[BUG] presence of `overrides` prevents hoisting when updating workspace dependencies

[jenseng]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

If the root package.json defines any overrides, if you attempt to update a hoisted workspace dependency (either via npm install <specifier> --save-exact -w <workspace> or by editing its package.json and running npm install), it always becomes un-hoisted, even if you have set prefer-dedupe=true

This is a contributing factor to #7018 and #7028

Expected Behavior

Packages should generally be hoisted, especially when prefer-dedupe=true.

If you remove the root-level overrides, it works as expected.

Steps To Reproduce

Given package.json:

{
  "workspaces": [
    "packages/*"
  ],
  "overrides": {
    "doesnt-matter-can-be-anything": "1.2.3"
  }
}

And packages/my-cool-package/package.json:

{}

Run:

• npm i tiny-invariant@0.0.2 --save-exact -w my-cool-package (hoisted to node_modules/tiny-invariant) ✅
• npm i tiny-invariant@0.0.3 --save-exact -w my-cool-package (un-hoisted to packages/my-cool-package/node_modules/tiny-invariant) ❌

Note that if you npm i tiny-invariant@... --save-exact -w my-cool-package a third time, it will re-hoist it 🤔 (and un-hoist it the fourth time, etc.)

Environment

• npm: 10.2.4
• Node.js: 18.17.1
• OS Name: Mac OS Ventura
• System Model Name: Macbook Pro
• npm config:

prefer-dedupe = true
registry = "https://registry.npmjs.org/"

[jenseng]

I've confirmed this is fixed in npm 11.2, likely thanks to #8089 🥳