autoDedupe does not work when downgrading a dependency in one package that is a peer dependency of another #16432

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

No response

Which area(s) of pnpm are affected? (leave empty if unsure)

No response

Link to the code that reproduces this issue or a replay of the bug

https://github.com/haines/pnpm-auto-dedupe

Reproduction steps

$ git clone https://github.com/haines/pnpm-auto-dedupe.git
$ cd pnpm-auto-dedupe
$ pnpm install

$ grep "@cerbos/embedded-server@" pnpm-lock.yaml
  '@cerbos/embedded-server@0.7.2':
  '@cerbos/embedded-server@0.7.2(@bufbuild/protobuf@2.16.0)(@cerbos/api@0.11.1)':

$ pnpm --filter=./packages/a add @cerbos/embedded-server@0.7.1
✓ Lockfile passes supply-chain policies (verified 31s ago)
Packages: +1
+
Progress: resolved 1, reused 1, downloaded 0, added 1, done
Done in 52ms using pnpm v12.8.1

$ grep "@cerbos/embedded-server@" pnpm-lock.yaml
  '@cerbos/embedded-server@0.7.1':
  '@cerbos/embedded-server@0.7.2':
  '@cerbos/embedded-server@0.7.1(@bufbuild/protobuf@2.16.0)(@cerbos/api@0.11.1)':
  '@cerbos/embedded-server@0.7.2(@bufbuild/protobuf@2.16.0)(@cerbos/api@0.11.1)':

$ pnpm dedupe
✓ Lockfile passes supply-chain policies (verified 40s ago)
Packages: -1
-
Progress: resolved 3, reused 3, downloaded 0, added 0, done
Done in 53ms using pnpm v12.8.1

$ grep "@cerbos/embedded-server@" pnpm-lock.yaml
  '@cerbos/embedded-server@0.7.1':
  '@cerbos/embedded-server@0.7.1(@bufbuild/protobuf@2.16.0)(@cerbos/api@0.11.1)':

With autoDedupe enabled, we'd expect the final pnpm dedupe to be a no-op, but the deduplication doesn't happen after pnpm add.

Describe the Bug

We have two packages in the monorepo. Package a has a dependency "@cerbos/embedded-server": "0.7.2", package b has a peer dependency "@cerbos/embedded-server": "^0.7.1".

When we run pnpm --filter=./packages/a add @cerbos/embedded-server@0.7.1 to downgrade the dependency, with autoDedupe enabled my expectation is that we end up only having one version of the dependency installed (0.7.1).

In reality, we end up with both 0.7.1 and 0.7.2 installed. Running pnpm dedupe solves this, but we wouldn't expect to have to do so with autoDedupe enabled.

Expected Behavior

pnpm add deduplicates dependencies when autoDedupe is enabled.

Which Node.js version are you using?

v26.10.0

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

Ubuntu 24

Contributing a fix

• I am working on a fix