When "pnpm-lock.yaml" doesn't exist, "pnpm install" should not respect "node_modules/.pnpm-lock.yaml"

[sachinjoseph]

pnpm version: 3.5.3

Code to reproduce the issue:

https://github.com/sachinjoseph/rush-pnpm-bug/tree/pnpm-install-node_modules-lockfile-bug

Repro steps

git checkout pnpm-install-node_modules-lockfile-bug

cd common/temp

1. pnpm install
   Installs react-focus-lock version 1.17.7

2. rm .\pnpm-lock.yaml

3. pnpm install
   Installs react-focus-lock version 1.17.7

4. rm .\pnpm-lock.yaml
rm .\node_modules\.pnpm-lock.yaml

5. pnpm install
   Installs react-focus-lock version 1.19.1

Expected behavior:

If pnpm-lock.yaml doesn't exist, pnpm install should not respect .pnpm-lock.yaml in node_modules folder.
In the repro steps, step 4 should fail.

Actual behavior:

When pnpm-lock.yaml doesn't exist, pnpm install respects .pnpm-lock.yaml in node_modules folder. Step 4 passes when pnpm-lock.yaml doesn't exist.

Additional information:

• node -v prints: v10.15.3
• Windows, OS X, or Linux?: Windows 10

[sachinjoseph]

@zkochan I also have a related question: If pnpm-lock.yaml (and the backup node_modules/.pnpm-lock.yaml) doesn't exist, then are pnpm install and pnpm update expected to behave in the exact same way?

[zkochan]

@zkochan I also have a related question: If pnpm-lock.yaml (and the backup node_modules/.pnpm-lock.yaml) doesn't exist, then are pnpm install and pnpm update expected to behave in the exact same way?

yes

[zkochan]

I don't think this is an issue. Some users of pnpm set the lockfile config to false, so they don't even get a pnpm-lock.yaml. So for these users, pnpm install would always behave as pnpm update --depth Infinity

[sachinjoseph]

Okay, thanks. Closing this issue.