--frozen-lockfile fails with "local dependency is outdated" when an injected workspace package has a catalog: peer dependency #16557

Last pnpm version that worked

12.6.0

pnpm version

12.7.0 (also 12.8.0, 12.8.1, 12.8.2, 12.9.0)

Code to reproduce the issue

An injected workspace package declares a peer dependency with the catalog: protocol. pnpm install writes a lockfile, and pnpm install --frozen-lockfile immediately rejects that same lockfile.

Save this as repro.sh and run sh repro.sh 12.9.0 false (per-project lockfiles) or sh repro.sh 12.9.0 true (shared lockfile):

#!/bin/sh
set -eu
PNPM_VERSION=${1:-12.9.0}
SHARED=${2:-false}
pnpm() { npx -y "pnpm@$PNPM_VERSION" "$@"; }
dir=$(mktemp -d) && cd "$dir"
mkdir -p app lib
echo '{"name":"root","private":true}' > package.json
cat > pnpm-workspace.yaml <<EOF
packages:
  - app
  - lib
injectWorkspacePackages: true
catalog:
  is-odd: 3.0.1
EOF
if [ "$SHARED" = false ]; then
  echo 'sharedWorkspaceLockfile: false' >> pnpm-workspace.yaml
else
  echo 'dedupeInjectedDeps: false' >> pnpm-workspace.yaml
fi
echo '{"name":"lib","version":"1.0.0","peerDependencies":{"is-odd":"catalog:"}}' > lib/package.json
echo '{"name":"app","private":true,"dependencies":{"lib":"workspace:*","is-odd":"catalog:"}}' > app/package.json

pnpm --version
pnpm install
pnpm install --frozen-lockfile

Replacing "is-odd": "catalog:" in lib/package.json with "is-odd": "3.0.1" makes 12.9.0 pass in both modes.

Expected behavior

pnpm install --frozen-lockfile succeeds right after pnpm install, as it does on 12.6.0.

Actual behavior

Error: ERR_PNPM_OUTDATED_LOCKFILE

  × installing dependencies
  ╰─▶ Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up
      to date with package.json.

        Failure reason:
        local dependency "lib" at "../lib" is outdated

Additional information

The lockfile records the resolved peer range for the injected package:

packages:
  lib@file:../lib:
    resolution: {directory: ../lib, type: directory}
    peerDependencies:
      is-odd: 3.0.1

check_recorded_peer_specs_match in pnpm/crates/package-manager/src/install/lockfile_freshness/directory_deps.rs, added in #15356, compares the peer ranges from the injected package's raw package.json (catalog:) with the recorded ones (3.0.1) as strings, so they never match. The freshness check resolves catalog: for overrides (parse_config_overrides in lockfile_freshness.rs) but not for the injected package's peer dependencies. The code is unchanged on main (bf5cdd3).

With a shared lockfile and the default dedupeInjectedDeps: true, the dependency is recorded as link: and skips this check, which is why the shared case needs dedupeInjectedDeps: false to reproduce.

Node.js version

v24.21.0

Operating System

macOS