injectWorkspacePackages: true skips changed injected dependency manifests during optimistic install (12.14.0) #17007

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

12.14.0

Which area(s) of pnpm are affected? (leave empty if unsure)

No response

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

With pnpm 12.14.0 on PATH, save the following as repro.sh and run sh repro.sh normal. Alternatively set PNPM_BIN to the executable for that version. The script creates an isolated temporary directory and requires Node.js.

#!/bin/sh
set -eu
PNPM_BIN=${PNPM_BIN:-pnpm}
OPERATION=${1:-normal}
repro_dir=$(mktemp -d)
cd "$repro_dir"
mkdir app lib
printf '{"name":"root","private":true}\n' > package.json
cat > pnpm-workspace.yaml <<'YAML'
packages: [app, lib]
sharedWorkspaceLockfile: false
injectWorkspacePackages: true
dedupeInjectedDeps: false
registry: https://registry.npmjs.org/
YAML
printf '{"name":"app","private":true,"dependencies":{"lib":"workspace:*"}}\n' > app/package.json
printf '{"name":"lib","version":"1.0.0","main":"index.cjs","dependencies":{"is-number":"6.0.0"}}\n' > lib/package.json
printf "module.exports = require('is-number/package.json').version\n" > lib/index.cjs
"$PNPM_BIN" --version
"$PNPM_BIN" install --no-frozen-lockfile --ignore-scripts
cp app/pnpm-lock.yaml before.yaml
node -e 'const fs=require("node:fs");const p="lib/package.json";const j=JSON.parse(fs.readFileSync(p));j.dependencies["is-number"]="7.0.0";fs.writeFileSync(p,JSON.stringify(j))'
if [ "$OPERATION" = frozen ]; then
  "$PNPM_BIN" --filter app install --frozen-lockfile --ignore-scripts
else
  "$PNPM_BIN" --filter app install --no-frozen-lockfile --ignore-scripts
fi
if cmp -s before.yaml app/pnpm-lock.yaml; then
  echo 'consumer lockfile unchanged'
else
  echo 'consumer lockfile updated'
fi
printf 'dependency actually loaded by injected lib: '
node -p "require('./app/node_modules/lib')"
echo "Reproduction directory: $repro_dir"
if [ "$OPERATION" = normal ]; then
  "$PNPM_BIN" --filter app install --frozen-lockfile --ignore-scripts
fi

The only change is lib/package.json: is-number 6.0.0 -> 7.0.0. Neither lib's version nor app's manifest changes. dedupeInjectedDeps: false ensures lib is actually injected.

Describe the Bug

With sharedWorkspaceLockfile: false, injectWorkspacePackages: true, and existing node_modules, changing an injected package's dependency does not invalidate the consumer install. Normal non-frozen install and --lockfile-only return exit 0 without updating app/pnpm-lock.yaml, and the injected lib still loads is-number 6.0.0.

The subsequent --frozen-lockfile correctly rejects that same lockfile with ERR_PNPM_OUTDATED_LOCKFILE: local dependency "lib" at "../lib" is outdated. Thus a successful non-frozen install leaves a state pnpm itself considers invalid.

Controls tested

These controls suggest an optimistic-repeat-install invalidation gap specific to global injectWorkspacePackages. Related background: #7209 / #15356. Reproduced on latest npm release 12.14.0 and compared with latest 11.x 11.28.6, on macOS Darwin 25.6.0 arm64.

Expected Behavior

A non-frozen install should re-resolve the changed injected package, update app/pnpm-lock.yaml to is-number 7.0.0, and install 7.0.0 for lib. --lockfile-only should also update the consumer lockfile. A subsequent frozen install should then succeed.

Which Node.js version are you using?

v26.2.0

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response

Contributing a fix

• I am working on a fix