minimumReleaseAgeExcludePrune removes minimumReleaseAgeExclude entries for config dependencies #17142

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

12.14.0

Which area(s) of pnpm are affected? (leave empty if unsure)

Dependencies resolver, Lockfile

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

1. Create pnpm-workspace.yaml:

   configDependencies:
     '@pnpm/plugin-types-fixer': ^0.1.0
   minimumReleaseAgeExcludePrune: true
   minimumReleaseAgeExclude:
     - '@pnpm/plugin-types-fixer'

2. Run pnpm install (or pnpm install --force in an already-installed project).

3. The minimumReleaseAgeExclude entry has been removed from pnpm-workspace.yaml.

Describe the Bug

pnpm removes the minimumReleaseAgeExclude entry even though the lockfile resolves the package as a config dependency:

importers:
  .:
    configDependencies:
      '@pnpm/plugin-types-fixer':
        specifier: ^0.1.0
        version: 0.1.0

The prune pass builds its set of resolved packages only from the main lockfile document's snapshots (record_resolved_package_versions). Config dependencies are recorded in the env document that leads pnpm-lock.yaml (EnvLockfile), which the pass never reads, so every config dependency looks unresolved. The same set drives trustPolicyExcludePrune, so trustPolicyExclude entries for config dependencies are likely affected too.

Related: #16660. Its workaround (listing config dependencies in the workspace's minimumReleaseAgeExclude) is undone by this bug when minimumReleaseAgeExcludePrune: true is set.

Expected Behavior

Entries that match a resolved config dependency are kept.

minimumReleaseAge applies to config dependencies declared with a range, so excluding one is the only way to install a just-published version of your own config plugin. With minimumReleaseAgeExcludePrune: true, that exclusion is deleted on the next resolving install.

Which Node.js version are you using?

24.22.0

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response

Contributing a fix

• I am working on a fix