@pnpm/lockfile.preferred-versions 1100.0.33 → 1100.0.35

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @pnpm/lockfile.preferred-versions
 
+## 1100.0.35
+
+### Patch Changes
+
+- `pnpm dedupe` now moves transitive dependencies to the version a `catalog:` dependency pins, as it already did for versions written directly in `package.json`.
+
+- Updated dependencies:
+  - @pnpm/lockfile.utils@1102.1.4
+  - @pnpm/pkg-manifest.utils@1100.4.6
+  - @pnpm/resolving.resolver-base@1101.3.1
+  - @pnpm/types@1102.1.1
+
+## 1100.0.34
+
+### Patch Changes
+
+- Fixed `pnpm dedupe` requiring a second pass after bumping a direct dependency in `package.json` [pnpm/pnpm#14987](https://github.com/pnpm/pnpm/issues/14987).
+
+- Updated dependencies:
+  - @pnpm/lockfile.utils@1102.1.3
+  - @pnpm/pkg-manifest.utils@1100.4.5
+  - @pnpm/resolving.resolver-base@1101.3.0
+
 ## 1100.0.33
 
 ### Patch Changes

package/lib/index.d.ts

@@ -1,4 +1,8 @@
+import type { Catalogs } from '@pnpm/catalogs.types';
 import { type PackageSnapshots } from '@pnpm/lockfile.utils';
 import { type PreferredVersions } from '@pnpm/resolving.resolver-base';
 import type { DependencyManifest, ProjectManifest } from '@pnpm/types';
-export declare function getPreferredVersionsFromLockfileAndManifests(snapshots: PackageSnapshots | undefined, manifests: Array<DependencyManifest | ProjectManifest>): PreferredVersions;
+export declare function getPreferredVersionsFromLockfileAndManifests(snapshots: PackageSnapshots | undefined, manifests: Array<DependencyManifest | ProjectManifest>, opts?: {
+    catalogs?: Catalogs;
+    dedupe?: boolean;
+}): PreferredVersions;

package/lib/index.js

@@ -1,8 +1,9 @@
+import { resolveFromCatalog } from '@pnpm/catalogs.resolver';
 import { nameVerFromPkgSnapshot } from '@pnpm/lockfile.utils';
 import { getAllDependenciesFromManifest } from '@pnpm/pkg-manifest.utils';
 import { DIRECT_DEP_SELECTOR_WEIGHT, EXISTING_VERSION_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
 import getVersionSelectorType from 'version-selector-type';
-export function getPreferredVersionsFromLockfileAndManifests(snapshots, manifests) {
+export function getPreferredVersionsFromLockfileAndManifests(snapshots, manifests, opts = {}) {
     // All maps in here are keyed by package names and specifiers coming from
     // manifests and the lockfile — attacker-controlled inputs. Null-prototype
     // objects make a crafted key (e.g. `__proto__`) a plain own key instead of
@@ -10,7 +11,10 @@ export function getPreferredVersionsFromLockfileAndManifests(snapshots, manifest
     const preferredVersions = Object.create(null);
     for (const manifest of manifests) {
         const specs = getAllDependenciesFromManifest(manifest);
-        for (const [name, spec] of Object.entries(specs)) {
+        for (const [name, bareSpecifier] of Object.entries(specs)) {
+            const spec = resolveCatalogSpec(opts.catalogs ?? {}, name, bareSpecifier);
+            if (spec == null)
+                continue;
             const selector = getVersionSelectorType(spec);
             if (!selector)
                 continue;
@@ -23,10 +27,24 @@ export function getPreferredVersionsFromLockfileAndManifests(snapshots, manifest
     }
     if (!snapshots)
         return preferredVersions;
-    addPreferredVersionsFromLockfile(snapshots, preferredVersions);
+    // Dedupe must let newly resolved dependencies compete with lockfile versions.
+    addPreferredVersionsFromLockfile(snapshots, preferredVersions, opts.dedupe ? 1 : EXISTING_VERSION_SELECTOR_WEIGHT);
     return preferredVersions;
 }
-function addPreferredVersionsFromLockfile(snapshots, preferredVersions) {
+/**
+ * The specifier the resolver installs for a direct dependency: the catalog
+ * entry a `catalog:` specifier names, otherwise the specifier itself.
+ * `undefined` for a `catalog:` specifier without a usable entry.
+ */
+function resolveCatalogSpec(catalogs, alias, bareSpecifier) {
+    const result = resolveFromCatalog(catalogs, { alias, bareSpecifier });
+    switch (result.type) {
+        case 'found': return result.resolution.specifier;
+        case 'misconfiguration': return undefined;
+        case 'unused': return bareSpecifier;
+    }
+}
+function addPreferredVersionsFromLockfile(snapshots, preferredVersions, weight) {
     // The snapshots object can contain multiple entries with the same package
     // name and version. This is because a dependency can appear multiple times
     // with the same version in the lockfile due to peer dependency resolution. To
@@ -43,7 +61,7 @@ function addPreferredVersionsFromLockfile(snapshots, preferredVersions) {
             preferredVersions[name] ??= Object.create(null);
             const existingSelector = preferredVersions[name][version];
             if (existingSelector == null) {
-                preferredVersions[name][version] = { selectorType: 'version', weight: EXISTING_VERSION_SELECTOR_WEIGHT };
+                preferredVersions[name][version] = { selectorType: 'version', weight };
                 continue;
             }
             // The lookup for this selector was for an exact version and not a range
@@ -60,7 +78,7 @@ function addPreferredVersionsFromLockfile(snapshots, preferredVersions) {
             // present in the lockfile that's also used by a direct dependency to be
             // considered at a higher priority than a package with only one of the two
             // criteria.
-            preferredVersions[name][version] = addWeightToVersionSelector(existingSelector, EXISTING_VERSION_SELECTOR_WEIGHT);
+            preferredVersions[name][version] = addWeightToVersionSelector(existingSelector, weight);
         }
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.preferred-versions",
-  "version": "1100.0.33",
+  "version": "1100.0.35",
   "description": "Get preferred version from lockfile",
   "keywords": [
     "pnpm",
@@ -29,15 +29,17 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/lockfile.utils": "1102.1.2",
-    "@pnpm/pkg-manifest.utils": "1100.4.4",
-    "@pnpm/resolving.resolver-base": "1101.2.0",
-    "@pnpm/types": "1102.1.0",
+    "@pnpm/catalogs.resolver": "1100.1.0",
+    "@pnpm/catalogs.types": "1100.0.1",
+    "@pnpm/lockfile.utils": "1102.1.4",
+    "@pnpm/pkg-manifest.utils": "1100.4.6",
+    "@pnpm/resolving.resolver-base": "1101.3.1",
+    "@pnpm/types": "1102.1.1",
     "version-selector-type": "^3.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/lockfile.preferred-versions": "1100.0.33",
+    "@pnpm/lockfile.preferred-versions": "1100.0.35",
     "cross-env": "^10.1.0"
   },
   "engines": {