Lockfile records tarball URLs from scope registries that the docs say are omitted #16866

Last pnpm version that worked

11.28.5

pnpm version

12.12.1

Code to reproduce the issue

echo '{"dependencies":{"@types/ms":"0.7.34"}}' > package.json
echo '@types:registry=https://registry.npmmirror.com/' > .npmrc
pnpm install
grep resolution pnpm-lock.yaml

Expected behavior

No tarball:, per https://pnpm.io/registries: "pnpm omits a tarball URL from pnpm-lock.yaml when it can rebuild the URL from the package's name, version, and registry".

Actual behavior

tarball: https://registry.npmmirror.com/@types/ms/-/ms-0.7.34.tgz is recorded.

Additional information

A registry that is reachable under several URLs and builds tarball URLs from the request fails --frozen-lockfile with ERR_PNPM_TARBALL_URL_MISMATCH through any URL other than the one the lockfile was written through.

pnpm v11 does not record this URL so it seems like a regression in pnpm v12. At minimum, the docs should be fixed to describe what the code actually does.

Node.js version

v26.11.1

Operating System

macOS

Written by Claude Code