fix(pnpm-collector): find nested deps in pnpm hoisted workspaces

[claude]

Requested by Mike Maietta · Slack thread

In a pnpm hoisted (nodeLinker: hoisted) workspace the app package usually has no node_modules of its own, so the pnpm collector detected the layout as isolated and never searched the workspace root. It then packaged out-of-range copies of nested deps, for example the root readable-stream@3.6.2 in place of lazystream's nested readable-stream@2.3.8, which is the same symptom as #10228. The collector now finds the workspace root by walking up to the nearest pnpm-workspace.yaml and uses it both for hoisted detection and for the in-range lookup. This follows up on #10228, and the same fix is being added to the v26 backport #10230. It touches the same files as #10232, so whichever PR merges second may need a small rebase. The packaging integration tests couldn't run locally because the Electron download is blocked, so they rely on CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Evsxm8m75QrJA3XqkuaXNF

---

Generated by Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: e7ee366

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages

Name	Type
app-builder-lib	Patch
dmg-builder	Patch
electron-builder-squirrel-windows	Patch
electron-builder	Patch
electron-forge-maker-appimage	Patch
electron-forge-maker-nsis-web	Patch
electron-forge-maker-nsis	Patch
electron-forge-maker-snap	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[claude]

CI note: Test e2e Auto Updater Linux (appimage, true) failed for infrastructure reasons, not because of this PR (job 107710412913)

The job failed while building the Docker test image, before any test ran. It stopped at the first RUN apt-get update in test/src/updater/dockerfile-appimage because the Ubuntu mirror returned a file whose hash didn't match its index:

E: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/jammy-updates/main/binary-amd64/Packages.gz  Hash Sum mismatch
   Last modification reported: Thu, 24 Sep 2026 04:16:25 +0000
   Release file created at: Thu, 24 Sep 2026 12:35:36 +0000
E: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/jammy-updates/universe/binary-amd64/Packages.gz
ERROR: failed to solve: process "/bin/sh -c apt-get update && ..." did not complete successfully: exit code: 100

Why it isn't caused by this PR:

• blackboxUpdateTest, linuxUpdaterTest and blackboxInstallTest never started, so no app was built and PnpmNodeModulesCollector never ran. The step that failed only runs apt-get against archive.ubuntu.com.
• The mirror was mid-sync: its Release file was newer than the Packages.gz it served, which is a known transient Ubuntu mirror problem.
• The same appimage job in runs started a few minutes later (fix(pnpm-collector): pick in-range nested deps with pnpm 11 hoisted layout (v26) #10230, chore(deps): update dependency form-data to v4.0.6 [security] #9973, chore(deps): update dependency tar to v7.5.21 [security] #9974, chore(deps): update dependency undici to v7.29.0 [security] #9976) got past this step and is still running.
• I also checked whether the new workspace-root lookup (walking up to the nearest pnpm-workspace.yaml) could affect this job once it gets past the image build. It shouldn't: packTester copies fixtures into a TmpDir outside the repo, so the lookup can't reach the electron-builder repo's own pnpm-workspace.yaml.

There's no code fix to make. The failed job needs a re-run once the run finishes; GitHub won't re-run a single job while the run is in progress.

---

Generated by Claude Code

[claude]

I reviewed this PR and didn't find any bugs. Because it changes core pnpm dependency-resolution/packaging logic (workspace-root discovery, hoisted-layout detection, and the fallback search order used to pick nested dependency versions), a human look would still be worthwhile.

What was reviewed: the new workspaceRoot/layoutRoots walk-up and the refactored scanNodeModulesLayout helper used by isHoisted; the extended fallback order in locateFromDepOrRoot that now also checks the workspace root; and the new pnpm v11 test scenarios (hoisted workspace, hoisted single project, isolated project, isolated project with a link: dependency, no-dependencies project) plus their lockfile fixtures and snapshots.

Extended reasoning...

The change touches app-builder-lib's pnpm node-modules collector, specifically the algorithm that decides which on-disk copy of a version-conflicted transitive dependency gets packaged into the app; it has no auth/crypto/permissions surface, but a wrong result silently ships the wrong dependency version in a production app, which is what motivated the fix. The diff is non-trivial (new lazy workspace-root traversal, a reusable layout-scan helper, and an extra fallback search location) and several plausible edge cases (e.g. mixed isolated/hoisted layouts across rootDir and workspace root) were already raised and investigated by the automated bug hunt and ruled out rather than fixed, which is exactly the kind of judgment call a human maintainer should also weigh in on. Test coverage is solid: five new pnpm v11 scenarios directly exercise hoisted workspace, hoisted single-project, isolated, isolated-with-link, and no-dependency layouts against the described bug (lazystream's nested readable-stream@ 2 vs the root's readable-stream@ 3), with matching lockfile fixtures and updated snapshots.