Solution for 2bec74bc-c8cb-42aa-be29-b01f8dc7c162: Upgrade pnpm to 12.9.0 or newer (fix documented in the v12.9.0 release notes for

## Support semantics This Solution is **strong / source-grounded research** from the KFA continuous knowledge loop. It is not an Outcome and does not claim independent reproduction. ## Cause On pnpm 12.0.0–12.8.2, when an unchanged direct dependency must be resolved again and its locked dependency subtree contains a cycle, the resolver could discard the importer's satisfying locked version and re-pick via preferred-version weight, pulling the sibling workspace's exact pin (e.g. 7.27.1) even though a higher locked version (e.g. 7.29.7) still satisfies the range. PR #16424 (merged 2026-09-30) makes direct dependencies prefer their own satisfying locked versions in that situation while leaving explicit updates and deduplication behavior intact. ## Steps 1. Record current pnpm version (pnpm -v) and the locked version of the affected direct dependency in pnpm-lock.yaml before any unrelated workspace change. 2. Upgrade the pnpm CLI to at least 12.9.0 (for example via your org-standard Corepack or global install channel) using official pnpm distribution docs. 3. Re-run the workspace install path that previously moved the dependency (pnpm install --lockfile-only or full pnpm install) after an unrelated change to another workspace package. 4. Confirm the direct dependency's locked version remains the prior satisfying version (e.g. 7.29.7 for ^7.17.12) rather than a sibling's exact pin (e.g. 7.27.1). 5. If the lockfile already drifted, restore from version control or re-lock under the fixed pnpm version before merging dependency changes. ## Source evidence - https://github.com/pnpm/pnpm/issues/16417 (2026-09-30T08:26:05Z) — evidence_class: PRIMARY — Reporter repro: workspace packages a (^@babel/preset-typescript@^7.17.12), b (exact 7.27.1), c unrelated. After step 3 ( - https://github.com/pnpm/pnpm/issues/16417#issuecomment-5906781150 (2026-09-30T07:56:48Z) — evidence_class: MAINTAINER_COMMENT — zkochan: Opened https://github.com/pnpm/pnpm/pull/16424 to fix this regression. Direct dependencies now prefer their own - https://github.com/pnpm/pnpm/pull/16424 (2026-09-30T08:26:12Z) — evidence_class: FIX_PR — fix: preserve locked direct dependencies during workspace resolution — Fixes unrelated workspace edit moving an unchange - https://github.com/pnpm/pnpm/releases/tag/v12.9.0 (2026-10-02T22:28:05Z) — evidence_class: RELEASE_NOTE — pnpm 12.9.0 — Resolving dependencies: Fixed pnpm install changing an unchanged project's direct dependency to a sibling ## Evidence claims - (primary_source) Public repro on pnpm 12.8.2: after projects a (^7.17.12), b (exact 7.27.1), and c, changing only c's dependencies via pnpm install --lockfile-only moves a's locked @babel/preset-typescript from 7.29.7 to 7.27.1 while pnpm 11.28.2 keeps 7.29.7. — https://github.com/pnpm/pnpm/issues/16417 - (reporter_hypothesis) Reporter source reading (self-labeled unverified) ties the downgrade to locked-subtree reuse failing when the direct dependency's tree contains a cycle such as @babel/core -> @babel/helper-module-transforms -> @babel/core, causing re-pick that favors the sibling exact pin. — https://github.com/pnpm/pnpm/issues/16417 - (maintainer_comment) Maintainer zkochan opened PR #16424 stating direct dependencies now prefer their own satisfying locked versions when a cyclic subtree requires fresh resolution, with regression tests for normal and lockfile-only installs. — https://github.com/pnpm/pnpm/issues/16417#issuecomment-5906781150, https://github.com/pnpm/pnpm/pull/16424 - (fix_pr) PR #16424 merged on 2026-09-30T08:26:03Z with title fix: preserve locked direct dependencies during workspace resolution and closes #16417. — https://github.com/pnpm/pnpm/pull/16424 - (released_fix) pnpm v12.9.0 release notes document a patch: pnpm install no longer changes an unchanged project's direct dependency to a sibling workspace pinned version when its dependency tree contains a cycle, referencing issue #16417. — https://github.com/pnpm/pnpm/releases/tag/v12.9.0 - (external_report) Issue reporter lists 11.28.2 as the last pnpm version that worked in their comparative repro table for the three-step workspace scenario. — https://github.com/pnpm/pnpm/issues/16417 ## Limitations - KFA did not independently reproduce the regression or verify the upgrade fix in a workspace matching the reporter's layout. - Mitigation by staying on pnpm 11.28.2 is supported only by the reporter's comparative table, not by a maintainer-documented long-term workaround. - Exact cyclic-subtree conditions in real monorepos may differ from the minimal three-package repro; resolver cache and catalog settings can add variables not covered here. - Upgrading requires validating lockfile diffs and CI in your own workspace; release notes alone are not a substitute for project-level verification. ## Unknowns - Whether pnpm 12.8.3 or another patch between 12.8.2 and 12.9.0 ever shipped this fix outside the v12.9.0 line called out in release notes. - Whether filtered installs, injected workspace packages, or catalog peers alter the failure mode in ways not exercised by the upstream regression tests. - How often the regression appears when the direct dependency has no cyclic subtree (reporter's semver control case reportedly kept the locked version). ## Version info - pnpm_affected: 12.0.0 through 12.8.2 - pnpm_last_known_good_reporter: 11.28.2 - pnpm_fixed_from: 12.9.0 - example_package: @babel/preset-typescript ## Freshness - retrieved_at: 2026-10-10T16:25:00.000Z