rush-dependency-versions

Repro

rush install

Expected

Downloads [email protected] as specified in common/config/rush/pnpm-lock.yaml

Actual

Downloads [email protected] (latest on npmjs.com)

Setup

These steps were used to generate the files currently in this repo (like common/config/rush/pnpm-lock.yaml). They do not need to be run again to repro the actual issue.

1. Download dependencies from npmjs.com to local disk
   1. npm pack [email protected]
   2. npm pack [email protected]
2. Publish [email protected] and [email protected] to a private registry (e.g. Verdaccio)
3. Edit common/config/rush/.npmrc and change registry to your private registry
4. rush update
5. Note that common/config/rush/pnpm-lock.yaml contains:

packages:
  /pad-left/2.1.0:
    dependencies:
      repeat-string: 1.6.0
  /repeat-string/1.6.0:

6. Revert changes to common/config/rush/.npmrc
7. git commit