A registry's metadata can disagree with the package.json in the tarball it
serves, for example by omitting peerDependenciesMeta. pnpm read one copy or
the other depending on the code path, so the lockfile depended on which
command ran and on minimumReleaseAge. Both versions now follow one rule: a
locked package that is not re-picked keeps what the lockfile records, and a
re-picked one reads registry metadata, as a fresh install does. The store's
package.json never decides what the lockfile records.
v11: a fresh install and `pnpm dedupe` read registry metadata, but an
unrelated `pnpm add` reused the locked package with the manifest from the
store and rewrote its recorded peers, so `pnpm dedupe --check` failed after
every add. The store fast path always did this. Since 11.28.1
(pnpm/pnpm#16255) the default minimumReleaseAge configuration hits it too.
A registry or git package that is reused (not updated, not in update mode)
now keeps the peerDependencies and peerDependenciesMeta its lockfile entry
records, as v12 does when it reuses a lockfile entry. As in v12, this
requires the lockfile to have been written under the current hooks and
settings. A changed pnpmfile or packageExtensions checksum, a possibly
changed untracked readPackage hook, --force, an old lockfile version or
merge conflicts fall back to the resolver's manifest. Local directories are
excluded, since their contents change under the same id.
v12: `pnpm dedupe` reopens every locked version. The npm resolver re-picked
a reopened range from registry metadata but answered a reopened exact
version from the store unless minimumReleaseAge made the peek ineligible.
A reopened version now always goes through the picker. The offline fallback
still reads the store. The exact-spec exception never changed which version
an edge gets.
Both stacks test install, add, dedupe, update and install --force against a
registry whose metadata disagrees with the tarball, with and without the
release-age cutoff, for an exact and a range spec. pnpr-fixtures gains
remove_version_field for this.
Closespnpm/pnpm#16615
Zoltan Kochan
fb1fd43535