Is pnpm dedupe safe for production use?

[dmltdev]

Per my understanding, pnpm dedupe finds cases where multiple versions of a package are used and tries to reduce the number of versions used. For instance, if the project uses [email protected] in one place and [email protected] in another, running pnpm dedupe would likely consolidate to just using [email protected] everywhere.

How it deduplicates a package that has different major/minor version throughout the app? As if lodash@^9 and lodash@^10 is used in different parts of the project. Though it is generally not recommended to have such a setup, I want to be sure that pnpm dedupe is safe to use in production. E.g., you have a Dockerfile that uses pnpm and after installing packages, you also run pnpm dedupe.

So, my question is: does pnpm dedupe respect semver ranges by not violating the semver constraints specified in the package.json dependencies? I assume the answer is affirmative, but I could not find any official information on it, nor similar questions raised there or confirmation in the docs.

I think some clarification on the inner workings of this CLI command should be added to the command's description.

Thank you.

[zkochan]

pnpm dedupe respects semver.

[dmltdev]

Okay, thanks for the confirmation.