doesn't resolve to latest satisfied version

[tjx666]

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

8.14.1

Which area(s) of pnpm are affected? (leave empty if unsure)

No response

Link to the code that reproduces this issue or a replay of the bug

https://stackblitz.com/~/github.com/tjx666/mono-project

Reproduction steps

1. open https://stackblitz.com/~/github.com/tjx666/mono-project
2. pnpm install, packages/pkg1 will install @yutengjing/foo v1.0.0 because of the lockfile
3. rm pnpm-lockfile.yaml
4. pnpm install, packages/pkg1 should install @yutengjing/foo v1.0.2 but still install v1.0.0
5. If I remove node_modules first and then remove pnpm-lock.yaml, pnpm install, will install correctlly

Describe the Bug

When I remove lockfile, and reinstall, packages/pkg1 still install v1.0.0

Seems affected by the node_modules. If I remove the node_modules, everythings ok.

Expected Behavior

should install @yutengjing/foo v1.0.2. Because I decalre the version by ^1.0.0, and the latest version is v1.0.2.

Which Node.js version are you using?

18.8

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response

[zkochan]

So why don't you run pnpm update if you want to update a dependency? This behaviour seems correct to me. Why should pnpm change an existing node_modules only because you remove the lockfile?

[tjx666]

In my opinion, when I remove lockfile, the install result should be the same whether or not the node_modules exits. node_modules shouldn't affect the install result.

pnpm update is the better way to update deps, but many people include me all know remove the lockfile will make the deps to update...

[zkochan]

but many people include me all know remove the lockfile will make the deps to update...

I am not sure what made you believe that. Historically, npm didn't even have a lockfile by default and running npm install repeatadely didn't update node_modules. That's what the update command is for. Some users still don't use a lockfile, they set the lockfile setting to false, so running update on repeat install doesn't seem like the right solution.

That said, I don't know what most people would expect. However, I think this is the first time I hear about this expectation.

[tjx666]

I'm wrting a article about how pnpm resolve duplicate deps, I think pnpm will update to latest satified verison when there is no lockfile. But after test, I find it will be affted by node_module cache.