Installing packages bumps hash for unrelated git packages in lock file

[dangmai]

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

No response

Which area(s) of pnpm are affected? (leave empty if unsure)

Lockfile

Link to the code that reproduces this issue or a replay of the bug

https://github.com/dangmai/pnpm-lib-1

Reproduction steps

You can run the following commands after cloning my repository:

pnpm i
pnpm add express
git diff

Observe that the lockfile shows that the dependency dangmai/pnpm-dep-1 has been bumped up in the lockfile.

Describe the Bug

If you're using a git dependency with a mutable identifier (for example, #main), any install or update commands lead to its version getting bumped up in the lockfile.

Expected Behavior

Commands that deal with specific packages shouldn't affect other packages.

Which Node.js version are you using?

v16.20.0

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

Ubuntu

[await-ovo]

It does look like a bug here. Tested it with npm@8.11.0 and yarn@3.6.3, git-protocol dependency will not changed after add express.

[RoyRao2333]

@await-ovo @zkochan

Is this already fixed? I can still reproduce this issue by calling pnpm add xxx@latest. A lot of packages' dependency added a hash for no reason:

But if I remove all local node_modules and call pnpm store prune, then manually edit the package's version in package.json, the lockfile will be alright by calling pnpm install rather than pnpm add xxx@latest.