nrwl
fix(core): include PNPM patches in externalDependencies hash computations
Current Behavior
If a workspace uses pnpm and adds a local patch to a dependency (e.g. vitest), this patch is not taken into account when computing that dependency's hash for purposes of determining cache changes. In practice, you could patch vitest locally, and tests would pull from the cache.
Expected Behavior
Patches can alter behavior in the same way that updating the version could, it's just that the version is not created and the patch is applied locally.
This updates the pnpm lockfile parsing functionality to read the patches field into a map and then combine the patch hash with the integrity hash. The integrity hash ONLY represents the remote / tarball intergrity, so these have to be combined in order to create a proper key.
Related Issue(s)
(Could not find any, but saw this in my work today)
