Use both key and version when sorting lockfile entries (#4541)

Co-authored-by: Chris Olszewski <chris.olszewski@vercel.com>

cli/internal/lockfile/lockfile.go

@@ -56,7 +56,7 @@ func (p ByKey) Swap(i, j int) {
 }
 
 func (p ByKey) Less(i, j int) bool {
-	return p[i].Key < p[j].Key
+	return p[i].Key+p[i].Version < p[j].Key+p[j].Version
 }
 
 var _ (sort.Interface) = (*ByKey)(nil)

cli/internal/lockfile/pnpm_lockfile_test.go

@@ -3,6 +3,7 @@ package lockfile
 import (
 	"bytes"
 	"os"
+	"sort"
 	"testing"
 
 	"github.com/google/go-cmp/cmp/cmpopts"
@@ -375,3 +376,31 @@ func Test_DepPathParsing(t *testing.T) {
 		assert.Equal(t, parseDepPath(tc.input), tc.dp, tc.input)
 	}
 }
+
+func Test_MixedVersioning(t *testing.T) {
+	contents, err := getFixture(t, "pnpm-absolute.yaml")
+	assert.NilError(t, err)
+
+	lockfile, err := DecodePnpmLockfile(contents)
+	assert.NilError(t, err)
+
+	closure, err := transitiveClosure("packages/a", map[string]string{"@scope/parent": "^1.0.0", "another": "^1.0.0", "special": "npm:Special@1.2.3"}, lockfile)
+	assert.NilError(t, err)
+
+	deps := []Package{}
+
+	for _, v := range closure.ToSlice() {
+		dep := v.(Package)
+		deps = append(deps, dep)
+	}
+	sort.Sort(ByKey(deps))
+
+	assert.DeepEqual(t, deps, []Package{
+		{"/@scope/child/1.0.0", "1.0.0", true},
+		{"/@scope/parent/1.0.0", "1.0.0", true},
+		{"/Special/1.2.3", "/Special/1.2.3", true},
+		{"/Special/1.2.3", "1.2.3", true},
+		{"/another/1.0.0", "1.0.0", true},
+		{"/foo/1.0.0", "1.0.0", true},
+	})
+}

cli/internal/lockfile/testdata/pnpm-absolute.yaml

@@ -2,9 +2,14 @@ lockfileVersion: 5.4
 importers:
   packages/a:
     specifiers:
+      another: ^1.0.0
       "@scope/parent": ^1.0.0
+      special: npm:Special@1.2.3
     dependencies:
-      somepackage: 1.0.0
+      another: 1.0.0
+      "@scope/parent": 1.0.0
+      special: /Special/1.2.3
+
 packages:
   /@scope/parent/1.0.0:
     resolution: { integrity: junk }
@@ -15,3 +20,19 @@ packages:
   /@scope/child/1.0.0:
     resolution: { integrity: junk }
     dev: false
+
+  /another/1.0.0:
+    resolution: { integrity: junk }
+    dev: false
+    dependencies:
+      foo: 1.0.0
+
+  /foo/1.0.0:
+    resolution: { integrity: junk }
+    dev: false
+    dependencies:
+      Special: 1.2.3
+
+  /Special/1.2.3:
+    resolution: { integrity: junk }
+    dev: false