From 94858a489cd4c5a48009a879c44fbd9b8a82afa1 Mon Sep 17 00:00:00 2001
From: Nyannyacha <meow@nnc.gg>
Date: Wed, 22 Oct 2025 11:51:47 +0000
Subject: [PATCH 1/2] fix: when resolving dep versions, it should respect
 versions in deno.lock

---
 crates/deno_facade/emitter.rs | 10 +++++++++-
 deno/npm/managed/mod.rs       |  2 +-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/crates/deno_facade/emitter.rs b/crates/deno_facade/emitter.rs
index 8990de566..5efbf0ae0 100644
--- a/crates/deno_facade/emitter.rs
+++ b/crates/deno_facade/emitter.rs
@@ -356,7 +356,15 @@ impl EmitterFactory {
           } else {
             CliNpmResolverCreateOptions::Managed(
               CliManagedNpmResolverCreateOptions {
-                snapshot: CliNpmResolverManagedSnapshotOption::Specified(None),
+                snapshot: if let Some(lockfile) =
+                  options.maybe_lockfile().cloned()
+                {
+                  CliNpmResolverManagedSnapshotOption::ResolveFromLockfile(
+                    lockfile,
+                  )
+                } else {
+                  CliNpmResolverManagedSnapshotOption::Specified(None)
+                },
                 maybe_lockfile: options.maybe_lockfile().cloned(),
                 fs,
                 http_client_provider: self.http_client_provider().clone(),
diff --git a/deno/npm/managed/mod.rs b/deno/npm/managed/mod.rs
index 04875fa89..6e9477bec 100644
--- a/deno/npm/managed/mod.rs
+++ b/deno/npm/managed/mod.rs
@@ -179,7 +179,7 @@ async fn resolve_snapshot(
         let guard = lockfile.lock();
         (guard.overwrite, guard.filename.clone())
       };
-      if overwrite {
+      if !overwrite {
         let snapshot = snapshot_from_lockfile(
           lockfile.clone(),
           &registry_info_provider.as_npm_registry_api(),

From d7935dd94a4c8bdd925d9e1e76c3df2f1cc92847 Mon Sep 17 00:00:00 2001
From: Nyannyacha <meow@nnc.gg>
Date: Fri, 31 Oct 2025 01:34:26 +0000
Subject: [PATCH 2/2] chore: add an integration test

---
 crates/base/test_cases/pin-package/.gitignore |  1 +
 crates/base/test_cases/pin-package/deno.json  |  3 +++
 crates/base/test_cases/pin-package/deno.lock  | 17 +++++++++++++++
 crates/base/test_cases/pin-package/index.ts   |  6 ++++++
 crates/base/tests/integration_tests.rs        | 21 +++++++++++++++++++
 5 files changed, 48 insertions(+)
 create mode 100644 crates/base/test_cases/pin-package/.gitignore
 create mode 100644 crates/base/test_cases/pin-package/deno.json
 create mode 100644 crates/base/test_cases/pin-package/deno.lock
 create mode 100644 crates/base/test_cases/pin-package/index.ts

diff --git a/crates/base/test_cases/pin-package/.gitignore b/crates/base/test_cases/pin-package/.gitignore
new file mode 100644
index 000000000..71a1de59c
--- /dev/null
+++ b/crates/base/test_cases/pin-package/.gitignore
@@ -0,0 +1 @@
+!deno.lock
diff --git a/crates/base/test_cases/pin-package/deno.json b/crates/base/test_cases/pin-package/deno.json
new file mode 100644
index 000000000..a80b8235b
--- /dev/null
+++ b/crates/base/test_cases/pin-package/deno.json
@@ -0,0 +1,3 @@
+{
+  "workspace": []
+}
diff --git a/crates/base/test_cases/pin-package/deno.lock b/crates/base/test_cases/pin-package/deno.lock
new file mode 100644
index 000000000..f31dfd693
--- /dev/null
+++ b/crates/base/test_cases/pin-package/deno.lock
@@ -0,0 +1,17 @@
+{
+  "version": "4",
+  "specifiers": {
+    "npm:is-odd@3": "3.0.0"
+  },
+  "npm": {
+    "is-number@6.0.0": {
+      "integrity": "sha512-Wu1VHeILBK8KAWJUAiSZQX94GmOE45Rg6/538fKwiloUu21KncEkYGPqob2oSZ5mUT73vLGrHQjKw3KMPwfDzg=="
+    },
+    "is-odd@3.0.0": {
+      "integrity": "sha512-204vE5IJ0Cd6pA6x1dMyLooGk6/xeKuq90imFuJN/ndMDBP4Sk9tJpBlTedHPvt6KDbtTDTsjVzzgctFqNV7FQ==",
+      "dependencies": [
+        "is-number"
+      ]
+    }
+  }
+}
diff --git a/crates/base/test_cases/pin-package/index.ts b/crates/base/test_cases/pin-package/index.ts
new file mode 100644
index 000000000..7ded2886b
--- /dev/null
+++ b/crates/base/test_cases/pin-package/index.ts
@@ -0,0 +1,6 @@
+import isOdd from "npm:is-odd@^3";
+import json from "npm:is-odd@^3/package.json" with { type: "json" };
+
+console.log(isOdd);
+
+Deno.serve(() => new Response(json["version"]));
diff --git a/crates/base/tests/integration_tests.rs b/crates/base/tests/integration_tests.rs
index 0d3b989c1..f8b293ce1 100644
--- a/crates/base/tests/integration_tests.rs
+++ b/crates/base/tests/integration_tests.rs
@@ -4224,6 +4224,27 @@ async fn test_user_worker_with_import_map() {
   }
 }
 
+#[tokio::test]
+#[serial]
+async fn test_pin_package_version_correctly() {
+  integration_test!(
+    "./test_cases/pin-package",
+    NON_SECURE_PORT,
+    "",
+    None,
+    None,
+    None,
+    (|resp| async {
+      let res = resp.unwrap();
+      assert!(res.status().as_u16() == 200);
+
+      let body_bytes = res.bytes().await.unwrap();
+      assert_eq!(body_bytes, r#"3.0.0"#);
+    }),
+    TerminationToken::new()
+  );
+}
+
 #[derive(Deserialize)]
 struct ErrorResponsePayload {
   msg: String,