External dependencies that has packageExtensions to depend on internal dependencies causes lockfile to always unable to be frozen

[kenrick95]

pnpm version: 7.5.1

Code to reproduce the issue:

In this repo: https://github.com/kenrick95/pnpm-testing-repro-peers-issue using PNPM which has #4776 implemented causes pnpm install --frozen-lockfileto always fail regardless if pnpm install has been executed before.

This seems to be caused by #4776 since I managed to reproduce the issue even in 6.32.18+ (6.32.16-6.32.17 are not usable due to #4796). This issue didn't happen at 6.32.15.

The issue seem to go away if I set auto-install-peers = false

One symptom that I find is that, in the lockfile, I see entries like

importers:
  /package/something:
    specifiers:
      pkg-a: 'workspace: ^'
      pkg-b: 'workspace: ^'
      pkg-c: '' // <-- just empty string here ???
      pkg-d: 'workspace: ^'

This seem related to packageExtensions where it injects "dependencies" of internal packages to an external package.

In that repro https://github.com/kenrick95/pnpm-testing-repro-peers-issue

@kenrick95/external-depend-on-internal has peerDep + devDep to @kenrick95/internal-a, @kenrick95/internal-b, @kenrick95/internal-c, @kenrick95/internal-d

At root package.json, the packageExtensions set this:

  "pnpm": {
    "packageExtensions": {
      "@kenrick95/external-depend-on-internal": {
        "dependencies": {
          "@kenrick95/internal-a": "*",
          "@kenrick95/internal-b": "*",
          "@kenrick95/internal-c": "*",
          "@kenrick95/internal-d": "*",
          "@kenrick95/internal-e": "*"
        }
      }
    }
  },

This is used at packages/e/package.json:

{
  "name": "@kenrick95/internal-e",
  "version": "1.0.0",
  "publishConfig": {
    "registry": "https://registry.npmjs.org/",
    "access": "public"
  },
  "dependencies": {
    "@kenrick95/external-depend-on-internal": "^1.0.0"
  }
}

The resulting lockfile looks like

  packages/e:
    specifiers:
      '@kenrick95/external-depend-on-internal': ^1.0.0
      '@kenrick95/internal-a': ''
      '@kenrick95/internal-b': ''
      '@kenrick95/internal-c': ''
      '@kenrick95/internal-d': ''
    dependencies:
      '@kenrick95/external-depend-on-internal': 1.0.0_react@16.11.0+redux@4.2.0

This causes pnpm's packages/lockfile-utils/src/satisfiesPackageManifest.ts's following block to always return false:

if (!equals({ ...pkg.devDependencies, ...pkg.dependencies, ...pkg.optionalDependencies }, importer.specifiers)) {
   // at packages/e, "importer.specifiers" object does not have "@kenrick95/internal-a", "@kenrick95/internal-b", "@kenrick95/internal-c", "@kenrick95/internal-d"
    return false
  }

Expected behavior:

pnpm install --frozen-lockfile should not fail

Actual behavior:

pnpm install --frozen-lockfile always fail regardless how many times pnpm install is executed

Additional information:

• node -v prints: 14.19.3
• Windows, macOS, or Linux?: macOS & Linux

[kenrick95]

(edit: updated issue body instead)

[valerybugakov]

We bumped into the same issue recently.