@pnpm/lockfile.preferred-versions 1100.0.32 → 1100.0.34

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @pnpm/lockfile.preferred-versions
 
+## 1100.0.34
+
+### Patch Changes
+
+- Fixed `pnpm dedupe` requiring a second pass after bumping a direct dependency in `package.json` [pnpm/pnpm#14987](https://github.com/pnpm/pnpm/issues/14987).
+
+- Updated dependencies:
+  - @pnpm/lockfile.utils@1102.1.3
+  - @pnpm/pkg-manifest.utils@1100.4.5
+  - @pnpm/resolving.resolver-base@1101.3.0
+
+## 1100.0.33
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/lockfile.utils@1102.1.2
+  - @pnpm/pkg-manifest.utils@1100.4.4
+
 ## 1100.0.32
 
 ### Patch Changes

package/lib/index.d.ts

@@ -1,4 +1,6 @@
 import { type PackageSnapshots } from '@pnpm/lockfile.utils';
 import { type PreferredVersions } from '@pnpm/resolving.resolver-base';
 import type { DependencyManifest, ProjectManifest } from '@pnpm/types';
-export declare function getPreferredVersionsFromLockfileAndManifests(snapshots: PackageSnapshots | undefined, manifests: Array<DependencyManifest | ProjectManifest>): PreferredVersions;
+export declare function getPreferredVersionsFromLockfileAndManifests(snapshots: PackageSnapshots | undefined, manifests: Array<DependencyManifest | ProjectManifest>, opts?: {
+    dedupe?: boolean;
+}): PreferredVersions;

package/lib/index.js

@@ -2,7 +2,7 @@ import { nameVerFromPkgSnapshot } from '@pnpm/lockfile.utils';
 import { getAllDependenciesFromManifest } from '@pnpm/pkg-manifest.utils';
 import { DIRECT_DEP_SELECTOR_WEIGHT, EXISTING_VERSION_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
 import getVersionSelectorType from 'version-selector-type';
-export function getPreferredVersionsFromLockfileAndManifests(snapshots, manifests) {
+export function getPreferredVersionsFromLockfileAndManifests(snapshots, manifests, opts = {}) {
     // All maps in here are keyed by package names and specifiers coming from
     // manifests and the lockfile — attacker-controlled inputs. Null-prototype
     // objects make a crafted key (e.g. `__proto__`) a plain own key instead of
@@ -23,10 +23,11 @@ export function getPreferredVersionsFromLockfileAndManifests(snapshots, manifest
     }
     if (!snapshots)
         return preferredVersions;
-    addPreferredVersionsFromLockfile(snapshots, preferredVersions);
+    // Dedupe must let newly resolved dependencies compete with lockfile versions.
+    addPreferredVersionsFromLockfile(snapshots, preferredVersions, opts.dedupe ? 1 : EXISTING_VERSION_SELECTOR_WEIGHT);
     return preferredVersions;
 }
-function addPreferredVersionsFromLockfile(snapshots, preferredVersions) {
+function addPreferredVersionsFromLockfile(snapshots, preferredVersions, weight) {
     // The snapshots object can contain multiple entries with the same package
     // name and version. This is because a dependency can appear multiple times
     // with the same version in the lockfile due to peer dependency resolution. To
@@ -43,7 +44,7 @@ function addPreferredVersionsFromLockfile(snapshots, preferredVersions) {
             preferredVersions[name] ??= Object.create(null);
             const existingSelector = preferredVersions[name][version];
             if (existingSelector == null) {
-                preferredVersions[name][version] = { selectorType: 'version', weight: EXISTING_VERSION_SELECTOR_WEIGHT };
+                preferredVersions[name][version] = { selectorType: 'version', weight };
                 continue;
             }
             // The lookup for this selector was for an exact version and not a range
@@ -60,7 +61,7 @@ function addPreferredVersionsFromLockfile(snapshots, preferredVersions) {
             // present in the lockfile that's also used by a direct dependency to be
             // considered at a higher priority than a package with only one of the two
             // criteria.
-            preferredVersions[name][version] = addWeightToVersionSelector(existingSelector, EXISTING_VERSION_SELECTOR_WEIGHT);
+            preferredVersions[name][version] = addWeightToVersionSelector(existingSelector, weight);
         }
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.preferred-versions",
-  "version": "1100.0.32",
+  "version": "1100.0.34",
   "description": "Get preferred version from lockfile",
   "keywords": [
     "pnpm",
@@ -29,15 +29,15 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/lockfile.utils": "1102.1.1",
-    "@pnpm/pkg-manifest.utils": "1100.4.3",
-    "@pnpm/resolving.resolver-base": "1101.2.0",
+    "@pnpm/lockfile.utils": "1102.1.3",
+    "@pnpm/pkg-manifest.utils": "1100.4.5",
+    "@pnpm/resolving.resolver-base": "1101.3.0",
     "@pnpm/types": "1102.1.0",
     "version-selector-type": "^3.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/lockfile.preferred-versions": "1100.0.32",
+    "@pnpm/lockfile.preferred-versions": "1100.0.34",
     "cross-env": "^10.1.0"
   },
   "engines": {