fix(js): detect pnpm snapshot dependency redirects in affected (#36929)

[jdpt0]

Current Behavior

With projectsAffectedByDependencyUpdates: "auto", changing a pnpm snapshot dependency from one already-present version to another can leave every package version/integrity fingerprint unchanged. Nx then returns no affected projects even though the consumer's transitive dependencies changed.

For example, consumer → host@1.0.0 → dep@1.0.0 becomes consumer → host@1.0.0 → dep@2.0.0, while independent projects keep both dep versions in both lockfiles.

Expected Behavior

The package owning the changed snapshot is marked touched, allowing the existing reverse graph traversal to select its consumers. In the reproduction this selects only consumer.

This change supplements pnpm affected fingerprints with snapshot keys and sorted resolved dependencies/optionalDependencies. It reuses the existing pnpm normalizer and parser key map, preserving the association between snapshot peer contexts and dependency edges. It does not change external-node hashes used elsewhere in Nx or the other package managers' comparison paths.

Regression coverage includes both pnpm lockfile filenames, normal and optional redirects, edge additions/removals, ordering-only changes, mixed integrity changes, peer-context edge swaps, and v6 snapshots.

Validation

• Confirmed six regression cases fail against the original implementation before applying the fix.
• 180 tests passed across the affected-selection and pnpm-parser suites:
  pnpm exec vitest run --config packages/nx/vitest.config.mts packages/nx/src/plugins/js/project-graph/affected packages/nx/src/plugins/js/lock-file/pnpm-parser.spec.ts
• TypeScript passed:
  pnpm exec tsc -p packages/nx/tsconfig.lib.json --noEmit --tsBuildInfoFile /tmp/nx-36929.tsbuildinfo
• Oxfmt check and git diff --check passed.
• Oxlint ran on both changed files; its module-boundary rule was skipped because no workspace project graph was available.
• The public CLI reproduction selects ["consumer"] after transpiling this changed module into the installed Nx 23.2.0 package, versus [] without it. This was a module-level smoke test, not a full Nx package build.

Remaining validation

The full checkout's install lifecycle requires Rust, and the normal Nx task runner / nx prepush cannot construct the workspace graph without Java and .NET in this environment. The focused suite therefore ran directly through the repository's Vitest config. Full build, prepush and affected e2e validation remain outstanding.

The pnpm path performs an additional normalization pass to read snapshot dependencies. Sharing the parser's normalized data could avoid that extra pass.

Related Issue(s)

Fixes #36929

[netlify]

👷 Deploy request for nx-docs pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	b6f67ae

[netlify]

👷 Deploy request for nx-dev pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	b6f67ae