Relative path overrides don't work in monorepos

Verify latest release

I verified that the issue exists in the latest pnpm release

pnpm version

10.33.0

Which area(s) of pnpm are affected? (leave empty if unsure)

Package version resolution

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

Create a monorepo with a workspace package, so you have two package.json files, one in the root and one in the workspace.
Create or download a package tarball and place it in the root of the monorepo.
Set overrides in the root package.json file that points to that tarball using relative paths, e.g. "foo": "./foo.tgz"
Use that package as a dependency in your workspace package. If we stay with the "foo" example, put "foo" in the "dependencies" section of the workspace package's package.json.
Run pnpm install

Describe the Bug

I have a monorepo where I try to override packages by pointing to local tarballs using relative paths. It works for packages listed as dependencies in the root package.json, but not for packages that are used as deps in any of the workspace packages. For the workspace packages the relative path is resolved relative to the workspace package itself, which obviously won't work.

Here's my root package.json

{
  "private": true,
  "devDependencies": {
    "@cedarjs/core": "3.1.0",
    "@cedarjs/eslint-config": "3.1.0",
    "@cedarjs/project-config": "3.1.0",
    "@cedarjs/testing": "3.1.0"
  },
  "engines": {
    "node": "=24.x"
  },
  "packageManager": "pnpm@10.33.0",
  "pnpm": {
    "overrides": {
      "react-is": "19.2.3",
      "@cedarjs/fastify-web": "./tarballs/cedarjs-fastify-web.tgz",
      "@cedarjs/api": "./tarballs/cedarjs-api.tgz",
      "@cedarjs/api-server": "./tarballs/cedarjs-api-server.tgz",
      "@cedarjs/auth": "./tarballs/cedarjs-auth.tgz",
      "@cedarjs/auth-auth0-api": "./tarballs/cedarjs-auth-auth0-api.tgz",
      "@cedarjs/auth-auth0-setup": "./tarballs/cedarjs-auth-auth0-setup.tgz",
      "@cedarjs/auth-auth0-web": "./tarballs/cedarjs-auth-auth0-web.tgz",
      "@cedarjs/auth-azure-active-directory-api": "./tarballs/cedarjs-auth-azure-active-directory-api.tgz",
      "@cedarjs/auth-azure-active-directory-setup": "./tarballs/cedarjs-auth-azure-active-directory-setup.tgz",
      "@cedarjs/auth-azure-active-directory-web": "./tarballs/cedarjs-auth-azure-active-directory-web.tgz",
      "@cedarjs/auth-clerk-api": "./tarballs/cedarjs-auth-clerk-api.tgz",
      "@cedarjs/auth-clerk-setup": "./tarballs/cedarjs-auth-clerk-setup.tgz",
      "@cedarjs/auth-clerk-web": "./tarballs/cedarjs-auth-clerk-web.tgz",
      "@cedarjs/auth-custom-setup": "./tarballs/cedarjs-auth-custom-setup.tgz",
      "@cedarjs/auth-dbauth-api": "./tarballs/cedarjs-auth-dbauth-api.tgz",
      "@cedarjs/auth-dbauth-middleware": "./tarballs/cedarjs-auth-dbauth-middleware.tgz",
      "@cedarjs/auth-dbauth-setup": "./tarballs/cedarjs-auth-dbauth-setup.tgz",
      "@cedarjs/auth-dbauth-web": "./tarballs/cedarjs-auth-dbauth-web.tgz",
      "@cedarjs/auth-firebase-api": "./tarballs/cedarjs-auth-firebase-api.tgz",
      "@cedarjs/auth-firebase-setup": "./tarballs/cedarjs-auth-firebase-setup.tgz",
      "@cedarjs/auth-firebase-web": "./tarballs/cedarjs-auth-firebase-web.tgz",
      "@cedarjs/auth-netlify-api": "./tarballs/cedarjs-auth-netlify-api.tgz",
      "@cedarjs/auth-netlify-setup": "./tarballs/cedarjs-auth-netlify-setup.tgz",
      "@cedarjs/auth-netlify-web": "./tarballs/cedarjs-auth-netlify-web.tgz",
      "@cedarjs/auth-supabase-api": "./tarballs/cedarjs-auth-supabase-api.tgz",
      "@cedarjs/auth-supabase-middleware": "./tarballs/cedarjs-auth-supabase-middleware.tgz",
      "@cedarjs/auth-supabase-setup": "./tarballs/cedarjs-auth-supabase-setup.tgz",
      "@cedarjs/auth-supabase-web": "./tarballs/cedarjs-auth-supabase-web.tgz",
      "@cedarjs/auth-supertokens-api": "./tarballs/cedarjs-auth-supertokens-api.tgz",
      "@cedarjs/auth-supertokens-setup": "./tarballs/cedarjs-auth-supertokens-setup.tgz",
      "@cedarjs/auth-supertokens-web": "./tarballs/cedarjs-auth-supertokens-web.tgz",
      "@cedarjs/babel-config": "./tarballs/cedarjs-babel-config.tgz",
      "@cedarjs/cli": "./tarballs/cedarjs-cli.tgz",
      "@cedarjs/cli-helpers": "./tarballs/cedarjs-cli-helpers.tgz",
      "@cedarjs/cli-data-migrate": "./tarballs/cedarjs-cli-data-migrate.tgz",
      "@cedarjs/cli-storybook-vite": "./tarballs/cedarjs-cli-storybook-vite.tgz",
      "@cedarjs/codemods": "./tarballs/cedarjs-codemods.tgz",
      "@cedarjs/context": "./tarballs/cedarjs-context.tgz",
      "@cedarjs/cookie-jar": "./tarballs/cedarjs-cookie-jar.tgz",
      "@cedarjs/core": "./tarballs/cedarjs-core.tgz",
      "create-cedar-app": "./tarballs/create-cedar-app.tgz",
      "@cedarjs/eslint-config": "./tarballs/cedarjs-eslint-config.tgz",
      "@cedarjs/eslint-plugin": "./tarballs/cedarjs-eslint-plugin.tgz",
      "@cedarjs/forms": "./tarballs/cedarjs-forms.tgz",
      "@cedarjs/framework-tools": "./tarballs/cedarjs-framework-tools.tgz",
      "@cedarjs/gqlorm": "./tarballs/cedarjs-gqlorm.tgz",
      "@cedarjs/graphql-server": "./tarballs/cedarjs-graphql-server.tgz",
      "@cedarjs/internal": "./tarballs/cedarjs-internal.tgz",
      "@cedarjs/jobs": "./tarballs/cedarjs-jobs.tgz",
      "@cedarjs/mailer-core": "./tarballs/cedarjs-mailer-core.tgz",
      "@cedarjs/mailer-handler-in-memory": "./tarballs/cedarjs-mailer-handler-in-memory.tgz",
      "@cedarjs/mailer-handler-nodemailer": "./tarballs/cedarjs-mailer-handler-nodemailer.tgz",
      "@cedarjs/mailer-handler-resend": "./tarballs/cedarjs-mailer-handler-resend.tgz",
      "@cedarjs/mailer-handler-studio": "./tarballs/cedarjs-mailer-handler-studio.tgz",
      "@cedarjs/mailer-renderer-mjml-react": "./tarballs/cedarjs-mailer-renderer-mjml-react.tgz",
      "@cedarjs/mailer-renderer-react-email": "./tarballs/cedarjs-mailer-renderer-react-email.tgz",
      "@cedarjs/ogimage-gen": "./tarballs/cedarjs-ogimage-gen.tgz",
      "@cedarjs/prerender": "./tarballs/cedarjs-prerender.tgz",
      "@cedarjs/project-config": "./tarballs/cedarjs-project-config.tgz",
      "@cedarjs/realtime": "./tarballs/cedarjs-realtime.tgz",
      "@cedarjs/record": "./tarballs/cedarjs-record.tgz",
      "@cedarjs/router": "./tarballs/cedarjs-router.tgz",
      "@cedarjs/server-store": "./tarballs/cedarjs-server-store.tgz",
      "@cedarjs/storage": "./tarballs/cedarjs-storage.tgz",
      "storybook-framework-cedarjs": "./tarballs/storybook-framework-cedarjs.tgz",
      "@cedarjs/structure": "./tarballs/cedarjs-structure.tgz",
      "@cedarjs/telemetry": "./tarballs/cedarjs-telemetry.tgz",
      "@cedarjs/testing": "./tarballs/cedarjs-testing.tgz",
      "@cedarjs/tui": "./tarballs/cedarjs-tui.tgz",
      "@cedarjs/utils": "./tarballs/cedarjs-utils.tgz",
      "@cedarjs/vite": "./tarballs/cedarjs-vite.tgz",
      "@cedarjs/web": "./tarballs/cedarjs-web.tgz",
      "@cedarjs/web-server": "./tarballs/cedarjs-web-server.tgz",
      "@cedarjs/upgrade-scripts": "./tarballs/cedarjs-upgrade-scripts.tgz",
      "react": "19.2.3",
      "react-dom": "19.2.3"
    }
  }
}

And here's the package.json of a workspace package

{
  "name": "api",
  "version": "0.0.0",
  "private": true,
  "dependencies": {
    "@cedarjs/api": "3.1.0",
    "@cedarjs/graphql-server": "3.1.0",
    "@prisma/adapter-better-sqlite3": "7.5.0",
    "better-sqlite3": "12.8.0"
  }
}

Running pnpm install gives me this message

❯ pnpm install
Scope: all 3 workspace projects
/Users/tobbe/tmp/cedar-pm-agnostic-iii/api:
 ENOENT  ENOENT: no such file or directory, open '/Users/tobbe/tmp/cedar-pm-agnostic-iii/api/tarballs/cedarjs-api.tgz'

This error happened while installing a direct dependency of /Users/tobbe/tmp/cedar-pm-agnostic-iii/api

Expected Behavior

The path to the tarball is resolved relative to the file the path is defined in (i.e. relative to the root package.json)

Which Node.js version are you using?

24.13.1

Which operating systems have you used?

macOS
Windows
Linux

Extra Info

I'm not sure, but this might be a regression. It sound like this was maybe reported and fixed in #5493

fix(overrides): measure a bare path in an override from the workspace

#15134 is open for this.

The cause is not specific to tarballs. pnpm.overrides is written once, at the workspace root, and applied to every package that matches. A file: / link: value moves with it: the overrider anchors the path at the root and renders it again for each package it rewrites. A value written as a bare path, such as your ./tarballs/cedarjs-api.tgz, did not, so it was measured from whichever package the override landed on. Writing the same value as file:./tarballs/cedarjs-api.tgz resolves correctly today, which is a workaround until this lands.

The PR fixes every bare local path, a directory as much as a tarball, and it fixes both pnpm v11 and pnpm v12.

On #11134, which is also linked here: it predates the repository's pnpm11/ move, so it edits files at paths that no longer exist, and it rebases only a bare tarball value, in pnpm v11 alone. Its tarball case is covered by the new PR.

Written by an agent (Claude Code, claude-opus-5).

fix(overrides): measure a bare path in an override from the workspace

This no longer reproduces on current pnpm, so closing.

Verified on pnpm 12.5.1: an override that points at a tarball with a relative path applies to a workspace project, and the path is read from the workspace root.

If you still hit this on the latest pnpm, please comment with a reproduction and we will reopen.

Written by an agent (Claude Code, claude-opus-5).

fix(overrides): measure a bare path in an override from the workspace (…

Navigation Menu

Repository navigation

Relative path overrides don't work in monorepos #11131

Verify latest release

pnpm version

Which area(s) of pnpm are affected? (leave empty if unsure)

Link to the code that reproduces this issue or a replay of the bug

Reproduction steps

Describe the Bug

Expected Behavior

Which Node.js version are you using?

Which operating systems have you used?

Extra Info

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Relative path overrides don't work in monorepos #11131

Description

Verify latest release

pnpm version

Which area(s) of pnpm are affected? (leave empty if unsure)

Link to the code that reproduces this issue or a replay of the bug

Reproduction steps

Describe the Bug

Expected Behavior

Which Node.js version are you using?

Which operating systems have you used?

Extra Info

Activity

zkochan commented on Sep 19, 2026

zkochan commented on Sep 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions