Repository navigation
pnpm 12 treats remote tarball URLs as peer dependency versions (follow-up to #15298) #17037
Description
Verify latest release
- I verified that the issue exists in the latest pnpm release (12.14.0)
pnpm version
12.14.0 (works in 11.15.1)
Reproduction
pnpm-workspace.yaml
packages:
- packages/*
strictPeerDependencies: truepackages/lib/package.json
{
"name": "lib",
"version": "1.0.0",
"peerDependencies": { "konva": ">=9.0.0" },
"devDependencies": { "konva": "https://codeload.github.com/konvajs/konva/tar.gz/refs/tags/10.0.0" }
}packages/app/package.json
{
"name": "app",
"version": "1.0.0",
"dependencies": {
"lib": "workspace:*",
"konva": "https://codeload.github.com/konvajs/konva/tar.gz/refs/tags/10.0.0"
}
}Run pnpm install (or pnpm peers check).
Actual behavior
[ERR_PNPM_PEER_DEP_ISSUES] Unmet peer dependencies
packages/app
✕ unmet peer konva
Installed: https://codeload.github.com/konvajs/konva/tar.gz/refs/tags/10.0.0
Wanted:
>=9.0.0:
lib@1.0.0
Expected behavior
The peer is satisfied by the tarball's manifest version (10.0.0), as in pnpm 11.15.1, which installs without peer issues.
Additional info
#15298 / #15299 fixed this for local file: tarballs; remote tarball (and git-hosted codeload) URLs still compare the locator string against the range. Workaround: peerDependencyRules.allowAny.
Node 24.13.0, macOS.
Activity
github-actions commentedon Oct 17, 2026
@max-tafelmayer, are you planning to open a pull request for this? If so, reply here and a maintainer will assign the issue to you, so nobody else starts on the same fix.
samanyudas commentedon Oct 17, 2026
I'm working on a fix for this.
fix(peers): check linked peers against remote tarball manifest versions
fix(peers): check linked peers against remote tarball manifest versio…
Update pnpm to v12.15.0 (#2046)
Update pnpm to v12.15.0 (#2046)