pnpm grouped update does not update pnpm-workspace.yaml overrides, leaving direct dependency updates ineffective #16529

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

npm

Package manager version

pnpm 11.22.0

Language version

Node.js v24.14.0

Manifest location and content before the Dependabot update

The relevant manifests are:

• /package.json
• /pnpm-workspace.yaml
• /pnpm-lock.yaml

Before the Dependabot update, package.json contained:

{
  "dependencies": {
    "openai": "7.19.0"
  }
}

pnpm-workspace.yaml contained:

overrides:
  openai: 7.19.0

The root importer in pnpm-lock.yaml also resolved openai to 7.19.0.

Repository:
https://github.com/nyaomaru/nyaomaru-portfolio

dependabot.yml content

version: 2

updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    cooldown:
      default-days: 2
    groups:
      minor-and-patch:
        patterns:
          - '*'
        update-types:
          - minor
          - patch

Full file:
https://github.com/nyaomaru/nyaomaru-portfolio/blob/main/.github/dependabot.yml

Updated dependency

openai

From:

7.19.0

To:

7.27.0

This update was part of the minor-and-patch grouped version update.

What you expected to see, versus what you actually saw

I expected Dependabot to keep the direct dependency declaration, pnpm override, and generated lockfile consistent.

The initial Dependabot commit updated package.json from:

- "openai": "7.19.0"
+ "openai": "7.27.0"

but did not update the matching override in pnpm-workspace.yaml:

overrides:
  openai: 7.19.0

As a result, pnpm-lock.yaml continued to resolve the root importer to openai@7.19.0.

Because pnpm overrides take precedence over the direct dependency declaration, the Dependabot update was ineffective: package.json declared 7.27.0, but the project continued to install 7.19.0.

Expected behavior:

When Dependabot updates a direct dependency governed by a matching pnpm-workspace.yaml override, it should either:

1. update the matching override and regenerate pnpm-lock.yaml, or
2. leave the direct dependency unchanged and report that the override prevents the update.

This is not a duplicate of #15104. #15104 produces lockfile specifiers that are newer than their manifest declarations. This issue changes package.json while leaving the authoritative pnpm override and effective resolution at the previous version.

Related: #15104 and #16232.

Native package manager behavior

I reproduced the behavior locally.

With pnpm-workspace.yaml left at:

overrides:
  openai: 7.19.0

and only package.json changed to:

{
  "dependencies": {
    "openai": "7.27.0"
  }
}

running:

pnpm install --frozen-lockfile
node -p "require('./node_modules/openai/package.json').version"

succeeds and prints:

7.19.0

pnpm install --frozen-lockfile does not report a lockfile mismatch in this case.

This is expected pnpm behavior because the workspace override takes precedence over the direct dependency declaration. The direct-dependency update is therefore ineffective.

Updating the override to 7.27.0 and regenerating the lockfile resolves the dependency consistently.

Images of the diff or a link to the PR, issue, or logs

Dependabot PR:

nyaomaru/nyaomaru-portfolio#74

Initial Dependabot commit:

nyaomaru/nyaomaru-portfolio@0c1f236

Smallest manifest that reproduces the issue

package.json:

{
  "dependencies": {
    "openai": "7.19.0"
  }
}

pnpm-workspace.yaml:

overrides:
  openai: 7.19.0

.github/dependabot.yml:

version: 2

updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    groups:
      minor-and-patch:
        patterns:
          - '*'
        update-types:
          - minor
          - patch

When Dependabot proposes a grouped update of openai from 7.19.0 to 7.27.0, it updates package.json but leaves the matching pnpm-workspace.yaml override at 7.19.0, so pnpm continues to resolve and install the old version.