Pnpm: Updating package versions without being told to do so

[jsumners]

pnpm version: 4.3.0

Code to reproduce the issue:

Create a package.json:

{
  "dependencies": {
    "dotenv": "^8.0.0"
  }
}

Next, run pnpm i abstract-logging.

Expected behavior:

The abstract-logging package will be added to the dependencies at ^2.0.0 and the version of dotenv will not be changed.

Actual behavior:

[email protected] is added to the dependencies and dotenv's minimum version is updated to 8.2.0.

Additional information:

• node -v prints: 12.13.1
• Windows, OS X, or Linux?: OS X

[zkochan]

Looking into it

[jsumners]

Thank you.

[zkochan]

:ship: 4.5.0