fix(lockfile): apply overrides before frozen-lockfile spec comparison#354
fix(lockfile): apply overrides before frozen-lockfile spec comparison#354
Conversation
When a name+range override (`plist@<3.0.5` → `>=3.0.5`) fires on a direct dep, pnpm rewrites the lockfile's importer specifier to the override target. The previous drift check only honored bare-name overrides via raw map lookup, so `--frozen-lockfile` reported stale on every install once the user added a version-keyed override. Pull the matching logic into a new `override_match` module that parses `name`, `name@<range>`, `@scope/name`, and `@scope/name@<range>` keys and applies them against (name, manifest spec). Parent-chain selectors (`foo>bar`, `**/foo`) are dropped at compile time — they can't fire on direct deps. Kept inside aube-lockfile to avoid a cross-crate dep cycle (aube-resolver already depends on aube-lockfile). Reported in #352.
Greptile SummaryFixes a Confidence Score: 5/5Safe to merge — the bug fix is well-scoped, all three previously flagged issues are addressed, and new unit + integration tests lock in the correct behavior. Only a P2 style issue remains (misleading comment in one test assertion). The core logic for sorting version-keyed rules before bare rules, the exclusive- No files require special attention. Important Files Changed
Reviews (2): Last reviewed commit: "fix(lockfile): handle gt-comparator, exc..." | Re-trigger Greptile |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 08ae9e7. Configure here.
…e in override matcher
Three bugs in the initial override_match landing, all caught in PR review:
1. Keys with `>` in the version req (`lodash@>=4.17.21`, `@scope/pkg@>1`)
were silently dropped because parse_key rejected any key containing
`>`. Port aube-resolver's split_segments walker, which distinguishes
`>` as a comparator continuation from `>` as a chain separator.
2. Bare-name rules always shadowed version-keyed rules for the same
package. BTreeMap iteration is alphabetical, so `"plist"` came
before `"plist@<3"` in the compiled Vec and `apply`'s find_map fired
the bare rule even when pnpm would apply the more specific one.
Sort version-keyed rules first to mirror pnpm's "more specific
selector wins".
3. range_could_satisfy(">3.0.5", "<3.0.5") returned `true` because
lower_bound_version stripped the `>` greedily, yielding 3.0.5,
which fails `<3.0.5` (boundary excluded) and falls through to the
"probably matches" default. Bump the candidate above the boundary
when the range is exclusive `>X.Y.Z`.
The existing first_matching_rule_wins test didn't catch (2) because
its probe (`"^3"`) failed the version-keyed rule's range regardless
of order. New tests pin all three behaviors.
Summary
When a name+range override (
plist@<3.0.5→>=3.0.5) fires on a direct dep, pnpm rewrites the lockfile's importerspecifier:to the override target. aube's drift check only honored bare-name overrides via raw map lookup, so--frozen-lockfilereported stale on every install once the user added a version-keyed override.Pull the matching logic into a new
override_matchmodule that parsesname,name@<range>,@scope/name, and@scope/name@<range>keys and applies them against(name, manifest_spec). Parent-chain selectors (foo>bar,**/foo) are dropped at compile time — they can't fire on direct deps. Kept inside aube-lockfile to avoid a cross-crate dep cycle (aube-resolver already depends on aube-lockfile, so the existing matcher there isn't reachable from here).Reported in #352 (item 7,
frozen-lockfile-override-specifier).Test plan
cargo clippy --all-targets -- -D warningscargo fmt --checkcargo test --package aube-lockfile— 214 tests pass, including newfresh_when_version_keyed_override_rewrites_importer_specand 7override_matchunit tests./test/bats/bin/bats test/overrides.bats— all 25 tests pass, including new "frozen-lockfile accepts version-keyed override that rewrites importer specifier"Note
Medium Risk
Changes drift detection logic used by
--frozen-lockfileto account for override rewriting; incorrect matching could cause false Fresh/Stale results and affect whether installs re-resolve.Overview
Fixes
--frozen-lockfiledrift checking to apply overrides before comparing manifest vs lockfile importerspecifiers, including version-keyed override selectors (e.g.pkg@<x).Introduces a small
override_matchmodule to parse and match direct-dependency override keys (bare andname@range, including scoped packages), ignore parent-chain selectors, and prefer more-specific (range-keyed) rules. Adds unit and Bats regression tests covering version-keyed overrides that rewrite importer specifiers.Reviewed by Cursor Bugbot for commit 7e4444a. Bugbot is set up for automated code reviews on this repo. Configure here.