fix(overrides): filter overrides by intersection instead of subset (#6904)

close #6878

.changeset/sour-spiders-rest.md

@@ -0,0 +1,5 @@
+---
+"@pnpm/hooks.read-package-hook": patch
+---
+
+Compare overriding ranges with intersection instead of subset to fix override range bug [#6878](https://github.com/pnpm/pnpm/issues/6878).

hooks/read-package-hook/src/createVersionsOverrider.ts

@@ -5,7 +5,7 @@ import { type Dependencies, type PackageManifest, type ReadPackageHook } from '@
 import { PnpmError } from '@pnpm/error'
 import { parseOverrides } from '@pnpm/parse-overrides'
 import normalizePath from 'normalize-path'
-import { isSubRange } from './isSubRange'
+import { isIntersectingRange } from './isIntersectingRange'
 
 export function createVersionsOverrider (
   overrides: Record<string, string>,
@@ -94,13 +94,13 @@ function overrideDeps (
     pickMostSpecificVersionOverride(
       versionOverrides.filter(
         ({ targetPkg }) =>
-          targetPkg.name === name && isSubRange(targetPkg.pref, pref)
+          targetPkg.name === name && isIntersectingRange(targetPkg.pref, pref)
       )
     ) ??
     pickMostSpecificVersionOverride(
       genericVersionOverrides.filter(
         ({ targetPkg }) =>
-          targetPkg.name === name && isSubRange(targetPkg.pref, pref)
+          targetPkg.name === name && isIntersectingRange(targetPkg.pref, pref)
       )
     )
     if (!versionOverride) continue
@@ -122,5 +122,5 @@ function overrideDeps (
 }
 
 function pickMostSpecificVersionOverride (versionOverrides: VersionOverride[]): VersionOverride | undefined {
-  return versionOverrides.sort((a, b) => isSubRange(b.targetPkg.pref ?? '', a.targetPkg.pref ?? '') ? -1 : 1)[0]
+  return versionOverrides.sort((a, b) => isIntersectingRange(b.targetPkg.pref ?? '', a.targetPkg.pref ?? '') ? -1 : 1)[0]
 }

hooks/read-package-hook/src/isIntersectingRange.ts

@@ -0,0 +1,9 @@
+import semver from 'semver'
+
+export function isIntersectingRange (range1: string | undefined, range2: string) {
+  return !range1 ||
+    range2 === range1 ||
+    semver.validRange(range2) != null &&
+    semver.validRange(range1) != null &&
+    semver.intersects(range2, range1)
+}

hooks/read-package-hook/test/createVersionOverrider.test.ts

@@ -370,3 +370,16 @@ test('createVersionOverrider() throws error when supplied an invalid selector',
     'foo > bar': '2',
   }, process.cwd())).toThrowError('Cannot parse the "foo > bar" selector in pnpm.overrides')
 })
+
+test('createVersionsOverrider() matches intersections', () => {
+  const overrider = createVersionsOverrider({
+    'foo@<1.2.4': '>=1.2.4',
+  }, process.cwd())
+  expect(
+    overrider({
+      dependencies: { foo: '^1.2.3' },
+    })
+  ).toStrictEqual({
+    dependencies: { foo: '>=1.2.4' },
+  })
+})