Contribution

• I'd be willing to implement this feature (contributing guide)

Describe the user story

In a pnpm workspace I would like to pin certain dependencies e.g. rarely used CLIs etc. to a specific version.
I don't want to add them as normal devDependencies since they are not used often enough to justify always installing them.

The only solution currently is to inline the version in the command e.g. pnpm dlx large-cli@1.2.3 or write a wrapper script that reads the version from the catalog definition.

Especially in the current situation with lots of malicious npm packages, I think it is important to have an easy and scalable way of pinning the versions of packages, invoked via dlx.

Describe the solution you'd like

When running pnpm dlx inside a pnpm workspace, resolve package versions from the catalog when using the catalog: protocol.

pnpm-workspace.yaml

catalog:
  large-cli: '1.2.3'

pnpm dlx large-cli@catalog: -> should run large-cli with version 1.2.3, no the latest.

Describe the drawbacks of your solution

No response

Describe alternatives you've considered

• Inlining the pinned version: would loose support for tooling like renovate, dependabot etc.
• wrapper script, that manually reads the catalog: not very ergonomic / scalable