Skip to content

fix: Retain injected workspace package entries during pnpm lockfile pruning#12073

Merged
anthonyshew merged 1 commit into
mainfrom
shew/issue-11059-fix
Feb 28, 2026
Merged

fix: Retain injected workspace package entries during pnpm lockfile pruning#12073
anthonyshew merged 1 commit into
mainfrom
shew/issue-11059-fix

Conversation

@anthonyshew

Copy link
Copy Markdown
Contributor

Summary

Fixes #11059

  • turbo prune now correctly retains packages and snapshots entries for injected workspace dependencies that use file: protocol resolution
  • Handles both pnpm 10's global injectWorkspacePackages: true setting and per-dependency dependenciesMeta.*.injected: true
  • Adds the injected package's transitive dependencies to the pruned lockfile as well

Why

When pnpm injects (hard-links) workspace packages, the lockfile resolves those deps via file: protocol instead of link:, creating entries in both packages and snapshots sections. The pruning code only looked at dependenciesMeta.injected (missing the global setting), only added to packages (missing snapshots), and used the wrong key format for V6+ lockfiles.

Testing

  • Two new Rust unit tests in crates/turborepo-lockfiles/src/pnpm/data.rs exercise both the global setting and per-dependency injection paths with file: versions
  • New pnpm-10-inject-workspace-packages fixture in lockfile-tests/ validates the end-to-end prune + frozen install flow
  • All 82 existing pnpm lockfile test cases continue to pass

@anthonyshew anthonyshew requested a review from a team as a code owner February 28, 2026 19:16
@anthonyshew anthonyshew requested review from tknickman and removed request for a team February 28, 2026 19:16
@vercel

vercel Bot commented Feb 28, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
examples-basic-web Ready Ready Preview, Comment, Open in v0 Feb 28, 2026 10:11pm
examples-designsystem-docs Ready Ready Preview, Comment, Open in v0 Feb 28, 2026 10:11pm
examples-gatsby-web Ready Ready Preview, Comment, Open in v0 Feb 28, 2026 10:11pm
examples-kitchensink-blog Ready Ready Preview, Comment, Open in v0 Feb 28, 2026 10:11pm
examples-nonmonorepo Ready Ready Preview, Comment, Open in v0 Feb 28, 2026 10:11pm
examples-svelte-web Ready Ready Preview, Comment, Open in v0 Feb 28, 2026 10:11pm
examples-tailwind-web Ready Ready Preview, Comment, Open in v0 Feb 28, 2026 10:11pm
examples-vite-web Ready Ready Preview, Comment, Open in v0 Feb 28, 2026 10:11pm
turbo-site Ready Ready Preview, Comment, Open in v0 Feb 28, 2026 10:11pm
turborepo-agents Ready Ready Preview, Comment, Open in v0 Feb 28, 2026 10:11pm
turborepo-test-coverage Ready Ready Preview, Comment, Open in v0 Feb 28, 2026 10:11pm

@github-actions

github-actions Bot commented Feb 28, 2026

Copy link
Copy Markdown
Contributor

Coverage Report

Metric Coverage
Lines 82.89%
Functions 54.65%
Branches 0.00%

View full report

Comment thread crates/turborepo-lockfiles/src/pnpm/data.rs Outdated
…runing

When injectWorkspacePackages is enabled (pnpm 10) or dependenciesMeta.injected
is set per-dependency, workspace deps resolved via file: protocol have entries
in both packages and snapshots sections of the lockfile. turbo prune was
dropping these entries because:

1. The global injectWorkspacePackages setting was ignored entirely
2. Injected packages were only added to pruned_packages, not pruned_snapshots
3. The package key format was wrong for V6+ lockfiles (used raw version instead
   of name@version)

Fixes #11059
@anthonyshew anthonyshew merged commit acbe869 into main Feb 28, 2026
72 checks passed
@anthonyshew anthonyshew deleted the shew/issue-11059-fix branch February 28, 2026 22:22
anthonyshew added a commit that referenced this pull request Mar 1, 2026
…8243) (#12082)

## Summary

- Adds an end-to-end lockfile fixture (`pnpm-v9-inject-workspace`) that
reproduces the scenario from #8243: `turbo prune` with pnpm v9 lockfiles
using `dependenciesMeta.injected: true` and `link:` protocol resolution
- Adds a Rust unit test (`test_subgraph_with_pnpm9_link_injected_deps`)
covering the `link:` protocol case specifically, since the existing
injected-dep tests only covered `file:` protocol

The underlying bug was already fixed in #12073. The existing tests for
injected deps only exercised the `file:` protocol (used by pnpm 10's
`injectWorkspacePackages: true`). In pnpm 9, `dependenciesMeta.injected:
true` still resolves to `link:` in the lockfile, which is a distinct
code path. This adds regression coverage for that case.

Closes #8243
github-actions Bot added a commit that referenced this pull request Mar 2, 2026
## Release v2.8.13-canary.9

Versioned docs: https://v2-8-13-canary-9.turborepo.dev

### Changes

- fix: Treat `npm: alias` dependencies as external, not workspace
references (#12061) (`b179cb8`)
- test: Port 18 more prysk tests to Rust (other/ +
lockfile-aware-caching/) (#12062) (`7887af2`)
- release(turborepo): 2.8.13-canary.8 (#12063) (`2a5522a`)
- fix: Preserve file: protocol entries in pruned yarn v1 lockfile
(#12064) (`ae5c1a1`)
- perf: Use stack-allocated OidHash in FileHashes and skip expanded
hashes on normal runs (#12065) (`677b248`)
- test: Port all 8 find-turbo prysk tests to Rust (#12066) (`f827fca`)
- fix: Support pnpm per-workspace lockfiles in turbo prune (#12067)
(`23d047d`)
- test: Port final 2 prysk tests to Rust (100% complete) (#12068)
(`6d7e057`)
- fix: Resolve Berry prune failure when resolutions contain patch
overrides (#12069) (`6fe3c5e`)
- test: Add lockfile fixture for yarn berry resolution pruning (issue
#2791) (#12071) (`6cc1654`)
- chore: Remove prysk test framework entirely (#12070) (`ed2d05a`)
- refactor: Clean up test infrastructure and eliminate duplication
(#12072) (`338911d`)
- fix: Retain injected workspace package entries during pnpm lockfile
pruning (#12073) (`acbe869`)
- ci: Exclude turborepo-lsp and turborepo-schema-gen from test builds
(#12075) (`4ce12e2`)
- refactor: Clean up test infrastructure + improve test quality (#12074)
(`4571f2b`)
- ci: Remove redundant cargo build from coverage job (#12077)
(`3c9bbe2`)
- perf: Speed up lockfile test suite (#12078) (`20024df`)
- ci: Remove integration test serialization (#12079) (`24d7c02`)
- fix: Preserve `file:` and `link:` protocol entries in pruned bun
lockfile (#12076) (`2635d9a`)
- fix: Stop running unnecessary npm install in engines tests (#12081)
(`24e4905`)
- test: Add lockfile fixture for pnpm v9 injected workspace deps (issue
#8243) (#12082) (`4d4929b`)
- fix: Filter orphaned Yarn packageExtensions entries during lockfile
pruning (#12084) (`68eb223`)
- fix: Align experimentalObservability on object maps rather than arrays
(#12089) (`9b9d1e4`)
- examples: Upgrade with-react-native-web example to use latest versions
(#12085) (`980ca43`)
- fix: duplicate /signup? in Vercel URL (#12088) (`e865b51`)
- ci: Deduplicate Rust test compilation with nextest archive (#12083)
(`962cf39`)
- fix: Prevent yarn integration tests from hanging on corepack prompts
(#12090) (`29b0da7`)
- fix: Prevent turbo dev from hanging when daemon file watching fails
(#12091) (`b0d2f62`)
- ci: Skip pnpm install for Rust test jobs (#12092) (`ebd137f`)
- perf: Optimize npm lockfile parser (#12093) (`e4b4a66`)
- chore: Trim unused dependency features for faster compilation (#12094)
(`03b79e0`)
- fix: Prevent lockfile-aware yarn test from hanging on corepack
downloads (#12095) (`bf516e4`)
- fix: Exclude turborepo-repository from JS smoke test in release
workflow (#12097) (`fecc400`)

---------

Co-authored-by: Turbobot <turbobot@vercel.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Turbo prune removes necessary packages and snapshots of hard linked deps from pnpm-lock.yaml when inject-workspace-packages=true

1 participant