@pnpm/installing.deps-resolver 1100.2.2 → 1100.2.3

package/lib/index.d.ts

@@ -9,6 +9,7 @@ import { type DependenciesByProjectId, type GenericDependenciesGraphNodeWithReso
 export type DependenciesGraph = GenericDependenciesGraphWithResolvedChildren<ResolvedPackage>;
 export type DependenciesGraphNode = GenericDependenciesGraphNodeWithResolvedChildren & ResolvedPackage;
 export { getWantedDependencies, type LinkedDependency, type PinnedVersion, type ResolvedPackage, type UpdateMatchingFunction, type WantedDependency, };
+export { assertValidDependencyAliases, isValidDependencyAlias } from './validateDependencyAlias.js';
 export interface ImporterToResolve extends Importer<{
     isNew?: boolean;
     nodeExecPath?: string;

package/lib/index.js

@@ -19,6 +19,7 @@ import { toResolveImporter } from './toResolveImporter.js';
 import { updateLockfile } from './updateLockfile.js';
 import { updateProjectManifest } from './updateProjectManifest.js';
 export { getWantedDependencies, };
+export { assertValidDependencyAliases, isValidDependencyAlias } from './validateDependencyAlias.js';
 export async function resolveDependencies(importers, opts) {
     const _toResolveImporter = toResolveImporter.bind(null, {
         defaultUpdateDepth: opts.defaultUpdateDepth,

package/lib/resolveDependencies.d.ts

@@ -87,7 +87,12 @@ export interface ResolutionContext {
     resolvedPkgsById: ResolvedPkgsById;
     resolvePeersFromWorkspaceRoot?: boolean;
     outdatedDependencies: Record<PkgResolutionId, string>;
+    packageResolutionBarrier: PackageResolutionBarrier;
     childrenByParentId: ChildrenByParentId;
+    childrenResolutionByPkgId: Record<PkgResolutionId, ChildrenResolution>;
+    childrenResolutionId: number;
+    importerResolutionOrder: Record<string, number>;
+    nodeResolutionContextByNodeId: Map<NodeId, NodeResolutionContext>;
     patchedDependencies?: PatchGroupRecord;
     pendingNodes: PendingNode[];
     wantedLockfile: LockfileObject;
@@ -132,6 +137,26 @@ export interface ResolutionContext {
     trustPolicyIgnoreAfter?: number;
     blockExoticSubdeps?: boolean;
 }
+interface PackageResolutionBarrier {
+    activeByDepth: Map<number, number>;
+    waiters: Array<() => void>;
+}
+interface ChildrenResolutionOwner {
+    depth: number;
+    importerOrder: number;
+    parentPath: PkgResolutionId[];
+}
+interface ChildrenResolution {
+    id: number;
+    owner: ChildrenResolutionOwner;
+    missingPeersOfChildren?: MissingPeersOfChildren;
+}
+interface NodeResolutionContext {
+    depth: number;
+    installable: boolean;
+    parentIds: PkgResolutionId[];
+    pkgId: PkgResolutionId;
+}
 export interface MissingPeerInfo {
     range: string;
     optional: boolean;
@@ -156,6 +181,7 @@ export interface PkgAddress extends PkgAddressOrLinkBase {
     rootDir: string;
     missingPeers: MissingPeers;
     missingPeersOfChildren?: MissingPeersOfChildren;
+    childrenResolutionId?: number;
     publishedAt?: string;
     saveCatalogName?: string;
     lockedPeerContext?: LockedPeerContext;
@@ -252,6 +278,15 @@ export declare function resolveDependencies(ctx: ResolutionContext, preferredVer
     updateDepth?: number;
 }>, options: ResolvedDependenciesOptions): Promise<ResolvedDependenciesResult>;
 export declare function createNodeIdForLinkedLocalPkg(lockfileDir: string, pkgDir: string): NodeId;
+export declare function buildTree(ctx: {
+    childrenByParentId: ChildrenByParentId;
+    dependenciesTree: DependenciesTree<ResolvedPackage>;
+    resolvedPkgsById: ResolvedPkgsById;
+    skipped: Set<PkgResolutionId>;
+}, parentId: PkgResolutionId, parentIds: PkgResolutionId[], children: Array<{
+    alias: string;
+    id: PkgResolutionId;
+}>, depth: number, installable: boolean): Record<string, NodeId>;
 export interface LockedPeerContext {
     [peerName: string]: DepPath;
 }

package/lib/resolveDependencies.js

@@ -9,6 +9,7 @@ import { logger } from '@pnpm/logger';
 import { getPatchInfo } from '@pnpm/patching.config';
 import { convertEnginesRuntimeToDependencies } from '@pnpm/pkg-manifest.utils';
 import { DIRECT_DEP_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
+import { lexCompare } from '@pnpm/util.lex-comparator';
 import normalizePath from 'normalize-path';
 import pDefer from 'p-defer';
 import { pathExists } from 'path-exists';
@@ -522,6 +523,7 @@ async function resolveDependenciesOfDependency(ctx, preferredVersions, options,
     }
     const postponedResolution = resolveChildren.bind(null, ctx, {
         parentPkg: resolveDependencyResult,
+        childrenResolutionId: resolveDependencyResult.childrenResolutionId,
         dependencyLockfile: extendedWantedDep.infoFromLockfile?.dependencyLockfile,
         parentDepth: options.currentDepth,
         parentIds: [...options.parentIds, resolveDependencyResult.pkgId],
@@ -534,7 +536,18 @@ async function resolveDependenciesOfDependency(ctx, preferredVersions, options,
     return {
         resolveDependencyResult,
         postponedResolution: async (postponedResolutionOpts) => {
+            if (!isCurrentChildrenResolution(ctx, resolveDependencyResult.pkgId, resolveDependencyResult.childrenResolutionId)) {
+                setDependencyTreeNodeWithCurrentChildren(ctx, {
+                    parentDepth: options.currentDepth,
+                    parentIds: [...options.parentIds, resolveDependencyResult.pkgId],
+                    parentPkg: resolveDependencyResult,
+                });
+                return resolveMissingPeersFromCurrentChildrenResolution(ctx, resolveDependencyResult.pkgId, postponedResolutionOpts.parentPkgAliases);
+            }
             const { missingPeers, resolvedPeers } = await postponedResolution(postponedResolutionOpts);
+            if (!isCurrentChildrenResolution(ctx, resolveDependencyResult.pkgId, resolveDependencyResult.childrenResolutionId)) {
+                return resolveMissingPeersFromCurrentChildrenResolution(ctx, resolveDependencyResult.pkgId, postponedResolutionOpts.parentPkgAliases);
+            }
             if (resolveDependencyResult.missingPeersOfChildren) {
                 resolveDependencyResult.missingPeersOfChildren.resolved = true;
                 resolveDependencyResult.missingPeersOfChildren.resolve(missingPeers);
@@ -563,7 +576,195 @@ function filterMissingPeers({ missingPeers, resolvedPeers }, parentPkgAliases) {
         missingPeers: newMissing,
     };
 }
-async function resolveChildren(ctx, { parentPkg, parentIds, dependencyLockfile, parentDepth, updateDepth, updateMatching, prefix, supportedArchitectures, }, { parentPkgAliases, preferredVersions, publishedBy, }) {
+function startPackageResolution(ctx, depth) {
+    const activeCount = ctx.packageResolutionBarrier.activeByDepth.get(depth) ?? 0;
+    ctx.packageResolutionBarrier.activeByDepth.set(depth, activeCount + 1);
+    let finished = false;
+    return () => {
+        if (finished)
+            return;
+        finished = true;
+        const nextActiveCount = (ctx.packageResolutionBarrier.activeByDepth.get(depth) ?? 1) - 1;
+        if (nextActiveCount > 0) {
+            ctx.packageResolutionBarrier.activeByDepth.set(depth, nextActiveCount);
+        }
+        else {
+            ctx.packageResolutionBarrier.activeByDepth.delete(depth);
+        }
+        const waiters = ctx.packageResolutionBarrier.waiters.splice(0);
+        for (const resolve of waiters) {
+            resolve();
+        }
+    };
+}
+async function waitForPackageResolutionTurn(ctx, depth) {
+    if (!hasActivePackageResolutionBeforeDepth(ctx, depth))
+        return;
+    await new Promise((resolve) => ctx.packageResolutionBarrier.waiters.push(resolve));
+    return waitForPackageResolutionTurn(ctx, depth);
+}
+function hasActivePackageResolutionBeforeDepth(ctx, depth) {
+    for (const [activeDepth, activeCount] of ctx.packageResolutionBarrier.activeByDepth) {
+        if (activeDepth < depth && activeCount > 0)
+            return true;
+    }
+    return false;
+}
+function claimChildrenResolution(ctx, opts) {
+    const owner = {
+        depth: opts.currentDepth,
+        importerOrder: ctx.importerResolutionOrder[opts.parentIds[0]] ?? Number.MAX_SAFE_INTEGER,
+        parentPath: opts.parentIds,
+    };
+    const existing = ctx.childrenResolutionByPkgId[opts.pkgId];
+    if (existing == null || compareChildrenResolutionOwners(owner, existing.owner) < 0) {
+        const previousMissingPeersOfChildren = existing?.missingPeersOfChildren;
+        const missingPeersOfChildren = ctx.hoistPeers && !opts.parentIds.includes(opts.pkgId)
+            ? createMissingPeersOfChildren()
+            : undefined;
+        const resolution = {
+            id: ++ctx.childrenResolutionId,
+            owner,
+            missingPeersOfChildren,
+        };
+        ctx.childrenResolutionByPkgId[opts.pkgId] = resolution;
+        if (missingPeersOfChildren) {
+            ctx.missingPeersOfChildrenByPkgId[opts.pkgId] = {
+                depth: owner.depth,
+                missingPeersOfChildren,
+            };
+        }
+        if (previousMissingPeersOfChildren) {
+            if (missingPeersOfChildren) {
+                missingPeersOfChildren.get().then((missingPeers) => {
+                    previousMissingPeersOfChildren.resolved = true;
+                    previousMissingPeersOfChildren.resolve(missingPeers);
+                }, previousMissingPeersOfChildren.reject);
+            }
+            else {
+                previousMissingPeersOfChildren.resolved = true;
+                previousMissingPeersOfChildren.resolve({});
+            }
+        }
+        return {
+            id: resolution.id,
+            isOwner: true,
+            missingPeersOfChildren,
+        };
+    }
+    let missingPeersOfChildren;
+    if (ctx.hoistPeers &&
+        !opts.parentIds.includes(opts.pkgId) &&
+        existing.missingPeersOfChildren &&
+        (existing.owner.depth >= opts.currentDepth ||
+            existing.missingPeersOfChildren.resolved)) {
+        missingPeersOfChildren = existing.missingPeersOfChildren;
+    }
+    return {
+        id: existing.id,
+        isOwner: false,
+        missingPeersOfChildren,
+    };
+}
+function compareChildrenResolutionOwners(owner1, owner2) {
+    if (owner1.depth !== owner2.depth)
+        return owner1.depth - owner2.depth;
+    if (owner1.importerOrder !== owner2.importerOrder)
+        return owner1.importerOrder - owner2.importerOrder;
+    const pathLength = Math.min(owner1.parentPath.length, owner2.parentPath.length);
+    for (let i = 0; i < pathLength; i++) {
+        const result = lexCompare(owner1.parentPath[i], owner2.parentPath[i]);
+        if (result !== 0)
+            return result;
+    }
+    return owner1.parentPath.length - owner2.parentPath.length;
+}
+function createMissingPeersOfChildren() {
+    const p = pDefer();
+    return {
+        resolve: p.resolve,
+        reject: p.reject,
+        get: pShare(p.promise),
+    };
+}
+function isCurrentChildrenResolution(ctx, pkgId, childrenResolutionId) {
+    return childrenResolutionId != null && ctx.childrenResolutionByPkgId[pkgId]?.id === childrenResolutionId;
+}
+async function resolveMissingPeersFromCurrentChildrenResolution(ctx, pkgId, parentPkgAliases) {
+    const missingPeersOfChildren = ctx.childrenResolutionByPkgId[pkgId]?.missingPeersOfChildren;
+    if (missingPeersOfChildren == null) {
+        return {
+            missingPeers: {},
+            resolvedPeers: {},
+        };
+    }
+    const missingPeers = await missingPeersOfChildren.get();
+    return filterMissingPeers({ missingPeers, resolvedPeers: {} }, parentPkgAliases);
+}
+function setDependencyTreeNodeWithCurrentChildren(ctx, { parentDepth, parentIds, parentPkg, }) {
+    ctx.dependenciesTree.set(parentPkg.nodeId, {
+        children: () => buildTree(ctx, parentPkg.pkgId, parentIds, ctx.childrenByParentId[parentPkg.pkgId] ?? [], parentDepth + 1, parentPkg.installable),
+        depth: parentDepth,
+        installable: parentPkg.installable,
+        lockedPeerContext: parentPkg.lockedPeerContext,
+        previousDepPath: parentPkg.previousDepPath,
+        resolvedPackage: ctx.resolvedPkgsById[parentPkg.pkgId],
+    });
+    ctx.nodeResolutionContextByNodeId.set(parentPkg.nodeId, {
+        depth: parentDepth,
+        installable: parentPkg.installable,
+        parentIds,
+        pkgId: parentPkg.pkgId,
+    });
+}
+function updateChildrenResolutionNodes(ctx, pkgId, currentNodeId) {
+    for (const [nodeId, nodeContext] of ctx.nodeResolutionContextByNodeId) {
+        if (nodeId === currentNodeId || nodeContext.pkgId !== pkgId)
+            continue;
+        const node = ctx.dependenciesTree.get(nodeId);
+        if (node == null || node.depth === -1)
+            continue;
+        node.children = () => buildTree(ctx, pkgId, nodeContext.parentIds, ctx.childrenByParentId[pkgId] ?? [], nodeContext.depth + 1, nodeContext.installable);
+    }
+}
+export function buildTree(ctx, parentId, parentIds, children, depth, installable) {
+    const childrenNodeIds = {};
+    for (const child of children) {
+        if (child.id.startsWith('link:')) {
+            childrenNodeIds[child.alias] = child.id;
+            continue;
+        }
+        if (parentIdsContainSequence(parentIds, parentId, child.id) || parentId === child.id) {
+            continue;
+        }
+        if (ctx.resolvedPkgsById[child.id].isLeaf) {
+            childrenNodeIds[child.alias] = child.id;
+            continue;
+        }
+        const childNodeId = nextNodeId();
+        childrenNodeIds[child.alias] = childNodeId;
+        installable = installable || !ctx.skipped.has(child.id);
+        ctx.dependenciesTree.set(childNodeId, {
+            children: () => buildTree(ctx, child.id, [...parentIds, child.id], ctx.childrenByParentId[child.id], depth + 1, installable),
+            depth,
+            installable,
+            resolvedPackage: ctx.resolvedPkgsById[child.id],
+        });
+    }
+    return childrenNodeIds;
+}
+async function resolveChildren(ctx, { parentPkg, childrenResolutionId, parentIds, dependencyLockfile, parentDepth, updateDepth, updateMatching, prefix, supportedArchitectures, }, { parentPkgAliases, preferredVersions, publishedBy, }) {
+    if (!isCurrentChildrenResolution(ctx, parentPkg.pkgId, childrenResolutionId)) {
+        setDependencyTreeNodeWithCurrentChildren(ctx, {
+            parentDepth,
+            parentIds,
+            parentPkg,
+        });
+        return {
+            missingPeers: {},
+            resolvedPeers: {},
+        };
+    }
     const currentResolvedDependencies = (dependencyLockfile != null)
         ? {
             ...dependencyLockfile.dependencies,
@@ -593,6 +794,14 @@ async function resolveChildren(ctx, { parentPkg, parentIds, dependencyLockfile,
         supportedArchitectures,
         parentIds,
     });
+    if (!isCurrentChildrenResolution(ctx, parentPkg.pkgId, childrenResolutionId)) {
+        setDependencyTreeNodeWithCurrentChildren(ctx, {
+            parentDepth,
+            parentIds,
+            parentPkg,
+        });
+        return resolvingPeers;
+    }
     ctx.childrenByParentId[parentPkg.pkgId] = pkgAddresses.map((child) => ({
         alias: child.alias,
         id: child.pkgId,
@@ -617,6 +826,13 @@ async function resolveChildren(ctx, { parentPkg, parentIds, dependencyLockfile,
         previousDepPath: parentPkg.previousDepPath,
         resolvedPackage: ctx.resolvedPkgsById[parentPkg.pkgId],
     });
+    ctx.nodeResolutionContextByNodeId.set(parentPkg.nodeId, {
+        depth: parentDepth,
+        installable: parentPkg.installable,
+        parentIds,
+        pkgId: parentPkg.pkgId,
+    });
+    updateChildrenResolutionNodes(ctx, parentPkg.pkgId, parentPkg.nodeId);
     return resolvingPeers;
 }
 function getDepsToResolve(wantedDependencies, wantedLockfile, options) {
@@ -775,345 +991,338 @@ async function resolveDependency(wantedDependency, ctx, options) {
             optional: true,
         };
     }
-    // Normalize the `preferredVersion` (singular) and `preferredVersions`
-    // (plural) options. If the singular option is passed through, it'll be used
-    // instead of the plural option.
-    const preferredVersions = !options.updateRequested && options.preferredVersion != null
-        ? getExactSinglePreferredVersions(wantedDependency, options.preferredVersion)
-        : options.preferredVersions;
+    const finishPackageResolution = startPackageResolution(ctx, options.currentDepth);
     try {
-        const calcSpecifier = options.currentDepth === 0;
-        if (!options.update && currentPkg.version && currentPkg.pkgId?.endsWith(`@${currentPkg.version}`) && !calcSpecifier) {
-            wantedDependency.bareSpecifier = replaceVersionInBareSpecifier(wantedDependency.bareSpecifier, currentPkg.version, ctx.namedRegistryPrefixes);
+        await waitForPackageResolutionTurn(ctx, options.currentDepth);
+        // Normalize the `preferredVersion` (singular) and `preferredVersions`
+        // (plural) options. If the singular option is passed through, it'll be used
+        // instead of the plural option.
+        const preferredVersions = !options.updateRequested && options.preferredVersion != null
+            ? getExactSinglePreferredVersions(wantedDependency, options.preferredVersion)
+            : options.preferredVersions;
+        try {
+            const calcSpecifier = options.currentDepth === 0;
+            if (!options.update && currentPkg.version && currentPkg.pkgId?.endsWith(`@${currentPkg.version}`) && !calcSpecifier) {
+                wantedDependency.bareSpecifier = replaceVersionInBareSpecifier(wantedDependency.bareSpecifier, currentPkg.version, ctx.namedRegistryPrefixes);
+            }
+            pkgResponse = await ctx.storeController.requestPackage(wantedDependency, {
+                allowBuild: ctx.allowBuild,
+                alwaysTryWorkspacePackages: ctx.linkWorkspacePackagesDepth >= options.currentDepth,
+                currentPkg: currentPkg
+                    ? {
+                        id: currentPkg.pkgId,
+                        name: currentPkg.name,
+                        resolution: currentPkg.resolution,
+                        version: currentPkg.version,
+                        publishedAt: currentPkg.pkgId ? ctx.wantedLockfile.time?.[currentPkg.pkgId] : undefined,
+                    }
+                    : undefined,
+                expectedPkg: currentPkg,
+                defaultTag: ctx.defaultTag,
+                ignoreScripts: ctx.ignoreScripts,
+                publishedBy: options.publishedBy,
+                publishedByExclude: ctx.publishedByExclude,
+                pickLowestVersion: options.pickLowestVersion,
+                downloadPriority: -options.currentDepth,
+                lockfileDir: ctx.lockfileDir,
+                preferredVersions,
+                preferWorkspacePackages: ctx.preferWorkspacePackages,
+                projectDir: (options.currentDepth > 0 &&
+                    !wantedDependency.bareSpecifier.startsWith('file:'))
+                    ? ctx.lockfileDir
+                    : options.parentPkg.rootDir,
+                skipFetch: ctx.dryRun,
+                trustPolicy: ctx.trustPolicy,
+                trustPolicyExclude: ctx.trustPolicyExclude,
+                trustPolicyIgnoreAfter: ctx.trustPolicyIgnoreAfter,
+                update: options.update,
+                updateChecksums: options.updateChecksums,
+                workspacePackages: ctx.workspacePackages,
+                supportedArchitectures: options.supportedArchitectures,
+                onFetchError: (err) => {
+                    err.prefix = options.prefix;
+                    err.pkgsStack = getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById);
+                    return err;
+                },
+                injectWorkspacePackages: ctx.injectWorkspacePackages,
+                calcSpecifier,
+                pinnedVersion: options.pinnedVersion,
+            });
         }
-        pkgResponse = await ctx.storeController.requestPackage(wantedDependency, {
-            allowBuild: ctx.allowBuild,
-            alwaysTryWorkspacePackages: ctx.linkWorkspacePackagesDepth >= options.currentDepth,
-            currentPkg: currentPkg
-                ? {
-                    id: currentPkg.pkgId,
-                    name: currentPkg.name,
-                    resolution: currentPkg.resolution,
-                    version: currentPkg.version,
-                    publishedAt: currentPkg.pkgId ? ctx.wantedLockfile.time?.[currentPkg.pkgId] : undefined,
-                }
-                : undefined,
-            expectedPkg: currentPkg,
-            defaultTag: ctx.defaultTag,
-            ignoreScripts: ctx.ignoreScripts,
-            publishedBy: options.publishedBy,
-            publishedByExclude: ctx.publishedByExclude,
-            pickLowestVersion: options.pickLowestVersion,
-            downloadPriority: -options.currentDepth,
-            lockfileDir: ctx.lockfileDir,
-            preferredVersions,
-            preferWorkspacePackages: ctx.preferWorkspacePackages,
-            projectDir: (options.currentDepth > 0 &&
-                !wantedDependency.bareSpecifier.startsWith('file:'))
-                ? ctx.lockfileDir
-                : options.parentPkg.rootDir,
-            skipFetch: ctx.dryRun,
-            trustPolicy: ctx.trustPolicy,
-            trustPolicyExclude: ctx.trustPolicyExclude,
-            trustPolicyIgnoreAfter: ctx.trustPolicyIgnoreAfter,
-            update: options.update,
-            updateChecksums: options.updateChecksums,
-            workspacePackages: ctx.workspacePackages,
-            supportedArchitectures: options.supportedArchitectures,
-            onFetchError: (err) => {
-                err.prefix = options.prefix;
-                err.pkgsStack = getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById);
-                return err;
+        catch (err) { // eslint-disable-line
+            const wantedDependencyDetails = {
+                name: wantedDependency.alias,
+                bareSpecifier: wantedDependency.bareSpecifier,
+                version: wantedDependency.alias ? wantedDependency.bareSpecifier : undefined,
+            };
+            if (wantedDependency.optional && err.code !== 'ERR_PNPM_TRUST_DOWNGRADE') {
+                skippedOptionalDependencyLogger.debug({
+                    details: err.toString(),
+                    package: wantedDependencyDetails,
+                    parents: getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById),
+                    prefix: options.prefix,
+                    reason: 'resolution_failure',
+                });
+                return null;
+            }
+            err.package = wantedDependencyDetails;
+            err.prefix = options.prefix;
+            err.pkgsStack = getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById);
+            throw err;
+        }
+        dependencyResolvedLogger.debug({
+            resolution: pkgResponse.body.id,
+            wanted: {
+                dependentId: options.parentPkg.pkgId,
+                name: wantedDependency.alias,
+                rawSpec: wantedDependency.bareSpecifier,
             },
-            injectWorkspacePackages: ctx.injectWorkspacePackages,
-            calcSpecifier,
-            pinnedVersion: options.pinnedVersion,
         });
-    }
-    catch (err) { // eslint-disable-line
-        const wantedDependencyDetails = {
-            name: wantedDependency.alias,
-            bareSpecifier: wantedDependency.bareSpecifier,
-            version: wantedDependency.alias ? wantedDependency.bareSpecifier : undefined,
-        };
-        if (wantedDependency.optional && err.code !== 'ERR_PNPM_TRUST_DOWNGRADE') {
-            skippedOptionalDependencyLogger.debug({
-                details: err.toString(),
-                package: wantedDependencyDetails,
-                parents: getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById),
-                prefix: options.prefix,
-                reason: 'resolution_failure',
-            });
-            return null;
+        // Resolver-inline policy violations (e.g. minimumReleaseAge) flow up
+        // here; collect them onto the shared context so resolveDependencyTree
+        // can hand the full set to the install command between
+        // resolveDependencyTree and resolvePeers.
+        if (pkgResponse.body.policyViolation) {
+            ctx.resolutionPolicyViolations.push(pkgResponse.body.policyViolation);
         }
-        err.package = wantedDependencyDetails;
-        err.prefix = options.prefix;
-        err.pkgsStack = getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById);
-        throw err;
-    }
-    dependencyResolvedLogger.debug({
-        resolution: pkgResponse.body.id,
-        wanted: {
-            dependentId: options.parentPkg.pkgId,
-            name: wantedDependency.alias,
-            rawSpec: wantedDependency.bareSpecifier,
-        },
-    });
-    // Resolver-inline policy violations (e.g. minimumReleaseAge) flow up
-    // here; collect them onto the shared context so resolveDependencyTree
-    // can hand the full set to the install command between
-    // resolveDependencyTree and resolvePeers.
-    if (pkgResponse.body.policyViolation) {
-        ctx.resolutionPolicyViolations.push(pkgResponse.body.policyViolation);
-    }
-    // Check if exotic dependencies are disallowed in subdependencies
-    if (ctx.blockExoticSubdeps &&
-        options.currentDepth > 0 &&
-        pkgResponse.body.resolvedVia != null && // This is already coming from the lockfile, we skip the check in this case for now. Should be fixed later.
-        isExoticDep(pkgResponse.body.resolvedVia)) {
-        const error = new PnpmError('EXOTIC_SUBDEP', `Exotic dependency "${wantedDependency.alias ?? wantedDependency.bareSpecifier}" (resolved via ${pkgResponse.body.resolvedVia}) is not allowed in subdependencies when blockExoticSubdeps is enabled`);
-        error.prefix = options.prefix;
-        error.pkgsStack = getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById);
-        throw error;
-    }
-    if (ctx.allPreferredVersions && pkgResponse.body.manifest?.version) {
-        if (!ctx.allPreferredVersions[pkgResponse.body.manifest.name]) {
-            ctx.allPreferredVersions[pkgResponse.body.manifest.name] = {};
+        // Check if exotic dependencies are disallowed in subdependencies
+        if (ctx.blockExoticSubdeps &&
+            options.currentDepth > 0 &&
+            pkgResponse.body.resolvedVia != null && // This is already coming from the lockfile, we skip the check in this case for now. Should be fixed later.
+            isExoticDep(pkgResponse.body.resolvedVia)) {
+            const error = new PnpmError('EXOTIC_SUBDEP', `Exotic dependency "${wantedDependency.alias ?? wantedDependency.bareSpecifier}" (resolved via ${pkgResponse.body.resolvedVia}) is not allowed in subdependencies when blockExoticSubdeps is enabled`);
+            error.prefix = options.prefix;
+            error.pkgsStack = getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById);
+            throw error;
         }
-        ctx.allPreferredVersions[pkgResponse.body.manifest.name][pkgResponse.body.manifest.version] = 'version';
-    }
-    if (!pkgResponse.body.updated &&
-        options.currentDepth === Math.max(0, options.updateDepth) &&
-        depIsLinked && !ctx.force && !options.proceed) {
-        return null;
-    }
-    if (pkgResponse.body.isLocal) {
-        if (!pkgResponse.body.manifest) {
-            // This should actually never happen because the local-resolver returns a manifest
-            // even if no real manifest exists in the filesystem.
-            throw new PnpmError('MISSING_PACKAGE_JSON', `Can't install ${wantedDependency.bareSpecifier}: Missing package.json file`);
+        if (ctx.allPreferredVersions && pkgResponse.body.manifest?.version) {
+            if (!ctx.allPreferredVersions[pkgResponse.body.manifest.name]) {
+                ctx.allPreferredVersions[pkgResponse.body.manifest.name] = {};
+            }
+            ctx.allPreferredVersions[pkgResponse.body.manifest.name][pkgResponse.body.manifest.version] = 'version';
         }
-        return {
-            alias: wantedDependency.alias ?? pkgResponse.body.alias ?? pkgResponse.body.manifest.name ?? path.basename(pkgResponse.body.resolution.directory),
-            dev: wantedDependency.dev,
-            isLinkedDependency: true,
-            name: pkgResponse.body.manifest.name,
-            optional: wantedDependency.optional,
-            pkgId: pkgResponse.body.id,
-            resolution: pkgResponse.body.resolution,
-            version: pkgResponse.body.manifest.version,
-            normalizedBareSpecifier: pkgResponse.body.normalizedBareSpecifier,
-            pkg: pkgResponse.body.manifest,
-        };
-    }
-    let prepare;
-    let hasBin;
-    let pkg = getManifestFromResponse(pkgResponse, wantedDependency, currentPkg);
-    if (!pkg.dependencies) {
-        pkg.dependencies = {};
-    }
-    if (ctx.readPackageHook != null) {
-        pkg = await ctx.readPackageHook(pkg);
-    }
-    if (pkg.peerDependencies && pkg.dependencies) {
-        if (ctx.autoInstallPeers) {
-            pkg = {
-                ...pkg,
-                dependencies: omit(Object.keys(pkg.peerDependencies), pkg.dependencies),
-            };
+        if (!pkgResponse.body.updated &&
+            options.currentDepth === Math.max(0, options.updateDepth) &&
+            depIsLinked && !ctx.force && !options.proceed) {
+            return null;
         }
-        else {
-            pkg = {
-                ...pkg,
-                dependencies: omit(Object.keys(pkg.peerDependencies).filter((peerDep) => options.parentPkgAliases[peerDep]), pkg.dependencies),
+        if (pkgResponse.body.isLocal) {
+            if (!pkgResponse.body.manifest) {
+                // This should actually never happen because the local-resolver returns a manifest
+                // even if no real manifest exists in the filesystem.
+                throw new PnpmError('MISSING_PACKAGE_JSON', `Can't install ${wantedDependency.bareSpecifier}: Missing package.json file`);
+            }
+            return {
+                alias: wantedDependency.alias ?? pkgResponse.body.alias ?? pkgResponse.body.manifest.name ?? path.basename(pkgResponse.body.resolution.directory),
+                dev: wantedDependency.dev,
+                isLinkedDependency: true,
+                name: pkgResponse.body.manifest.name,
+                optional: wantedDependency.optional,
+                pkgId: pkgResponse.body.id,
+                resolution: pkgResponse.body.resolution,
+                version: pkgResponse.body.manifest.version,
+                normalizedBareSpecifier: pkgResponse.body.normalizedBareSpecifier,
+                pkg: pkgResponse.body.manifest,
             };
         }
-    }
-    if (pkg.engines?.runtime != null) {
-        convertEnginesRuntimeToDependencies(pkg, 'engines', 'dependencies');
-    }
-    if (!pkg.name) { // TODO: don't fail on optional dependencies
-        throw new PnpmError('MISSING_PACKAGE_NAME', `Can't install ${wantedDependency.bareSpecifier}: Missing package name`);
-    }
-    let pkgIdWithPatchHash = (pkgResponse.body.id.startsWith(`${pkg.name}@`) ? pkgResponse.body.id : `${pkg.name}@${pkgResponse.body.id}`);
-    const patch = getPatchInfo(ctx.patchedDependencies, pkg.name, pkg.version);
-    if (patch) {
-        ctx.appliedPatches.add(patch.key);
-        pkgIdWithPatchHash = `${pkgIdWithPatchHash}(patch_hash=${patch.hash})`;
-    }
-    // We are building the dependency tree only until there are new packages
-    // or the packages repeat in a unique order.
-    // This is needed later during peer dependencies resolution.
-    //
-    // So we resolve foo > bar > qar > foo
-    // But we stop on foo > bar > qar > foo > qar
-    // In the second example, there's no reason to walk qar again
-    // when qar is included the first time, the dependencies of foo
-    // are already resolved and included as parent dependencies of qar.
-    // So during peers resolution, qar cannot possibly get any new or different
-    // peers resolved, after the first occurrence.
-    //
-    // However, in the next example we would analyze the second qar as well,
-    // because zoo is a new parent package:
-    // foo > bar > qar > zoo > qar
-    if (parentIdsContainSequence(options.parentIds, options.parentPkg.pkgId, pkgResponse.body.id) || pkgResponse.body.id === options.parentPkg.pkgId) {
-        return null;
-    }
-    if (!options.update && (currentPkg.dependencyLockfile != null) && currentPkg.depPath &&
-        !pkgResponse.body.updated &&
-        // peerDependencies field is also used for transitive peer dependencies which should not be linked
-        // That's why we cannot omit reading package.json of such dependencies.
-        // This can be removed if we implement something like peerDependenciesMeta.transitive: true
-        (currentPkg.dependencyLockfile.peerDependencies == null)) {
-        hasBin = currentPkg.dependencyLockfile.hasBin === true;
-        pkg = {
-            ...nameVerFromPkgSnapshot(currentPkg.depPath, currentPkg.dependencyLockfile),
-            ...omitDepsFields(currentPkg.dependencyLockfile),
-            ...pkg,
-        };
-    }
-    else {
-        prepare = Boolean(pkgResponse.body.resolvedVia === 'git-repository' &&
-            typeof pkg.scripts?.prepare === 'string');
-        if (currentPkg.dependencyLockfile?.deprecated &&
-            !pkgResponse.body.updated && !pkg.deprecated) {
-            pkg.deprecated = currentPkg.dependencyLockfile.deprecated;
+        let prepare;
+        let hasBin;
+        let pkg = getManifestFromResponse(pkgResponse, wantedDependency, currentPkg);
+        if (!pkg.dependencies) {
+            pkg.dependencies = {};
         }
-        hasBin = (currentPkg.dependencyLockfile?.hasBin != null && !pkg.bin)
-            ? currentPkg.dependencyLockfile.hasBin
-            : Boolean((pkg.bin && !(pkg.bin === '' || Object.keys(pkg.bin).length === 0)) ?? pkg.directories?.bin);
-    }
-    if (options.currentDepth === 0 && pkgResponse.body.latest && pkgResponse.body.latest !== pkg.version) {
-        ctx.outdatedDependencies[pkgResponse.body.id] = pkgResponse.body.latest;
-    }
-    if (pkg.peerDependencies != null) {
-        for (const name in pkg.peerDependencies) {
-            ctx.allPeerDepNames.add(name);
+        if (ctx.readPackageHook != null) {
+            pkg = await ctx.readPackageHook(pkg);
         }
-    }
-    if (pkg.peerDependenciesMeta != null) {
-        for (const name in pkg.peerDependenciesMeta) {
-            ctx.allPeerDepNames.add(name);
+        if (pkg.peerDependencies && pkg.dependencies) {
+            if (ctx.autoInstallPeers) {
+                pkg = {
+                    ...pkg,
+                    dependencies: omit(Object.keys(pkg.peerDependencies), pkg.dependencies),
+                };
+            }
+            else {
+                pkg = {
+                    ...pkg,
+                    dependencies: omit(Object.keys(pkg.peerDependencies).filter((peerDep) => options.parentPkgAliases[peerDep]), pkg.dependencies),
+                };
+            }
         }
-    }
-    // In case of leaf dependencies (dependencies that have no prod deps or peer deps),
-    // we only ever need to analyze one leaf dep in a graph, so the nodeId can be short and stateless.
-    const nodeId = pkgIsLeaf(pkg) ? pkgResponse.body.id : nextNodeId();
-    const parentIsInstallable = options.parentPkg.installable === undefined || options.parentPkg.installable;
-    const installable = parentIsInstallable && pkgResponse.body.isInstallable !== false;
-    const isNew = !ctx.resolvedPkgsById[pkgResponse.body.id];
-    const parentImporterId = options.parentIds[0];
-    const currentIsOptional = wantedDependency.optional || options.parentPkg.optional;
-    if (isNew) {
-        if (pkg.deprecated &&
-            (!ctx.allowedDeprecatedVersions[pkg.name] || !semver.satisfies(pkg.version, ctx.allowedDeprecatedVersions[pkg.name]))) {
-            // Report deprecated packages only on first occurrence.
-            deprecationLogger.debug({
-                deprecated: pkg.deprecated,
-                depth: options.currentDepth,
-                pkgId: pkgResponse.body.id,
-                pkgName: pkg.name,
-                pkgVersion: pkg.version,
-                prefix: options.prefix,
-            });
+        if (pkg.engines?.runtime != null) {
+            convertEnginesRuntimeToDependencies(pkg, 'engines', 'dependencies');
         }
-        if (pkgResponse.body.isInstallable === false || !parentIsInstallable) {
-            ctx.skipped.add(pkgResponse.body.id);
+        if (!pkg.name) { // TODO: don't fail on optional dependencies
+            throw new PnpmError('MISSING_PACKAGE_NAME', `Can't install ${wantedDependency.bareSpecifier}: Missing package name`);
         }
-        progressLogger.debug({
-            packageId: pkgResponse.body.id,
-            requester: ctx.lockfileDir,
-            status: 'resolved',
-        });
-        // WARN: It is very important to keep this sync
-        // Otherwise, deprecation messages for the same package might get written several times
-        ctx.resolvedPkgsById[pkgResponse.body.id] = getResolvedPackage({
-            dependencyLockfile: currentPkg.dependencyLockfile,
-            pkgIdWithPatchHash,
-            force: ctx.force,
-            hasBin,
-            patch,
-            pkg,
-            pkgResponse,
-            prepare,
-            wantedDependency,
-            parentImporterId,
-            optional: currentIsOptional,
-        });
-    }
-    else {
-        ctx.resolvedPkgsById[pkgResponse.body.id].prod = ctx.resolvedPkgsById[pkgResponse.body.id].prod || !wantedDependency.dev && !wantedDependency.optional;
-        ctx.resolvedPkgsById[pkgResponse.body.id].dev = ctx.resolvedPkgsById[pkgResponse.body.id].dev || wantedDependency.dev;
-        ctx.resolvedPkgsById[pkgResponse.body.id].optional = ctx.resolvedPkgsById[pkgResponse.body.id].optional && currentIsOptional;
-        if (ctx.resolvedPkgsById[pkgResponse.body.id].fetching == null && pkgResponse.fetching != null) {
-            ctx.resolvedPkgsById[pkgResponse.body.id].fetching = pkgResponse.fetching;
-            ctx.resolvedPkgsById[pkgResponse.body.id].filesIndexFile = pkgResponse.filesIndexFile;
+        let pkgIdWithPatchHash = (pkgResponse.body.id.startsWith(`${pkg.name}@`) ? pkgResponse.body.id : `${pkg.name}@${pkgResponse.body.id}`);
+        const patch = getPatchInfo(ctx.patchedDependencies, pkg.name, pkg.version);
+        if (patch) {
+            ctx.appliedPatches.add(patch.key);
+            pkgIdWithPatchHash = `${pkgIdWithPatchHash}(patch_hash=${patch.hash})`;
         }
-        if (ctx.dependenciesTree.has(nodeId)) {
-            ctx.dependenciesTree.get(nodeId).depth = Math.min(ctx.dependenciesTree.get(nodeId).depth, options.currentDepth);
+        // We are building the dependency tree only until there are new packages
+        // or the packages repeat in a unique order.
+        // This is needed later during peer dependencies resolution.
+        //
+        // So we resolve foo > bar > qar > foo
+        // But we stop on foo > bar > qar > foo > qar
+        // In the second example, there's no reason to walk qar again
+        // when qar is included the first time, the dependencies of foo
+        // are already resolved and included as parent dependencies of qar.
+        // So during peers resolution, qar cannot possibly get any new or different
+        // peers resolved, after the first occurrence.
+        //
+        // However, in the next example we would analyze the second qar as well,
+        // because zoo is a new parent package:
+        // foo > bar > qar > zoo > qar
+        if (parentIdsContainSequence(options.parentIds, options.parentPkg.pkgId, pkgResponse.body.id) || pkgResponse.body.id === options.parentPkg.pkgId) {
+            return null;
+        }
+        if (!options.update && (currentPkg.dependencyLockfile != null) && currentPkg.depPath &&
+            !pkgResponse.body.updated &&
+            // peerDependencies field is also used for transitive peer dependencies which should not be linked
+            // That's why we cannot omit reading package.json of such dependencies.
+            // This can be removed if we implement something like peerDependenciesMeta.transitive: true
+            (currentPkg.dependencyLockfile.peerDependencies == null)) {
+            hasBin = currentPkg.dependencyLockfile.hasBin === true;
+            pkg = {
+                ...nameVerFromPkgSnapshot(currentPkg.depPath, currentPkg.dependencyLockfile),
+                ...omitDepsFields(currentPkg.dependencyLockfile),
+                ...pkg,
+            };
         }
         else {
-            ctx.pendingNodes.push({
-                alias: wantedDependency.alias ?? pkgResponse.body.alias ?? pkg.name,
-                depth: options.currentDepth,
-                parentIds: options.parentIds,
-                installable,
-                lockedPeerContext: currentPkg.lockedPeerContext,
-                previousDepPath: currentPkg.depPath,
-                nodeId,
-                resolvedPackage: ctx.resolvedPkgsById[pkgResponse.body.id],
-            });
+            prepare = Boolean(pkgResponse.body.resolvedVia === 'git-repository' &&
+                typeof pkg.scripts?.prepare === 'string');
+            if (currentPkg.dependencyLockfile?.deprecated &&
+                !pkgResponse.body.updated && !pkg.deprecated) {
+                pkg.deprecated = currentPkg.dependencyLockfile.deprecated;
+            }
+            hasBin = (currentPkg.dependencyLockfile?.hasBin != null && !pkg.bin)
+                ? currentPkg.dependencyLockfile.hasBin
+                : Boolean((pkg.bin && !(pkg.bin === '' || Object.keys(pkg.bin).length === 0)) ?? pkg.directories?.bin);
         }
-    }
-    const rootDir = pkgResponse.body.resolution.type === 'directory'
-        ? path.resolve(ctx.lockfileDir, pkgResponse.body.resolution.directory)
-        : options.prefix;
-    let missingPeersOfChildren;
-    if (ctx.hoistPeers && !options.parentIds.includes(pkgResponse.body.id)) {
-        if (ctx.missingPeersOfChildrenByPkgId[pkgResponse.body.id]) {
-            // This if condition is used to avoid a dead lock.
-            // There might be a better way to hoist peer dependencies during resolution
-            // but it would probably require a big rewrite of the resolution algorithm.
-            if (ctx.missingPeersOfChildrenByPkgId[pkgResponse.body.id].depth >= options.currentDepth ||
-                ctx.missingPeersOfChildrenByPkgId[pkgResponse.body.id].missingPeersOfChildren.resolved) {
-                missingPeersOfChildren = ctx.missingPeersOfChildrenByPkgId[pkgResponse.body.id].missingPeersOfChildren;
+        if (options.currentDepth === 0 && pkgResponse.body.latest && pkgResponse.body.latest !== pkg.version) {
+            ctx.outdatedDependencies[pkgResponse.body.id] = pkgResponse.body.latest;
+        }
+        if (pkg.peerDependencies != null) {
+            for (const name in pkg.peerDependencies) {
+                ctx.allPeerDepNames.add(name);
+            }
+        }
+        if (pkg.peerDependenciesMeta != null) {
+            for (const name in pkg.peerDependenciesMeta) {
+                ctx.allPeerDepNames.add(name);
+            }
+        }
+        // In case of leaf dependencies (dependencies that have no prod deps or peer deps),
+        // we only ever need to analyze one leaf dep in a graph, so the nodeId can be short and stateless.
+        const nodeId = pkgIsLeaf(pkg) ? pkgResponse.body.id : nextNodeId();
+        const parentIsInstallable = options.parentPkg.installable === undefined || options.parentPkg.installable;
+        const installable = parentIsInstallable && pkgResponse.body.isInstallable !== false;
+        const packageIsNew = !ctx.resolvedPkgsById[pkgResponse.body.id];
+        const parentImporterId = options.parentIds[0];
+        const currentIsOptional = wantedDependency.optional || options.parentPkg.optional;
+        const childrenResolution = claimChildrenResolution(ctx, {
+            currentDepth: options.currentDepth,
+            parentIds: options.parentIds,
+            pkgId: pkgResponse.body.id,
+        });
+        const isNew = childrenResolution.isOwner;
+        if (packageIsNew) {
+            if (pkg.deprecated &&
+                (!ctx.allowedDeprecatedVersions[pkg.name] || !semver.satisfies(pkg.version, ctx.allowedDeprecatedVersions[pkg.name]))) {
+                // Report deprecated packages only on first occurrence.
+                deprecationLogger.debug({
+                    deprecated: pkg.deprecated,
+                    depth: options.currentDepth,
+                    pkgId: pkgResponse.body.id,
+                    pkgName: pkg.name,
+                    pkgVersion: pkg.version,
+                    prefix: options.prefix,
+                });
+            }
+            if (pkgResponse.body.isInstallable === false || !parentIsInstallable) {
+                ctx.skipped.add(pkgResponse.body.id);
             }
+            progressLogger.debug({
+                packageId: pkgResponse.body.id,
+                requester: ctx.lockfileDir,
+                status: 'resolved',
+            });
+            // WARN: It is very important to keep this sync
+            // Otherwise, deprecation messages for the same package might get written several times
+            ctx.resolvedPkgsById[pkgResponse.body.id] = getResolvedPackage({
+                dependencyLockfile: currentPkg.dependencyLockfile,
+                pkgIdWithPatchHash,
+                force: ctx.force,
+                hasBin,
+                patch,
+                pkg,
+                pkgResponse,
+                prepare,
+                wantedDependency,
+                parentImporterId,
+                optional: currentIsOptional,
+            });
         }
         else {
-            const p = pDefer();
-            missingPeersOfChildren = {
-                resolve: p.resolve,
-                reject: p.reject,
-                get: pShare(p.promise),
-            };
-            ctx.missingPeersOfChildrenByPkgId[pkgResponse.body.id] = {
-                depth: options.currentDepth,
-                missingPeersOfChildren,
-            };
+            ctx.resolvedPkgsById[pkgResponse.body.id].prod = ctx.resolvedPkgsById[pkgResponse.body.id].prod || !wantedDependency.dev && !wantedDependency.optional;
+            ctx.resolvedPkgsById[pkgResponse.body.id].dev = ctx.resolvedPkgsById[pkgResponse.body.id].dev || wantedDependency.dev;
+            ctx.resolvedPkgsById[pkgResponse.body.id].optional = ctx.resolvedPkgsById[pkgResponse.body.id].optional && currentIsOptional;
+            if (ctx.resolvedPkgsById[pkgResponse.body.id].fetching == null && pkgResponse.fetching != null) {
+                ctx.resolvedPkgsById[pkgResponse.body.id].fetching = pkgResponse.fetching;
+                ctx.resolvedPkgsById[pkgResponse.body.id].filesIndexFile = pkgResponse.filesIndexFile;
+            }
+            if (!isNew) {
+                if (ctx.dependenciesTree.has(nodeId)) {
+                    ctx.dependenciesTree.get(nodeId).depth = Math.min(ctx.dependenciesTree.get(nodeId).depth, options.currentDepth);
+                }
+                else {
+                    ctx.pendingNodes.push({
+                        alias: wantedDependency.alias ?? pkgResponse.body.alias ?? pkg.name,
+                        depth: options.currentDepth,
+                        parentIds: options.parentIds,
+                        installable,
+                        lockedPeerContext: currentPkg.lockedPeerContext,
+                        previousDepPath: currentPkg.depPath,
+                        nodeId,
+                        resolvedPackage: ctx.resolvedPkgsById[pkgResponse.body.id],
+                    });
+                }
+            }
         }
+        const rootDir = pkgResponse.body.resolution.type === 'directory'
+            ? path.resolve(ctx.lockfileDir, pkgResponse.body.resolution.directory)
+            : options.prefix;
+        const missingPeersOfChildren = childrenResolution.missingPeersOfChildren;
+        const resolvedPkg = ctx.resolvedPkgsById[pkgResponse.body.id];
+        return {
+            alias: wantedDependency.alias ?? pkgResponse.body.alias ?? pkg.name,
+            depIsLinked,
+            resolvedVia: pkgResponse.body.resolvedVia,
+            isNew,
+            nodeId,
+            normalizedBareSpecifier: pkgResponse.body.normalizedBareSpecifier,
+            missingPeersOfChildren,
+            childrenResolutionId: childrenResolution.id,
+            pkgId: pkgResponse.body.id,
+            rootDir,
+            missingPeers: getMissingPeers(pkg),
+            optional: resolvedPkg.optional,
+            version: resolvedPkg.version,
+            saveCatalogName: wantedDependency.saveCatalogName,
+            // Next fields are actually only needed when isNew = true
+            installable,
+            isLinkedDependency: undefined,
+            pkg,
+            updated: pkgResponse.body.updated,
+            publishedAt: pkgResponse.body.publishedAt,
+        };
+    }
+    finally {
+        finishPackageResolution();
     }
-    const resolvedPkg = ctx.resolvedPkgsById[pkgResponse.body.id];
-    return {
-        alias: wantedDependency.alias ?? pkgResponse.body.alias ?? pkg.name,
-        depIsLinked,
-        resolvedVia: pkgResponse.body.resolvedVia,
-        isNew,
-        nodeId,
-        normalizedBareSpecifier: pkgResponse.body.normalizedBareSpecifier,
-        missingPeersOfChildren,
-        pkgId: pkgResponse.body.id,
-        rootDir,
-        missingPeers: getMissingPeers(pkg),
-        optional: resolvedPkg.optional,
-        version: resolvedPkg.version,
-        saveCatalogName: wantedDependency.saveCatalogName,
-        // Next fields are actually only needed when isNew = true
-        installable,
-        isLinkedDependency: undefined,
-        pkg,
-        updated: pkgResponse.body.updated,
-        publishedAt: pkgResponse.body.publishedAt,
-    };
 }
 export function getManifestFromResponse(pkgResponse, wantedDependency, currentPkg) {
     if (pkgResponse.body.manifest)

package/lib/resolveDependencyTree.d.ts

@@ -5,7 +5,7 @@ import type { PreferredVersions, Resolution, ResolutionPolicyViolation, Workspac
 import type { StoreController } from '@pnpm/store.controller-types';
 import type { AllowBuild, AllowedDeprecatedVersions, PinnedVersion, PkgResolutionId, ProjectId, ProjectManifest, ProjectRootDir, ReadPackageHook, Registries, SupportedArchitectures, TrustPolicy } from '@pnpm/types';
 import type { WantedDependency } from './getNonDevWantedDependencies.js';
-import { type NodeId } from './nextNodeId.js';
+import type { NodeId } from './nextNodeId.js';
 import { type DependenciesTree, type LinkedDependency, type ResolvedPackage, type ResolvedPkgsById } from './resolveDependencies.js';
 export type { DependenciesTree, DependenciesTreeNode, LinkedDependency, ResolvedPackage } from './resolveDependencies.js';
 export interface ResolvedImporters {

package/lib/resolveDependencyTree.js

@@ -3,9 +3,7 @@ import { createPackageVersionPolicyOrThrow, getPublishedByPolicy } from '@pnpm/c
 import { globalWarn } from '@pnpm/logger';
 import { BUILTIN_NAMED_REGISTRIES } from '@pnpm/resolving.npm-resolver';
 import { partition } from 'ramda';
-import { nextNodeId } from './nextNodeId.js';
-import { parentIdsContainSequence } from './parentIdsContainSequence.js';
-import { resolveRootDependencies, } from './resolveDependencies.js';
+import { buildTree, resolveRootDependencies, } from './resolveDependencies.js';
 export async function resolveDependencyTree(importers, opts) {
     const wantedToBeSkippedPackageIds = new Set();
     const autoInstallPeers = opts.autoInstallPeers === true;
@@ -57,6 +55,14 @@ export async function resolveDependencyTree(importers, opts) {
         allPeerDepNames: new Set(),
         maximumPublishedBy: publishedBy,
         publishedByExclude,
+        packageResolutionBarrier: {
+            activeByDepth: new Map(),
+            waiters: [],
+        },
+        childrenResolutionByPkgId: {},
+        childrenResolutionId: 0,
+        importerResolutionOrder: Object.fromEntries(importers.map(({ id }, index) => [id, index])),
+        nodeResolutionContextByNodeId: new Map(),
         trustPolicy: opts.trustPolicy,
         trustPolicyExclude: opts.trustPolicyExclude ? createPackageVersionPolicyOrThrow(opts.trustPolicyExclude, 'trustPolicyExclude') : undefined,
         trustPolicyIgnoreAfter: opts.trustPolicyIgnoreAfter,
@@ -176,32 +182,6 @@ export async function resolveDependencyTree(importers, opts) {
         resolutionPolicyViolations: ctx.resolutionPolicyViolations,
     };
 }
-function buildTree(ctx, parentId, parentIds, children, depth, installable) {
-    const childrenNodeIds = {};
-    for (const child of children) {
-        if (child.id.startsWith('link:')) {
-            childrenNodeIds[child.alias] = child.id;
-            continue;
-        }
-        if (parentIdsContainSequence(parentIds, parentId, child.id) || parentId === child.id) {
-            continue;
-        }
-        if (ctx.resolvedPkgsById[child.id].isLeaf) {
-            childrenNodeIds[child.alias] = child.id;
-            continue;
-        }
-        const childNodeId = nextNodeId();
-        childrenNodeIds[child.alias] = childNodeId;
-        installable = installable || !ctx.skipped.has(child.id);
-        ctx.dependenciesTree.set(childNodeId, {
-            children: () => buildTree(ctx, child.id, [...parentIds, child.id], ctx.childrenByParentId[child.id], depth + 1, installable),
-            depth,
-            installable,
-            resolvedPackage: ctx.resolvedPkgsById[child.id],
-        });
-    }
-    return childrenNodeIds;
-}
 /**
   * There may be cases where multiple dependencies have the same alias in the directDeps array.
   * E.g., when there is "is-negative: github:kevva/is-negative#1.0.0" in the package.json dependencies,

package/lib/resolvePeers.js

@@ -320,6 +320,15 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
             ctx.pathsByNodeIdPromises.set(peerNodeId, peerPathPromise);
             ctx.pathsByNodeId.set(peerNodeId, previousPeerDepPath);
             peerPathPromise.resolve(previousPeerDepPath);
+            // Pinning writes into parentPkgs, and a childless node shares the object
+            // with its parent, so siblings processed later would see the pinned
+            // provider too. Copy before the first write to keep the pin scoped to
+            // this node — sibling order follows resolution order, so a leak makes the
+            // lockfile depend on network timing. Done here, not before the loop, so a
+            // pass whose guards skip every entry never allocates.
+            if (parentPkgs === parentParentPkgs) {
+                parentPkgs = { ...parentParentPkgs };
+            }
             parentPkgs[peerName] = lockedPeer;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.2.2",
+  "version": "1100.2.3",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -27,8 +27,8 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/util.lex-comparator": "^3.0.2",
-    "@yarnpkg/core": "4.5.0",
+    "@pnpm/util.lex-comparator": "^4.0.1",
+    "@yarnpkg/core": "4.8.0",
     "graph-cycles": "3.0.0",
     "is-inner-link": "^5.0.0",
     "is-subdir": "^2.0.0",
@@ -39,46 +39,46 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^7.0.1",
     "safe-promise-defer": "^2.0.0",
-    "semver": "^7.8.1",
+    "semver": "^7.8.4",
     "semver-range-intersect": "^0.3.1",
     "validate-npm-package-name": "7.0.2",
     "version-selector-type": "^3.0.0",
-    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.1.4",
-    "@pnpm/core-loggers": "1100.2.0",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/config.version-policy": "1100.1.5",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.2.4",
-    "@pnpm/deps.path": "1100.0.7",
-    "@pnpm/deps.peer-range": "1100.0.1",
+    "@pnpm/core-loggers": "1100.2.1",
+    "@pnpm/deps.graph-hasher": "1100.2.5",
+    "@pnpm/deps.path": "1100.0.8",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/fetching.pick-fetcher": "1100.0.11",
-    "@pnpm/hooks.types": "1100.0.11",
-    "@pnpm/lockfile.preferred-versions": "1100.0.15",
-    "@pnpm/lockfile.pruner": "1100.0.10",
-    "@pnpm/lockfile.utils": "1100.0.12",
-    "@pnpm/lockfile.types": "1100.0.10",
-    "@pnpm/patching.config": "1100.0.7",
+    "@pnpm/deps.peer-range": "1100.0.2",
+    "@pnpm/fetching.pick-fetcher": "1100.0.12",
+    "@pnpm/hooks.types": "1100.0.12",
+    "@pnpm/lockfile.preferred-versions": "1100.0.16",
+    "@pnpm/lockfile.pruner": "1100.0.11",
+    "@pnpm/lockfile.types": "1100.0.11",
+    "@pnpm/lockfile.utils": "1100.0.13",
+    "@pnpm/patching.config": "1100.0.8",
     "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.7",
-    "@pnpm/pkg-manifest.utils": "1100.2.4",
-    "@pnpm/resolving.npm-resolver": "1101.5.2",
-    "@pnpm/store.controller-types": "1100.1.4",
-    "@pnpm/resolving.resolver-base": "1100.4.1",
-    "@pnpm/types": "1101.3.1",
-    "@pnpm/workspace.spec-parser": "1100.0.0"
+    "@pnpm/pkg-manifest.utils": "1100.2.5",
+    "@pnpm/pkg-manifest.reader": "1100.0.8",
+    "@pnpm/resolving.npm-resolver": "1102.0.0",
+    "@pnpm/store.controller-types": "1100.1.5",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/workspace.spec-parser": "1100.0.0",
+    "@pnpm/resolving.resolver-base": "1100.4.2"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1"
+    "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/validate-npm-package-name": "^4.0.2",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/installing.deps-resolver": "1100.2.2"
+    "@pnpm/installing.deps-resolver": "1100.2.3",
+    "@pnpm/logger": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"