Unexpected interaction between --lockfile-only with --frozen-lockfile modifies the lockfile.

[Zemnmez]

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

8.7.0

Which area(s) of pnpm are affected? (leave empty if unsure)

CLI

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

npm exec pnpm@8.7.0 --yes i --frozen-lockfile --lockfile-only --dir .

Describe the Bug

This should have been fixed as per #6913
I note that ecad8a7 shows the commit as having landed in https://github.com/pnpm/pnpm/releases/tag/v8.7.0-0 and https://github.com/pnpm/pnpm/releases/tag/v8.6.12

I note that functionality is broken anytime --dir is provided (previously, I thought it was broken at a specific version.

At these versions, PNPM should be checking the lockfile and throwing an error if it's out of sync with package.json. However, it is simply updating the lockfile.

Expected Behavior

PNPM checks the lockfile is in sync with package.json, but does not update it or node_modules. PNPM returns a failure code.

Which Node.js version are you using?

v20.5.1

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

Ubuntu

[Zemnmez]

@zkochan

[Zemnmez]

sorry about all the noise sapling is generating on this issue.

[Zemnmez]

Okay, I've confirmed that this works correctly ONLY when --dir is not provided.

[Zemnmez]

tshadwell@Thomass-Air monorepo-sl % npm exec --yes pnpm@8.6.12 i --frozen-lockfile --lockfile-only
 ERR_PNPM_OUTDATED_LOCKFILE  Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up to date with package.json

Note that in CI environments this setting is true by default. If you still need to run install in such cases, use "pnpm install --no-frozen-lockfile"

8.6.12 working as intended without --dir.

tshadwell@Thomass-Air monorepo-sl % npm exec --yes pnpm@8.6.12 i --frozen-lockfile --lockfile-only --dir .
 WARN  `node_modules` is present. Lockfile only installation will make it out-of-date
 WARN  deprecated @bazel/typescript@5.8.1: No longer maintained, https://github.com/aspect-build/rules_ts is the recommended replacement
 WARN  deprecated @types/sharp@0.32.0: This is a stub types definition. sharp provides its own type definitions, so you do not need this installed.
 WARN  deprecated @types/svgo@3.0.0: This is a stub types definition. svgo provides its own type definitions, so you do not need this installed.
Progress: resolved 86, reused 85, downloaded 0

8.6.12 failing with --dir.

tshadwell@Thomass-Air monorepo-sl % npm exec --yes pnpm@latest i --frozen-lockfile --lockfile-only --dir .
 WARN  `node_modules` is present. Lockfile only installation will make it out-of-date
 WARN  deprecated @bazel/typescript@5.8.1: No longer maintained, https://github.com/aspect-build/rules_ts is the recommended replacement
 WARN  deprecated @types/sharp@0.32.0: This is a stub types definition. sharp provides its own type definitions, so you do not need this installed.
 WARN  deprecated @types/svgo@3.0.0: This is a stub types definition. svgo provides its own type definitions, so you do not need this installed.
 WARN  deprecated @pulumi/command@4.5.0: Inadvertently published.
Progress: resolved 98, reused 98, downloaded 0