[rush] `rush update` never stabilizes when `globalOverrides` uses a versioned selector

Open

#5,614 opened on Feb 9, 2026 1 comment 1 reaction 2 assignees View on GitHub

@bmiddha is already working on this.

Since Feb 9, 2026.

Assessment

This issue has not been assessed yet.

Description

Summary

Repro steps

Minimal repro: https://github.com/bmiddha/rushstack-demo-pnpm-global-overrides-rush-update-bug

Details

When a globalOverrides entry in pnpm-config.json uses a versioned package selector (e.g. "webpack@5": "5.103.0"), rush update never reaches a stable state when a package is requesting another version. Every invocation reports that dependencies do not match the current shrinkwrap, re-runs pnpm install, and rewrites the lockfile — even though nothing has changed.

Changing the override key to an unversioned selector (e.g. "webpack": "5.103.0") works; rush update stabilizes after the first run.

Standard questions

Please answer these questions to help us investigate your issue more quickly:

Question	Answer
`@microsoft/rush` globally installed version?	5.163.0
`rushVersion` from rush.json?	5.163.0
`pnpmVersion`, `npmVersion`, or `yarnVersion` from rush.json?	[email protected]
(if pnpm) `useWorkspaces` from pnpm-config.json?	true
Operating system?	Mac
Would you consider contributing a PR?	Yes
Node.js version (`node -v`)?	22.19.0

Dominant language: TypeScript
Stars: 6.5k
Forks: 708
Avg merge: 4d 13h
Merged PRs (30d): 62

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

More from microsoft/rushstack

[rush] Upgrade the pnpm-sync-lib dependency to 0.3.5. Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

microsoft/rushstack#5971 · 2 comments · Opened Aug 27, 2026
[rush] pnpm-config schema is out of date and missing keys Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

microsoft/rushstack#5902 · 1 reaction · Opened Jul 22, 2026
[rush] "globalCatalogs" is not defined in json schema Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

microsoft/rushstack#5839 · 1 reaction · Opened Jun 19, 2026
[rush] Rush adds `globalOnlyBuiltDependencies` to my pnpm-config and then subsequently complains about it Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

microsoft/rushstack#5683 · 3 comments · Opened Mar 4, 2026
[rush] rush-daemon-transport: long socket paths are silently truncated so workspaces share one daemon; reclaim lock steal is not exclusive; deleting the runtime dir leaves an unreachable daemon running Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

microsoft/rushstack#6083 · Opened Sep 24, 2026

All issues in microsoft/rushstack

Similar issues

docs: manual client injection examples reference removed exports Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

vitejs/devtools#589 · 1 comment · Opened Sep 25, 2026
🔒 [IBM OSPO Security Notification] — IBM/node-sdk-core Open

security

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

IBM/node-sdk-core#373 · Opened Sep 25, 2026
[fullsend] E2E: topology — Tekton pipeline status decorator timeout on Topology tab Open

e2e-failure ready-to-code

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

redhat-developer/rhdh-plugin-export-overlays#3937 · Opened Sep 25, 2026
The open-first recovery advice falls back to --base main, contradicting the fetched base Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

victorstein/herdr-plugin-pipeline#121 · Opened Sep 25, 2026
Finish the #680 label rename: audit-report 'Layout flags' heading and CLAUDE.md Open

chore

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

offlinecv/OfflineCV#1018 · Opened Sep 25, 2026

More TypeScript issues