fix: don't modify the inject project's manifest (#5294)

.changeset/quiet-carrots-exist.md

@@ -0,0 +1,7 @@
+---
+"@pnpm/npm-resolver": patch
+"@pnpm/resolve-dependencies": patch
+"pnpm": patch
+---
+
+Don't modify the manifest of the injected workspace project, when it has the same dependency in prod and peer dependencies.

packages/core/test/install/injectLocalPackages.ts

@@ -1296,3 +1296,84 @@ test('peer dependency of injected project should be resolved correctly', async (
   const lockfile = await rootModules.readLockfile()
   expect(lockfile.packages?.['file:project-2_project-1@project-1'].dependencies?.['project-1']).toEqual('link:project-1')
 })
+
+// There was a bug related to this. The manifests in the workspacePackages object were modified
+test('do not modify the manifest of the injected workpspace project', async () => {
+  const project1Manifest = {
+    name: 'project-1',
+    version: '1.0.0',
+    dependencies: {
+      'is-positive': '1.0.0',
+    },
+    peerDependencies: {
+      'is-positive': '>=1.0.0',
+    },
+  }
+  const project2Manifest = {
+    name: 'project-2',
+    version: '1.0.0',
+    dependencies: {
+      'project-1': 'workspace:1.0.0',
+    },
+    devDependencies: {
+      'is-positive': '1.0.0',
+    },
+    dependenciesMeta: {
+      'project-1': {
+        injected: true,
+      },
+    },
+  }
+  preparePackages([
+    {
+      location: 'project-1',
+      package: project1Manifest,
+    },
+    {
+      location: 'project-2',
+      package: project2Manifest,
+    },
+  ])
+
+  const importers: MutatedProject[] = [
+    {
+      buildIndex: 0,
+      manifest: project1Manifest,
+      mutation: 'install',
+      rootDir: path.resolve('project-1'),
+    },
+    {
+      buildIndex: 0,
+      manifest: project2Manifest,
+      mutation: 'install',
+      rootDir: path.resolve('project-2'),
+    },
+  ]
+  const workspacePackages = {
+    'project-1': {
+      '1.0.0': {
+        dir: path.resolve('project-1'),
+        manifest: project1Manifest,
+      },
+    },
+    'project-2': {
+      '1.0.0': {
+        dir: path.resolve('project-2'),
+        manifest: project2Manifest,
+      },
+    },
+  }
+  const [project1] = await mutateModules(importers, await testDefaults({
+    workspacePackages,
+  }))
+  expect(project1.manifest).toStrictEqual({
+    name: 'project-1',
+    version: '1.0.0',
+    dependencies: {
+      'is-positive': '1.0.0',
+    },
+    peerDependencies: {
+      'is-positive': '>=1.0.0',
+    },
+  })
+})

packages/npm-resolver/package.json

@@ -50,6 +50,7 @@
     "p-memoize": "4.0.1",
     "parse-npm-tarball-url": "^3.0.0",
     "path-temp": "^2.0.0",
+    "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^4.0.2",
     "semver": "^7.3.7",
     "ssri": "^9.0.1",
@@ -61,6 +62,7 @@
     "@pnpm/npm-resolver": "workspace:*",
     "@pnpm/test-fixtures": "workspace:*",
     "@types/normalize-path": "^3.0.0",
+    "@types/ramda": "0.28.15",
     "@types/semver": "7.3.10",
     "@types/ssri": "^7.1.1",
     "nock": "13.2.9",

packages/npm-resolver/src/index.ts

@@ -16,6 +16,7 @@ import { DependencyManifest } from '@pnpm/types'
 import LRU from 'lru-cache'
 import normalize from 'normalize-path'
 import pMemoize from 'p-memoize'
+import clone from 'ramda/src/clone'
 import semver from 'semver'
 import ssri from 'ssri'
 import pickPackage, {
@@ -317,7 +318,7 @@ function resolveFromLocalPackage (
   }
   return {
     id,
-    manifest: localPackage.manifest,
+    manifest: clone(localPackage.manifest),
     normalizedPref,
     resolution: {
       directory,

packages/resolve-dependencies/src/resolveDependencies.ts

@@ -41,6 +41,7 @@ import {
 import * as dp from 'dependency-path'
 import exists from 'path-exists'
 import isEmpty from 'ramda/src/isEmpty'
+import omit from 'ramda/src/omit'
 import zipWith from 'ramda/src/zipWith'
 import semver from 'semver'
 import encodePkgId from './encodePkgId'
@@ -935,14 +936,17 @@ async function resolveDependency (
   }
   if (pkg.peerDependencies && pkg.dependencies) {
     if (ctx.autoInstallPeers) {
-      for (const peerDep of Object.keys(pkg.peerDependencies)) {
-        delete pkg.dependencies[peerDep]
+      pkg = {
+        ...pkg,
+        dependencies: omit(Object.keys(pkg.peerDependencies), pkg.dependencies),
       }
     } else {
-      for (const peerDep of Object.keys(pkg.peerDependencies)) {
-        if (options.parentPkgAliases[peerDep]) {
-          delete pkg.dependencies[peerDep]
-        }
+      pkg = {
+        ...pkg,
+        dependencies: omit(
+          Object.keys(pkg.peerDependencies).filter((peerDep) => options.parentPkgAliases[peerDep]),
+          pkg.dependencies
+        ),
       }
     }
   }

pnpm-lock.yaml

@@ -2510,6 +2510,9 @@ importers:
       path-temp:
         specifier: ^2.0.0
         version: 2.0.0
+      ramda:
+        specifier: npm:@pnpm/ramda@0.28.1
+        version: /@pnpm/ramda/0.28.1
       rename-overwrite:
         specifier: ^4.0.2
         version: 4.0.2
@@ -2538,6 +2541,9 @@ importers:
       '@types/normalize-path':
         specifier: ^3.0.0
         version: 3.0.0
+      '@types/ramda':
+        specifier: 0.28.15
+        version: 0.28.15
       '@types/semver':
         specifier: 7.3.10
         version: 7.3.10
@@ -5588,7 +5594,7 @@ packages:
     engines: {node: '>=6.0.0'}
     hasBin: true
     dependencies:
-      '@babel/types': 7.17.10
+      '@babel/types': 7.18.13
     dev: true
 
   /@babel/parser/7.18.13_@babel+types@7.18.13: