fix: always check direct local tarball dependencies

.changeset/spicy-dragons-fly.md

@@ -0,0 +1,5 @@
+---
+"supi": patch
+---
+
+This fixes a regression introduced in pnpm v5.0.0. Direct local tarball dependencies should always be reanalized on install.

packages/supi/src/install/index.ts

@@ -851,9 +851,18 @@ async function toResolveImporter (
       updateDepth: opts.defaultUpdateDepth,
     }))
   } else {
+    // Direct local tarballs are always checked,
+    // so their update depth should be at least 0
+    const updateLocalTarballs = (dep: WantedDependency) => ({
+      ...dep,
+      updateDepth: prefIsLocalTarball(dep.pref) ? 0 : -1,
+    })
     wantedDependencies = [
-      ...project.wantedDependencies.map((dep) => ({ ...dep, updateDepth: opts.defaultUpdateDepth })),
-      ...existingDeps.map((dep) => ({ ...dep, updateDepth: -1 })),
+      ...project.wantedDependencies.map(
+        opts.defaultUpdateDepth < 0
+          ? updateLocalTarballs
+          : (dep) => ({ ...dep, updateDepth: opts.defaultUpdateDepth })),
+      ...existingDeps.map(updateLocalTarballs),
     ]
   }
   return {
@@ -865,6 +874,10 @@ async function toResolveImporter (
   }
 }
 
+function prefIsLocalTarball (pref: string) {
+  return pref.startsWith('file:') && pref.endsWith('.tgz')
+}
+
 const limitLinking = pLimit(16)
 
 function linkBinsOfImporter ({ modulesDir, binsDir, rootDir }: ProjectToLink) {

packages/supi/test/install/local.ts

@@ -164,7 +164,7 @@ test('tarball local package from project directory', async (t: tape.Test) => {
   }, `a snapshot of the local dep tarball added to ${WANTED_LOCKFILE}`)
 })
 
-test.skip('update tarball local package when its integrity changes', async (t) => {
+test('update tarball local package when its integrity changes', async (t) => {
   const project = prepareEmpty(t)
 
   await copyFixture('tar-pkg-with-dep-1/tar-pkg-with-dep-1.0.0.tgz', path.resolve('..', 'tar.tgz'))