[Bharat Middha (bmiddha)]

Summary

With native pnpm 12, rush install fails with ERR_PNPM_OUTDATED_LOCKFILE ... local dependency "..." is outdated for any subspace that has injected workspace dependencies. Rush now passes --no-frozen-lockfile --prefer-frozen-lockfile instead of --frozen-lockfile in that one case. A @microsoft/rush change file is included.

This PR targets main and changes rush-lib only. It is the bottom of a stack: #6136 (this PR) → #6138 → #6139 → #6140 → #6141 → #6146 → #6148. Rush 5.182.0 already includes the earlier native pnpm fixes from #6131 and #6133. The repo's own move to pnpm 12.13.0 (pnpmVersion, globalAllowBuilds, regenerated lockfiles and repo-state.json) is in #6146.

Why the split: before, every PR in this stack carried the repo's pnpm 12 bump. None of them could pass CI until Rush was released with these fixes, and that release needed the PRs to merge first. With the bump moved out, this PR runs CI on the repo's current toolchain (Rush 5.182.0 and pnpm 10.27.0) and can merge on its own, so a Rush release can include it. #6146 then needs a Rush release containing this PR, #6138 through #6141, and #6119, followed by a rushVersion bump.

Details

Native pnpm 12 checks the freshness of injected workspace dependencies during a frozen install (lockfile_freshness/directory_deps). In a Rush repo that check always fails, for two reasons:

• It reads each injected project's raw package.json without pnpmfile readPackage hooks, so it sees the unrewritten workspace: specifiers.
• It requires workspace: targets to be inside the pnpm workspace root, which is common/temp/<subspace>. Every Rush project lives outside that folder.

Rush already verifies that the committed shrinkwrap satisfies every package.json before it invokes pnpm. So in BaseInstallManager.pushConfigurationArgs, when all of the following hold:

• usePnpmFrozenLockfileForRushInstall is enabled,
• the command is rush install (shrinkwrap updates are not allowed),
• pnpm is >= 12.0.0, and
• subspace.getPackageJsonInjectedDependenciesHash() is defined,

Rush passes --no-frozen-lockfile --prefer-frozen-lockfile. It also prints an informational line, not a warning:

PNPM 12.13.0 cannot verify injected workspace dependencies with "--frozen-lockfile"; using "--prefer-frozen-lockfile" instead.

In every other case, including subspaces without injected dependencies and pnpm < 12, Rush still passes --frozen-lockfile. pnpm 10 and 11 behavior is unchanged.

Tradeoff: for affected subspaces, pnpm may fetch metadata and re-resolve during rush install instead of failing outright. In testing, the installed package set was identical to the committed lockfile. rush install never copies the temp lockfile back to common/config.

Alternatives considered:

• Disabling the freshness check through configuration. pnpm 12 has no setting for this.
• Moving injected projects under the workspace root. That is not feasible with Rush's layout.

I did not find an upstream pnpm issue for the containment check.

How it was tested

The final commit is fd22b2bd5c, on main 4481cbe5b1. git range-diff against the previous head f19bdbab2f shows =, so the patch is unchanged by the rebase.

CI on fd22b2bd5c, run 41128187233, uses the repo's pinned Rush 5.182.0 and pnpm 10.27.0. All 5 Node.js jobs pass: v22 ubuntu, v24 ubuntu, v24 windows, v26 ubuntu, and v26 windows. CodeQL, Analyze, and license/cla also pass. In every job:

• "Verify Change Logs" (rush change --verify) and "Rush Install" passed.
• rush retest --production reported 299 operations succeeded, 17 no-op, 0 failed, and no warnings.
• @microsoft/rush-lib (test) passed: 1927 passed and 0 failed on Ubuntu, 1899 passed and 0 failed on Windows. BaseInstallManager.test passed 18/18.
• The package manager integration tests, README verification, and the repo-b rush update / rush test / cache-hit rush test steps passed.

Local testing ran on macOS arm64 with Node 22.23.4, on f19bdbab2f. That commit has the same patch, on main aaf2f7675f. Rush commands ran through install-run-rush with the toolchain pinned at that time, Rush 5.181.0 and pnpm 10.27.0. The heft commands used the repo's installed Heft:

• node common/scripts/install-run-rush.js install: passed, no lockfile or repo-state.json diff.
• node common/scripts/install-run-rush.js build --production --to @microsoft/rush-lib: passed. 36 operations succeeded and 4 were no-op, with 0 warnings.
• heft build in libraries/rush-lib: passed, 0 warnings.
• heft test --production --test-path-pattern BaseInstallManager in libraries/rush-lib: passed (18/18). New cases:
  • --frozen-lockfile is kept for PNPM 10.27.0 with injected dependencies, and for PNPM 12.10.1 without them.
  • --no-frozen-lockfile --prefer-frozen-lockfile and the informational line, with no warning, are used for PNPM 12 with injected dependencies.
• node common/scripts/install-run-rush.js change --verify: passed.

End-to-end, before the restack, this same change was exercised on the full rushstack repo moved to pnpm 12.13.0. That repo change now lives in #6146. Results with Rush built from this branch:

• CI=true rush install: passed.
  • build-tests-subspace took the --prefer-frozen-lockfile path.
  • default stayed on --frozen-lockfile, with "Lockfile is up to date, resolution step is skipped".
  • No lockfile or repo-state.json diff afterward.
• rush build --production (whole repo): passed, no warnings.
• heft test --production in libraries/rush-lib: passed (1919 passed, 0 failed, 2 skipped).
• Running pnpm install --frozen-lockfile ... with pnpm 12.13.0 directly in common/temp/build-tests-subspace failed with local dependency "@rushstack/terminal" at "../../../libraries/terminal" is outdated. This confirms the change is still needed on the latest pnpm 12.
• Without this change, Rush 5.181.0 CI=true install with pnpm 12.13.0 failed with ERR_PNPM_OUTDATED_LOCKFILE on the injected @microsoft/rush-lib. Rush 5.182.0 does not include this change either.

Impacted documentation

None.