Pewarta Proxy

📋 Server Request & Proxy Logs

Loading active proxy settings...
Developed by Khairul Adha (adhexa.id)
Mengambil log server...

⚙️ Pengaturan Proxy Target

Skip to content

pnpm audit --fix=override doesn't respect saveExact #13209

Closed
Bug
#13215
Closed
pnpm audit --fix=override doesn't respect saveExact#13209
Bug
#13215
Labels
state: acceptedThe required changes are defined. There is consensus on the change. Development can be startedtype: bug

Description

@yzhe554
yzhe554
opened on Jul 22, 2026

Verify latest release

  • I verified that the issue exists in the latest pnpm release

pnpm version

v11.15.1

Which area(s) of pnpm are affected? (leave empty if unsure)

No response

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

  1. install minimatch: 3.0.0
  2. set saveExact in pnpm-workspace.yaml
  3. run pnpm audit --fix=override
  4. In pnpm-workspace.yaml, the override version isn't using the exact version. when fix is update, it respects exact version though.

Describe the Bug

pnpm audit --fix=override doesn't respect saveExact config, while --fix=update respect it.

Expected Behavior

pnpm audit --fix=override uses exact version when saveExact: true is configured.

Which Node.js version are you using?

24.18.0

Which operating systems have you used?

  • macOS
  • Windows
  • Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response

Activity

  1. yzhe554
    added
    type: bug
    on Jul 22, 2026
  2. yzhe554
    added the
    Bug
    issue type on Jul 22, 2026

  3. github-actions commented on Jul 22, 2026

    @github-actions
    github-actionsBot
    on Jul 22, 2026 – with GitHub Actions
    Contributor

    Oz triage is running now and will classify this issue and apply one pnpm state: label.

    Follow along in Oz: https://app.warp.dev/run/019f873a-9935-76d4-9f4c-e48f5f8a681a

  4. github-actions
    added
    state: acceptedThe required changes are defined. There is consensus on the change. Development can be started
    on Jul 22, 2026

  5. github-actions commented on Jul 22, 2026

    @github-actions
    github-actionsBot
    on Jul 22, 2026 – with GitHub Actions
    Contributor

    Triage result

    • Issue: pnpm audit --fix=override doesn't respect saveExact
    • State: Ready to implement
    • Applied label: state: accepted
    • Product / parity: TypeScript CLI only (the override mechanism is TS-only; no pnpm↔pacquet parity work implied)
    • Rationale: The bug is confirmed in the codebase. In pnpm11/deps/compliance/commands/src/audit/fix.ts, caretRangeForPatched unconditionally returns ^${min.version} without checking saveExact or savePrefix. By contrast, --fix=update delegates to update.handler() which flows through the normal install pipeline and inherits saveExact. The AuditOptions type already includes both saveExact and savePrefix (via InstallCommandOptions), so the fix is bounded to threading those settings through createOverrides / caretRangeForPatched and returning an exact version string when saveExact: true or savePrefix === ''.
    • Next step: Modify caretRangeForPatched (or createOverrides) in pnpm11/deps/compliance/commands/src/audit/fix.ts to accept a saveExact/savePrefix option and return an exact version instead of a caret range when appropriate.

    Written by an agent (Oz, auto).

  6. AmariahAK
    added 2 commits that reference this issue on Jul 22, 2026

    fix(audit): respect saveExact and savePrefix in audit --fix=override

    98d17cf

    fix(audit): respect saveExact and savePrefix in audit --fix=override

    0034ab8
  7. zkochan
    added a commit that references this issue on Jul 30, 2026

    fix(audit): respect saveExact and savePrefix in audit --fix=override

    f00d34e

  8. zkochan commented on Sep 19, 2026

    @zkochan
    zkochan
    on Sep 19, 2026
    Member

    This no longer reproduces on current pnpm, so closing.

    Verified on pnpm 12.5.1 with saveExact: true: pnpm audit --fix=override writes exact versions in the overrides it adds.

    If you still hit this on the latest pnpm, please comment with a reproduction and we will reopen.

    Written by an agent (Claude Code, claude-opus-5).

  9. zkochan
    closed this as completedon Sep 19, 2026
  10. zkochan
    added a commit that references this issue on Sep 25, 2026

    fix(audit): respect saveExact and savePrefix in audit --fix=override

    a8bed97
  11. zkochan
    added 2 commits that reference this issue on Oct 5, 2026

    fix(audit): show the save style in the interactive audit fix picker

    eae8167

    fix(audit): show the save style in the interactive audit fix picker (#…

    f239b6c
  12. elrincondehiro
    added a commit that references this issue on Oct 9, 2026

    fix(deps): update dependencias no-major (#34)

    3734f39
  13. renovate
    added 8 commits that reference this issue on Oct 20, 2026

    chore(deps): update pnpm to v12.10.1

    4ccf942

    chore(deps): update pnpm to v12.10.1

    1669ea1

    chore(deps): update pnpm to v12.10.1

    aa1f0ec

    chore(deps): update pnpm to v12.10.1

    3f754fa

    chore(deps): update pnpm to v12.10.1

    01da501

    chore(deps): update pnpm to v12.10.1

    4fc4379

    chore(deps): update pnpm to v12.10.1

    da96a6d

    chore(deps): update pnpm to v12.10.1

    dd15d1e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    state: acceptedThe required changes are defined. There is consensus on the change. Development can be startedtype: bug

    Type

    Bug

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions