@pnpm/installing.deps-resolver 1100.2.8 → 1100.2.9

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @pnpm/resolve-dependencies
 
+## 1100.2.9
+
+### Patch Changes
+
+- Fixed an injected workspace dependency (`injectWorkspacePackages: true`) incorrectly staying as `file:` instead of deduping back to `link:` when an unrelated, ordinary shared dependency resolved to a peer-suffixed variant for the target project's own copy but not for the injected occurrence. See pnpm/pnpm#10433.
+
+- Fixed `pnpm update` removing transitive lockfile entries when `dedupePeerDependents` is disabled and the selected package is absent [pnpm/pnpm#12456](https://github.com/pnpm/pnpm/issues/12456).
+
+- Updated dependencies:
+  - @pnpm/config.version-policy@1100.1.7
+  - @pnpm/core-loggers@1100.2.2
+  - @pnpm/deps.graph-hasher@1100.2.10
+  - @pnpm/deps.path@1100.0.9
+  - @pnpm/fetching.pick-fetcher@1100.1.1
+  - @pnpm/fs.symlink-dependency@1100.0.11
+  - @pnpm/hooks.types@1100.2.1
+  - @pnpm/lockfile.preferred-versions@1100.0.20
+  - @pnpm/lockfile.pruner@1100.0.14
+  - @pnpm/lockfile.types@1100.0.14
+  - @pnpm/lockfile.utils@1100.1.3
+  - @pnpm/patching.config@1100.0.10
+  - @pnpm/pkg-manifest.reader@1100.0.10
+  - @pnpm/pkg-manifest.utils@1100.2.7
+  - @pnpm/resolving.npm-resolver@1102.1.3
+  - @pnpm/resolving.resolver-base@1100.5.2
+  - @pnpm/store.controller-types@1100.1.8
+  - @pnpm/types@1101.4.0
+
 ## 1100.2.8
 
 ### Patch Changes

package/lib/dedupeInjectedDeps.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import normalize from 'normalize-path';
+import { isCompatibleAndHasMoreDeps } from './depPathCompatibility.js';
 export function dedupeInjectedDeps(opts) {
     const injectedDepsByProjects = getInjectedDepsByProjects(opts);
     const dedupeMap = getDedupeMap(injectedDepsByProjects, opts);
@@ -46,7 +47,25 @@ function getDedupeMap(injectedDepsByProjects, opts) {
             // The injected project in the workspace may have dev deps
             const children = Object.entries(node.children);
             const isSubset = children
-                .every(([alias, depPath]) => targetProjectDeps.get(alias) === depPath);
+                .every(([alias, depPath]) => {
+                const targetDepPath = targetProjectDeps.get(alias);
+                if (targetDepPath === depPath)
+                    return true;
+                if (targetDepPath == null)
+                    return false;
+                // A shared dep can resolve peer-suffixed on one side and peer-free on
+                // the other (e.g. an existing lockfile pinned debug's optional
+                // supports-color for the target project but not the injected
+                // occurrence). Accept the target's variant when it's the same package
+                // identity and a compatible superset. See pnpm/pnpm#10433.
+                const targetNode = opts.depGraph[targetDepPath];
+                const injectedChildNode = opts.depGraph[depPath];
+                if (targetNode == null || injectedChildNode == null)
+                    return false;
+                if (targetNode.pkgIdWithPatchHash !== injectedChildNode.pkgIdWithPatchHash)
+                    return false;
+                return isCompatibleAndHasMoreDeps(opts.depGraph, targetDepPath, depPath);
+            });
             if (isSubset) {
                 dedupedInjectedDeps.set(alias, dep.id);
             }

package/lib/depPathCompatibility.d.ts

@@ -0,0 +1,4 @@
+import type { DepPath } from '@pnpm/types';
+import type { GenericDependenciesGraphNodeWithResolvedChildren, GenericDependenciesGraphWithResolvedChildren, PartialResolvedPackage } from './resolvePeers.js';
+export declare function nodeDepsCount(node: GenericDependenciesGraphNodeWithResolvedChildren): number;
+export declare function isCompatibleAndHasMoreDeps<T extends PartialResolvedPackage>(depGraph: GenericDependenciesGraphWithResolvedChildren<T>, depPath1: DepPath, depPath2: DepPath): boolean;

package/lib/depPathCompatibility.js

@@ -0,0 +1,28 @@
+// Shared helpers used by both resolvePeers (dedupePeerDependents) and
+// dedupeInjectedDeps. Lives in its own module so neither consumer has to import
+// the other, which would create a runtime cycle. The type imports above are
+// erased at build time, so no cycle exists at runtime.
+export function nodeDepsCount(node) {
+    return Object.keys(node.children).length + node.resolvedPeerNames.size;
+}
+// Whether `depPath1` is a superset-or-equal of `depPath2`: same-or-more resolved
+// children and peers. Compares dependency/peer *sets* only, not package
+// identity, so callers must pass depPaths already known to share a
+// `pkgIdWithPatchHash` — otherwise two unrelated leaf packages (both with empty
+// sets) would count as compatible.
+export function isCompatibleAndHasMoreDeps(depGraph, depPath1, depPath2) {
+    const node1 = depGraph[depPath1];
+    const node2 = depGraph[depPath2];
+    if (nodeDepsCount(node1) < nodeDepsCount(node2))
+        return false;
+    const node1DepPathsSet = new Set(Object.values(node1.children));
+    const node2DepPaths = Object.values(node2.children);
+    if (!node2DepPaths.every((depPath) => node1DepPathsSet.has(depPath)))
+        return false;
+    for (const depPath of node2.resolvedPeerNames) {
+        if (!node1.resolvedPeerNames.has(depPath))
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=depPathCompatibility.js.map

package/lib/resolveDependencies.js

@@ -1106,7 +1106,9 @@ async function resolveDependency(wantedDependency, ctx, options) {
         currentPkg.dependencyLockfile &&
         currentPkg.name &&
         await pathExists(path.join(ctx.virtualStoreDir, dp.depPathToFilename(currentPkg.depPath, ctx.virtualStoreDirMaxLength), 'node_modules', currentPkg.name, 'package.json')));
-    if (!options.update && !options.proceed && (currentPkg.resolution != null) && depIsLinked) {
+    if (!options.update && !options.proceed &&
+        options.currentDepth === Math.max(0, options.updateDepth) &&
+        (currentPkg.resolution != null) && depIsLinked) {
         return null;
     }
     let pkgResponse;

package/lib/resolvePeers.js

@@ -7,6 +7,7 @@ import pDefer, {} from 'p-defer';
 import { partition, pick } from 'ramda';
 import semver from 'semver';
 import { dedupeInjectedDeps } from './dedupeInjectedDeps.js';
+import { isCompatibleAndHasMoreDeps, nodeDepsCount } from './depPathCompatibility.js';
 import { linkPathToPeerVersion } from './linkPathToPeerVersion.js';
 import { mergePeers } from './mergePeers.js';
 export async function resolvePeers(opts) {
@@ -241,9 +242,6 @@ function breakDepPathAwaitCycles(opts) {
         opts.pathsByNodeIdPromises.get(nodeId)?.resolve(`${name}@${version}`);
     }
 }
-function nodeDepsCount(node) {
-    return Object.keys(node.children).length + node.resolvedPeerNames.size;
-}
 function deduplicateAll(depGraph, duplicates) {
     const { depPathsMap, remainingDuplicates } = deduplicateDepPaths(duplicates, depGraph);
     if (remainingDuplicates.length === duplicates.length) {
@@ -307,21 +305,6 @@ function deduplicateDepPaths(duplicates, depGraph) {
         remainingDuplicates,
     };
 }
-function isCompatibleAndHasMoreDeps(depGraph, depPath1, depPath2) {
-    const node1 = depGraph[depPath1];
-    const node2 = depGraph[depPath2];
-    if (nodeDepsCount(node1) < nodeDepsCount(node2))
-        return false;
-    const node1DepPathsSet = new Set(Object.values(node1.children));
-    const node2DepPaths = Object.values(node2.children);
-    if (!node2DepPaths.every((depPath) => node1DepPathsSet.has(depPath)))
-        return false;
-    for (const depPath of node2.resolvedPeerNames) {
-        if (!node1.resolvedPeerNames.has(depPath))
-            return false;
-    }
-    return true;
-}
 function createPkgsByName(dependenciesTree, { directNodeIdsByAlias, topParents }) {
     const parentRefs = toPkgByName(Array.from(directNodeIdsByAlias.entries())
         .map(([alias, nodeId]) => ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.2.8",
+  "version": "1100.2.9",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -29,28 +29,28 @@
   "dependencies": {
     "@pnpm/catalogs.resolver": "1100.0.0",
     "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.1.6",
+    "@pnpm/config.version-policy": "1100.1.7",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.2.1",
-    "@pnpm/deps.graph-hasher": "1100.2.9",
-    "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/core-loggers": "1100.2.2",
+    "@pnpm/deps.graph-hasher": "1100.2.10",
+    "@pnpm/deps.path": "1100.0.9",
     "@pnpm/deps.peer-range": "1100.0.2",
     "@pnpm/error": "1100.0.1",
-    "@pnpm/fetching.pick-fetcher": "1100.1.0",
-    "@pnpm/fs.symlink-dependency": "1100.0.10",
-    "@pnpm/hooks.types": "1100.2.0",
-    "@pnpm/lockfile.preferred-versions": "1100.0.19",
-    "@pnpm/lockfile.pruner": "1100.0.13",
-    "@pnpm/lockfile.types": "1100.0.13",
-    "@pnpm/lockfile.utils": "1100.1.2",
-    "@pnpm/patching.config": "1100.0.9",
+    "@pnpm/fetching.pick-fetcher": "1100.1.1",
+    "@pnpm/fs.symlink-dependency": "1100.0.11",
+    "@pnpm/hooks.types": "1100.2.1",
+    "@pnpm/lockfile.preferred-versions": "1100.0.20",
+    "@pnpm/lockfile.pruner": "1100.0.14",
+    "@pnpm/lockfile.types": "1100.0.14",
+    "@pnpm/lockfile.utils": "1100.1.3",
+    "@pnpm/patching.config": "1100.0.10",
     "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/pkg-manifest.utils": "1100.2.6",
-    "@pnpm/resolving.npm-resolver": "1102.1.2",
-    "@pnpm/resolving.resolver-base": "1100.5.1",
-    "@pnpm/store.controller-types": "1100.1.7",
-    "@pnpm/types": "1101.3.2",
+    "@pnpm/pkg-manifest.reader": "1100.0.10",
+    "@pnpm/pkg-manifest.utils": "1100.2.7",
+    "@pnpm/resolving.npm-resolver": "1102.1.3",
+    "@pnpm/resolving.resolver-base": "1100.5.2",
+    "@pnpm/store.controller-types": "1100.1.8",
+    "@pnpm/types": "1101.4.0",
     "@pnpm/util.lex-comparator": "^4.0.1",
     "@pnpm/workspace.spec-parser": "1100.0.0",
     "@yarnpkg/core": "4.8.0",
@@ -74,7 +74,7 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/installing.deps-resolver": "1100.2.8",
+    "@pnpm/installing.deps-resolver": "1100.2.9",
     "@pnpm/logger": "1100.0.0",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",