@pnpm/installing.deps-resolver 1100.2.3 → 1100.2.4

package/lib/dedupeInjectedDeps.js

@@ -27,19 +27,26 @@ function getDedupeMap(injectedDepsByProjects, opts) {
     for (const [id, deps] of injectedDepsByProjects.entries()) {
         const dedupedInjectedDeps = new Map();
         for (const [alias, dep] of deps.entries()) {
-            // Check for subgroup not equal.
-            // The injected project in the workspace may have dev deps
-            const children = Object.entries(opts.depGraph[dep.depPath].children);
+            const node = opts.depGraph[dep.depPath];
             const targetProjectDeps = opts.dependenciesByProjectId[dep.id];
-            // When the target project wasn't part of the current resolution (e.g. single-project
-            // operation), its dependencies aren't available. We can only deduplicate safely when the
-            // injected dep has no children (the empty set is always a subset).
+            // In single-project operations (e.g. `pnpm rm` from inside a workspace package) the target
+            // workspace project isn't being resolved, so its children aren't in
+            // `dependenciesByProjectId`. The injected dep was resolved against the same workspace
+            // package source, so dedupe is safe. The exception is peer-suffixed depPaths, whose
+            // resolution depends on the importer's peer context. A plain `link:` would lose that, so
+            // we skip dedupe for those. A depPath is `${pkgIdWithPatchHash}${peerDepGraphHash}`, so it
+            // carries a peer suffix exactly when it differs from its peer-free `pkgIdWithPatchHash`.
             if (!targetProjectDeps) {
-                if (children.length > 0)
-                    continue;
+                if (node.pkgIdWithPatchHash === dep.depPath) {
+                    dedupedInjectedDeps.set(alias, dep.id);
+                }
+                continue;
             }
+            // Check for subgroup not equal.
+            // The injected project in the workspace may have dev deps
+            const children = Object.entries(node.children);
             const isSubset = children
-                .every(([alias, depPath]) => targetProjectDeps?.get(alias) === depPath);
+                .every(([alias, depPath]) => targetProjectDeps.get(alias) === depPath);
             if (isSubset) {
                 dedupedInjectedDeps.set(alias, dep.id);
             }

package/lib/resolveDependencies.js

@@ -314,6 +314,7 @@ function getPublishedByDate(pkgAddresses, timeFromLockfile = {}) {
 export async function resolveDependencies(ctx, preferredVersions, wantedDependencies, options) {
     const extendedWantedDeps = getDepsToResolve(wantedDependencies, ctx.wantedLockfile, {
         preferredDependencies: options.preferredDependencies,
+        preferredVersions,
         prefix: options.prefix,
         proceed: options.proceed || ctx.forceFullResolution,
         registries: ctx.registries,
@@ -849,12 +850,33 @@ function getDepsToResolve(wantedDependencies, wantedLockfile, options) {
     });
     for (const wantedDependency of wantedDependencies) {
         let reference = undefined;
+        let preferredVersion = undefined;
         let proceed = proceedAll;
         if (wantedDependency.alias) {
             const satisfiesWanted = satisfiesWanted2Args.bind(null, wantedDependency);
             if (resolvedDependencies[wantedDependency.alias] &&
                 (satisfiesWanted(resolvedDependencies[wantedDependency.alias]) || resolvedDependencies[wantedDependency.alias].startsWith('file:'))) {
-                reference = resolvedDependencies[wantedDependency.alias];
+                const pinnedRef = resolvedDependencies[wantedDependency.alias];
+                // Reusing a lockfile pin verbatim bypasses the preferred-versions
+                // walk, so a transitive edge stays on a stale lower version even
+                // when a direct dependency resolved to a higher version in range.
+                const pinned = pinnedRef.startsWith('file:')
+                    ? undefined
+                    : getPinnedNameVer(wantedLockfile, pinnedRef, wantedDependency.alias);
+                const higherDirectVersion = pinned == null
+                    ? undefined
+                    : findHigherDirectDepVersion(options.preferredVersions, pinned.name, pinned.version, wantedDependency.bareSpecifier);
+                if (higherDirectVersion != null) {
+                    // `preferredVersion` (singular) overrides the
+                    // EXISTING_VERSION_SELECTOR_WEIGHT stability bias that would
+                    // otherwise re-pick the lower version. The lower version is then
+                    // never resolved or fetched.
+                    proceed = true;
+                    preferredVersion = higherDirectVersion;
+                }
+                else {
+                    reference = pinnedRef;
+                }
             }
             else if (
             // If dependencies that were used by the previous version of the package
@@ -885,6 +907,7 @@ function getDepsToResolve(wantedDependencies, wantedLockfile, options) {
         }
         extendedWantedDeps.push({
             infoFromLockfile,
+            preferredVersion,
             proceed,
             wantedDependency,
         });
@@ -909,6 +932,44 @@ function referenceSatisfiesWantedSpec(opts, wantedDep, preferredRef) {
     }
     return semver.satisfies(version, wantedDep.bareSpecifier, true);
 }
+function getPinnedNameVer(lockfile, reference, alias) {
+    const depPath = dp.refToRelative(reference, alias);
+    if (depPath === null)
+        return undefined;
+    const pkgSnapshot = lockfile.packages?.[depPath];
+    if (pkgSnapshot == null)
+        return undefined;
+    return nameVerFromPkgSnapshot(depPath, pkgSnapshot);
+}
+// The highest version a direct dependency (the only deterministic,
+// resolved-first anchor) resolved to that is higher than the
+// lockfile-pinned `pinnedVersion` and still satisfies the edge's range, or
+// `undefined` when none exists. Direct-dependency versions are marked with
+// DIRECT_DEP_SELECTOR_WEIGHT in preferredVersions.
+function findHigherDirectDepVersion(preferredVersions, pinnedName, pinnedVersion, bareSpecifier) {
+    if (preferredVersions == null)
+        return undefined;
+    if (!semver.valid(pinnedVersion))
+        return undefined;
+    if (semver.validRange(bareSpecifier) === null)
+        return undefined;
+    const selectors = preferredVersions[pinnedName];
+    if (selectors == null)
+        return undefined;
+    let best;
+    for (const [candidate, selector] of Object.entries(selectors)) {
+        if (typeof selector === 'object' &&
+            selector.selectorType === 'version' &&
+            selector.weight === DIRECT_DEP_SELECTOR_WEIGHT &&
+            semver.valid(candidate) &&
+            semver.gt(candidate, pinnedVersion) &&
+            semver.satisfies(candidate, bareSpecifier, true) &&
+            (best == null || semver.gt(candidate, best))) {
+            best = candidate;
+        }
+    }
+    return best;
+}
 function getLockedPeerContext(dependencyLockfile) {
     if (dependencyLockfile.peerDependencies == null)
         return undefined;

package/lib/resolvePeers.js

@@ -259,10 +259,11 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
         parentPkgs = { ...parentParentPkgs };
         const parentPkgNodes = [];
         for (const [alias, nodeId] of Object.entries(children)) {
-            if (ctx.allPeerDepNames.has(alias)) {
+            const childNode = ctx.dependenciesTree.get(nodeId);
+            if (ctx.allPeerDepNames.has(alias) || (alias !== childNode.resolvedPackage.name && ctx.allPeerDepNames.has(childNode.resolvedPackage.name))) {
                 parentPkgNodes.push({
                     alias,
-                    node: ctx.dependenciesTree.get(nodeId),
+                    node: childNode,
                     nodeId,
                     parentNodeIds,
                 });
@@ -391,7 +392,18 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
     }
     let cache;
     const isPure = allResolvedPeers.size === 0 && allMissingPeers.size === 0;
-    if (isPure) {
+    // A cycle re-entry resolves against truncated children (the cycle is broken by
+    // dropping the repeated package's subtree), so its empty/partial peer sets are
+    // not authoritative for the package as a whole. Recording that verdict — as
+    // pure or in peersCache — lets it short-circuit other occurrences that *can*
+    // see the full subtree, dropping their transitivePeerDependencies depending on
+    // traversal order and churning the lockfile (https://github.com/pnpm/pnpm/issues/5108).
+    const resolvedThroughCycle = ctx.parentDepPathsChain.includes(resolvedPackage.pkgIdWithPatchHash);
+    if (resolvedThroughCycle) {
+        // Leave both caches untouched so later occurrences re-resolve (or hit the
+        // authoritative entry of the same package) instead of reusing this partial one.
+    }
+    else if (isPure) {
         ctx.purePkgs.add(resolvedPackage.pkgIdWithPatchHash);
     }
     else {

package/lib/toResolveImporter.js

@@ -48,7 +48,7 @@ export async function toResolveImporter(opts, project) {
             ...project.wantedDependencies.map(defaultUpdateDepth < 0
                 ? updateLocalTarballs
                 : (dep) => ({ ...dep, updateDepth: defaultUpdateDepth })),
-            ...existingDeps.map(opts.noDependencySelectors && project.updateMatching != null
+            ...existingDeps.map(project.updateMatching != null
                 ? updateLocalTarballs
                 : (dep) => ({ ...dep, updateDepth: -1 })),
         ];

package/lib/updateProjectManifest.js

@@ -10,7 +10,7 @@ export async function updateProjectManifest(importer, opts) {
         return {
             alias: rdd.alias,
             peer: importer.peer,
-            bareSpecifier: rdd.catalogLookup?.userSpecifiedBareSpecifier ?? rdd.normalizedBareSpecifier ?? wantedDep.bareSpecifier,
+            bareSpecifier: getBareSpecifierToSave(wantedDep, rdd, opts.preserveWorkspaceProtocol),
             resolvedVersion: rdd.version,
             pinnedVersion: importer.pinnedVersion,
             saveType: importer.targetDependenciesField,
@@ -31,4 +31,19 @@ export async function updateProjectManifest(importer, opts) {
         : undefined;
     return [hookedManifest, originalManifest];
 }
+function getBareSpecifierToSave(wantedDep, resolvedDep, preserveWorkspaceProtocol) {
+    if (resolvedDep.catalogLookup != null) {
+        return resolvedDep.catalogLookup.userSpecifiedBareSpecifier;
+    }
+    if (preserveWorkspaceProtocol && isWorkspaceLocalPathSpecifier(wantedDep.bareSpecifier)) {
+        return wantedDep.bareSpecifier;
+    }
+    return resolvedDep.normalizedBareSpecifier ?? wantedDep.bareSpecifier;
+}
+function isWorkspaceLocalPathSpecifier(bareSpecifier) {
+    if (!bareSpecifier.startsWith('workspace:'))
+        return false;
+    const pref = bareSpecifier.slice('workspace:'.length);
+    return pref.startsWith('.') || pref.startsWith('/') || pref.startsWith('~/') || /^[A-Z]:/i.test(pref);
+}
 //# sourceMappingURL=updateProjectManifest.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.2.3",
+  "version": "1100.2.4",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -43,30 +43,30 @@
     "semver-range-intersect": "^0.3.1",
     "validate-npm-package-name": "7.0.2",
     "version-selector-type": "^3.0.0",
-    "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.1.5",
     "@pnpm/constants": "1100.0.0",
     "@pnpm/core-loggers": "1100.2.1",
     "@pnpm/deps.graph-hasher": "1100.2.5",
-    "@pnpm/deps.path": "1100.0.8",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/deps.peer-range": "1100.0.2",
     "@pnpm/fetching.pick-fetcher": "1100.0.12",
+    "@pnpm/deps.peer-range": "1100.0.2",
     "@pnpm/hooks.types": "1100.0.12",
+    "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/config.version-policy": "1100.1.5",
     "@pnpm/lockfile.preferred-versions": "1100.0.16",
-    "@pnpm/lockfile.pruner": "1100.0.11",
     "@pnpm/lockfile.types": "1100.0.11",
     "@pnpm/lockfile.utils": "1100.0.13",
     "@pnpm/patching.config": "1100.0.8",
-    "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/pkg-manifest.utils": "1100.2.5",
+    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/pkg-manifest.reader": "1100.0.8",
-    "@pnpm/resolving.npm-resolver": "1102.0.0",
+    "@pnpm/pkg-manifest.utils": "1100.2.5",
+    "@pnpm/resolving.npm-resolver": "1102.0.1",
+    "@pnpm/resolving.resolver-base": "1100.4.2",
     "@pnpm/store.controller-types": "1100.1.5",
     "@pnpm/types": "1101.3.2",
     "@pnpm/workspace.spec-parser": "1100.0.0",
-    "@pnpm/resolving.resolver-base": "1100.4.2"
+    "@pnpm/patching.types": "1100.0.0",
+    "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/lockfile.pruner": "1100.0.11"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
@@ -77,7 +77,7 @@
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/validate-npm-package-name": "^4.0.2",
-    "@pnpm/installing.deps-resolver": "1100.2.3",
+    "@pnpm/installing.deps-resolver": "1100.2.4",
     "@pnpm/logger": "1100.0.0"
   },
   "engines": {