pnpm doesn't deduplicate dependencies correctly

[ocavue]

pnpm version: 6.7.4

Code to reproduce the issue:

When I updated the dependency @types/react from ^17.0.9 to ^17.0.10 in my project, I got both version of @types/react in node_modules and pnpm-lock.yaml, which causes the following error when I build the project with tsc:

$ error TS2300: Duplicate identifier 'LibraryManagedAttributes'.

For example, I can find that @types/reactcss@1.2.3 is still using @types/react@17.0.9 based on what I saw in pnpm-lock.yaml:

// pnpm-lock.yaml
  /@types/reactcss/1.2.3:
    resolution: {integrity: sha512-d2gQQ0IL6hXLnoRfVYZukQNWHuVsE75DzFTLPUuyyEhJS8G2VvlE+qfQQ91SJjaMqlURRCNIsX7Jcsw6cEuJlA==}
    dependencies:
      '@types/react': 17.0.9
    dev: false

// node_modules/@types/reactcss/package.json
{
    "name": "@types/reactcss",
    "version": "1.2.3",
    "dependencies": {
        "@types/react": "*"
    }
}

---

Check this PR to see the code: ocavue/rino#646

Detailed step to reproduce this bug:

/tmp $ git clone https://github.com/ocavue/rino
/tmp $ cd rino/
/tmp/rino (master) $ git --no-pager log --oneline -n 1 
4211d45 (HEAD -> master, origin/master, origin/HEAD) chore: add stabilityDays to renovate config (#645)
/tmp/rino (master) $ pnpm i
/tmp/rino (master) $ cd packages/common/
/tmp/rino/packages/common (master) $ pnpm build

> @rino.app/common@0.0.0 build /tmp/rino/packages/common
> tsc --build src/tsconfig.json && tsc --build src/tsconfig.cjs.json

/tmp/rino/packages/common (master) $ 
/tmp/rino/packages/common (master) $ cd ../..
/tmp/rino (master) $ git checkout chore/react
Branch 'chore/react' set up to track remote branch 'chore/react' from 'origin'.
Switched to a new branch 'chore/react'
/tmp/rino (chore/react) $ git --no-pager log --oneline -n 1 
084f6ee (HEAD -> chore/react, origin/chore/react) force ci to ignore cache
/tmp/rino (chore/react) $ 
/tmp/rino (chore/react) $ pnpm i
/tmp/rino (chore/react) $ cd packages/common
/tmp/rino/packages/common (chore/react) $ rm -rf dist 
/tmp/rino/packages/common (chore/react) $ pnpm build

> @rino.app/common@0.0.0 build /tmp/rino/packages/common
> tsc --build src/tsconfig.json && tsc --build src/tsconfig.cjs.json

../../node_modules/.pnpm/@types+react@17.0.10/node_modules/@types/react/index.d.ts:3051:14 - error TS2300: Duplicate identifier 'LibraryManagedAttributes'.

3051         type LibraryManagedAttributes<C, P> = C extends React.MemoExoticComponent<infer T> | React.LazyExoticComponent<infer T>
                  ~~~~~~~~~~~~~~~~~~~~~~~~

  ../../node_modules/.pnpm/@types+react@17.0.9/node_modules/@types/react/index.d.ts:3047:14
    3047         type LibraryManagedAttributes<C, P> = C extends React.MemoExoticComponent<infer T> | React.LazyExoticComponent<infer T>
                      ~~~~~~~~~~~~~~~~~~~~~~~~
    'LibraryManagedAttributes' was also declared here.

../../node_modules/.pnpm/@types+react@17.0.9/node_modules/@types/react/index.d.ts:3047:14 - error TS2300: Duplicate identifier 'LibraryManagedAttributes'.

3047         type LibraryManagedAttributes<C, P> = C extends React.MemoExoticComponent<infer T> | React.LazyExoticComponent<infer T>
                  ~~~~~~~~~~~~~~~~~~~~~~~~

  ../../node_modules/.pnpm/@types+react@17.0.10/node_modules/@types/react/index.d.ts:3051:14
    3051         type LibraryManagedAttributes<C, P> = C extends React.MemoExoticComponent<infer T> | React.LazyExoticComponent<infer T>
                      ~~~~~~~~~~~~~~~~~~~~~~~~
    'LibraryManagedAttributes' was also declared here.


Found 2 errors.

 ERROR  Command failed with exit code 1.
/tmp/rino/packages/common (chore/react) $ 

Expected behavior:

No deduplicate dependencies and no build error.

Actual behavior:

I have both @types/react@17.0.9 and @types/react@17.0.10 installed.

Additional information:

• node -v prints: v16.3.0 / v14.15.1
• Windows, macOS, or Linux?: macOS 11.2 / Ubuntu 18.04.1

I can fix this issue by removing node_modules and pnpm-lock.yaml and reinstalling dependencies, but it's not an ideal way obviously.

[ocavue]

It seems that pnpm -r update '@types/react' will not cause this issue. But if I manually edit all package.json and then run pnpm install, then this error will occur.

I guess renovate uses the latter way to update dependencies and that's why I found this issue.

[ocavue]

Closing this issue since I failed to reproduce this with a minimal repo. I will try to give more information if I see this issue twice.

[wujunchuan]

Perhaps the discussion #4143 is talking about this issue?
I have the similar error but can fix by pnpm update, but will reproduce after pnpm install or pnpm add some-pakcage.

[ocavue]

@wujunchuan You can check my little tool pnpm-deduplicate and see if it helps in your case.