pnpm reads settings only from the pnpm-workspace.yaml at the workspace
root. When an outer workspace's packages glob matches a directory that is
itself a workspace, the inner file's patchedDependencies, overrides, and
other settings were dropped without a word, and the next install from the
outer root rewrote the inner lockfile without its patches.
Both CLIs now print one warning per installed project that carries a
pnpm-workspace.yaml, naming the file and the two ways out: move the
settings to the root, or exclude the project from the root's packages.
The TypeScript CLI emits it from installDeps next to the workspace cycle
warning. The Rust CLI emits it from the install-family selection, where
the scope log is reported once for every plan shape, so a workspace with
a lockfile per project still warns once.
Closespnpm/pnpm#11724
---------
Co-authored-by: Zoltan Kochan <z@kochan.io>
