Reproduction link or steps

1. Clone https://github.com/vitejs/vite
2. Run pnpm i
3. Notice that the lockfile updates itself due to tsdown's dependency on rolldown

What is expected?

The lockfile does not update itself

What is actually happening?

The lockfile is updated because tsdown depends on rolldown via latest instead of a semver ^1.0.0-beta.X, causing the installation to always pull in the latest rolldown and updates the lockfile when there's a new version of rolldown.

I don't know if this is possibly a bug in pnpm where it should always reuse the locked version, but it might be better to use a strict range in the library instead.

Any additional comments?

This seem to happen since 8ae720a. On npm, you can also see that package.json dependencies has "rolldown": "latest"