pnpm update updates node runtime version in lock file but not in package.json #14988

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

12.4.2

Which area(s) of pnpm are affected? (leave empty if unsure)

No response

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

This is difficult to reproduce because it requires a new version of node to be released while you have an existing project setup with a dev engine node runtime with a caret version range set like this ^26.8.2, not an exact version. But in principle here is how to reproduce:

1. initialize a new project with pnpm init while in an empty directory
2. add this to the package.json devEngines section:

    "runtime": {
      "name": "node",
      "version": "^26.8.2",
      "onFail": "download"
    }

3. run pnpm i
4. when a new version of node releases, if you run pnpm update the node version used in pnpm-lock.yaml will update but the devEngines.runtime.version will not be updated

Describe the Bug

Any other dependency declared in your package.json with a caret version range gets updated both in the package.json and in the pnpm-lock.yaml, so if you have a dependency with ^1.1.0 and version 1.2.0 comes out, when you run pnpm update it updates the package.json to ^1.2.0. I would assume devEngines.runtime worked the same.

Not directly related, but I believe that previously pnpm outdated also flagged devEngines.runtime if a newer version was available, but now that does not happen, both for caret version range and exact versions.

Expected Behavior

package.json devEngines.runtime version gets updated when you run pnpm update and new version is available.

Which Node.js version are you using?

26.8.2

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response