pnpm-dedup 2.2.1 → 2.2.2

package/src/dedupeCheckConsistency.test.ts

@@ -1,8 +1,8 @@
-import { describe, it } from "bun:test";
 import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import { readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
+import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import { buildIdentifiedFixesMap } from "pm-dedup-core";
 import {
@@ -14,15 +14,24 @@ import {
 } from "./index.ts";
 
 // These tests shell out to the real `pnpm` and require either network access or
-// a warm pnpm store; they are skipped when pnpm is not on PATH. `--lockfile-only`
-// keeps pnpm from writing node_modules, and `--frozen-lockfile` / `--check` never
-// rewrite the lockfile, so pnpm runs against the committed fixtures in place
-// without modifying them (asserted below). `pnpm dedupe --check` only flags the
-// safely-mergeable subset of duplicates, so the invariant is: everything pnpm
-// would dedupe is also reported by our listing.
-
-const pnpmAvailable =
-  spawnSync("pnpm", ["--version"], { encoding: "utf8" }).status === 0;
+// a warm pnpm store. `--lockfile-only` keeps pnpm from writing node_modules, and
+// `--frozen-lockfile` / `--check` never rewrite the lockfile, so pnpm runs
+// against the committed fixtures in place without modifying them (asserted
+// below). The invariant is: everything `pnpm dedupe` would merge is also
+// reported by our listing.
+//
+// What `dedupe` merges changes between pnpm minors, so the expectations hold for
+// pnpm 12 only and the suite is skipped under any other major. The fixtures cannot
+// pin it through `packageManager`: pnpm 12 records the pinned version in the
+// lockfile, which breaks their byte-exactness.
+
+const SUPPORTED_PNPM_MAJOR = 12;
+
+const pnpmMajor = ((): number | null => {
+  const result = spawnSync("pnpm", ["--version"], { encoding: "utf8" });
+  if (result.status !== 0) return null;
+  return Number(result.stdout.trim().split(".")[0]);
+})();
 
 const fixturePath = (scenario: string): string =>
   fileURLToPath(new URL(`../test/fixtures/${scenario}`, import.meta.url));
@@ -47,17 +56,26 @@ const runPnpm = (cwd: string, args: string[]): PnpmRun => {
   };
 };
 
-// `pnpm dedupe --check` prints a tree of changes; each merged dependency is on a
-// branch line `├── name fromVersion → toVersion`. We collect those names.
-const parseDedupedPackages = (output: string): string[] => {
+const withoutPeerSuffix = (version: string): string =>
+  version.split("(")[0] ?? "";
+
+// `pnpm dedupe --check` prints a tree of changes, one `├── name from → to` branch
+// per changed dependency. A change that keeps the version only re-resolves peers,
+// which is not a merge.
+const parseMergedPackages = (output: string): string[] => {
   const names = new Set<string>();
   for (const line of output.split("\n")) {
     if (!line.includes("→")) continue;
-    const name = line
+    const [name, from, , to] = line
       .replace(/^[\s│├└─]+/u, "")
       .trim()
-      .split(/\s+/u)[0];
-    if (name) {
+      .split(/\s+/u);
+    if (
+      name &&
+      from &&
+      to &&
+      withoutPeerSuffix(from) !== withoutPeerSuffix(to)
+    ) {
       names.add(name);
     }
   }
@@ -98,70 +116,35 @@ const assertPristine = (dir: string, lockBefore: string): void => {
   rmSync(join(dir, "node_modules"), { recursive: true, force: true });
 };
 
-const suite = pnpmAvailable ? describe : describe.skip;
+const suite = pnpmMajor === SUPPORTED_PNPM_MAJOR ? describe : describe.skip;
 
 suite("pnpm dedupe --check vs listDuplicates", () => {
-  // `duplicated-typescript-eslint-dedupe-peers` is the same dependency with
-  // `dedupePeers: true`, which flattens the peer suffixes in the lockfile: pnpm
-  // must still merge the same packages, and we must still list them.
-  const mergeable: { scenario: string; expectedFlagged: string[] }[] = [
-    {
-      scenario: "duplicated-typescript-eslint",
-      expectedFlagged: [
-        "@typescript-eslint/tsconfig-utils",
-        "@typescript-eslint/types",
-      ],
-    },
-    {
-      scenario: "duplicated-typescript-eslint-dedupe-peers",
-      expectedFlagged: [
-        "@typescript-eslint/tsconfig-utils",
-        "@typescript-eslint/types",
-      ],
-    },
-  ];
-
-  for (const { scenario, expectedFlagged } of mergeable) {
-    it(`flags the mergeable subset of ${scenario}, all of which listDuplicates reports`, () => {
-      const dir = fixturePath(scenario);
-      const lockBefore = lockContent(dir);
-
-      const install = runPnpm(dir, ["install", "--frozen-lockfile"]);
-      strictEqual(install.status, 0, install.output);
-      assertPristine(dir, lockBefore);
-
-      const check = runPnpm(dir, ["dedupe", "--check"]);
-      ok(
-        check.status !== 0,
-        `dedupe --check should flag issues\n${check.output}`,
-      );
-      assertPristine(dir, lockBefore);
-
-      deepStrictEqual(parseDedupedPackages(check.output), expectedFlagged);
-
-      const duplicates = duplicateNames(scenario);
-      for (const name of expectedFlagged) {
-        ok(
-          duplicates.includes(name),
-          `listDuplicates should report ${name} that pnpm dedupe flags`,
-        );
-      }
-    }, 180_000);
-  }
-
-  // Duplicates pnpm does not merge: `dedupe --check` exits 0 and flags nothing,
-  // yet listDuplicates still reports the duplicate. The `mergeable-alias*`
-  // fixtures go one step further: every declared range accepts the aliased
-  // 5.0.7 pin, so we do identify a merge target — one pnpm will never apply,
-  // because merging means downgrading the range from 5.3.1.
+  // pnpm merges none of these duplicates, yet listDuplicates reports each one.
+  // In the `duplicated-typescript-eslint*` fixtures (`-dedupe-peers` is the same
+  // dependency with `dedupePeers: true`, which flattens the peer suffixes) pnpm
+  // re-resolves `@pob/eslint-config`'s auto-installed `eslint` peer to 9.39.5,
+  // the newest version that also satisfies eslint-plugin-react, and leaves the
+  // @typescript-eslint packages duplicated; pnpm 11.26 still merged them.
+  // The `mergeable-alias*` fixtures go one step further: every declared range
+  // accepts the aliased 5.0.7 pin, so we do identify a merge target — one pnpm
+  // will never apply, because merging means downgrading the range from 5.3.1.
   // `wildcard-not-reused` is the widest case: a `*` range resolved to 0.87.0
   // instead of the installed 0.84.5, duplicating the metro family (see
-  // wildcardNotReused.test.ts). pnpm will not undo it either.
-  const unmergeableByPnpm: {
+  // wildcardNotReused.test.ts). pnpm will not undo it either; it only re-resolves
+  // the optional `supports-color` peer of metro-symbolicate.
+  const scenarios: {
     scenario: string;
     expectedDuplicate: string;
     expectedFixTargets?: string[];
   }[] = [
+    {
+      scenario: "duplicated-typescript-eslint",
+      expectedDuplicate: "@typescript-eslint/types",
+    },
+    {
+      scenario: "duplicated-typescript-eslint-dedupe-peers",
+      expectedDuplicate: "@typescript-eslint/types",
+    },
     {
       scenario: "duplicated-babel-frame",
       expectedDuplicate: "@babel/code-frame",
@@ -186,33 +169,34 @@ suite("pnpm dedupe --check vs listDuplicates", () => {
     },
   ];
 
-  for (const {
-    scenario,
-    expectedDuplicate,
-    expectedFixTargets,
-  } of unmergeableByPnpm) {
-    it(`flags nothing for ${scenario} but still lists ${expectedDuplicate}`, () => {
-      const dir = fixturePath(scenario);
-      const lockBefore = lockContent(dir);
-
-      const install = runPnpm(dir, ["install", "--frozen-lockfile"]);
-      strictEqual(install.status, 0, install.output);
-      assertPristine(dir, lockBefore);
-
-      const check = runPnpm(dir, ["dedupe", "--check"]);
-      strictEqual(
-        check.status,
-        0,
-        `dedupe --check should find nothing to merge\n${check.output}`,
-      );
-      assertPristine(dir, lockBefore);
-
-      deepStrictEqual(parseDedupedPackages(check.output), []);
-      ok(duplicateNames(scenario).includes(expectedDuplicate));
-      deepStrictEqual(
-        fixTargets(scenario, expectedDuplicate),
-        expectedFixTargets ?? [],
-      );
-    }, 180_000);
+  for (const { scenario, expectedDuplicate, expectedFixTargets } of scenarios) {
+    it(
+      `merges nothing in ${scenario} but still lists ${expectedDuplicate}`,
+      { timeout: 180_000 },
+      () => {
+        const dir = fixturePath(scenario);
+        const lockBefore = lockContent(dir);
+
+        const install = runPnpm(dir, ["install", "--frozen-lockfile"]);
+        strictEqual(install.status, 0, install.output);
+        assertPristine(dir, lockBefore);
+
+        // exits 1 on a peer-only re-resolution too
+        const check = runPnpm(dir, ["dedupe", "--check"]);
+        ok(
+          check.status === 0 ||
+            check.output.includes("ERR_PNPM_DEDUPE_CHECK_ISSUES"),
+          check.output,
+        );
+        assertPristine(dir, lockBefore);
+
+        deepStrictEqual(parseMergedPackages(check.output), []);
+        ok(duplicateNames(scenario).includes(expectedDuplicate));
+        deepStrictEqual(
+          fixTargets(scenario, expectedDuplicate),
+          expectedFixTargets ?? [],
+        );
+      },
+    );
   }
 });

package/src/dedupeEndToEnd.test.ts

@@ -1,8 +1,8 @@
-import { afterEach, describe, it } from "bun:test";
 import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import { cpSync, existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { afterEach, describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import { buildPnpmPackagesMap } from "./helpers/buildPnpmPackagesMap.ts";
 import { readDuplicateSnapshot } from "./helpers/duplicateSnapshot.ts";
@@ -89,80 +89,87 @@ const resolutionsOf = (dir: string, packageName: string): string[] => {
 const suite = pnpmAvailable ? describe : describe.skip;
 
 suite("pnpm-dedupe end to end", () => {
-  it("converges the cluster and leaves pnpm holding it without an override", () => {
-    const dir = projects.create();
-    // only the manifest: the lockfile has to be the real resolution pnpm writes
-    // here, not the trimmed one the unit-test fixture commits
-    cpSync(join(fixtureDir, "package.json"), join(dir, "package.json"));
-    writeFileSync(join(dir, "pnpm-workspace.yaml"), workspaceYamlContent);
-
-    const installed = install(dir);
-    strictEqual(installed.status, 0, installed.output);
-
-    // `@yudiel/react-qr-scanner` pins barcode-detector at exactly 3.0.3 while
-    // expo-camera's `^3.0.0` resolved to 3.2.2, and the pair drags zxing-wasm
-    // along: four resolutions for two packages.
-    const before = readDuplicateSnapshot(lockPath(dir));
-    strictEqual(before.size, 4, [...before].join(", "));
-    ok(before.has("barcode-detector@3.0.3"));
-    ok(before.has("barcode-detector@3.2.2"));
-
-    const applied = dedupe(dir);
-    strictEqual(applied.status, 0, applied.output);
-
-    // the tool's own verdict: the convergence override went in, came back out,
-    // and the result survived the re-resolution without it
-    ok(applied.output.includes('"barcode-detector@": "3.0.3"'), applied.output);
-    ok(
-      applied.output.includes(
-        "Removing the overrides and re-resolving to check the result holds",
-      ),
-      applied.output,
-    );
-    // what it deduped, named: two packages, one copy of each merged away
-    ok(
-      applied.output.includes("Deduped 2 packages, 2 copies merged:"),
-      applied.output,
-    );
-    ok(
-      applied.output.includes(
-        "barcode-detector: 2 versions (3.0.3, 3.2.2) -> 1 version (3.0.3)",
-      ),
-      applied.output,
-    );
-    ok(applied.output.includes("No duplicate left."), applied.output);
-
-    // what matters is the lockfile pnpm was left with
-    strictEqual(readDuplicateSnapshot(lockPath(dir)).size, 0);
-    deepStrictEqual(resolutionsOf(dir, "barcode-detector"), [
-      "barcode-detector@3.0.3",
-    ]);
-    // barcode-detector 3.2.2 pinned zxing-wasm at exactly 3.1.3; 3.0.3 asks for
-    // `^2.1.2`, so converging onto it has to bring the 2.x line back — a 3.1.3
-    // left standing would be a range the installed tree contradicts.
-    const zxing = resolutionsOf(dir, "zxing-wasm");
-    strictEqual(zxing.length, 1, zxing.join(", "));
-    ok(zxing[0]?.startsWith("zxing-wasm@2."), zxing.join(", "));
-
-    // no standing override is left behind, in a file otherwise untouched
-    strictEqual(
-      readFileSync(join(dir, "pnpm-workspace.yaml"), "utf8"),
-      workspaceYamlContent,
-    );
-
-    // and pnpm itself agrees, from the manifests alone
-    const frozen = install(dir, "--frozen-lockfile");
-    strictEqual(frozen.status, 0, frozen.output);
-
-    // pnpm's own account of the installed tree, not ours: one copy, reached
-    // from both dependents
-    const list = run(dir, "pnpm", ["list", "--depth", "Infinity"]);
-    strictEqual(list.status, 0, list.output);
-    ok(list.output.includes("barcode-detector@3.0.3 [deduped]"), list.output);
-    strictEqual(list.output.includes("barcode-detector@3.2.2"), false);
-
-    const check = dedupe(dir, "--check");
-    strictEqual(check.status, 0, check.output);
-    ok(check.output.includes("Nothing to dedupe."), check.output);
-  }, 180_000);
+  it(
+    "converges the cluster and leaves pnpm holding it without an override",
+    { timeout: 180_000 },
+    () => {
+      const dir = projects.create();
+      // only the manifest: the lockfile has to be the real resolution pnpm writes
+      // here, not the trimmed one the unit-test fixture commits
+      cpSync(join(fixtureDir, "package.json"), join(dir, "package.json"));
+      writeFileSync(join(dir, "pnpm-workspace.yaml"), workspaceYamlContent);
+
+      const installed = install(dir);
+      strictEqual(installed.status, 0, installed.output);
+
+      // `@yudiel/react-qr-scanner` pins barcode-detector at exactly 3.0.3 while
+      // expo-camera's `^3.0.0` resolved to 3.2.2, and the pair drags zxing-wasm
+      // along: four resolutions for two packages.
+      const before = readDuplicateSnapshot(lockPath(dir));
+      strictEqual(before.size, 4, [...before].join(", "));
+      ok(before.has("barcode-detector@3.0.3"));
+      ok(before.has("barcode-detector@3.2.2"));
+
+      const applied = dedupe(dir);
+      strictEqual(applied.status, 0, applied.output);
+
+      // the tool's own verdict: the convergence override went in, came back out,
+      // and the result survived the re-resolution without it
+      ok(
+        applied.output.includes('"barcode-detector@": "3.0.3"'),
+        applied.output,
+      );
+      ok(
+        applied.output.includes(
+          "Removing the overrides and re-resolving to check the result holds",
+        ),
+        applied.output,
+      );
+      // what it deduped, named: two packages, one copy of each merged away
+      ok(
+        applied.output.includes("Deduped 2 packages, 2 copies merged:"),
+        applied.output,
+      );
+      ok(
+        applied.output.includes(
+          "barcode-detector: 2 versions (3.0.3, 3.2.2) -> 1 version (3.0.3)",
+        ),
+        applied.output,
+      );
+      ok(applied.output.includes("No duplicate left."), applied.output);
+
+      // what matters is the lockfile pnpm was left with
+      strictEqual(readDuplicateSnapshot(lockPath(dir)).size, 0);
+      deepStrictEqual(resolutionsOf(dir, "barcode-detector"), [
+        "barcode-detector@3.0.3",
+      ]);
+      // barcode-detector 3.2.2 pinned zxing-wasm at exactly 3.1.3; 3.0.3 asks for
+      // `^2.1.2`, so converging onto it has to bring the 2.x line back — a 3.1.3
+      // left standing would be a range the installed tree contradicts.
+      const zxing = resolutionsOf(dir, "zxing-wasm");
+      strictEqual(zxing.length, 1, zxing.join(", "));
+      ok(zxing[0]?.startsWith("zxing-wasm@2."), zxing.join(", "));
+
+      // no standing override is left behind, in a file otherwise untouched
+      strictEqual(
+        readFileSync(join(dir, "pnpm-workspace.yaml"), "utf8"),
+        workspaceYamlContent,
+      );
+
+      // and pnpm itself agrees, from the manifests alone
+      const frozen = install(dir, "--frozen-lockfile");
+      strictEqual(frozen.status, 0, frozen.output);
+
+      // pnpm's own account of the installed tree, not ours: one copy, reached
+      // from both dependents
+      const list = run(dir, "pnpm", ["list", "--depth", "Infinity"]);
+      strictEqual(list.status, 0, list.output);
+      ok(list.output.includes("barcode-detector@3.0.3 [deduped]"), list.output);
+      strictEqual(list.output.includes("barcode-detector@3.2.2"), false);
+
+      const check = dedupe(dir, "--check");
+      strictEqual(check.status, 0, check.output);
+      ok(check.output.includes("Nothing to dedupe."), check.output);
+    },
+  );
 });

package/src/dedupePeers.test.ts

@@ -1,5 +1,5 @@
-import { describe, it } from "bun:test";
 import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import { buildIdentifiedFixesMap } from "pm-dedup-core";
 import type { PackagesMap } from "./helpers/buildPnpmPackagesMap.ts";

package/src/displayMany.test.ts

@@ -1,5 +1,5 @@
-import { describe, expect, it } from "bun:test";
-import { ok } from "node:assert/strict";
+import { ok, strictEqual } from "node:assert/strict";
+import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import type { ClusterFix } from "pm-dedup-core";
 import { displayMany } from "./displayMany.ts";
@@ -86,7 +86,6 @@ const clusterFix = (overrides: Partial<ClusterFix> = {}): ClusterFix => ({
   excludedMembers: [],
   anchor: null,
   reuseFixes: [],
-  floatingMembers: [],
   workspaceChanges: [],
   reResolutionSet: ["metro"],
   externalConstraints: [],
@@ -128,7 +127,8 @@ describe("displayMany", () => {
   });
 
   it("reports no duplicates for a clean lockfile", () => {
-    expect(renderDuplicates("simple")).toBe(
+    strictEqual(
+      renderDuplicates("simple"),
       "No duplicates found\n\nFound 1 dependency, 0 duplicates, 0 dedupable.\n",
     );
   });

package/src/helpers/buildIdentifiedFixesMap.test.ts

@@ -1,5 +1,5 @@
-import { describe, it } from "bun:test";
 import { ok, strictEqual } from "node:assert/strict";
+import { describe, it } from "node:test";
 import { buildIdentifiedFixesMap } from "pm-dedup-core";
 import type { PackageResolution, PackagesMap } from "./buildPnpmPackagesMap.ts";
 import type { DependentsMap } from "./collectPnpmDependents.ts";

package/src/helpers/buildPnpmPackagesMap.test.ts

@@ -1,5 +1,5 @@
-import { describe, it } from "bun:test";
 import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import { readPnpmLock } from "../readPnpmLock.ts";
 import {

package/src/helpers/collectDependentRanges.test.ts

@@ -1,5 +1,5 @@
-import { describe, it } from "bun:test";
 import { deepStrictEqual, strictEqual } from "node:assert/strict";
+import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import { readPnpmLock } from "../readPnpmLock.ts";
 import { collectDependentRanges } from "./collectDependentRanges.ts";

package/src/helpers/collectPnpmDependents.test.ts

@@ -1,5 +1,5 @@
-import { describe, it } from "bun:test";
 import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import { readPnpmLock } from "../readPnpmLock.ts";
 import { collectPnpmDependents } from "./collectPnpmDependents.ts";

package/src/helpers/describeUnheldOverride.test.ts

@@ -0,0 +1,100 @@
+import { deepStrictEqual } from "node:assert/strict";
+import { describe, it } from "node:test";
+import { describeUnheldOverride } from "./describeUnheldOverride.ts";
+
+describe("describeUnheldOverride", () => {
+  it("names a requester once, whatever its peer contexts", () => {
+    deepStrictEqual(
+      describeUnheldOverride(
+        { packageName: "lightningcss", version: "1.30.1", reason: "converge" },
+        [
+          // two installations of one requester, one already repointed
+          {
+            key: "react-native-css@3.1.0-rc.0",
+            range: ">=1.27.0",
+            resolvedVersion: "1.30.1",
+            requesterName: "react-native-css",
+            peer: true,
+          },
+          {
+            key: "react-native-css@3.1.0-rc.0",
+            range: ">=1.27.0",
+            resolvedVersion: "1.33.0",
+            requesterName: "react-native-css",
+            peer: true,
+          },
+          {
+            key: "react-native-css@3.1.0-rc.0",
+            range: ">=1.27.0",
+            resolvedVersion: "1.33.0",
+            requesterName: "react-native-css",
+            peer: true,
+          },
+          {
+            key: "vite@8.3.0",
+            range: "^1.33.0",
+            resolvedVersion: "1.33.0",
+            requesterName: "vite",
+          },
+        ],
+      ),
+      [
+        'vite@8.3.0 requires "^1.33.0"',
+        'react-native-css@3.1.0-rc.0 requires ">=1.27.0" (peer), is provided 1.33.0',
+      ],
+    );
+  });
+
+  it("lists the ranges that reject the version first", () => {
+    deepStrictEqual(
+      describeUnheldOverride(
+        {
+          packageName: "@commitlint/types",
+          version: "21.0.1",
+          reason: "converge",
+        },
+        [
+          {
+            key: "@commitlint/format@21.0.1",
+            range: "^21.0.1",
+            resolvedVersion: "21.1.0",
+            requesterName: "@commitlint/format",
+          },
+          {
+            key: "@commitlint/rules@21.1.0",
+            range: "^21.1.0",
+            resolvedVersion: "21.1.0",
+            requesterName: "@commitlint/rules",
+          },
+          {
+            key: "@pob/root@27.11.0",
+            range: "21.0.1",
+            resolvedVersion: "21.0.1",
+            requesterName: "@pob/root",
+          },
+        ],
+      ),
+      [
+        '@commitlint/rules@21.1.0 requires "^21.1.0"',
+        '@commitlint/format@21.0.1 requires "^21.0.1", resolves 21.1.0 without an override',
+      ],
+    );
+  });
+
+  it("names an importer by its manifest and dependency type", () => {
+    deepStrictEqual(
+      describeUnheldOverride(
+        { packageName: "leaf", version: "2.0.0", reason: "converge" },
+        [
+          {
+            key: "package.json in devDependencies",
+            range: "1.0.0",
+            resolvedVersion: "1.0.0",
+            workspace: { path: ".", depType: "devDependencies" },
+          },
+        ],
+      ),
+      ['package.json in devDependencies requires "1.0.0"'],
+    );
+  });
+});

package/src/helpers/describeUnheldOverride.ts

@@ -0,0 +1,53 @@
+import type { PlannedOverride } from "pm-dedup-core";
+import semver from "semver";
+import type { DependentRange } from "./collectDependentRanges.ts";
+
+const rejects = (version: string, range: string): boolean =>
+  semver.validRange(range) !== null &&
+  !semver.satisfies(version, range, { includePrerelease: true });
+
+const describeDependent = (
+  dependent: DependentRange & { resolvedVersion: string },
+  version: string,
+): string => {
+  const declared = `${dependent.key} requires "${dependent.range}"`;
+  if (rejects(version, dependent.range)) {
+    return dependent.peer ? `${declared} (peer)` : declared;
+  }
+  // pnpm provides a peer from the parent's context rather than resolving it
+  return dependent.peer
+    ? `${declared} (peer), is provided ${dependent.resolvedVersion}`
+    : `${declared}, resolves ${dependent.resolvedVersion} without an override`;
+};
+
+/**
+ * Why an override did not hold, as one line per edge still resolving away from
+ * its version, the ranges that reject it first: those are what blocks the merge.
+ *
+ * Several peer contexts of one requester share a key, so lines are counted once.
+ */
+export const describeUnheldOverride = (
+  override: PlannedOverride,
+  dependents: DependentRange[],
+): string[] => {
+  const offVersion = dependents.filter(
+    (dependent): dependent is DependentRange & { resolvedVersion: string } =>
+      dependent.resolvedVersion !== undefined &&
+      dependent.resolvedVersion !== override.version,
+  );
+
+  const blockersFirst = offVersion.toSorted(
+    (a, b) =>
+      Number(rejects(override.version, b.range)) -
+        Number(rejects(override.version, a.range)) ||
+      a.key.localeCompare(b.key),
+  );
+
+  return [
+    ...new Set(
+      blockersFirst.map((dependent) =>
+        describeDependent(dependent, override.version),
+      ),
+    ),
+  ];
+};

package/src/helpers/parsePnpmLockPackages.test.ts

@@ -1,5 +1,5 @@
-import { describe, it } from "bun:test";
 import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import { readPnpmLock } from "../readPnpmLock.ts";
 import {