readPackage / pnpm.overrides and relative paths in file: protocol dependencies

[walkerburgin]

pnpm version:

7.13.4, 7.13.5

Code to reproduce the issue:

See standalone repro here: walkerburgin/pnpm7-readpackage-file-repro.

Expected behavior:

With pnpm 6.24.4 we could use the .pnpmfile.cjs or pnpm.overrides in package.json to override transitive dependencies to point to a local .tgz using the file: protocol:

function readPackage(pkg) {
  if (pkg.name == "jspdf" && pkg.version == "1.5.3") {
    // jspdf takes a dependency on github.com/eligrey/FileSaver.js/e865e37af9f9947ddcced76b549e27dc45c1cb2e.
    // This corresponds to version 1.3.8. To avoid loading packages from GitHub, override the transitive dependency
    // to a vendored copy of the package in the `stash` directory.
    pkg.dependencies["file-saver"] = "file:stash/FileSaver.js-eligrey-1.3.8.tgz"
  }
  return pkg;
}

module.exports = {
  hooks: {
    readPackage,
  },
};

I'm not sure whether this behavior was intentional or a happy accident, but we found it intuitive and useful in our large monorepo.

Actual behavior:

With pnpm version 7.13.4, this produces an error:

ENOENT  ENOENT: no such file or directory, open '/Volumes/git/walkerburgin/pnpm7-readpackage-file-repro/packages/foo-app/stash/FileSaver.js-eligrey-1.3.8.tgz'

This error happened while installing the dependencies of jspdf@1.5.3

PNPM seems to be attempting to resolve the file: path relative to the leaf package in the workspace.

I believe that this was introduced by #4415.

Additional information:

• node -v prints: v16.17.1
• Windows, macOS, or Linux?: macOS

[walkerburgin]

Thank you!