pnpm install --frozen-lockfile is non deterministic, how to debug

[mfazekas]

We have a complex monorepo migrated from yarn, with some packages using react19 and some react18. Pnpm (10.11.1) seems to be flaky for us, in the sense that even though our lock file is checked in some of the CI runs fails because wrong react is being picked up.

I was able to repro it locally using a loop like:

for i in {1..10}; do; rm -rf node_modules; pnpm install --frozen-lockfile; cd packages/app; npx jest; done;

It fails after 5-6 successful runs

I've tried to compare the bad and good case. One difference I see is:
Good:

%readlink node_modules/.pnpm/node_modules/react
../[email protected]/node_modules/react

Bad:

% readlink node_modules/.pnpm/node_modules/react
../[email protected]/node_modules/react

In pnpm docs I do see description of node_modules/.pnpm/<pkg>@<vers> but what is node_modules/.pnpm/node_modules/<pkg>, and why can it be different between pnpm installs with same lock file?

Sounds like same or similar issue as #7070

This is a repo to reproduce the issue:
https://github.com/mfazekas/pnpm-nondeterministic-hoisting

Seems to be happening on macOS runners:
https://github.com/mfazekas/pnpm-nondeterministic-hoisting/actions/runs/15919782803/job/44903986529

[logartis]

We faced a very similar issue, and haven't yet found a reliable solution.