@pnpm/installing.deps-resolver 1100.2.7 → 1100.2.9

package/lib/dedupeInjectedDeps.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import normalize from 'normalize-path';
+import { isCompatibleAndHasMoreDeps } from './depPathCompatibility.js';
 export function dedupeInjectedDeps(opts) {
     const injectedDepsByProjects = getInjectedDepsByProjects(opts);
     const dedupeMap = getDedupeMap(injectedDepsByProjects, opts);
@@ -46,7 +47,25 @@ function getDedupeMap(injectedDepsByProjects, opts) {
             // The injected project in the workspace may have dev deps
             const children = Object.entries(node.children);
             const isSubset = children
-                .every(([alias, depPath]) => targetProjectDeps.get(alias) === depPath);
+                .every(([alias, depPath]) => {
+                const targetDepPath = targetProjectDeps.get(alias);
+                if (targetDepPath === depPath)
+                    return true;
+                if (targetDepPath == null)
+                    return false;
+                // A shared dep can resolve peer-suffixed on one side and peer-free on
+                // the other (e.g. an existing lockfile pinned debug's optional
+                // supports-color for the target project but not the injected
+                // occurrence). Accept the target's variant when it's the same package
+                // identity and a compatible superset. See pnpm/pnpm#10433.
+                const targetNode = opts.depGraph[targetDepPath];
+                const injectedChildNode = opts.depGraph[depPath];
+                if (targetNode == null || injectedChildNode == null)
+                    return false;
+                if (targetNode.pkgIdWithPatchHash !== injectedChildNode.pkgIdWithPatchHash)
+                    return false;
+                return isCompatibleAndHasMoreDeps(opts.depGraph, targetDepPath, depPath);
+            });
             if (isSubset) {
                 dedupedInjectedDeps.set(alias, dep.id);
             }

package/lib/depPathCompatibility.d.ts

@@ -0,0 +1,4 @@
+import type { DepPath } from '@pnpm/types';
+import type { GenericDependenciesGraphNodeWithResolvedChildren, GenericDependenciesGraphWithResolvedChildren, PartialResolvedPackage } from './resolvePeers.js';
+export declare function nodeDepsCount(node: GenericDependenciesGraphNodeWithResolvedChildren): number;
+export declare function isCompatibleAndHasMoreDeps<T extends PartialResolvedPackage>(depGraph: GenericDependenciesGraphWithResolvedChildren<T>, depPath1: DepPath, depPath2: DepPath): boolean;

package/lib/depPathCompatibility.js

@@ -0,0 +1,28 @@
+// Shared helpers used by both resolvePeers (dedupePeerDependents) and
+// dedupeInjectedDeps. Lives in its own module so neither consumer has to import
+// the other, which would create a runtime cycle. The type imports above are
+// erased at build time, so no cycle exists at runtime.
+export function nodeDepsCount(node) {
+    return Object.keys(node.children).length + node.resolvedPeerNames.size;
+}
+// Whether `depPath1` is a superset-or-equal of `depPath2`: same-or-more resolved
+// children and peers. Compares dependency/peer *sets* only, not package
+// identity, so callers must pass depPaths already known to share a
+// `pkgIdWithPatchHash` — otherwise two unrelated leaf packages (both with empty
+// sets) would count as compatible.
+export function isCompatibleAndHasMoreDeps(depGraph, depPath1, depPath2) {
+    const node1 = depGraph[depPath1];
+    const node2 = depGraph[depPath2];
+    if (nodeDepsCount(node1) < nodeDepsCount(node2))
+        return false;
+    const node1DepPathsSet = new Set(Object.values(node1.children));
+    const node2DepPaths = Object.values(node2.children);
+    if (!node2DepPaths.every((depPath) => node1DepPathsSet.has(depPath)))
+        return false;
+    for (const depPath of node2.resolvedPeerNames) {
+        if (!node1.resolvedPeerNames.has(depPath))
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=depPathCompatibility.js.map

package/lib/hoistPeers.d.ts

@@ -1,9 +1,14 @@
 import type { PreferredVersions } from '@pnpm/resolving.resolver-base';
-import type { PkgAddressOrLink } from './resolveDependencies.js';
+/** One workspace-root dependency that a missing peer can be satisfied with. */
+export interface HoistableRootDep {
+    alias: string;
+    pkgName: string;
+    normalizedBareSpecifier?: string;
+}
 export declare function hoistPeers(opts: {
     autoInstallPeers: boolean;
     allPreferredVersions?: PreferredVersions;
-    workspaceRootDeps: PkgAddressOrLink[];
+    workspaceRootDeps: HoistableRootDep[];
 }, missingRequiredPeers: Array<[string, {
     range: string;
 }]>): Record<string, string>;

package/lib/hoistPeers.js

@@ -9,7 +9,7 @@ export function hoistPeers(opts, missingRequiredPeers) {
             continue;
         }
         const rootDep = opts.workspaceRootDeps
-            .filter((rootDep) => rootDep.pkg.name === peerName)
+            .filter((rootDep) => rootDep.pkgName === peerName)
             .sort((rootDep1, rootDep2) => lexCompare(rootDep1.alias, rootDep2.alias))[0];
         if (rootDep?.normalizedBareSpecifier) {
             dependencies[peerName] = rootDep.normalizedBareSpecifier;
@@ -27,22 +27,28 @@ export function hoistPeers(opts, missingRequiredPeers) {
                     nonVersions.push(spec);
                 }
             }
-            // When the range is an exact version (e.g. pinned by an override like "4.3.0"),
-            // try to find a preferred version that satisfies it. This prevents a stale
-            // higher version from the lockfile being picked over the overridden version.
-            // For regular semver ranges (e.g. "^1.0.0"), use the highest preferred
-            // version for deduplication.
-            const isExactVersion = semver.valid(range) != null;
-            const satisfyingVersion = isExactVersion
+            // Dedupe onto a preferred version only when it actually satisfies the
+            // wanted peer range. Picking the highest preferred version regardless of
+            // the range lets a version resolved for one importer be auto-installed as
+            // another importer's peer even though nothing in that importer's closure
+            // accepts it, silently producing a peer graph that mixes incompatible
+            // majors. Ranges that are not semver (workspace:, npm: aliases, dist-tags)
+            // cannot be checked, so they keep the dedupe-to-highest behavior.
+            const isSemverRange = semver.validRange(range, { includePrerelease: true }) != null;
+            const satisfyingVersion = isSemverRange
                 ? semver.maxSatisfying(versions, range, { includePrerelease: true })
                 : null;
             if (satisfyingVersion) {
                 dependencies[peerName] = [satisfyingVersion, ...nonVersions].join(' || ');
             }
-            else if (isExactVersion && opts.autoInstallPeers) {
-                // No preferred version satisfies the exact override version.
-                // Use the range directly so pnpm resolves it from the registry.
-                dependencies[peerName] = range;
+            else if (isSemverRange && versions.length > 0) {
+                // Preferred versions exist but none satisfies the wanted range.
+                // Use the range directly so pnpm resolves it from the registry rather
+                // than installing a version the peer explicitly rejects. Without
+                // autoInstallPeers, hoist nothing and leave the peer missing.
+                if (opts.autoInstallPeers) {
+                    dependencies[peerName] = range;
+                }
             }
             else {
                 dependencies[peerName] = [semver.maxSatisfying(versions, '*', { includePrerelease: true }), ...nonVersions]

package/lib/resolveDependencies.js

@@ -54,7 +54,7 @@ export async function resolveRootDependencies(ctx, importers) {
     let workspaceRootDeps;
     if (ctx.resolvePeersFromWorkspaceRoot) {
         const rootImporterIndex = importers.findIndex(({ options }) => options.parentIds[0] === '.');
-        workspaceRootDeps = pkgAddressesByImportersWithoutPeers[rootImporterIndex]?.pkgAddresses ?? [];
+        workspaceRootDeps = getHoistableRootDeps(importers[rootImporterIndex], pkgAddressesByImportersWithoutPeers[rootImporterIndex]?.pkgAddresses ?? []);
     }
     else {
         workspaceRootDeps = [];
@@ -150,6 +150,38 @@ export async function resolveRootDependencies(ctx, importers) {
         time,
     };
 }
+/**
+ * Lists the workspace-root dependencies that `hoistPeers` may satisfy a
+ * missing peer with. A root dependency reused from the lockfile skips full
+ * resolution, so it has no address (or an address without a
+ * normalizedBareSpecifier); its wanted specifier is used instead, so that
+ * re-resolving with a lockfile hoists the same version as a fresh install of
+ * the same manifest.
+ */
+function getHoistableRootDeps(rootImporter, rootPkgAddresses) {
+    const wantedSpecifierByAlias = new Map();
+    for (const wantedDep of rootImporter?.wantedDependencies ?? []) {
+        if (wantedDep.alias && wantedDep.bareSpecifier) {
+            wantedSpecifierByAlias.set(wantedDep.alias, wantedDep.bareSpecifier);
+        }
+    }
+    const rootDeps = rootPkgAddresses.map((pkgAddress) => ({
+        alias: pkgAddress.alias,
+        pkgName: pkgAddress.pkg.name,
+        normalizedBareSpecifier: pkgAddress.normalizedBareSpecifier ?? wantedSpecifierByAlias.get(pkgAddress.alias),
+    }));
+    const coveredAliases = new Set(rootDeps.map(({ alias }) => alias));
+    for (const [alias, bareSpecifier] of wantedSpecifierByAlias) {
+        if (coveredAliases.has(alias))
+            continue;
+        rootDeps.push({
+            alias,
+            pkgName: unwrapPackageName(alias, bareSpecifier).pkgName,
+            normalizedBareSpecifier: bareSpecifier,
+        });
+    }
+    return rootDeps;
+}
 async function resolveDependenciesOfImporters(ctx, importers) {
     const pickLowestVersion = ctx.resolutionMode === 'time-based' || ctx.resolutionMode === 'lowest-direct';
     const resolveResults = await Promise.all(importers.map(async (importer) => {
@@ -1074,7 +1106,9 @@ async function resolveDependency(wantedDependency, ctx, options) {
         currentPkg.dependencyLockfile &&
         currentPkg.name &&
         await pathExists(path.join(ctx.virtualStoreDir, dp.depPathToFilename(currentPkg.depPath, ctx.virtualStoreDirMaxLength), 'node_modules', currentPkg.name, 'package.json')));
-    if (!options.update && !options.proceed && (currentPkg.resolution != null) && depIsLinked) {
+    if (!options.update && !options.proceed &&
+        options.currentDepth === Math.max(0, options.updateDepth) &&
+        (currentPkg.resolution != null) && depIsLinked) {
         return null;
     }
     let pkgResponse;

package/lib/resolvePeers.js

@@ -7,12 +7,16 @@ import pDefer, {} from 'p-defer';
 import { partition, pick } from 'ramda';
 import semver from 'semver';
 import { dedupeInjectedDeps } from './dedupeInjectedDeps.js';
+import { isCompatibleAndHasMoreDeps, nodeDepsCount } from './depPathCompatibility.js';
 import { linkPathToPeerVersion } from './linkPathToPeerVersion.js';
 import { mergePeers } from './mergePeers.js';
 export async function resolvePeers(opts) {
     const depGraph = {};
     const pathsByNodeId = new Map();
     const pathsByNodeIdPromises = new Map();
+    const awaitedPeerNodeIdsByNodeId = new Map();
+    const peersCacheOwnerByNodeId = new Map();
+    const cycleBrokenNodeIds = new Set();
     const depPathsByPkgId = new Map();
     const nodeIdsByPreviousDepPath = opts.resolvedPeerProviderPaths == null
         ? new Map()
@@ -76,6 +80,9 @@ export async function resolvePeers(opts) {
             parentDepPathsChain: [],
             pathsByNodeId,
             pathsByNodeIdPromises,
+            awaitedPeerNodeIdsByNodeId,
+            peersCacheOwnerByNodeId,
+            cycleBrokenNodeIds,
             depPathsByPkgId,
             nodeIdsByPreviousDepPath,
             resolvedPeerProviderPaths: opts.resolvedPeerProviderPaths,
@@ -102,6 +109,9 @@ export async function resolvePeers(opts) {
         // its cycle analysis only sees the children of one call, and providers
         // frequently peer-depend on each other, so resolving them one by one
         // would leave their dep path calculations awaiting each other forever.
+        // A peer cycle that spans this call and the traversal above is still
+        // invisible here; breakDepPathAwaitCycles resolves those before the
+        // finishing promises are awaited.
         const prunedProviderChildren = {};
         for (const [alias, nodeId] of Object.entries(hoistedProviderChildren)) {
             if (parentPkgsOfNode.has(nodeId))
@@ -122,6 +132,14 @@ export async function resolvePeers(opts) {
             };
         }
     }
+    breakDepPathAwaitCycles({
+        awaitedPeerNodeIdsByNodeId,
+        peersCacheOwnerByNodeId,
+        cycleBrokenNodeIds,
+        pathsByNodeId,
+        pathsByNodeIdPromises,
+        dependenciesTree: opts.dependenciesTree,
+    });
     await Promise.all(finishingList);
     const depGraphWithResolvedChildren = resolveChildren(depGraph);
     function resolveChildren(depGraph) {
@@ -168,8 +186,61 @@ export async function resolvePeers(opts) {
         pathsByNodeId,
     };
 }
-function nodeDepsCount(node) {
-    return Object.keys(node.children).length + node.resolvedPeerNames.size;
+// Cycle analysis inside resolvePeersOfChildren only sees the children of a
+// single call, but a dep path calculation may await a node resolved in a
+// different call or at a different tree level (a hoisted peer provider and
+// a consumer that peer-depend on each other, https://github.com/pnpm/pnpm/issues/12921).
+// Such an await cycle never settles on its own, so before the finishing
+// promises are awaited, walk the recorded await edges and resolve every
+// dep path promise on a cycle to the peer's `name@version` — the same
+// collapse in-call cycle detection applies (see calculateDepPath).
+// A node that hit the peers cache awaits its dep path from the node that
+// created the cache entry, so it borrows that owner's await edges.
+function breakDepPathAwaitCycles(opts) {
+    const isSettled = (nodeId) => opts.pathsByNodeId.has(nodeId) || opts.cycleBrokenNodeIds.has(nodeId);
+    const keysByNodeId = new Map();
+    const nodeIdsByKey = new Map();
+    function keyOf(nodeId) {
+        let key = keysByNodeId.get(nodeId);
+        if (key == null) {
+            key = String(keysByNodeId.size);
+            keysByNodeId.set(nodeId, key);
+            nodeIdsByKey.set(key, nodeId);
+        }
+        return key;
+    }
+    const graphEntries = [];
+    const awaitingNodeIds = new Set([
+        ...opts.awaitedPeerNodeIdsByNodeId.keys(),
+        ...opts.peersCacheOwnerByNodeId.keys(),
+    ]);
+    for (const nodeId of awaitingNodeIds) {
+        if (isSettled(nodeId))
+            continue;
+        const cacheOwnerNodeId = opts.peersCacheOwnerByNodeId.get(nodeId);
+        const awaitedNodeIds = opts.awaitedPeerNodeIdsByNodeId.get(nodeId) ??
+            (cacheOwnerNodeId == null ? undefined : opts.awaitedPeerNodeIdsByNodeId.get(cacheOwnerNodeId));
+        if (awaitedNodeIds == null)
+            continue;
+        const liveTargets = [];
+        for (const awaitedNodeId of awaitedNodeIds) {
+            if (!isSettled(awaitedNodeId)) {
+                liveTargets.push(keyOf(awaitedNodeId));
+            }
+        }
+        if (liveTargets.length > 0) {
+            graphEntries.push([keyOf(nodeId), liveTargets]);
+        }
+    }
+    if (graphEntries.length === 0)
+        return;
+    const { cycles } = analyzeGraph(graphEntries);
+    for (const key of new Set(cycles.flat())) {
+        const nodeId = nodeIdsByKey.get(key);
+        const { name, version } = opts.dependenciesTree.get(nodeId).resolvedPackage;
+        opts.cycleBrokenNodeIds.add(nodeId);
+        opts.pathsByNodeIdPromises.get(nodeId)?.resolve(`${name}@${version}`);
+    }
 }
 function deduplicateAll(depGraph, duplicates) {
     const { depPathsMap, remainingDuplicates } = deduplicateDepPaths(duplicates, depGraph);
@@ -234,21 +305,6 @@ function deduplicateDepPaths(duplicates, depGraph) {
         remainingDuplicates,
     };
 }
-function isCompatibleAndHasMoreDeps(depGraph, depPath1, depPath2) {
-    const node1 = depGraph[depPath1];
-    const node2 = depGraph[depPath2];
-    if (nodeDepsCount(node1) < nodeDepsCount(node2))
-        return false;
-    const node1DepPathsSet = new Set(Object.values(node1.children));
-    const node2DepPaths = Object.values(node2.children);
-    if (!node2DepPaths.every((depPath) => node1DepPathsSet.has(depPath)))
-        return false;
-    for (const depPath of node2.resolvedPeerNames) {
-        if (!node1.resolvedPeerNames.has(depPath))
-            return false;
-    }
-    return true;
-}
 function createPkgsByName(dependenciesTree, { directNodeIdsByAlias, topParents }) {
     const parentRefs = toPkgByName(Array.from(directNodeIdsByAlias.entries())
         .map(([alias, nodeId]) => ({
@@ -389,6 +445,7 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
                 wantedRange,
             });
         }
+        ctx.peersCacheOwnerByNodeId.set(nodeId, hit.ownerNodeId);
         return {
             missingPeers: hit.missingPeers,
             finishing: (async () => {
@@ -451,6 +508,7 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
             missingPeers: allMissingPeers,
             depPath: pDefer(),
             resolvedPeers: allResolvedPeers,
+            ownerNodeId: nodeId,
         };
         if (ctx.peersCache.has(resolvedPackage.pkgIdWithPatchHash)) {
             ctx.peersCache.get(resolvedPackage.pkgIdWithPatchHash).push(cache);
@@ -512,6 +570,7 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
                 if (cyclicPeerAliases.has(pendingPeer.alias)) {
                     const { name, version } = ctx.dependenciesTree.get(pendingPeer.nodeId)?.resolvedPackage;
                     const id = `${name}@${version}`;
+                    ctx.cycleBrokenNodeIds.add(pendingPeer.nodeId);
                     ctx.pathsByNodeIdPromises.get(pendingPeer.nodeId)?.resolve(id);
                     return id;
                 }
@@ -521,6 +580,12 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
                         return { name: peerNode.resolvedPackage.name, version: peerNode.resolvedPackage.version };
                     }
                 }
+                let awaitedPeerNodeIds = ctx.awaitedPeerNodeIdsByNodeId.get(nodeId);
+                if (awaitedPeerNodeIds == null) {
+                    awaitedPeerNodeIds = new Set();
+                    ctx.awaitedPeerNodeIdsByNodeId.set(nodeId, awaitedPeerNodeIds);
+                }
+                awaitedPeerNodeIds.add(pendingPeer.nodeId);
                 return ctx.pathsByNodeIdPromises.get(pendingPeer.nodeId).promise;
             })),
         ], ctx.peersSuffixMaxLength);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.2.7",
+  "version": "1100.2.9",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -27,7 +27,32 @@
     "!*.map"
   ],
   "dependencies": {
+    "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/config.version-policy": "1100.1.7",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/core-loggers": "1100.2.2",
+    "@pnpm/deps.graph-hasher": "1100.2.10",
+    "@pnpm/deps.path": "1100.0.9",
+    "@pnpm/deps.peer-range": "1100.0.2",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/fetching.pick-fetcher": "1100.1.1",
+    "@pnpm/fs.symlink-dependency": "1100.0.11",
+    "@pnpm/hooks.types": "1100.2.1",
+    "@pnpm/lockfile.preferred-versions": "1100.0.20",
+    "@pnpm/lockfile.pruner": "1100.0.14",
+    "@pnpm/lockfile.types": "1100.0.14",
+    "@pnpm/lockfile.utils": "1100.1.3",
+    "@pnpm/patching.config": "1100.0.10",
+    "@pnpm/patching.types": "1100.0.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.10",
+    "@pnpm/pkg-manifest.utils": "1100.2.7",
+    "@pnpm/resolving.npm-resolver": "1102.1.3",
+    "@pnpm/resolving.resolver-base": "1100.5.2",
+    "@pnpm/store.controller-types": "1100.1.8",
+    "@pnpm/types": "1101.4.0",
     "@pnpm/util.lex-comparator": "^4.0.1",
+    "@pnpm/workspace.spec-parser": "1100.0.0",
     "@yarnpkg/core": "4.8.0",
     "graph-cycles": "3.0.0",
     "is-inner-link": "^5.0.0",
@@ -42,44 +67,19 @@
     "semver": "^7.8.4",
     "semver-range-intersect": "^0.3.1",
     "validate-npm-package-name": "7.0.2",
-    "version-selector-type": "^3.0.0",
-    "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.1.6",
-    "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.2.8",
-    "@pnpm/core-loggers": "1100.2.1",
-    "@pnpm/deps.peer-range": "1100.0.2",
-    "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/fetching.pick-fetcher": "1100.0.14",
-    "@pnpm/hooks.types": "1100.1.1",
-    "@pnpm/lockfile.preferred-versions": "1100.0.18",
-    "@pnpm/lockfile.pruner": "1100.0.13",
-    "@pnpm/fs.symlink-dependency": "1100.0.10",
-    "@pnpm/lockfile.types": "1100.0.13",
-    "@pnpm/lockfile.utils": "1100.1.1",
-    "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/pkg-manifest.utils": "1100.2.6",
-    "@pnpm/resolving.npm-resolver": "1102.1.2",
-    "@pnpm/resolving.resolver-base": "1100.5.1",
-    "@pnpm/store.controller-types": "1100.1.7",
-    "@pnpm/types": "1101.3.2",
-    "@pnpm/patching.config": "1100.0.9",
-    "@pnpm/workspace.spec-parser": "1100.0.0"
+    "version-selector-type": "^3.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
+    "@pnpm/installing.deps-resolver": "1100.2.9",
+    "@pnpm/logger": "1100.0.0",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
-    "@types/validate-npm-package-name": "^4.0.2",
-    "@pnpm/installing.deps-resolver": "1100.2.7",
-    "@pnpm/logger": "1100.0.0"
+    "@types/validate-npm-package-name": "^4.0.2"
   },
   "engines": {
     "node": ">=22.13"