@pnpm/installing.deps-resolver 1100.2.6 → 1100.2.8

package/lib/hoistPeers.d.ts

@@ -1,9 +1,14 @@
 import type { PreferredVersions } from '@pnpm/resolving.resolver-base';
-import type { PkgAddressOrLink } from './resolveDependencies.js';
+/** One workspace-root dependency that a missing peer can be satisfied with. */
+export interface HoistableRootDep {
+    alias: string;
+    pkgName: string;
+    normalizedBareSpecifier?: string;
+}
 export declare function hoistPeers(opts: {
     autoInstallPeers: boolean;
     allPreferredVersions?: PreferredVersions;
-    workspaceRootDeps: PkgAddressOrLink[];
+    workspaceRootDeps: HoistableRootDep[];
 }, missingRequiredPeers: Array<[string, {
     range: string;
 }]>): Record<string, string>;

package/lib/hoistPeers.js

@@ -9,7 +9,7 @@ export function hoistPeers(opts, missingRequiredPeers) {
             continue;
         }
         const rootDep = opts.workspaceRootDeps
-            .filter((rootDep) => rootDep.pkg.name === peerName)
+            .filter((rootDep) => rootDep.pkgName === peerName)
             .sort((rootDep1, rootDep2) => lexCompare(rootDep1.alias, rootDep2.alias))[0];
         if (rootDep?.normalizedBareSpecifier) {
             dependencies[peerName] = rootDep.normalizedBareSpecifier;
@@ -27,22 +27,28 @@ export function hoistPeers(opts, missingRequiredPeers) {
                     nonVersions.push(spec);
                 }
             }
-            // When the range is an exact version (e.g. pinned by an override like "4.3.0"),
-            // try to find a preferred version that satisfies it. This prevents a stale
-            // higher version from the lockfile being picked over the overridden version.
-            // For regular semver ranges (e.g. "^1.0.0"), use the highest preferred
-            // version for deduplication.
-            const isExactVersion = semver.valid(range) != null;
-            const satisfyingVersion = isExactVersion
+            // Dedupe onto a preferred version only when it actually satisfies the
+            // wanted peer range. Picking the highest preferred version regardless of
+            // the range lets a version resolved for one importer be auto-installed as
+            // another importer's peer even though nothing in that importer's closure
+            // accepts it, silently producing a peer graph that mixes incompatible
+            // majors. Ranges that are not semver (workspace:, npm: aliases, dist-tags)
+            // cannot be checked, so they keep the dedupe-to-highest behavior.
+            const isSemverRange = semver.validRange(range, { includePrerelease: true }) != null;
+            const satisfyingVersion = isSemverRange
                 ? semver.maxSatisfying(versions, range, { includePrerelease: true })
                 : null;
             if (satisfyingVersion) {
                 dependencies[peerName] = [satisfyingVersion, ...nonVersions].join(' || ');
             }
-            else if (isExactVersion && opts.autoInstallPeers) {
-                // No preferred version satisfies the exact override version.
-                // Use the range directly so pnpm resolves it from the registry.
-                dependencies[peerName] = range;
+            else if (isSemverRange && versions.length > 0) {
+                // Preferred versions exist but none satisfies the wanted range.
+                // Use the range directly so pnpm resolves it from the registry rather
+                // than installing a version the peer explicitly rejects. Without
+                // autoInstallPeers, hoist nothing and leave the peer missing.
+                if (opts.autoInstallPeers) {
+                    dependencies[peerName] = range;
+                }
             }
             else {
                 dependencies[peerName] = [semver.maxSatisfying(versions, '*', { includePrerelease: true }), ...nonVersions]

package/lib/index.js

@@ -3,6 +3,7 @@ import { packageManifestLogger, } from '@pnpm/core-loggers';
 import { findRuntimeNodeVersion, iterateHashedGraphNodes } from '@pnpm/deps.graph-hasher';
 import { isRuntimeDepPath } from '@pnpm/deps.path';
 import { PnpmError } from '@pnpm/error';
+import { safeJoinModulesDir } from '@pnpm/fs.symlink-dependency';
 import { verifyPatches } from '@pnpm/patching.config';
 import { safeReadPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
 import { getAllDependenciesFromManifest, getSpecFromPackageManifest, } from '@pnpm/pkg-manifest.utils';
@@ -90,6 +91,7 @@ export async function resolveDependencies(importers, opts) {
                 ...project.wantedDependencies.flatMap(({ alias, isNew }) => isNew && alias != null ? [alias] : []),
             ]),
             directNodeIdsByAlias: resolvedImporter.directNodeIdsByAlias,
+            hoistedPeerProviderNodeIds: resolvedImporter.hoistedPeerProviderNodeIds,
             explicitlyRequestedDirectDependencies: new Set(project.wantedDependencies.flatMap(({ alias, bareSpecifier, isNew, prevSpecifier, updateSpec }) => alias != null && (isNew === true || updateSpec === true || (prevSpecifier != null && bareSpecifier !== prevSpecifier))
                 ? [alias]
                 : [])),
@@ -403,7 +405,7 @@ function extendGraph(graph, opts) {
         const node = graph[depPath];
         Object.assign(node, {
             modules,
-            dir: path.join(modules, node.name),
+            dir: safeJoinModulesDir(modules, node.name),
         });
     }
     return graph;

package/lib/resolveDependencies.d.ts

@@ -191,6 +191,13 @@ export interface PkgAddress extends PkgAddressOrLinkBase {
     saveCatalogName?: string;
     lockedPeerContext?: LockedPeerContext;
     previousDepPath?: DepPath;
+    /**
+     * A peer dependency provider attached to the root importer so that other
+     * subtrees can reuse it. Its `nodeId` keeps pointing at the provider's
+     * original position inside the dependency tree, so the node must be
+     * peer-resolved there — not in the root context.
+     */
+    hoistedPeerProvider?: boolean;
 }
 export type PkgAddressOrLink = PkgAddress | LinkedDependency;
 export interface PeerDependency {

package/lib/resolveDependencies.js

@@ -24,6 +24,7 @@ import { safeIntersect } from './mergePeers.js';
 import { nextNodeId } from './nextNodeId.js';
 import { parentIdsContainSequence } from './parentIdsContainSequence.js';
 import { replaceVersionInBareSpecifier } from './replaceVersionInBareSpecifier.js';
+import { unwrapPackageName } from './unwrapPackageName.js';
 import { wantedDepIsLocallyAvailable } from './wantedDepIsLocallyAvailable.js';
 const dependencyResolvedLogger = logger('_dependency_resolved');
 const omitDepsFields = omit(['dependencies', 'optionalDependencies', 'peerDependencies', 'peerDependenciesMeta']);
@@ -53,7 +54,7 @@ export async function resolveRootDependencies(ctx, importers) {
     let workspaceRootDeps;
     if (ctx.resolvePeersFromWorkspaceRoot) {
         const rootImporterIndex = importers.findIndex(({ options }) => options.parentIds[0] === '.');
-        workspaceRootDeps = pkgAddressesByImportersWithoutPeers[rootImporterIndex]?.pkgAddresses ?? [];
+        workspaceRootDeps = getHoistableRootDeps(importers[rootImporterIndex], pkgAddressesByImportersWithoutPeers[rootImporterIndex]?.pkgAddresses ?? []);
     }
     else {
         workspaceRootDeps = [];
@@ -89,7 +90,10 @@ export async function resolveRootDependencies(ctx, importers) {
                     // even those peers should be hoisted that are not autoinstalled
                     for (const [resolvedPeerName, resolvedPeerAddress] of Object.entries(importerResolutionResult.resolvedPeers ?? {})) {
                         if (!parentPkgAliases[resolvedPeerName]) {
-                            importerResolutionResult.pkgAddresses.push(resolvedPeerAddress);
+                            importerResolutionResult.pkgAddresses.push({
+                                ...resolvedPeerAddress,
+                                hoistedPeerProvider: true,
+                            });
                         }
                     }
                 }
@@ -146,6 +150,38 @@ export async function resolveRootDependencies(ctx, importers) {
         time,
     };
 }
+/**
+ * Lists the workspace-root dependencies that `hoistPeers` may satisfy a
+ * missing peer with. A root dependency reused from the lockfile skips full
+ * resolution, so it has no address (or an address without a
+ * normalizedBareSpecifier); its wanted specifier is used instead, so that
+ * re-resolving with a lockfile hoists the same version as a fresh install of
+ * the same manifest.
+ */
+function getHoistableRootDeps(rootImporter, rootPkgAddresses) {
+    const wantedSpecifierByAlias = new Map();
+    for (const wantedDep of rootImporter?.wantedDependencies ?? []) {
+        if (wantedDep.alias && wantedDep.bareSpecifier) {
+            wantedSpecifierByAlias.set(wantedDep.alias, wantedDep.bareSpecifier);
+        }
+    }
+    const rootDeps = rootPkgAddresses.map((pkgAddress) => ({
+        alias: pkgAddress.alias,
+        pkgName: pkgAddress.pkg.name,
+        normalizedBareSpecifier: pkgAddress.normalizedBareSpecifier ?? wantedSpecifierByAlias.get(pkgAddress.alias),
+    }));
+    const coveredAliases = new Set(rootDeps.map(({ alias }) => alias));
+    for (const [alias, bareSpecifier] of wantedSpecifierByAlias) {
+        if (coveredAliases.has(alias))
+            continue;
+        rootDeps.push({
+            alias,
+            pkgName: unwrapPackageName(alias, bareSpecifier).pkgName,
+            normalizedBareSpecifier: bareSpecifier,
+        });
+    }
+    return rootDeps;
+}
 async function resolveDependenciesOfImporters(ctx, importers) {
     const pickLowestVersion = ctx.resolutionMode === 'time-based' || ctx.resolutionMode === 'lowest-direct';
     const resolveResults = await Promise.all(importers.map(async (importer) => {
@@ -1146,14 +1182,21 @@ async function resolveDependency(wantedDependency, ctx, options) {
                 version: wantedDependency.alias ? wantedDependency.bareSpecifier : undefined,
             };
             if (wantedDependency.optional && err.code !== 'ERR_PNPM_TRUST_DOWNGRADE') {
-                skippedOptionalDependencyLogger.debug({
-                    details: err.toString(),
-                    package: wantedDependencyDetails,
-                    parents: getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById),
-                    prefix: options.prefix,
-                    reason: 'resolution_failure',
-                });
-                return null;
+                if (!wantedLockfileContainsSatisfyingEntry(ctx.wantedLockfile, wantedDependency)) {
+                    skippedOptionalDependencyLogger.debug({
+                        details: err.toString(),
+                        package: wantedDependencyDetails,
+                        parents: getPkgsInfoFromIds(options.parentIds, ctx.resolvedPkgsById),
+                        prefix: options.prefix,
+                        reason: 'resolution_failure',
+                    });
+                    return null;
+                }
+                if (err.hint == null) {
+                    err.hint = 'This optional dependency is not skipped, because the lockfile contains a resolution for it. ' +
+                        'Skipping it would remove the locked entries, making the lockfile differ depending on which machine ran the install. ' +
+                        'If the version was intentionally removed from the registry, update the dependent package or remove the entries from the lockfile.';
+                }
             }
             err.package = wantedDependencyDetails;
             err.prefix = options.prefix;
@@ -1417,6 +1460,39 @@ async function resolveDependency(wantedDependency, ctx, options) {
         finishPackageResolution();
     }
 }
+/**
+ * Whether the wanted lockfile already holds a package entry that satisfies the
+ * wanted dependency. An optional dependency that fails to resolve is normally
+ * skipped, but when a locked resolution exists the failure is environmental
+ * (e.g. a registry mirror that hasn't synced the release yet) rather than a
+ * genuinely uninstallable package. Silently skipping in that case would erase
+ * the locked entries, making the lockfile differ across machines from
+ * identical inputs and leaving frozen installs on other hosts with nothing to
+ * link (https://github.com/pnpm/pnpm/issues/12853).
+ *
+ * Only plain semver specifiers are checked; exotic specifiers (git, catalogs,
+ * tags, URLs) keep the skip-on-failure behavior.
+ *
+ * The check is deliberately by package name and range rather than by the
+ * current edge's locked dep path. `pnpm dedupe` — the flow where the erasure
+ * bites — clears every per-snapshot dependency map before resolving
+ * (`forgetResolutionsOfAllPrevWantedDeps`), so on this code path no edge-level
+ * lockfile linkage exists to key on; only the package entries survive. A
+ * satisfying entry locked via any edge also means the registry served this
+ * package in-range before, so failing loudly instead of skipping is the right
+ * outcome even when the failing edge itself was never locked.
+ */
+function wantedLockfileContainsSatisfyingEntry(lockfile, wantedDependency) {
+    if (!wantedDependency.alias)
+        return false;
+    const { pkgName, bareSpecifier } = unwrapPackageName(wantedDependency.alias, wantedDependency.bareSpecifier);
+    if (semver.validRange(bareSpecifier) == null)
+        return false;
+    return Object.keys(lockfile.packages ?? {}).some((depPath) => {
+        const parsed = dp.parse(depPath);
+        return parsed.name === pkgName && parsed.version != null && semver.satisfies(parsed.version, bareSpecifier);
+    });
+}
 export function getManifestFromResponse(pkgResponse, wantedDependency, currentPkg) {
     if (pkgResponse.body.manifest)
         return pkgResponse.body.manifest;

package/lib/resolveDependencyTree.d.ts

@@ -12,6 +12,7 @@ export interface ResolvedImporters {
     [id: string]: {
         directDependencies: ResolvedDirectDependency[];
         directNodeIdsByAlias: Map<string, NodeId>;
+        hoistedPeerProviderNodeIds: Set<NodeId>;
         linkedDependencies: LinkedDependency[];
     };
 }

package/lib/resolveDependencyTree.js

@@ -168,6 +168,7 @@ export async function resolveDependencyTree(importers, opts) {
                 };
             }),
             directNodeIdsByAlias: new Map(directNonLinkedDeps.map(({ alias, nodeId }) => [alias, nodeId])),
+            hoistedPeerProviderNodeIds: new Set(directNonLinkedDeps.filter((dep) => dep.hoistedPeerProvider).map(({ nodeId }) => nodeId)),
             linkedDependencies,
         };
     }

package/lib/resolvePeers.d.ts

@@ -30,6 +30,7 @@ export interface GenericDependenciesGraphWithResolvedChildren<T extends PartialR
 }
 export interface ProjectToResolve {
     directNodeIdsByAlias: Map<string, NodeId>;
+    hoistedPeerProviderNodeIds?: Set<NodeId>;
     declaredDirectDependencies?: Set<string>;
     explicitlyRequestedDirectDependencies?: Set<string>;
     topParents: Array<{

package/lib/resolvePeers.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { createPeerDepGraphHash, depPathToFilename, parseDepPath } from '@pnpm/deps.path';
+import { safeJoinModulesDir } from '@pnpm/fs.symlink-dependency';
 import * as semverUtils from '@yarnpkg/core/semverUtils';
 import { analyzeGraph } from 'graph-cycles';
 import pDefer, {} from 'p-defer';
@@ -12,6 +13,9 @@ export async function resolvePeers(opts) {
     const depGraph = {};
     const pathsByNodeId = new Map();
     const pathsByNodeIdPromises = new Map();
+    const awaitedPeerNodeIdsByNodeId = new Map();
+    const peersCacheOwnerByNodeId = new Map();
+    const cycleBrokenNodeIds = new Set();
     const depPathsByPkgId = new Map();
     const nodeIdsByPreviousDepPath = opts.resolvedPeerProviderPaths == null
         ? new Map()
@@ -25,7 +29,7 @@ export async function resolvePeers(opts) {
     const finishingList = [];
     const peersCache = new Map();
     const purePkgs = new Set();
-    for (const { directNodeIdsByAlias, declaredDirectDependencies, explicitlyRequestedDirectDependencies, topParents, rootDir, id } of opts.projects) {
+    for (const { directNodeIdsByAlias, hoistedPeerProviderNodeIds, declaredDirectDependencies, explicitlyRequestedDirectDependencies, topParents, rootDir, id } of opts.projects) {
         const currentProviderSources = [{
                 directNodeIdsByAlias,
                 declaredDirectDependencies: declaredDirectDependencies ?? new Set(),
@@ -48,10 +52,26 @@ export async function resolvePeers(opts) {
                 pathsByNodeIdPromises.set(nodeId, pDefer());
             }
         }
-        // eslint-disable-next-line no-await-in-loop
-        const { finishing } = await resolvePeersOfChildren(Object.fromEntries(directNodeIdsByAlias.entries()), pkgsByName, {
+        // Hoisted peer providers stay visible as providers (via pkgsByName) but are
+        // not traversed as direct children: their nodeIds point into subtrees, and
+        // resolving them a second time in the project's root context would bind
+        // their peers to the project's own dependencies instead of the providers
+        // next to them in the tree, racing with the in-place resolution on
+        // pathsByNodeId and producing peer graphs that mix both contexts.
+        const ownDirectChildren = {};
+        const hoistedProviderChildren = {};
+        for (const [alias, nodeId] of directNodeIdsByAlias.entries()) {
+            if (hoistedPeerProviderNodeIds?.has(nodeId)) {
+                hoistedProviderChildren[alias] = nodeId;
+            }
+            else {
+                ownDirectChildren[alias] = nodeId;
+            }
+        }
+        const parentPkgsOfNode = new Map();
+        const projectPeersContext = {
             allPeerDepNames: opts.allPeerDepNames,
-            parentPkgsOfNode: new Map(),
+            parentPkgsOfNode,
             dependenciesTree: opts.dependenciesTree,
             depGraph,
             lockfileDir: opts.lockfileDir,
@@ -59,6 +79,9 @@ export async function resolvePeers(opts) {
             parentDepPathsChain: [],
             pathsByNodeId,
             pathsByNodeIdPromises,
+            awaitedPeerNodeIdsByNodeId,
+            peersCacheOwnerByNodeId,
+            cycleBrokenNodeIds,
             depPathsByPkgId,
             nodeIdsByPreviousDepPath,
             resolvedPeerProviderPaths: opts.resolvedPeerProviderPaths,
@@ -71,10 +94,36 @@ export async function resolvePeers(opts) {
             rootDir,
             virtualStoreDir: opts.virtualStoreDir,
             virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
-        });
+        };
+        // eslint-disable-next-line no-await-in-loop
+        const { finishing } = await resolvePeersOfChildren(ownDirectChildren, pkgsByName, projectPeersContext);
         if (finishing) {
             finishingList.push(finishing);
         }
+        // A provider whose tree position was pruned from the traversal (its parent
+        // hit peersCache, so its children were never visited) still has consumers
+        // awaiting its dep path, so resolve it here as a last resort. Providers
+        // visited by the traversal above are recorded in parentPkgsOfNode.
+        // All pruned providers go into a single resolvePeersOfChildren call:
+        // its cycle analysis only sees the children of one call, and providers
+        // frequently peer-depend on each other, so resolving them one by one
+        // would leave their dep path calculations awaiting each other forever.
+        // A peer cycle that spans this call and the traversal above is still
+        // invisible here; breakDepPathAwaitCycles resolves those before the
+        // finishing promises are awaited.
+        const prunedProviderChildren = {};
+        for (const [alias, nodeId] of Object.entries(hoistedProviderChildren)) {
+            if (parentPkgsOfNode.has(nodeId))
+                continue;
+            prunedProviderChildren[alias] = nodeId;
+        }
+        if (Object.keys(prunedProviderChildren).length > 0) {
+            // eslint-disable-next-line no-await-in-loop
+            const { finishing } = await resolvePeersOfChildren(prunedProviderChildren, pkgsByName, projectPeersContext);
+            if (finishing) {
+                finishingList.push(finishing);
+            }
+        }
         if (Object.keys(peerDependencyIssues.bad).length > 0 || Object.keys(peerDependencyIssues.missing).length > 0) {
             peerDependencyIssuesByProjects[id] = {
                 ...peerDependencyIssues,
@@ -82,6 +131,14 @@ export async function resolvePeers(opts) {
             };
         }
     }
+    breakDepPathAwaitCycles({
+        awaitedPeerNodeIdsByNodeId,
+        peersCacheOwnerByNodeId,
+        cycleBrokenNodeIds,
+        pathsByNodeId,
+        pathsByNodeIdPromises,
+        dependenciesTree: opts.dependenciesTree,
+    });
     await Promise.all(finishingList);
     const depGraphWithResolvedChildren = resolveChildren(depGraph);
     function resolveChildren(depGraph) {
@@ -128,6 +185,62 @@ export async function resolvePeers(opts) {
         pathsByNodeId,
     };
 }
+// Cycle analysis inside resolvePeersOfChildren only sees the children of a
+// single call, but a dep path calculation may await a node resolved in a
+// different call or at a different tree level (a hoisted peer provider and
+// a consumer that peer-depend on each other, https://github.com/pnpm/pnpm/issues/12921).
+// Such an await cycle never settles on its own, so before the finishing
+// promises are awaited, walk the recorded await edges and resolve every
+// dep path promise on a cycle to the peer's `name@version` — the same
+// collapse in-call cycle detection applies (see calculateDepPath).
+// A node that hit the peers cache awaits its dep path from the node that
+// created the cache entry, so it borrows that owner's await edges.
+function breakDepPathAwaitCycles(opts) {
+    const isSettled = (nodeId) => opts.pathsByNodeId.has(nodeId) || opts.cycleBrokenNodeIds.has(nodeId);
+    const keysByNodeId = new Map();
+    const nodeIdsByKey = new Map();
+    function keyOf(nodeId) {
+        let key = keysByNodeId.get(nodeId);
+        if (key == null) {
+            key = String(keysByNodeId.size);
+            keysByNodeId.set(nodeId, key);
+            nodeIdsByKey.set(key, nodeId);
+        }
+        return key;
+    }
+    const graphEntries = [];
+    const awaitingNodeIds = new Set([
+        ...opts.awaitedPeerNodeIdsByNodeId.keys(),
+        ...opts.peersCacheOwnerByNodeId.keys(),
+    ]);
+    for (const nodeId of awaitingNodeIds) {
+        if (isSettled(nodeId))
+            continue;
+        const cacheOwnerNodeId = opts.peersCacheOwnerByNodeId.get(nodeId);
+        const awaitedNodeIds = opts.awaitedPeerNodeIdsByNodeId.get(nodeId) ??
+            (cacheOwnerNodeId == null ? undefined : opts.awaitedPeerNodeIdsByNodeId.get(cacheOwnerNodeId));
+        if (awaitedNodeIds == null)
+            continue;
+        const liveTargets = [];
+        for (const awaitedNodeId of awaitedNodeIds) {
+            if (!isSettled(awaitedNodeId)) {
+                liveTargets.push(keyOf(awaitedNodeId));
+            }
+        }
+        if (liveTargets.length > 0) {
+            graphEntries.push([keyOf(nodeId), liveTargets]);
+        }
+    }
+    if (graphEntries.length === 0)
+        return;
+    const { cycles } = analyzeGraph(graphEntries);
+    for (const key of new Set(cycles.flat())) {
+        const nodeId = nodeIdsByKey.get(key);
+        const { name, version } = opts.dependenciesTree.get(nodeId).resolvedPackage;
+        opts.cycleBrokenNodeIds.add(nodeId);
+        opts.pathsByNodeIdPromises.get(nodeId)?.resolve(`${name}@${version}`);
+    }
+}
 function nodeDepsCount(node) {
     return Object.keys(node.children).length + node.resolvedPeerNames.size;
 }
@@ -349,6 +462,7 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
                 wantedRange,
             });
         }
+        ctx.peersCacheOwnerByNodeId.set(nodeId, hit.ownerNodeId);
         return {
             missingPeers: hit.missingPeers,
             finishing: (async () => {
@@ -411,6 +525,7 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
             missingPeers: allMissingPeers,
             depPath: pDefer(),
             resolvedPeers: allResolvedPeers,
+            ownerNodeId: nodeId,
         };
         if (ctx.peersCache.has(resolvedPackage.pkgIdWithPatchHash)) {
             ctx.peersCache.get(resolvedPackage.pkgIdWithPatchHash).push(cache);
@@ -472,6 +587,7 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
                 if (cyclicPeerAliases.has(pendingPeer.alias)) {
                     const { name, version } = ctx.dependenciesTree.get(pendingPeer.nodeId)?.resolvedPackage;
                     const id = `${name}@${version}`;
+                    ctx.cycleBrokenNodeIds.add(pendingPeer.nodeId);
                     ctx.pathsByNodeIdPromises.get(pendingPeer.nodeId)?.resolve(id);
                     return id;
                 }
@@ -481,6 +597,12 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
                         return { name: peerNode.resolvedPackage.name, version: peerNode.resolvedPackage.version };
                     }
                 }
+                let awaitedPeerNodeIds = ctx.awaitedPeerNodeIdsByNodeId.get(nodeId);
+                if (awaitedPeerNodeIds == null) {
+                    awaitedPeerNodeIds = new Set();
+                    ctx.awaitedPeerNodeIdsByNodeId.set(nodeId, awaitedPeerNodeIds);
+                }
+                awaitedPeerNodeIds.add(pendingPeer.nodeId);
                 return ctx.pathsByNodeIdPromises.get(pendingPeer.nodeId).promise;
             })),
         ], ctx.peersSuffixMaxLength);
@@ -501,7 +623,7 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
         const peerDependencies = { ...resolvedPackage.peerDependencies };
         if (!ctx.depGraph[depPath] || ctx.depGraph[depPath].depth > node.depth) {
             const modules = path.join(ctx.virtualStoreDir, depPathToFilename(depPath, ctx.virtualStoreDirMaxLength), 'node_modules');
-            const dir = path.join(modules, resolvedPackage.name);
+            const dir = safeJoinModulesDir(modules, resolvedPackage.name);
             const transitivePeerDependencies = new Set();
             for (const unknownPeer of allResolvedPeers.keys()) {
                 if (!peerDependencies[unknownPeer]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.2.6",
+  "version": "1100.2.8",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -27,7 +27,32 @@
     "!*.map"
   ],
   "dependencies": {
+    "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/config.version-policy": "1100.1.6",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/core-loggers": "1100.2.1",
+    "@pnpm/deps.graph-hasher": "1100.2.9",
+    "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/deps.peer-range": "1100.0.2",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/fetching.pick-fetcher": "1100.1.0",
+    "@pnpm/fs.symlink-dependency": "1100.0.10",
+    "@pnpm/hooks.types": "1100.2.0",
+    "@pnpm/lockfile.preferred-versions": "1100.0.19",
+    "@pnpm/lockfile.pruner": "1100.0.13",
+    "@pnpm/lockfile.types": "1100.0.13",
+    "@pnpm/lockfile.utils": "1100.1.2",
+    "@pnpm/patching.config": "1100.0.9",
+    "@pnpm/patching.types": "1100.0.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.9",
+    "@pnpm/pkg-manifest.utils": "1100.2.6",
+    "@pnpm/resolving.npm-resolver": "1102.1.2",
+    "@pnpm/resolving.resolver-base": "1100.5.1",
+    "@pnpm/store.controller-types": "1100.1.7",
+    "@pnpm/types": "1101.3.2",
     "@pnpm/util.lex-comparator": "^4.0.1",
+    "@pnpm/workspace.spec-parser": "1100.0.0",
     "@yarnpkg/core": "4.8.0",
     "graph-cycles": "3.0.0",
     "is-inner-link": "^5.0.0",
@@ -42,43 +67,19 @@
     "semver": "^7.8.4",
     "semver-range-intersect": "^0.3.1",
     "validate-npm-package-name": "7.0.2",
-    "version-selector-type": "^3.0.0",
-    "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.1.6",
-    "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.2.1",
-    "@pnpm/deps.graph-hasher": "1100.2.7",
-    "@pnpm/deps.peer-range": "1100.0.2",
-    "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/hooks.types": "1100.1.1",
-    "@pnpm/fetching.pick-fetcher": "1100.0.14",
-    "@pnpm/lockfile.preferred-versions": "1100.0.18",
-    "@pnpm/lockfile.pruner": "1100.0.13",
-    "@pnpm/lockfile.types": "1100.0.13",
-    "@pnpm/lockfile.utils": "1100.1.1",
-    "@pnpm/patching.config": "1100.0.9",
-    "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/resolving.npm-resolver": "1102.1.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/resolving.resolver-base": "1100.5.1",
-    "@pnpm/pkg-manifest.utils": "1100.2.6",
-    "@pnpm/types": "1101.3.2",
-    "@pnpm/store.controller-types": "1100.1.7",
-    "@pnpm/workspace.spec-parser": "1100.0.0"
+    "version-selector-type": "^3.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
+    "@pnpm/installing.deps-resolver": "1100.2.8",
+    "@pnpm/logger": "1100.0.0",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
-    "@types/validate-npm-package-name": "^4.0.2",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/installing.deps-resolver": "1100.2.6"
+    "@types/validate-npm-package-name": "^4.0.2"
   },
   "engines": {
     "node": ">=22.13"