDependencies)) {
+        const ref = dependencyLockfile.dependencies?.[peerName] ?? dependencyLockfile.optionalDependencies?.[peerName];
+        const depPath = ref == null ? null : dp.refToRelative(ref, peerName);
+        if (depPath != null)
+            lockedPeerContext[peerName] = depPath;
+    }
+    return Object.keys(lockedPeerContext).length === 0 ? undefined : lockedPeerContext;
+}
 function getInfoFromLockfile(lockfile, registries, reference, alias) {
     if (!reference || !alias) {
         return undefined;
@@ -688,6 +715,7 @@ function getInfoFromLockfile(lockfile, registries, reference, alias) {
     }
     let dependencyLockfile = lockfile.packages?.[depPath];
     if (dependencyLockfile != null) {
+        const lockedPeerContext = getLockedPeerContext(dependencyLockfile);
         if ((dependencyLockfile.peerDependencies != null) && (dependencyLockfile.dependencies != null)) {
             // This is done to guarantee that the dependency will be relinked with the
             // up-to-date peer dependencies
@@ -705,9 +733,11 @@ function getInfoFromLockfile(lockfile, registries, reference, alias) {
         }
         const { name, version, nonSemverVersion } = nameVerFromPkgSnapshot(depPath, dependencyLockfile);
         return {
+            depPath,
             name,
             version,
             dependencyLockfile,
+            lockedPeerContext,
             pkgId: nonSemverVersion ?? `${name}@${version}`,
             // resolution may not exist if lockfile is broken, and an unexpected error will be thrown
             // if resolution does not exist, return undefined so it can be autofixed later
@@ -717,6 +747,7 @@ function getInfoFromLockfile(lockfile, registries, reference, alias) {
     else {
         const parsed = dp.parse(depPath);
         return {
+            depPath,
             pkgId: parsed.nonSemverVersion ?? (parsed.name && parsed.version ? `${parsed.name}@${parsed.version}` : depPath), // Does it make sense to set pkgId when we're not sure?
         };
     }
@@ -1027,6 +1058,8 @@ async function resolveDependency(wantedDependency, ctx, options) {
                 depth: options.currentDepth,
                 parentIds: options.parentIds,
                 installable,
+                lockedPeerContext: currentPkg.lockedPeerContext,
+                previousDepPath: currentPkg.depPath,
                 nodeId,
                 resolvedPackage: ctx.resolvedPkgsById[pkgResponse.body.id],
             });

package/lib/resolveDependencyTree.js

@@ -132,6 +132,8 @@ export async function resolveDependencyTree(importers, opts) {
             children: () => buildTree(ctx, pendingNode.resolvedPackage.id, pendingNode.parentIds, ctx.childrenByParentId[pendingNode.resolvedPackage.id], pendingNode.depth + 1, pendingNode.installable),
             depth: pendingNode.depth,
             installable: pendingNode.installable,
+            lockedPeerContext: pendingNode.lockedPeerContext,
+            previousDepPath: pendingNode.previousDepPath,
             resolvedPackage: pendingNode.resolvedPackage,
         });
     }

package/lib/resolvePeers.d.ts

@@ -30,6 +30,8 @@ export interface GenericDependenciesGraphWithResolvedChildren<T extends PartialR
 }
 export interface ProjectToResolve {
     directNodeIdsByAlias: Map<string, NodeId>;
+    declaredDirectDependencies?: Set<string>;
+    explicitlyRequestedDirectDependencies?: Set<string>;
     topParents: Array<{
         name: string;
         version: string;
@@ -53,8 +55,10 @@ export declare function resolvePeers<T extends PartialResolvedPackage>(opts: {
     resolvedImporters: ResolvedImporters;
     peersSuffixMaxLength: number;
     workspaceProjectIds: Set<string>;
+    resolvedPeerProviderPaths?: Map<NodeId, DepPath>;
 }): Promise<{
     dependenciesGraph: GenericDependenciesGraphWithResolvedChildren<T>;
     dependenciesByProjectId: DependenciesByProjectId;
     peerDependencyIssuesByProjects: PeerDependencyIssuesByProjects;
+    pathsByNodeId: Map<NodeId, DepPath>;
 }>;

package/lib/resolvePeers.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { createPeerDepGraphHash, depPathToFilename } from '@pnpm/deps.path';
+import { createPeerDepGraphHash, depPathToFilename, parseDepPath } from '@pnpm/deps.path';
 import * as semverUtils from '@yarnpkg/core/semverUtils';
 import { analyzeGraph } from 'graph-cycles';
 import pDefer, {} from 'p-defer';
@@ -13,13 +13,31 @@ export async function resolvePeers(opts) {
     const pathsByNodeId = new Map();
     const pathsByNodeIdPromises = new Map();
     const depPathsByPkgId = new Map();
+    const nodeIdsByPreviousDepPath = opts.resolvedPeerProviderPaths == null
+        ? new Map()
+        : getNodeIdsByPreviousDepPath(opts.dependenciesTree);
     const _createPkgsByName = createPkgsByName.bind(null, opts.dependenciesTree);
-    const rootPkgsByName = opts.resolvePeersFromWorkspaceRoot ? getRootPkgsByName(opts.dependenciesTree, opts.projects) : {};
+    const workspaceRootProject = opts.resolvePeersFromWorkspaceRoot && opts.projects.length > 1
+        ? opts.projects.find(({ id }) => id === '.')
+        : undefined;
+    const rootPkgsByName = workspaceRootProject == null ? {} : _createPkgsByName(workspaceRootProject);
     const peerDependencyIssuesByProjects = {};
     const finishingList = [];
     const peersCache = new Map();
     const purePkgs = new Set();
-    for (const { directNodeIdsByAlias, topParents, rootDir, id } of opts.projects) {
+    for (const { directNodeIdsByAlias, declaredDirectDependencies, explicitlyRequestedDirectDependencies, topParents, rootDir, id } of opts.projects) {
+        const currentProviderSources = [{
+                directNodeIdsByAlias,
+                declaredDirectDependencies: declaredDirectDependencies ?? new Set(),
+                explicitlyRequestedDirectDependencies: explicitlyRequestedDirectDependencies ?? new Set(),
+            }];
+        if (workspaceRootProject != null && workspaceRootProject.id !== id) {
+            currentProviderSources.push({
+                directNodeIdsByAlias: workspaceRootProject.directNodeIdsByAlias,
+                declaredDirectDependencies: workspaceRootProject.declaredDirectDependencies ?? new Set(),
+                explicitlyRequestedDirectDependencies: workspaceRootProject.explicitlyRequestedDirectDependencies ?? new Set(),
+            });
+        }
         const peerDependencyIssues = { bad: {}, missing: {} };
         const pkgsByName = Object.fromEntries(Object.entries({
             ...rootPkgsByName,
@@ -42,6 +60,9 @@ export async function resolvePeers(opts) {
             pathsByNodeId,
             pathsByNodeIdPromises,
             depPathsByPkgId,
+            nodeIdsByPreviousDepPath,
+            resolvedPeerProviderPaths: opts.resolvedPeerProviderPaths,
+            currentProviderSources,
             peersCache,
             peerDependencyIssues,
             purePkgs,
@@ -104,6 +125,7 @@ export async function resolvePeers(opts) {
         dependenciesGraph: depGraphWithResolvedChildren,
         dependenciesByProjectId,
         peerDependencyIssuesByProjects,
+        pathsByNodeId,
     };
 }
 function nodeDepsCount(node) {
@@ -177,10 +199,6 @@ function isCompatibleAndHasMoreDeps(depGraph, depPath1, depPath2) {
     }
     return true;
 }
-function getRootPkgsByName(dependenciesTree, projects) {
-    const rootProject = projects.length > 1 ? projects.find(({ id }) => id === '.') : null;
-    return rootProject == null ? {} : createPkgsByName(dependenciesTree, rootProject);
-}
 function createPkgsByName(dependenciesTree, { directNodeIdsByAlias, topParents }) {
     const parentRefs = toPkgByName(Array.from(directNodeIdsByAlias.entries())
         .map(([alias, nodeId]) => ({
@@ -244,7 +262,8 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
         const _parentPkgsMatch = parentPkgsMatch.bind(null, ctx.dependenciesTree);
         for (const [newParentPkgName, newParentPkg] of Object.entries(newParentPkgs)) {
             if (parentPkgs[newParentPkgName]) {
-                if (!_parentPkgsMatch(parentPkgs[newParentPkgName], newParentPkg)) {
+                if (!_parentPkgsMatch(parentPkgs[newParentPkgName], newParentPkg) ||
+                    inheritedParentPkgBreaksPeerDiamond(ctx, parentPkgs, parentPkgs[newParentPkgName], newParentPkg, children)) {
                     newParentPkg.occurrence = parentPkgs[newParentPkgName].occurrence + 1;
                     parentPkgs[newParentPkgName] = newParentPkg;
                 }
@@ -254,6 +273,46 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
             }
         }
     }
+    if (node.lockedPeerContext != null && ctx.resolvedPeerProviderPaths != null) {
+        for (const [peerName, previousPeerDepPath] of Object.entries(node.lockedPeerContext)) {
+            const peerNodeId = ctx.nodeIdsByPreviousDepPath.get(previousPeerDepPath);
+            const peerDependency = resolvedPackage.peerDependencies[peerName];
+            if (peerNodeId == null || peerDependency == null)
+                continue;
+            if (ctx.resolvedPeerProviderPaths?.get(peerNodeId) !== previousPeerDepPath)
+                continue;
+            // Only pin providers that have no peer context of their own. A provider
+            // whose locked depPath carries a peer suffix is itself context-dependent
+            // — and self-referential for cyclic peers — so reusing it can re-expand
+            // cyclic suffixes and break the deterministic resolution that
+            // https://github.com/pnpm/pnpm/issues/8155 established. Stable leaf
+            // providers are the ones worth pinning; anything else falls back to
+            // fresh resolution.
+            if (parseDepPath(previousPeerDepPath).peerDepGraphHash !== '')
+                continue;
+            // A provider that already resolved to a different path this pass no longer
+            // matches its locked context; pinning it would leave pathsByNodeId
+            // pointing at a depPath that was never added to the graph.
+            const currentPeerDepPath = ctx.pathsByNodeId.get(peerNodeId);
+            if (currentPeerDepPath != null && currentPeerDepPath !== previousPeerDepPath)
+                continue;
+            if (hasCurrentPeerProviderThatMustWin(peerName, parentPkgs, ctx))
+                continue;
+            const lockedPeer = toPkgByName([{
+                    alias: peerName,
+                    node: ctx.dependenciesTree.get(peerNodeId),
+                    nodeId: peerNodeId,
+                    parentNodeIds,
+                }])[peerName];
+            if (!semverUtils.satisfiesWithPrereleases(lockedPeer.version, peerDependency.version.replace(/^workspace:/, ''), true))
+                continue;
+            const peerPathPromise = ctx.pathsByNodeIdPromises.get(peerNodeId) ?? pDefer();
+            ctx.pathsByNodeIdPromises.set(peerNodeId, peerPathPromise);
+            ctx.pathsByNodeId.set(peerNodeId, previousPeerDepPath);
+            peerPathPromise.resolve(previousPeerDepPath);
+            parentPkgs[peerName] = lockedPeer;
+        }
+    }
     const hit = findHit(ctx, parentPkgs, resolvedPackage.pkgIdWithPatchHash);
     if (hit != null) {
         for (const [peerName, { range: wantedRange, optional }] of hit.missingPeers.entries()) {
@@ -439,6 +498,40 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
         }
     }
 }
+function getNodeIdsByPreviousDepPath(dependenciesTree) {
+    const nodeIdsByPreviousDepPath = new Map();
+    for (const [nodeId, node] of dependenciesTree.entries()) {
+        if (node.previousDepPath != null && !nodeIdsByPreviousDepPath.has(node.previousDepPath)) {
+            nodeIdsByPreviousDepPath.set(node.previousDepPath, nodeId);
+        }
+    }
+    return nodeIdsByPreviousDepPath;
+}
+function hasCurrentPeerProviderThatMustWin(peerName, parentPkgs, ctx) {
+    const peerNodeId = parentPkgs[peerName]?.nodeId;
+    if (peerNodeId == null)
+        return false;
+    for (const source of ctx.currentProviderSources) {
+        for (const [alias, directNodeId] of source.directNodeIdsByAlias) {
+            if (directNodeId === peerNodeId &&
+                (alias !== peerName ||
+                    source.explicitlyRequestedDirectDependencies.has(alias) ||
+                    (source.declaredDirectDependencies.has(alias) &&
+                        ctx.dependenciesTree.get(peerNodeId)?.previousDepPath == null)))
+                return true;
+        }
+    }
+    for (const parentNodeId of ctx.parentNodeIds) {
+        const parentNode = ctx.dependenciesTree.get(parentNodeId);
+        if (parentNode == null)
+            continue;
+        const children = typeof parentNode.children === 'function' ? parentNode.children() : parentNode.children;
+        parentNode.children = children;
+        if ([...(parentNode.dependencyNamesWhoseCurrentProviderMustWin ?? [])].some((alias) => children[alias] === peerNodeId))
+            return true;
+    }
+    return false;
+}
 function parentPkgsMatch(dependenciesTree, currentParentPkg, newParentPkg) {
     if (currentParentPkg.version !== newParentPkg.version ||
         currentParentPkg.alias !== newParentPkg.alias) {
@@ -452,6 +545,59 @@ function parentPkgsMatch(dependenciesTree, currentParentPkg, newParentPkg) {
         return true;
     return currentParentResolvedPkg.name === newParentResolvedPkg.name;
 }
+// A package that is both inherited from an ancestor and present among the
+// current node's own children is normally not duplicated: the inherited
+// instance is reused (see https://github.com/pnpm/pnpm/issues/8370). That reuse
+// is unsafe when a sibling peer-depends both this package and one of this
+// package's own peer dependencies. The sibling must see a single, consistent
+// instance of that shared peer, but the inherited instance resolved it in a
+// different context. In that case the node's own child has to be used instead.
+// See https://github.com/pnpm/pnpm/issues/12079
+function inheritedParentPkgBreaksPeerDiamond(ctx, parentPkgs, inheritedParentPkg, ownChildParentPkg, children) {
+    if (inheritedParentPkg.nodeId == null || ownChildParentPkg.nodeId == null)
+        return false;
+    if (inheritedParentPkg.nodeId === ownChildParentPkg.nodeId)
+        return false;
+    const inheritedContext = ctx.parentPkgsOfNode.get(inheritedParentPkg.nodeId);
+    if (inheritedContext == null)
+        return false;
+    const parentPkg = ctx.dependenciesTree.get(ownChildParentPkg.nodeId)?.resolvedPackage;
+    if (parentPkg == null)
+        return false;
+    const conflictingPeers = new Set();
+    for (const peerName of Object.keys(parentPkg.peerDependencies)) {
+        if (!ctx.allPeerDepNames.has(peerName))
+            continue;
+        const inheritedPeer = inheritedContext[peerName];
+        const currentPeer = parentPkgs[peerName];
+        if (inheritedPeer == null || currentPeer == null)
+            continue;
+        if (parentPeerDiffers(ctx.dependenciesTree, currentPeer, inheritedPeer)) {
+            conflictingPeers.add(peerName);
+        }
+    }
+    if (conflictingPeers.size === 0)
+        return false;
+    for (const childNodeId of Object.values(children)) {
+        const childPeerDependencies = ctx.dependenciesTree.get(childNodeId)?.resolvedPackage?.peerDependencies;
+        if (childPeerDependencies == null || childPeerDependencies[parentPkg.name] == null)
+            continue;
+        for (const peerName of conflictingPeers) {
+            if (childPeerDependencies[peerName] != null)
+                return true;
+        }
+    }
+    return false;
+}
+function parentPeerDiffers(dependenciesTree, currentPeer, inheritedPeer) {
+    if (inheritedPeer.pkgIdWithPatchHash != null) {
+        if (currentPeer.nodeId == null || (typeof currentPeer.nodeId === 'string' && currentPeer.nodeId.startsWith('link:'))) {
+            return true;
+        }
+        return dependenciesTree.get(currentPeer.nodeId)?.resolvedPackage?.pkgIdWithPatchHash !== inheritedPeer.pkgIdWithPatchHash;
+    }
+    return currentPeer.version !== inheritedPeer.version;
+}
 function findHit(ctx, parentPkgs, pkgIdWithPatchHash) {
     const cacheItems = ctx.peersCache.get(pkgIdWithPatchHash);
     if (!cacheItems)

package/lib/updateLockfile.js

@@ -25,7 +25,19 @@ export function updateLockfile({ dependenciesGraph, lockfile, prefix, registries
     return pruneSharedLockfile(lockfile, { warn, dependenciesGraph });
 }
 function toLockfileDependency(pkg, opts) {
-    const lockfileResolution = toLockfileResolution({ name: pkg.name, version: pkg.version }, pkg.resolution, opts.registry, opts.lockfileIncludeTarballUrl);
+    let lockfileResolution = toLockfileResolution({ name: pkg.name, version: pkg.version }, pkg.resolution, opts.registry, opts.lockfileIncludeTarballUrl);
+    if ('tarball' in lockfileResolution &&
+        lockfileResolution.integrity == null &&
+        lockfileResolution.type === undefined) {
+        const prevResolution = opts.prevSnapshot?.resolution;
+        if (prevResolution != null &&
+            'tarball' in prevResolution &&
+            prevResolution.type === undefined &&
+            prevResolution.tarball === lockfileResolution.tarball &&
+            prevResolution.integrity != null) {
+            lockfileResolution = { ...lockfileResolution, integrity: prevResolution.integrity };
+        }
+    }
     const newResolvedDeps = updateResolvedDeps(opts.updatedDeps, opts.depGraph);
     const newResolvedOptionalDeps = updateResolvedDeps(opts.updatedOptionalDeps, opts.depGraph);
     const result = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.1.5",
+  "version": "1100.2.0",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -8,7 +8,10 @@
   ],
   "license": "MIT",
   "funding": "https://opencollective.com/pnpm",
-  "repository": "https://github.com/pnpm/pnpm/tree/main/installing/deps-resolver",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pnpm/pnpm/tree/main/installing/deps-resolver"
+  },
   "homepage": "https://github.com/pnpm/pnpm/tree/main/installing/deps-resolver#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
@@ -32,7 +35,7 @@
     "normalize-path": "^3.0.0",
     "p-defer": "^4.0.1",
     "path-exists": "^5.0.0",
-    "promise-share": "^2.0.0",
+    "promise-share": "^2.0.1",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^7.0.1",
     "safe-promise-defer": "^2.0.0",
@@ -41,29 +44,29 @@
     "validate-npm-package-name": "7.0.2",
     "version-selector-type": "^3.0.0",
     "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.1.2",
     "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/config.version-policy": "1100.1.3",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.2.2",
-    "@pnpm/deps.path": "1100.0.5",
-    "@pnpm/core-loggers": "1100.1.2",
-    "@pnpm/deps.peer-range": "1100.0.1",
-    "@pnpm/fetching.pick-fetcher": "1100.0.9",
+    "@pnpm/core-loggers": "1100.1.3",
+    "@pnpm/deps.path": "1100.0.6",
+    "@pnpm/deps.graph-hasher": "1100.2.3",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/hooks.types": "1100.0.9",
-    "@pnpm/lockfile.pruner": "1100.0.8",
-    "@pnpm/lockfile.preferred-versions": "1100.0.12",
-    "@pnpm/lockfile.types": "1100.0.8",
-    "@pnpm/patching.config": "1100.0.5",
+    "@pnpm/deps.peer-range": "1100.0.1",
+    "@pnpm/fetching.pick-fetcher": "1100.0.10",
+    "@pnpm/lockfile.types": "1100.0.9",
+    "@pnpm/patching.config": "1100.0.6",
+    "@pnpm/lockfile.preferred-versions": "1100.0.13",
+    "@pnpm/pkg-manifest.utils": "1100.2.2",
+    "@pnpm/lockfile.utils": "1100.0.11",
+    "@pnpm/resolving.resolver-base": "1100.4.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.6",
     "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/lockfile.utils": "1100.0.10",
-    "@pnpm/pkg-manifest.reader": "1100.0.5",
-    "@pnpm/resolving.npm-resolver": "1101.4.0",
-    "@pnpm/pkg-manifest.utils": "1100.2.1",
-    "@pnpm/resolving.resolver-base": "1100.3.1",
-    "@pnpm/types": "1101.2.0",
+    "@pnpm/hooks.types": "1100.0.10",
+    "@pnpm/lockfile.pruner": "1100.0.9",
     "@pnpm/workspace.spec-parser": "1100.0.0",
-    "@pnpm/store.controller-types": "1100.1.2"
+    "@pnpm/types": "1101.3.0",
+    "@pnpm/resolving.npm-resolver": "1101.5.0",
+    "@pnpm/store.controller-types": "1100.1.3"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1001.0.1"
@@ -74,8 +77,8 @@
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/validate-npm-package-name": "^4.0.2",
-    "@pnpm/installing.deps-resolver": "1100.1.5",
-    "@pnpm/logger": "1100.0.0"
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/installing.deps-resolver": "1100.2.0"
   },
   "engines": {
     "node": ">=22.13"