fix(deps-installer): keep catalog-referencing overrides in sync on update (#12158)

fengmk2 · zkochan · web-flow · commit 3b54d79521b1 · 2026-06-17T08:10:12.000+02:00
* fix(deps-installer): re-resolve catalog-referencing overrides on update When `pnpm.overrides` reference a catalog (e.g. `overrides: { foo: 'catalog:' }`), `pnpm update` bumped the catalog entry during resolution but left the resolved `overrides` in the lockfile pointing at the old version. The lockfile's `catalogs` advanced while `overrides` stayed stale, producing an internally inconsistent lockfile that fails a later `pnpm install --frozen-lockfile` with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. After resolution, re-resolve the overrides against the catalog merged with the update's `updatedCatalogs`, so the lockfile `overrides` track the bumped catalog just like `catalogs` and direct catalog dependencies do. * fix(deps-installer): re-resolve catalog overrides before afterAllResolved Address review feedback: - Run the catalog-override re-resolution before the `afterAllResolved` pnpmfile hook instead of after it, so a hook that edits `lockfile.overrides` still sees and can amend the final value (the block previously ran after the hook and would clobber its edits whenever a catalog entry was updated). - Drop the dead `opts.catalogs ?? {}` fallback; `opts.catalogs` is required on the install options and always defaulted to `{}`, so it is never nullish here. * test(pacquet): cover catalog-referencing override sync on update --latest Mirrors pnpm's regression test for keeping lockfile overrides that resolve through a catalog in sync when `update --latest` bumps that catalog. pacquet already behaves correctly (it threads the bumped catalogs through to override parsing), so this is a guard against a future refactor reintroducing the inconsistency that #12158 fixes on the TypeScript side. --------- Co-authored-by: Zoltan Kochan <z@kochan.io>
diff --git a/.changeset/update-catalog-overrides-sync.md b/.changeset/update-catalog-overrides-sync.md
@@ -0,0 +1,6 @@
+---
+"@pnpm/installing.deps-installer": patch
+"pnpm": patch
+---
+
+`pnpm update` now keeps lockfile `overrides` that resolve through a catalog in sync with the catalog. Previously, when an override referenced a catalog (e.g. `overrides: { foo: 'catalog:' }`) and `pnpm update` bumped that catalog entry, the lockfile's `catalogs` advanced while the resolved `overrides` kept the old version. The resulting lockfile was internally inconsistent, so a later `pnpm install --frozen-lockfile` failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH`.
diff --git a/installing/deps-installer/package.json b/installing/deps-installer/package.json
@@ -64,6 +64,7 @@
     "@pnpm/building.after-install": "workspace:*",
     "@pnpm/building.during-install": "workspace:*",
     "@pnpm/building.policy": "workspace:*",
+    "@pnpm/catalogs.config": "workspace:*",
     "@pnpm/catalogs.protocol-parser": "workspace:*",
     "@pnpm/catalogs.resolver": "workspace:*",
     "@pnpm/catalogs.types": "workspace:*",
diff --git a/installing/deps-installer/src/install/index.ts b/installing/deps-installer/src/install/index.ts
@@ -4,9 +4,11 @@ import { linkBins, linkBinsOfPackages } from '@pnpm/bins.linker'
 import { buildSelectedPkgs } from '@pnpm/building.after-install'
 import { buildModules, type DepsStateCache, linkBinsOfDependencies } from '@pnpm/building.during-install'
 import { createAllowBuildFunction, isBuildExplicitlyDisallowed } from '@pnpm/building.policy'
+import { mergeCatalogs } from '@pnpm/catalogs.config'
 import { parseCatalogProtocol } from '@pnpm/catalogs.protocol-parser'
 import { type CatalogResultMatcher, matchCatalogResolveResult, resolveFromCatalog } from '@pnpm/catalogs.resolver'
 import type { Catalogs } from '@pnpm/catalogs.types'
+import { parseOverrides } from '@pnpm/config.parse-overrides'
 import {
   LAYOUT_VERSION,
   LOCKFILE_MAJOR_VERSION,
@@ -1653,6 +1655,20 @@ const _installInContext: InstallFunction = async (projects, ctx, opts) => {
     stage: 'resolution_done',
   })
 
+  // `pnpm update` may bump catalog entries during resolution. Overrides that
+  // reference a catalog (e.g. `overrides: { foo: 'catalog:' }`) were resolved
+  // against the pre-update catalog when the install options were extended, so
+  // re-resolve them against the updated catalog. Done before `afterAllResolved`
+  // so that hook still sees (and can amend) the final overrides. Otherwise
+  // lockfile `overrides` keeps pointing at the old version while `catalogs`
+  // advances, and a later `--frozen-lockfile` install fails with
+  // ERR_PNPM_LOCKFILE_CONFIG_MISMATCH.
+  if (updatedCatalogs != null && opts.overrides != null && Object.keys(opts.overrides).length > 0) {
+    newLockfile.overrides = createOverridesMapFromParsed(
+      parseOverrides(opts.overrides, mergeCatalogs(opts.catalogs, updatedCatalogs))
+    )
+  }
+
   newLockfile = ((opts.hooks?.afterAllResolved) != null)
     ? await pipeWith(async (f, res) => f(await res), opts.hooks.afterAllResolved as any)(newLockfile) as LockfileObject // eslint-disable-line
     : newLockfile
diff --git a/installing/deps-installer/test/catalogs.ts b/installing/deps-installer/test/catalogs.ts
@@ -1659,6 +1659,74 @@ describe('update', () => {
     expect(Object.keys(lockfile.snapshots)).toEqual(['@pnpm.e2e/foo@1.3.0'])
   })
 
+  test('overrides that reference a catalog are updated in the lockfile when the catalog is updated', async () => {
+    const { options, projects, readLockfile } = preparePackagesAndReturnObjects([{
+      name: 'project1',
+      dependencies: {
+        '@pnpm.e2e/foo': 'catalog:',
+      },
+    }])
+
+    const mutateOpts = {
+      ...options,
+      lockfileOnly: true,
+      catalogs: {
+        default: { '@pnpm.e2e/foo': '1.0.0' },
+      },
+      // An override that resolves through the catalog. A scoped selector is
+      // used so the override does not shadow the direct `catalog:` dependency
+      // above (an unscoped override would replace its specifier and drop it
+      // from the catalog). The resolved value recorded in lockfile "overrides"
+      // must track the catalog as the catalog is updated.
+      overrides: {
+        '@pnpm.e2e/foobar>@pnpm.e2e/foo': 'catalog:',
+      },
+    }
+
+    await mutateModules(installProjects(projects), mutateOpts)
+
+    // Widen the catalog range so a later update can bump it, while 1.0.0 stays
+    // locked for now.
+    mutateOpts.catalogs.default['@pnpm.e2e/foo'] = '^1.0.0'
+    await mutateModules(installProjects(projects), mutateOpts)
+
+    expect(readLockfile().catalogs.default).toEqual({
+      '@pnpm.e2e/foo': { specifier: '^1.0.0', version: '1.0.0' },
+    })
+    expect(readLockfile().overrides).toEqual({ '@pnpm.e2e/foobar>@pnpm.e2e/foo': '^1.0.0' })
+
+    const { updatedCatalogs } = await addDependenciesToPackage(
+      projects['project1' as ProjectId],
+      ['@pnpm.e2e/foo'],
+      {
+        ...mutateOpts,
+        dir: path.join(options.lockfileDir, 'project1'),
+        update: true,
+      })
+
+    expect(updatedCatalogs).toEqual({
+      default: { '@pnpm.e2e/foo': '^1.3.0' },
+    })
+
+    const lockfile = readLockfile()
+    expect(lockfile.catalogs).toEqual({
+      default: { '@pnpm.e2e/foo': { specifier: '^1.3.0', version: '1.3.0' } },
+    })
+
+    // The override referencing the catalog must be updated to match the new
+    // catalog. Otherwise lockfile "overrides" points at the old version while
+    // "catalogs" points at the new one, and a later frozen install fails with
+    // ERR_PNPM_LOCKFILE_CONFIG_MISMATCH.
+    expect(lockfile.overrides).toEqual({ '@pnpm.e2e/foobar>@pnpm.e2e/foo': '^1.3.0' })
+
+    // The updated catalog is written back to pnpm-workspace.yaml, so a
+    // subsequent frozen install reads the bumped catalog. It must not fail.
+    mutateOpts.catalogs.default['@pnpm.e2e/foo'] = '^1.3.0'
+    await expect(
+      mutateModules(installProjects(projects), { ...mutateOpts, frozenLockfile: true })
+    ).resolves.toBeDefined()
+  })
+
   test('update works on named catalog', async () => {
     const { options, projects, readLockfile } = preparePackagesAndReturnObjects([{
       name: 'project1',
diff --git a/installing/deps-installer/tsconfig.json b/installing/deps-installer/tsconfig.json
@@ -39,6 +39,9 @@
     {
       "path": "../../building/policy"
     },
+    {
+      "path": "../../catalogs/config"
+    },
     {
       "path": "../../catalogs/protocol-parser"
     },
diff --git a/pacquet/crates/cli/tests/catalog.rs b/pacquet/crates/cli/tests/catalog.rs
@@ -68,6 +68,12 @@ fn catalog_snapshot(workspace: &Path, name: &str) -> (String, String) {
     (entry.specifier.clone(), entry.version.clone())
 }
 
+fn lockfile_override(workspace: &Path, selector: &str) -> Option<String> {
+    let lockfile: Lockfile =
+        serde_saphyr::from_str(&read(workspace, "pnpm-lock.yaml")).expect("parse pnpm-lock.yaml");
+    lockfile.overrides.as_ref().and_then(|overrides| overrides.get(selector).cloned())
+}
+
 fn run_ok(workspace: &Path, args: &[&str]) {
     let output = pacquet(workspace, args).output().expect("run pacquet");
     assert!(
@@ -213,6 +219,55 @@ fn update_latest_named_catalog_bumps_the_entry() {
     drop((root, anchor));
 }
 
+/// `update --latest` bumping a catalog that an override resolves through
+/// must keep `pnpm-lock.yaml`'s `overrides` in sync with the bumped
+/// catalog. A scoped selector is used so the override does not shadow the
+/// direct `catalog:` dependency. If the override is not re-resolved against
+/// the bumped catalog, lockfile `overrides` lags `catalogs` and the
+/// follow-up `--frozen-lockfile` install fails with an overrides/catalogs
+/// mismatch. Ported from pnpm's "overrides that reference a catalog are
+/// updated in the lockfile when the catalog is updated".
+#[test]
+fn update_latest_keeps_catalog_referencing_override_in_sync() {
+    let (root, workspace, anchor) = setup();
+    write_manifest(&workspace, &format!(r#"{{ "{FOO}": "catalog:" }}"#));
+    let override_selector = format!("@pnpm.e2e/foobar>{FOO}");
+    append_workspace_yaml(
+        &workspace,
+        &format!(
+            "catalogMode: prefer\ncatalog:\n  '{FOO}': '^1.0.0'\noverrides:\n  '{override_selector}': 'catalog:'\n",
+        ),
+    );
+
+    run_ok(&workspace, &["install", "--lockfile-only"]);
+
+    // The override resolves through the catalog, so it records the catalog's
+    // specifier rather than a literal version.
+    let (initial_spec, _) = catalog_snapshot(&workspace, FOO);
+    assert_eq!(
+        lockfile_override(&workspace, &override_selector).as_deref(),
+        Some(initial_spec.as_str()),
+        "override should track the catalog specifier before the update",
+    );
+
+    run_ok(&workspace, &["update", "--latest", "--lockfile-only", FOO]);
+
+    let (bumped_spec, _) = catalog_snapshot(&workspace, FOO);
+    assert_ne!(bumped_spec, initial_spec, "update --latest should bump the catalog entry");
+    assert_eq!(
+        lockfile_override(&workspace, &override_selector).as_deref(),
+        Some(bumped_spec.as_str()),
+        "lockfile override must be re-resolved against the bumped catalog",
+    );
+
+    // The bumped catalog is written back to pnpm-workspace.yaml, so a
+    // follow-up frozen install reads it and must not fail with an
+    // overrides/catalogs mismatch.
+    run_ok(&workspace, &["install", "--frozen-lockfile"]);
+
+    drop((root, anchor));
+}
+
 /// `update --latest --no-save` must not persist catalog edits to
 /// `pnpm-workspace.yaml`, matching pnpm's `if (opts.save !== false)` guard.
 #[test]
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml

Original file line number	Diff line number	Diff line change
`@@ -39,6 +39,9 @@`
`39`	`39`	`{`
`40`	`40`	`"path": "../../building/policy"`
`41`	`41`	`},`
	`42`	`+ {`
	`43`	`+ "path": "../../catalogs/config"`
	`44`	`+ },`
`42`	`45`	`{`
`43`	`46`	`"path": "../../catalogs/protocol-parser"`
`44`	`47`	`},`