fix: frozen install in a project with peer deps and auto-install-peers=true (#5120)

close #5080

.changeset/breezy-geese-end.md

@@ -0,0 +1,6 @@
+---
+"@pnpm/lockfile-utils": patch
+"pnpm": patch
+---
+
+pnpm should not consider a lockfile out-of-date if `auto-install-peers` is set to `true` and the peer dependency is in `devDependencies` or `optionalDependencies` [#5080](https://github.com/pnpm/pnpm/issues/5080).

packages/lockfile-utils/src/satisfiesPackageManifest.ts

@@ -4,23 +4,24 @@ import {
   ProjectManifest,
 } from '@pnpm/types'
 import equals from 'ramda/src/equals.js'
+import omit from 'ramda/src/omit.js'
 
 export default (lockfile: Lockfile, pkg: ProjectManifest, importerId: string, opts?: { autoInstallPeers?: boolean }) => {
   const importer = lockfile.importers[importerId]
   if (!importer) return false
   let existingDeps = { ...pkg.devDependencies, ...pkg.dependencies, ...pkg.optionalDependencies }
   if (opts?.autoInstallPeers) {
-    existingDeps = {
-      ...pkg.peerDependencies,
-      ...existingDeps,
-    }
     pkg = {
       ...pkg,
       dependencies: {
-        ...pkg.peerDependencies,
+        ...omit(Object.keys(existingDeps), pkg.peerDependencies),
         ...pkg.dependencies,
       },
     }
+    existingDeps = {
+      ...pkg.peerDependencies,
+      ...existingDeps,
+    }
   }
   if (
     !equals(existingDeps, importer.specifiers) ||

packages/lockfile-utils/test/satisfiesPackageManifest.ts

@@ -284,6 +284,36 @@ test('satisfiesPackageManifest()', () => {
     },
   }, '.', { autoInstallPeers: true })).toBe(true)
 
+  expect(satisfiesPackageManifest({
+    ...DEFAULT_LOCKFILE_FIELDS,
+    importers: {
+      '.': {
+        optionalDependencies: {
+          bar: '1.0.0',
+        },
+        devDependencies: {
+          foo: '1.0.0',
+        },
+        specifiers: {
+          foo: '1.0.0',
+          bar: '1.0.0',
+        },
+      },
+    },
+  }, {
+    ...DEFAULT_PKG_FIELDS,
+    optionalDependencies: {
+      bar: '1.0.0',
+    },
+    devDependencies: {
+      foo: '1.0.0',
+    },
+    peerDependencies: {
+      foo: '^1.0.0',
+      bar: '^1.0.0',
+    },
+  }, '.', { autoInstallPeers: true })).toBe(true)
+
   expect(satisfiesPackageManifest({
     ...DEFAULT_LOCKFILE_FIELDS,
     importers: {