[rush] common-versions.json preferredVersions will cause rush install always fail when subspaces feature is enabled

Reproduce the issue with common-versions.json, subspaces, and the rush update --full && rush --debug install commands. Start by tracing how rush update generates common/temp//pnpmfileSettings.json and .pnpmfile.cjs; done means preferredVersions is retained and rush install succeeds without reporting an out-of-date pnpm-lock.yaml.

Summary

When using common-versions.json preferredVersions config, rush install will always fail.

Repro steps

1. Create a rush repo state with subspaces feature enabled.
2. Create a package.json with "rxjs": "^7".
3. Add "rxjs": "7.8.2" in common-versions.json preferredVersions field.
4. Run rush update --full && rush --debug install.

The following error will show:

Symlinking "/Users/majunchen/lp/rush-sample-repo/common/temp/pnpm-local"
  --> "/Users/majunchen/.rush/node-v22.20.0/pnpm-9.15.9"
Transforming /Users/majunchen/lp/rush-sample-repo/common/config/subspaces/default/.npmrc
  --> "/Users/majunchen/lp/rush-sample-repo/common/temp/default/.npmrc"

Updating workspace files in /Users/majunchen/lp/rush-sample-repo/common/temp/default
Total amount of time spent to hash related package.json files in the injected installation case: 0.00 seconds
Copying "/Users/majunchen/lp/rush-sample-repo/common/config/subspaces/default/pnpm-lock.yaml"
  --> "/Users/majunchen/lp/rush-sample-repo/common/temp/default/pnpm-lock.yaml"
Copying "/Users/majunchen/lp/rush-sample-repo/common/config/subspaces/default/pnpm-lock.yaml"
  --> "/Users/majunchen/lp/rush-sample-repo/common/temp/default/pnpm-lock-preinstall.yaml"

The shrinkwrap file (pnpm-lock.yaml) contains the following issues:
  Dependencies of project "app1" do not match the current shrinkwrap.
  Dependencies of project "app2" do not match the current shrinkwrap.


The shrinkwrap file (pnpm-lock.yaml) is out of date. You need to run "rush update".

Error: An error occurred.
    at WorkspaceInstallManager.prepareAsync (/Users/*/.rush/node-v22.20.0/rush-5.165.0/node_modules/@microsoft/rush-lib/dist/chunks/InstallManagerFactory.js:803:19)
    at async WorkspaceInstallManager.doInstallAsync (/Users/*/.rush/node-v22.20.0/rush-5.165.0/node_modules/@microsoft/rush-lib/dist/chunks/InstallManagerFactory.js:429:102)
    at async WorkspaceInstallManager.doInstallAsync (/Users/*/.rush/node-v22.20.0/rush-5.165.0/node_modules/@microsoft/rush-lib/dist/chunks/InstallManagerFactory.js:1347:9)
    at async InstallAction._doInstallAsync (/Users/*/.rush/node-v22.20.0/rush-5.165.0/node_modules/@microsoft/rush-lib/dist/commons.js:854:9)
    at async InstallAction.runAsync (/Users/*/.rush/node-v22.20.0/rush-5.165.0/node_modules/@microsoft/rush-lib/dist/commons.js:821:21)
    at async InstallAction.onExecuteAsync (/Users/*/.rush/node-v22.20.0/rush-5.165.0/node_modules/@microsoft/rush-lib/dist/commons.js:19739:9)
    at async InstallAction._executeAsync (/Users/*/.rush/node-v22.20.0/rush-5.165.0/node_modules/@rushstack/ts-command-line/lib/providers/CommandLineAction.js:65:9)
    at async RushCommandLineParser.onExecuteAsync (/Users/*/.rush/node-v22.20.0/rush-5.165.0/node_modules/@rushstack/ts-command-line/lib/providers/CommandLineParser.js:263:13)
    at async RushCommandLineParser._wrapOnExecuteAsync (/Users/*/.rush/node-v22.20.0/rush-5.165.0/node_modules/@microsoft/rush-lib/dist/commons.js:26798:13)
    at async RushCommandLineParser.onExecuteAsync (/Users/*/.rush/node-v22.20.0/rush-5.165.0/node_modules/@microsoft/rush-lib/dist/commons.js:26746:13)

Expected result: rush install should success.

Actual result: rush install failed.

Details

After some investigations, I found the common/temp/<subspaceName>/pnpmfileSettings.json lost the preferredVersions data after rush update.

{
  "workspaceProjects": {},
  "subspaceProjects": {
    "app1": {
      "packageName": "app1",
      "projectRelativeFolder": "packages/app1",
      "packageVersion": "1.0.0",
      "injectedDependencies": []
    }
  },
  "semverPath": "/Users/*/.rush/node-v22.20.0/rush-5.165.0/node_modules/semver/index.js",
  "userPnpmfilePath": "/Users/*/lp/rush-sample-repo/common/config/subspaces/default/.pnpmfile.cjs"
}

This preferred json should be like:

{
  "allPreferredVersions": {
    "rxjs": "7.8.2"
  },
  "workspaceProjects": {},
  "subspaceProjects": {
    "app1": {
      "packageName": "app1",
      "projectRelativeFolder": "packages/app1",
      "packageVersion": "1.0.0",
      "injectedDependencies": []
    }
  },
  "semverPath": "/Users/*/.rush/node-v22.20.0/rush-5.165.0/node_modules/semver/index.js",
  "userPnpmfilePath": "/Users/*/lp/rush-sample-repo/common/config/subspaces/default/.pnpmfile.cjs"
}

So, when rush call pnpm install, the common/temp/<subspaceName>/.pnpmfile.cjs lost the overrides version data and generate a wrong pnpm-lock.yaml.

Standard questions

Please answer these questions to help us investigate your issue more quickly: