pnpm update drops existing overrides metadata and reverts parent-scoped dependency resolution #16232

Existing issue search

Searched existing pnpm/overrides/lockfile reports. #15073 concerns adding unrelated audit overrides; this report concerns dropping existing manifest overrides and changing their resolved dependency.

Package ecosystem and environment

GitHub-native Dependabot, npm ecosystem, /astro-site; pnpm lockfile v9. Native verification: pnpm 10.33.0, Node.js 22.22.3, Linux. The hosted updater's exact pnpm version and dependabot-core revision are not available in the public PR/check artifacts; I am not assuming they match the local version.

Public reproduction artifacts

• Original bot PR #564, original bot commit d0160c50bdd2ff98067db65088a7780c3656104d.
• Manifest before update, including pnpm.overrides and "satori>fflate": "0.7.5".
• Lockfile before update.
• Bot-generated lockfile.
• Dependabot configuration.
• Failing CI check.

The grouped update bumps Astro 7.2.10 → 7.3.1, ESLint 10.9.1 → 10.10.0, and Playwright 1.62.1 → 1.63.0. The manifest's overrides are unchanged.

Expected versus actual

Expected: preserve existing pnpm.overrides in both the dependency resolution and lockfile metadata, so a frozen install succeeds.

Actual: the generated lockfile removes the complete top-level overrides: mapping and changes satori@0.33.4's dependency from fflate: 0.7.5 to fflate: 0.7.3, adding a 0.7.3 package/snapshot entry. This is not just missing metadata. A local frozen install fails:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH Cannot proceed with the frozen installation. The current "overrides" configuration doesn't match the value found in the lockfile

Native package manager behavior

These steps reproduce the failure and repair the exact public bot artifact (they do not reproduce the hosted updater itself):

git clone https://github.com/williamzujkowski/williamzujkowski.github.io.git
cd williamzujkowski.github.io
git checkout d0160c50bdd2ff98067db65088a7780c3656104d
cd astro-site
# pnpm 10.33.0
pnpm install --frozen-lockfile   # fails as above
pnpm install --lockfile-only
pnpm install --frozen-lockfile   # succeeds

Native regeneration restores the overrides header, removes the fflate@0.7.3 entries, restores satori → fflate@0.7.5, and reapplies six override-related peer range metadata entries. It does not change the three requested direct dependency updates. The repaired tree builds and passes type checking, lint, design audits and 18 unit tests.

Scope and remaining uncertainty

Earlier occurrences in the same repository were tracked in local issue #540. The previous working hypothesis was serialization-only, but the new parent-scoped satori>fflate override makes the resolution regression directly visible. I have not reduced this to a smaller manifest or identified the responsible hosted updater code path. The pinned original bot commit above remains available after the per-PR manual repair.