fix(deps): validate shrinkwrap restore dependency ranges

steipete · steipete · commit 24c20d334d5c · 2026-05-27T17:55:07.000+01:00
diff --git a/scripts/generate-npm-shrinkwrap.mjs b/scripts/generate-npm-shrinkwrap.mjs
@@ -886,6 +886,62 @@ function isStablePatchDrift(generatedVersion, currentVersion) {
   );
 }
 
+function compareStableVersions(leftVersion, rightVersion) {
+  const left = stableVersionParts(leftVersion);
+  const right = stableVersionParts(rightVersion);
+  if (!left || !right) {
+    return null;
+  }
+  return left.major - right.major || left.minor - right.minor || left.patch - right.patch;
+}
+
+function versionSatisfiesSimpleSpec(version, spec) {
+  const normalized = typeof spec === "string" ? spec.trim() : "";
+  if (normalized === "" || normalized === "*") {
+    return true;
+  }
+  const match = normalized.match(/^(?<operator>\^|~|>=)?(?<version>\d+\.\d+\.\d+)$/u);
+  if (!match?.groups) {
+    return normalized === version;
+  }
+  const minimumVersion = match.groups.version;
+  const comparison = compareStableVersions(version, minimumVersion);
+  if (comparison === null || comparison < 0) {
+    return false;
+  }
+  const candidate = stableVersionParts(version);
+  const minimum = stableVersionParts(minimumVersion);
+  if (!candidate || !minimum) {
+    return false;
+  }
+  switch (match.groups.operator) {
+    case "^":
+      return minimum.major > 0
+        ? candidate.major === minimum.major
+        : minimum.minor > 0
+          ? candidate.major === 0 && candidate.minor === minimum.minor
+          : candidate.major === 0 && candidate.minor === 0 && candidate.patch === minimum.patch;
+    case "~":
+      return candidate.major === minimum.major && candidate.minor === minimum.minor;
+    case ">=":
+      return true;
+    default:
+      return comparison === 0;
+  }
+}
+
+function dependencySpecForLockPath(packages, lockPath, dependencyName) {
+  const packagePath = parseLockPackagePath(lockPath);
+  const parentPath = packagePath.at(-2)?.path ?? "";
+  const parent = packages[parentPath];
+  return (
+    parent?.dependencies?.[dependencyName] ??
+    parent?.optionalDependencies?.[dependencyName] ??
+    parent?.peerDependencies?.[dependencyName] ??
+    null
+  );
+}
+
 function restoreCurrentPnpmLockedPackages(
   generated,
   current,
@@ -922,6 +978,10 @@ function restoreCurrentPnpmLockedPackages(
       !currentMetadata.version ||
       currentPackageName !== packageName ||
       !isStablePatchDrift(metadata.version, currentMetadata.version) ||
+      !versionSatisfiesSimpleSpec(
+        currentMetadata.version,
+        dependencySpecForLockPath(generatedPackages, lockPath, packageName),
+      ) ||
       !pnpmLockPackages.has(`${packageName}@${currentMetadata.version}`)
     ) {
       continue;
diff --git a/test/scripts/generate-npm-shrinkwrap.test.ts b/test/scripts/generate-npm-shrinkwrap.test.ts
@@ -88,7 +88,11 @@ describe("generate-npm-shrinkwrap", () => {
   it("disables embedded shrinkwraps that hide workspace overrides", () => {
     const lockfile = {
       packages: {
-        "": {},
+        "": {
+          dependencies: {
+            "lru-cache": "^11.5.0",
+          },
+        },
         "node_modules/@earendil-works/pi-coding-agent": {
           version: "0.75.4",
           hasShrinkwrap: true,
@@ -147,7 +151,11 @@ describe("generate-npm-shrinkwrap", () => {
   it("restores current shrinkwrap entries when npm floats past pnpm's lock", () => {
     const generated = {
       packages: {
-        "": {},
+        "": {
+          dependencies: {
+            "lru-cache": "^11.5.0",
+          },
+        },
         "node_modules/lru-cache": {
           version: "11.5.1",
           resolved: "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
@@ -177,7 +185,45 @@ describe("generate-npm-shrinkwrap", () => {
     };
     const pnpmPackages = new Set(["lru-cache@11.5.0", "lru-cache@6.0.0"]);
 
-    expect(restoreCurrentPnpmLockedPackages(generated, current, pnpmPackages)).toEqual(current);
+    expect(restoreCurrentPnpmLockedPackages(generated, current, pnpmPackages)).toEqual({
+      packages: {
+        "": {
+          dependencies: {
+            "lru-cache": "^11.5.0",
+          },
+        },
+        "node_modules/lru-cache": current.packages["node_modules/lru-cache"],
+        "node_modules/lru-memoizer/node_modules/lru-cache":
+          current.packages["node_modules/lru-memoizer/node_modules/lru-cache"],
+      },
+    });
+  });
+
+  it("does not restore versions that no longer satisfy the dependency edge", () => {
+    const generated = {
+      packages: {
+        "": {
+          dependencies: {
+            "lru-cache": "^11.5.1",
+          },
+        },
+        "node_modules/lru-cache": {
+          version: "11.5.1",
+        },
+      },
+    };
+    const current = {
+      packages: {
+        "": {},
+        "node_modules/lru-cache": {
+          version: "11.5.0",
+        },
+      },
+    };
+
+    expect(
+      restoreCurrentPnpmLockedPackages(generated, current, new Set(["lru-cache@11.5.0"])),
+    ).toEqual(generated);
   });
 
   it("does not restore incompatible generated shrinkwrap versions", () => {
