fix: [OSM-2481] pnpm outofsync error fix for overlap dep in peer/dev deps

Author: gemaxim

lib/dep-graph-builders/pnpm/lockfile-parser/lockfile-parser.ts

@@ -92,6 +92,7 @@ export abstract class PnpmLockfileParser {
         // Return early because dependencies were already normalized for this importer
         // as part of another's importer dependency and stored in extractedPackages
         this.extractedPackages[`${name}@${version}`] &&
+        this.extractedPackages[`${name}@${version}`].localWorkspacePackage &&
         !isEmpty(this.extractedPackages[`${name}@${version}`].dependencies)
       ) {
         return this.normalizedPkgToTopLevel(
@@ -134,6 +135,7 @@ export abstract class PnpmLockfileParser {
         devDependencies: this.topLevelDepsToNormalizedPkgs(devDeps),
         optionalDependencies: this.topLevelDepsToNormalizedPkgs(optionalDeps),
         isDev: false,
+        localWorkspacePackage: true,
       };
     }
     return { ...prodDeps, ...devDeps, ...optionalDeps, ...peerDeps };
@@ -246,6 +248,7 @@ export abstract class PnpmLockfileParser {
         isDev,
         dependencies: {},
         devDependencies: {},
+        localWorkspacePackage: true,
       };
 
       const subDeps = this.rawPnpmLock.importers[resolvedPathDep] || {
@@ -280,6 +283,7 @@ export abstract class PnpmLockfileParser {
         dependencies: resolvedDeps,
         devDependencies: resolvedDevDeps,
         optionalDependencies: resolvedOptionalDeps,
+        localWorkspacePackage: true,
       };
     }
     return version;

lib/dep-graph-builders/pnpm/types.ts

@@ -29,6 +29,7 @@ export type NormalisedPnpmPkg = {
   dependencies: Record<string, string>;
   devDependencies: Record<string, string>;
   optionalDependencies?: Record<string, string>;
+  localWorkspacePackage?: boolean;
 };
 
 export type PnpmNode = {

lib/dep-graph-builders/util.ts

@@ -54,9 +54,7 @@ export const getTopLevelDeps = (
 ): Dependencies => {
   const prodDeps = getGraphDependencies(pkgJson.dependencies || {}, false);
 
-  const devDeps = options.includeDevDeps
-    ? getGraphDependencies(pkgJson.devDependencies || {}, true)
-    : {};
+  const devDeps = getGraphDependencies(pkgJson.devDependencies || {}, true);
 
   const optionalDeps = options.includeOptionalDeps
     ? getGraphDependencies(pkgJson.optionalDependencies || {}, false)
@@ -66,7 +64,24 @@ export const getTopLevelDeps = (
     ? getGraphDependencies(pkgJson.peerDependencies || {}, false)
     : {};
 
-  return { ...prodDeps, ...devDeps, ...optionalDeps, ...peerDeps };
+  const deps = { ...prodDeps, ...optionalDeps, ...peerDeps };
+
+  if (options.includeDevDeps) {
+    // Ensure dev dependency 'isDev' flags are correctly set.
+    // Dev dependencies are applied last to override shared keys with regular dependencies.
+    return { ...deps, ...devDeps };
+  }
+
+  // For includeDevDeps option set to false, simulate pnpm install --prod
+  // by excluding all devDependencies,
+  // ignoring potential duplicates in other dependency lists.
+  // https://pnpm.io/cli/install#--prod--p
+  return Object.keys(deps)
+    .filter((packageName) => !devDeps.hasOwnProperty(packageName))
+    .reduce((result, packageName) => {
+      result[packageName] = deps[packageName];
+      return result;
+    }, {});
 };
 
 /**

test/jest/dep-graph-builders/fixtures/pnpm-lock-v5/duplicate-dev-peer-deps/expected.json

@@ -0,0 +1,88 @@
+{
+  "schemaVersion": "1.3.0",
+  "pkgManager": {
+    "name": "pnpm"
+  },
+  "pkgs": [
+    {
+      "id": "[email protected]",
+      "info": {
+        "name": "duplicate-dev-peer-deps",
+        "version": "1.0.0"
+      }
+    },
+    {
+      "id": "[email protected]",
+      "info": {
+        "name": "react",
+        "version": "18.3.1"
+      }
+    },
+    {
+      "id": "[email protected]",
+      "info": {
+        "name": "loose-envify",
+        "version": "1.4.0"
+      }
+    },
+    {
+      "id": "[email protected]",
+      "info": {
+        "name": "js-tokens",
+        "version": "4.0.0"
+      }
+    }
+  ],
+  "graph": {
+    "rootNodeId": "root-node",
+    "nodes": [
+      {
+        "nodeId": "root-node",
+        "pkgId": "[email protected]",
+        "deps": [
+          {
+            "nodeId": "[email protected]"
+          }
+        ]
+      },
+      {
+        "nodeId": "[email protected]",
+        "pkgId": "[email protected]",
+        "deps": [
+          {
+            "nodeId": "[email protected]"
+          }
+        ],
+        "info": {
+          "labels": {
+            "scope": "prod"
+          }
+        }
+      },
+      {
+        "nodeId": "[email protected]",
+        "pkgId": "[email protected]",
+        "deps": [
+          {
+            "nodeId": "[email protected]"
+          }
+        ],
+        "info": {
+          "labels": {
+            "scope": "prod"
+          }
+        }
+      },
+      {
+        "nodeId": "[email protected]",
+        "pkgId": "[email protected]",
+        "deps": [],
+        "info": {
+          "labels": {
+            "scope": "prod"
+          }
+        }
+      }
+    ]
+  }
+}

test/jest/dep-graph-builders/fixtures/pnpm-lock-v5/duplicate-dev-peer-deps/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "duplicate-dev-peer-deps",
+  "version": "1.0.0",
+  "peerDependencies": {
+    "@emotion/react": "^11.13.5",
+    "react": "^18.3.1"
+  },
+  "devDependencies": {
+    "@emotion/react": "^11.13.5",
+    "typescript": "5.7.2"
+  }
+}