bundledDependencies: false inconsistently added to pnpm-lock.yaml

[jfirebaugh]

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

No response

Which area(s) of pnpm are affected? (leave empty if unsure)

Lockfile

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

Run pnpm install --lockfile-only --ignore-scripts locally and commit the lockfile. Run pnpm install --lockfile-only --ignore-scripts in CI, with the identical version of pnpm, and then git diff --exit-code -- pnpm-lock.yaml. The expected result is that there are no changes to the lockfile.

Describe the Bug

Sometimes, there are changes to the lockfile, namely that locally pnpm install --lockfile-only --ignore-scripts has added bundledDependencies: false to certain dependencies, whereas in CI it is not present.

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1d7740ed185..a5f9996888b 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -25507,7 +25507,6 @@ packages:
       loose-envify: 1.4.0
       object-assign: 4.1.1
     dev: false
-    bundledDependencies: false
   /create-react-context@0.3.0(prop-types@15.8.1)(react@18.2.0):
     resolution: {integrity: sha512-dNldIoSuNSvlTJ7slIKC/ZFGKexBMBrrcc+TTe1NdmROnaASuLPvqpwj9v4XS4uXZ8+YPu0sNmShX2rXI5LNsw==}
@@ -40647,7 +40646,6 @@ packages:
     transitivePeerDependencies:
       - supports-color
     dev: false
-    bundledDependencies: false
   /react-diff-viewer-continued@3.2.4(react-dom@18.2.0)(react@18.2.0):
     resolution: {integrity: sha512-4LyUBVTnv82I87SiqoyfFugQ4+7s/52IdJZVPsAYMfxEm7irBteGYNFrBqzznTsPeLHD61lRxlPY/s+aSts15Q==}

Expected Behavior

Consistent behavior with regards to bundledDependencies: false no matter where pnpm is run.

Which Node.js version are you using?

18.17.1

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

Debian Bullseye

[jfirebaugh]

Bisects to 8.13.1 -- 8.13.0 does not add bundledDependencies: false locally.

[zkochan]

Could you share what packages in the lockfile have the bundledDependencies: false field?

[zkochan]

This change is probably related: #7412

It was released in 8.13.1

I have tried to publish a package with "bundleDependencies": true but it looks like npm normalizes it to an array, so I don't know how to test this.