feat: improve lockfile v4 to store normalized version constraints and be more terse (#25247)

Stores normalized version constraints in the lockfile, which will
improve reproducibility and will fix a bug with duplicate specifiers
ending up in the lockfile. Also, gets rid of some duplicate data in the
specifiers area of the lockfile.

40 files changed, 137 insertions, 131 deletions

diff --git a/tests/Cargo.toml b/tests/Cargo.toml
index 0c14b6993..bb84c2249 100644
--- a/tests/Cargo.toml
+++ b/tests/Cargo.toml
@@ -41,6 +41,7 @@ deno_cache_dir = { workspace = true }
 deno_core = { workspace = true, features = ["include_js_files_for_snapshotting", "unsafe_use_unprotected_platform"] }
 deno_fetch.workspace = true
 deno_lockfile.workspace = true
+deno_semver.workspace = true
 deno_terminal.workspace = true
 deno_tls.workspace = true
 fastwebsockets = { workspace = true, features = ["upgrade", "unstable-split"] }
diff --git a/tests/integration/check_tests.rs b/tests/integration/check_tests.rs
index f0e3dfb5a..ce464135b 100644
--- a/tests/integration/check_tests.rs
+++ b/tests/integration/check_tests.rs
@@ -1,6 +1,7 @@
 // Copyright 2018-2024 the Deno authors. All rights reserved. MIT license.
 
 use deno_lockfile::NewLockfileOptions;
+use deno_semver::jsr::JsrDepPackageReq;
 use test_util as util;
 use test_util::itest;
 use util::env_vars_for_npm_tests;
@@ -372,8 +373,11 @@ fn npm_module_check_then_error() {
 
   // make the specifier resolve to version 1
   lockfile.content.packages.specifiers.insert(
-    "npm:@denotest/breaking-change-between-versions".to_string(),
-    "npm:@denotest/breaking-change-between-versions@1.0.0".to_string(),
+    JsrDepPackageReq::from_str(
+      "npm:@denotest/breaking-change-between-versions",
+    )
+    .unwrap(),
+    "1.0.0".to_string(),
   );
   lockfile_path.write(lockfile.as_json_string());
   temp_dir.write(
@@ -387,8 +391,11 @@ fn npm_module_check_then_error() {
   // now update the lockfile to use version 2 instead, which should cause a
   // type checking error because the oldName no longer exists
   lockfile.content.packages.specifiers.insert(
-    "npm:@denotest/breaking-change-between-versions".to_string(),
-    "npm:@denotest/breaking-change-between-versions@2.0.0".to_string(),
+    JsrDepPackageReq::from_str(
+      "npm:@denotest/breaking-change-between-versions",
+    )
+    .unwrap(),
+    "2.0.0".to_string(),
   );
   lockfile_path.write(lockfile.as_json_string());
 
diff --git a/tests/integration/jsr_tests.rs b/tests/integration/jsr_tests.rs
index f31b53f27..af5b24fe4 100644
--- a/tests/integration/jsr_tests.rs
+++ b/tests/integration/jsr_tests.rs
@@ -6,6 +6,8 @@ use deno_core::serde_json::json;
 use deno_core::serde_json::Value;
 use deno_lockfile::Lockfile;
 use deno_lockfile::NewLockfileOptions;
+use deno_semver::jsr::JsrDepPackageReq;
+use deno_semver::package::PackageNv;
 use test_util as util;
 use url::Url;
 use util::assert_contains;
@@ -154,8 +156,10 @@ console.log(version);"#,
     .content
     .packages
     .specifiers
-    .get_mut("jsr:@denotest/no-module-graph@0.1")
-    .unwrap() = "jsr:@denotest/no-module-graph@0.1.0".to_string();
+    .get_mut(
+      &JsrDepPackageReq::from_str("jsr:@denotest/no-module-graph@0.1").unwrap(),
+    )
+    .unwrap() = "0.1.0".to_string();
   lockfile_path.write(lockfile.as_json_string());
 
   test_context
@@ -276,9 +280,9 @@ console.log(version);"#,
     overwrite: false,
   })
   .unwrap();
-  let pkg_name = "@denotest/no-module-graph@0.1.1";
-  let original_integrity = get_lockfile_pkg_integrity(&lockfile, pkg_name);
-  set_lockfile_pkg_integrity(&mut lockfile, pkg_name, "bad_integrity");
+  let pkg_nv = "@denotest/no-module-graph@0.1.1";
+  let original_integrity = get_lockfile_pkg_integrity(&lockfile, pkg_nv);
+  set_lockfile_pkg_integrity(&mut lockfile, pkg_nv, "bad_integrity");
   lockfile_path.write(lockfile.as_json_string());
 
   let actual_integrity =
@@ -317,7 +321,7 @@ Investigate the lockfile; delete it to regenerate the lockfile or --reload to re
     .assert_exit_code(10);
 
   // now update to the correct integrity
-  set_lockfile_pkg_integrity(&mut lockfile, pkg_name, &original_integrity);
+  set_lockfile_pkg_integrity(&mut lockfile, pkg_nv, &original_integrity);
   lockfile_path.write(lockfile.as_json_string());
 
   // should pass now
@@ -329,7 +333,7 @@ Investigate the lockfile; delete it to regenerate the lockfile or --reload to re
     .assert_exit_code(0);
 
   // now update to a bad integrity again
-  set_lockfile_pkg_integrity(&mut lockfile, pkg_name, "bad_integrity");
+  set_lockfile_pkg_integrity(&mut lockfile, pkg_nv, "bad_integrity");
   lockfile_path.write(lockfile.as_json_string());
 
   // shouldn't matter because we have a vendor folder
@@ -400,12 +404,12 @@ If you modified your global cache, run again with the --reload flag to restore i
     .assert_exit_code(10);
 }
 
-fn get_lockfile_pkg_integrity(lockfile: &Lockfile, pkg_name: &str) -> String {
+fn get_lockfile_pkg_integrity(lockfile: &Lockfile, pkg_nv: &str) -> String {
   lockfile
     .content
     .packages
     .jsr
-    .get(pkg_name)
+    .get(&PackageNv::from_str(pkg_nv).unwrap())
     .unwrap()
     .integrity
     .clone()
@@ -413,14 +417,14 @@ fn get_lockfile_pkg_integrity(lockfile: &Lockfile, pkg_name: &str) -> String {
 
 fn set_lockfile_pkg_integrity(
   lockfile: &mut Lockfile,
-  pkg_name: &str,
+  pkg_nv: &str,
   integrity: &str,
 ) {
   lockfile
     .content
     .packages
     .jsr
-    .get_mut(pkg_name)
+    .get_mut(&PackageNv::from_str(pkg_nv).unwrap())
     .unwrap()
     .integrity = integrity.to_string();
 }
diff --git a/tests/integration/npm_tests.rs b/tests/integration/npm_tests.rs
index 2babcb21e..f4bf3d6e9 100644
--- a/tests/integration/npm_tests.rs
+++ b/tests/integration/npm_tests.rs
@@ -272,13 +272,6 @@ itest!(nonexistent_file_node_modules_dir {
   exit_code: 1,
 });
 
-itest!(invalid_package_name {
-  args: "run -A --quiet npm/invalid_package_name/main.js",
-  output: "npm/invalid_package_name/main.out",
-  envs: env_vars_for_npm_tests(),
-  exit_code: 1,
-});
-
 itest!(require_json {
   args: "run -A --quiet npm/require_json/main.js",
   output: "npm/require_json/main.out",
@@ -1218,7 +1211,7 @@ fn lock_file_lock_write() {
   let lock_file_content = r#"{
   "version": "4",
   "specifiers": {
-    "npm:cowsay@1.5.0": "npm:cowsay@1.5.0"
+    "npm:cowsay@1.5.0": "1.5.0"
   },
   "npm": {
     "ansi-regex@3.0.1": {
@@ -1428,7 +1421,7 @@ fn auto_discover_lock_file() {
   let lock_file_content = r#"{
     "version": "4",
     "specifiers": {
-      "npm:@denotest/bin": "npm:@denotest/bin@1.0.0"
+      "npm:@denotest/bin": "1.0.0"
     },
     "npm": {
       "@denotest/bin@1.0.0": {
diff --git a/tests/integration/run_tests.rs b/tests/integration/run_tests.rs
index ad20b77e1..64e9d1c22 100644
--- a/tests/integration/run_tests.rs
+++ b/tests/integration/run_tests.rs
@@ -923,7 +923,7 @@ fn lock_redirects() {
     r#"{
   "version": "4",
   "specifiers": {
-    "npm:@denotest/esm-basic": "npm:@denotest/esm-basic@1.0.0"
+    "npm:@denotest/esm-basic@*": "1.0.0"
   },
   "npm": {
     "@denotest/esm-basic@1.0.0": {
@@ -974,8 +974,8 @@ fn lock_deno_json_package_json_deps() {
   lockfile.assert_matches_json(json!({
     "version": "4",
     "specifiers": {
-      "jsr:@denotest/module-graph@1.4": "jsr:@denotest/module-graph@1.4.0",
-      "npm:@denotest/esm-basic": "npm:@denotest/esm-basic@1.0.0"
+      "jsr:@denotest/module-graph@1.4": "1.4.0",
+      "npm:@denotest/esm-basic@*": "1.0.0"
     },
     "jsr": {
       "@denotest/module-graph@1.4.0": {
@@ -990,7 +990,7 @@ fn lock_deno_json_package_json_deps() {
     "workspace": {
       "dependencies": [
         "jsr:@denotest/module-graph@1.4",
-        "npm:@denotest/esm-basic"
+        "npm:@denotest/esm-basic@*"
       ]
     }
   }));
@@ -1022,8 +1022,8 @@ fn lock_deno_json_package_json_deps() {
   lockfile.assert_matches_json(json!({
     "version": "4",
     "specifiers": {
-      "jsr:@denotest/module-graph@1.4": "jsr:@denotest/module-graph@1.4.0",
-      "npm:@denotest/esm-basic": "npm:@denotest/esm-basic@1.0.0"
+      "jsr:@denotest/module-graph@1.4": "1.4.0",
+      "npm:@denotest/esm-basic@*": "1.0.0"
     },
     "jsr": {
       "@denotest/module-graph@1.4.0": {
@@ -1041,7 +1041,7 @@ fn lock_deno_json_package_json_deps() {
       ],
       "packageJson": {
         "dependencies": [
-          "npm:@denotest/esm-basic"
+          "npm:@denotest/esm-basic@*"
         ]
       }
     }
@@ -1059,7 +1059,7 @@ fn lock_deno_json_package_json_deps() {
   lockfile.assert_matches_json(json!({
     "version": "4",
     "specifiers": {
-      "jsr:@denotest/module-graph@1.4": "jsr:@denotest/module-graph@1.4.0",
+      "jsr:@denotest/module-graph@1.4": "1.4.0",
     },
     "jsr": {
       "@denotest/module-graph@1.4.0": {
@@ -1143,8 +1143,8 @@ fn lock_deno_json_package_json_deps_workspace() {
   lockfile.assert_matches_json(json!({
     "version": "4",
     "specifiers": {
-      "npm:@denotest/cjs-default-export@1": "npm:@denotest/cjs-default-export@1.0.0",
-      "npm:@denotest/esm-basic@1": "npm:@denotest/esm-basic@1.0.0"
+      "npm:@denotest/cjs-default-export@1": "1.0.0",
+      "npm:@denotest/esm-basic@1": "1.0.0"
     },
     "npm": {
       "@denotest/cjs-default-export@1.0.0": {
@@ -1186,8 +1186,8 @@ fn lock_deno_json_package_json_deps_workspace() {
   let expected_lockfile = json!({
     "version": "4",
     "specifiers": {
-      "npm:@denotest/cjs-default-export@1": "npm:@denotest/cjs-default-export@1.0.0",
-      "npm:@denotest/esm-basic@1": "npm:@denotest/esm-basic@1.0.0"
+      "npm:@denotest/cjs-default-export@1": "1.0.0",
+      "npm:@denotest/esm-basic@1": "1.0.0"
     },
     "npm": {
       "@denotest/cjs-default-export@1.0.0": {
@@ -3463,36 +3463,6 @@ fn package_json_with_deno_json() {
 }
 
 #[test]
-fn package_json_error_dep_value_test() {
-  let context = TestContextBuilder::for_npm()
-    .use_copy_temp_dir("package_json/invalid_value")
-    .cwd("package_json/invalid_value")
-    .build();
-
-  // should run fine when not referencing a failing dep entry
-  context
-    .new_command()
-    .args("run ok.ts")
-    .run()
-    .assert_matches_file("package_json/invalid_value/ok.ts.out");
-
-  // should fail when referencing a failing dep entry
-  context
-    .new_command()
-    .args("run error.ts")
-    .run()
-    .assert_exit_code(1)
-    .assert_matches_file("package_json/invalid_value/error.ts.out");
-
-  // should output a warning about the failing dep entry
-  context
-    .new_command()
-    .args("task test")
-    .run()
-    .assert_matches_file("package_json/invalid_value/task.out");
-}
-
-#[test]
 fn package_json_no_node_modules_dir_created() {
   // it should not create a node_modules directory
   let context = TestContextBuilder::new()
diff --git a/tests/specs/install/future_install_local_deno/deno.lock.out b/tests/specs/install/future_install_local_deno/deno.lock.out
index 04bfc9b3a..5c9582fff 100644
--- a/tests/specs/install/future_install_local_deno/deno.lock.out
+++ b/tests/specs/install/future_install_local_deno/deno.lock.out
@@ -1,9 +1,9 @@
 {
   "version": "4",
   "specifiers": {
-    "jsr:@denotest/add": "jsr:@denotest/add@1.0.0",
-    "jsr:@std/testing": "jsr:@std/testing@1.0.0",
-    "npm:@denotest/esm-basic@^1.0.0": "npm:@denotest/esm-basic@1.0.0"
+    "jsr:@denotest/add@*": "1.0.0",
+    "jsr:@std/testing@*": "1.0.0",
+    "npm:@denotest/esm-basic@1": "1.0.0"
   },
   "jsr": {
     "@denotest/add@1.0.0": {
@@ -26,9 +26,9 @@
   },
   "workspace": {
     "dependencies": [
-      "jsr:@denotest/add",
-      "jsr:@std/testing",
-      "npm:@denotest/esm-basic@^1.0.0"
+      "jsr:@denotest/add@*",
+      "jsr:@std/testing@*",
+      "npm:@denotest/esm-basic@1"
     ]
   }
 }
diff --git a/tests/specs/install/future_install_node_modules/deno.lock.out b/tests/specs/install/future_install_node_modules/deno.lock.out
index c8071adad..3a6ae8586 100644
--- a/tests/specs/install/future_install_node_modules/deno.lock.out
+++ b/tests/specs/install/future_install_node_modules/deno.lock.out
@@ -1,7 +1,7 @@
 {
   "version": "4",
   "specifiers": {
-    "npm:@denotest/esm-basic": "npm:@denotest/esm-basic@1.0.0"
+    "npm:@denotest/esm-basic@*": "1.0.0"
   },
   "npm": {
     "@denotest/esm-basic@1.0.0": {
@@ -11,7 +11,7 @@
   "workspace": {
     "packageJson": {
       "dependencies": [
-        "npm:@denotest/esm-basic"
+        "npm:@denotest/esm-basic@*"
       ]
     }
   }
diff --git a/tests/specs/lockfile/adding_jsr_dep/lock01.out b/tests/specs/lockfile/adding_jsr_dep/lock01.out
index fcdb22ae1..7f5c75407 100644
--- a/tests/specs/lockfile/adding_jsr_dep/lock01.out
+++ b/tests/specs/lockfile/adding_jsr_dep/lock01.out
@@ -1,7 +1,7 @@
 {
   "version": "4",
   "specifiers": {
-    "jsr:@denotest/add@1": "jsr:@denotest/add@1.0.0"
+    "jsr:@denotest/add@1": "1.0.0"
   },
   "jsr": {
     "@denotest/add@1.0.0": {
diff --git a/tests/specs/lockfile/adding_jsr_dep/lock02.out b/tests/specs/lockfile/adding_jsr_dep/lock02.out
index f069c5a2f..6519df0b3 100644
--- a/tests/specs/lockfile/adding_jsr_dep/lock02.out
+++ b/tests/specs/lockfile/adding_jsr_dep/lock02.out
@@ -1,8 +1,8 @@
 {
   "version": "4",
   "specifiers": {
-    "jsr:@denotest/add@1": "jsr:@denotest/add@1.0.0",
-    "jsr:@denotest/subtract@1": "jsr:@denotest/subtract@1.0.0"
+    "jsr:@denotest/add@1": "1.0.0",
+    "jsr:@denotest/subtract@1": "1.0.0"
   },
   "jsr": {
     "@denotest/add@1.0.0": {
diff --git a/tests/specs/lockfile/adding_jsr_export_new_dep/lock01.out b/tests/specs/lockfile/adding_jsr_export_new_dep/lock01.out
index a2ce254a3..d3b8f82e7 100644
--- a/tests/specs/lockfile/adding_jsr_export_new_dep/lock01.out
+++ b/tests/specs/lockfile/adding_jsr_export_new_dep/lock01.out
@@ -1,8 +1,8 @@
 {
   "version": "4",
   "specifiers": {
-    "jsr:@denotest/add@1": "jsr:@denotest/add@1.0.0",
-    "jsr:@denotest/different-deps-per-export@1": "jsr:@denotest/different-deps-per-export@1.0.0"
+    "jsr:@denotest/add@1": "1.0.0",
+    "jsr:@denotest/different-deps-per-export@1": "1.0.0"
   },
   "jsr": {
     "@denotest/add@1.0.0": {
diff --git a/tests/specs/lockfile/adding_jsr_export_new_dep/lock02.out b/tests/specs/lockfile/adding_jsr_export_new_dep/lock02.out
index d4825c32d..ddb1dfca0 100644
--- a/tests/specs/lockfile/adding_jsr_export_new_dep/lock02.out
+++ b/tests/specs/lockfile/adding_jsr_export_new_dep/lock02.out
@@ -1,9 +1,9 @@
 {
   "version": "4",
   "specifiers": {
-    "jsr:@denotest/add@1": "jsr:@denotest/add@1.0.0",
-    "jsr:@denotest/different-deps-per-export@1": "jsr:@denotest/different-deps-per-export@1.0.0",
-    "jsr:@denotest/subtract@1": "jsr:@denotest/subtract@1.0.0"
+    "jsr:@denotest/add@1": "1.0.0",
+    "jsr:@denotest/different-deps-per-export@1": "1.0.0",
+    "jsr:@denotest/subtract@1": "1.0.0"
   },
   "jsr": {
     "@denotest/add@1.0.0": {
diff --git a/tests/specs/lockfile/adding_npm_dep/lock01.out b/tests/specs/lockfile/adding_npm_dep/lock01.out
index 0ed6aa8c7..82b6a5b3d 100644
--- a/tests/specs/lockfile/adding_npm_dep/lock01.out
+++ b/tests/specs/lockfile/adding_npm_dep/lock01.out
@@ -1,7 +1,7 @@
 {
   "version": "4",
   "specifiers": {
-    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0"
+    "npm:@denotest/add@1": "1.0.0"
   },
   "npm": {
     "@denotest/add@1.0.0": {
diff --git a/tests/specs/lockfile/adding_npm_dep/lock02.out b/tests/specs/lockfile/adding_npm_dep/lock02.out
index 7a9da8d29..f22cbc428 100644
--- a/tests/specs/lockfile/adding_npm_dep/lock02.out
+++ b/tests/specs/lockfile/adding_npm_dep/lock02.out
@@ -1,8 +1,8 @@
 {
   "version": "4",
   "specifiers": {
-    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0",
-    "npm:@denotest/subtract@1": "npm:@denotest/subtract@1.0.0"
+    "npm:@denotest/add@1": "1.0.0",
+    "npm:@denotest/subtract@1": "1.0.0"
   },
   "npm": {
     "@denotest/add@1.0.0": {
diff --git a/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_cache.out b/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_cache.out
index a66e090a2..55ada3dc3 100644
--- a/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_cache.out
+++ b/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_cache.out
@@ -1,8 +1,8 @@
 error: The lockfile is out of date. Run `deno cache --frozen=false` or rerun with `--frozen=false` to update it.
 changes:
- 4 | -    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0"
- 4 | +    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0",
- 5 | +    "npm:@denotest/subtract@1": "npm:@denotest/subtract@1.0.0"
+ 4 | -    "npm:@denotest/add@1": "1.0.0"
+ 4 | +    "npm:@denotest/add@1": "1.0.0",
+ 5 | +    "npm:@denotest/subtract@1": "1.0.0"
  9 | -    }
 10 | +    },
 11 | +    "@denotest/subtract@1.0.0": {
diff --git a/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_dynamic_jsr.out b/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_dynamic_jsr.out
index 7051ecbfa..e2b29706c 100644
--- a/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_dynamic_jsr.out
+++ b/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_dynamic_jsr.out
@@ -3,9 +3,9 @@ Download http://127.0.0.1:4250/@denotest/add/1.0.0_meta.json
 Download http://127.0.0.1:4250/@denotest/add/1.0.0/mod.ts
 error: Uncaught (in promise) TypeError: The lockfile is out of date. Run `deno cache --frozen=false` or rerun with `--frozen=false` to update it.
 changes:
- 4 | -    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0"
- 4 | +    "jsr:@denotest/add@1": "jsr:@denotest/add@1.0.0",
- 5 | +    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0"
+ 4 | -    "npm:@denotest/add@1": "1.0.0"
+ 4 | +    "jsr:@denotest/add@1": "1.0.0",
+ 5 | +    "npm:@denotest/add@1": "1.0.0"
  6 | +  },
  7 | +  "jsr": {
  8 | +    "@denotest/add@1.0.0": {
diff --git a/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_dynamic_npm.out b/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_dynamic_npm.out
index 749c69587..368d8de5e 100644
--- a/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_dynamic_npm.out
+++ b/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_dynamic_npm.out
@@ -1,9 +1,9 @@
 Download http://localhost:4260/@denotest/subtract
 error: Uncaught (in promise) TypeError: The lockfile is out of date. Run `deno cache --frozen=false` or rerun with `--frozen=false` to update it.
 changes:
- 4 | -    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0"
- 4 | +    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0",
- 5 | +    "npm:@denotest/subtract@1": "npm:@denotest/subtract@1.0.0"
+ 4 | -    "npm:@denotest/add@1": "1.0.0"
+ 4 | +    "npm:@denotest/add@1": "1.0.0",
+ 5 | +    "npm:@denotest/subtract@1": "1.0.0"
  9 | -    }
 10 | +    },
 11 | +    "@denotest/subtract@1.0.0": {
diff --git a/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_jsr_cache.out b/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_jsr_cache.out
index 9e77bce85..5265400ec 100644
--- a/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_jsr_cache.out
+++ b/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_jsr_cache.out
@@ -1,10 +1,10 @@
 error: The lockfile is out of date. Run `deno cache --frozen=false` or rerun with `--frozen=false` to update it.
 changes:
- 4 | -    "jsr:@denotest/add@1": "jsr:@denotest/add@1.0.0"
+ 4 | -    "jsr:@denotest/add@1": "1.0.0"
  5 | -  },
  6 | -  "jsr": {
- 4 | +    "jsr:@denotest/add@0.2.0": "jsr:@denotest/add@0.2.0",
- 5 | +    "jsr:@denotest/add@1": "jsr:@denotest/add@1.0.0"
+ 4 | +    "jsr:@denotest/add@0.2.0": "0.2.0",
+ 5 | +    "jsr:@denotest/add@1": "1.0.0"
  6 | +  },
  7 | +  "jsr": {
  8 | +    "@denotest/add@0.2.0": {
diff --git a/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_jsr_run.out b/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_jsr_run.out
index 0222ca355..215427a0d 100644
--- a/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_jsr_run.out
+++ b/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_jsr_run.out
@@ -2,11 +2,11 @@ Download http://127.0.0.1:4250/@denotest/add/0.2.0_meta.json
 Download http://127.0.0.1:4250/@denotest/add/0.2.0/mod.ts
 error: The lockfile is out of date. Run `deno cache --frozen=false` or rerun with `--frozen=false` to update it.
 changes:
- 4 | -    "jsr:@denotest/add@1": "jsr:@denotest/add@1.0.0"
+ 4 | -    "jsr:@denotest/add@1": "1.0.0"
  5 | -  },
  6 | -  "jsr": {
- 4 | +    "jsr:@denotest/add@0.2.0": "jsr:@denotest/add@0.2.0",
- 5 | +    "jsr:@denotest/add@1": "jsr:@denotest/add@1.0.0"
+ 4 | +    "jsr:@denotest/add@0.2.0": "0.2.0",
+ 5 | +    "jsr:@denotest/add@1": "1.0.0"
  6 | +  },
  7 | +  "jsr": {
  8 | +    "@denotest/add@0.2.0": {
diff --git a/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_run.out b/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_run.out
index d8ab302b7..351afbae7 100644
--- a/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_run.out
+++ b/tests/specs/lockfile/frozen_lockfile/frozen_new_dep_run.out
@@ -1,9 +1,9 @@
 Download http://localhost:4260/@denotest/subtract
 error: The lockfile is out of date. Run `deno cache --frozen=false` or rerun with `--frozen=false` to update it.
 changes:
- 4 | -    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0"
- 4 | +    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0",
- 5 | +    "npm:@denotest/subtract@1": "npm:@denotest/subtract@1.0.0"
+ 4 | -    "npm:@denotest/add@1": "1.0.0"
+ 4 | +    "npm:@denotest/add@1": "1.0.0",
+ 5 | +    "npm:@denotest/subtract@1": "1.0.0"
  9 | -    }
 10 | +    },
 11 | +    "@denotest/subtract@1.0.0": {
diff --git a/tests/specs/lockfile/frozen_lockfile/frozen_package_json_changed.out b/tests/specs/lockfile/frozen_lockfile/frozen_package_json_changed.out
index 60a01158d..05d1ca375 100644
--- a/tests/specs/lockfile/frozen_lockfile/frozen_package_json_changed.out
+++ b/tests/specs/lockfile/frozen_lockfile/frozen_package_json_changed.out
@@ -1,9 +1,9 @@
 Download http://localhost:4260/@denotest/bin
 error: The lockfile is out of date. Run `deno cache --frozen=false`, `deno install --frozen=false`, or rerun with `--frozen=false` to update it.
 changes:
- 4 | -    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0"
- 4 | +    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0",
- 5 | +    "npm:@denotest/bin@0.7.0": "npm:@denotest/bin@0.7.0"
+ 4 | -    "npm:@denotest/add@1": "1.0.0"
+ 4 | +    "npm:@denotest/add@1": "1.0.0",
+ 5 | +    "npm:@denotest/bin@0.7.0": "0.7.0"
  9 | -    }
 10 | +    },
 11 | +    "@denotest/bin@0.7.0": {
diff --git a/tests/specs/lockfile/frozen_lockfile/frozen_package_json_changed_install.out b/tests/specs/lockfile/frozen_lockfile/frozen_package_json_changed_install.out
index 397179596..112edc411 100644
--- a/tests/specs/lockfile/frozen_lockfile/frozen_package_json_changed_install.out
+++ b/tests/specs/lockfile/frozen_lockfile/frozen_package_json_changed_install.out
@@ -1,8 +1,8 @@
 error: The lockfile is out of date. Run `deno cache --frozen=false`, `deno install --frozen=false`, or rerun with `--frozen=false` to update it.
 changes:
- 4 | -    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0"
- 4 | +    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0",
- 5 | +    "npm:@denotest/bin@0.7.0": "npm:@denotest/bin@0.7.0"
+ 4 | -    "npm:@denotest/add@1": "1.0.0"
+ 4 | +    "npm:@denotest/add@1": "1.0.0",
+ 5 | +    "npm:@denotest/bin@0.7.0": "0.7.0"
  9 | -    }
 10 | +    },
 11 | +    "@denotest/bin@0.7.0": {
diff --git a/tests/specs/lockfile/frozen_lockfile/no_lockfile_run.out b/tests/specs/lockfile/frozen_lockfile/no_lockfile_run.out
index e482c469f..f04aea55c 100644
--- a/tests/specs/lockfile/frozen_lockfile/no_lockfile_run.out
+++ b/tests/specs/lockfile/frozen_lockfile/no_lockfile_run.out
@@ -5,7 +5,7 @@ changes:
  1 | +{
  2 | +  "version": "4",
  3 | +  "specifiers": {
- 4 | +    "npm:@denotest/add@1": "npm:@denotest/add@1.0.0"
+ 4 | +    "npm:@denotest/add@1": "1.0.0"
  5 | +  },
  6 | +  "npm": {
  7 | +    "@denotest/add@1.0.0": {
diff --git a/tests/specs/lockfile/only_package_json/deno.lock.out b/tests/specs/lockfile/only_package_json/deno.lock.out
index 395190a66..d390a59c1 100644
--- a/tests/specs/lockfile/only_package_json/deno.lock.out
+++ b/tests/specs/lockfile/only_package_json/deno.lock.out
@@ -1,7 +1,7 @@
 {
   "version": "4",
   "specifiers": {
-    "npm:@denotest/esm-basic": "npm:@denotest/esm-basic@1.0.0"
+    "npm:@denotest/esm-basic@*": "1.0.0"
   },
   "npm": {
     "@denotest/esm-basic@1.0.0": [WILDCARD]
@@ -9,7 +9,7 @@
   "workspace": {
     "packageJson": {
       "dependencies": [
-        "npm:@denotest/esm-basic"
+        "npm:@denotest/esm-basic@*"
       ]
     }
   }
diff --git a/tests/specs/npm/adding_npm_dep_in_dynamic_import/lock.out b/tests/specs/npm/adding_npm_dep_in_dynamic_import/lock.out
index c8caafc07..e80d56bd8 100644
--- a/tests/specs/npm/adding_npm_dep_in_dynamic_import/lock.out
+++ b/tests/specs/npm/adding_npm_dep_in_dynamic_import/lock.out
@@ -1,8 +1,8 @@
 {
   "version": "4",
   "specifiers": {
-    "npm:@denotest/add": "npm:@denotest/add@1.0.0",
-    "npm:@denotest/subtract": "npm:@denotest/subtract@1.0.0"
+    "npm:@denotest/add@*": "1.0.0",
+    "npm:@denotest/subtract@*": "1.0.0"
   },
   "npm": {
     "@denotest/add@1.0.0": {
diff --git a/tests/specs/npm/dynamic_npm_resolution_failure/main.out b/tests/specs/npm/dynamic_npm_resolution_failure/main.out
index 03c733567..a795f0233 100644
--- a/tests/specs/npm/dynamic_npm_resolution_failure/main.out
+++ b/tests/specs/npm/dynamic_npm_resolution_failure/main.out
@@ -5,10 +5,10 @@ Download http://localhost:4260/@denotest/dep-cannot-parse
 Download http://localhost:4260/chalk/chalk-5.0.1.tgz
 Hi
 TypeError: Error in @denotest/dep-cannot-parse@1.0.0 parsing version requirement for dependency: @denotest/esm-basic@unknown-scheme:unknown
-
-Invalid npm version requirement. Unexpected character.
-  unknown-scheme:unknown
-  ~
+    0: Invalid version requirement
+    1: Unexpected character.
+         unknown-scheme:unknown
+         ~
     at async file:///[WILDLINE]main.ts:5:3 {
   code: "ERR_MODULE_NOT_FOUND"
 }
diff --git a/tests/specs/npm/invalid_package_name/__test__.jsonc b/tests/specs/npm/invalid_package_name/__test__.jsonc
new file mode 100644
index 000000000..34db0174e
--- /dev/null
+++ b/tests/specs/npm/invalid_package_name/__test__.jsonc
@@ -0,0 +1,5 @@
+{
+  "args": "run -A main.js",
+  "output": "main.out",
+  "exitCode": 1
+}
diff --git a/tests/testdata/npm/invalid_package_name/main.js b/tests/specs/npm/invalid_package_name/main.js
index 1e3783054..1e3783054 100644
--- a/tests/testdata/npm/invalid_package_name/main.js
+++ b/tests/specs/npm/invalid_package_name/main.js
diff --git a/tests/specs/npm/invalid_package_name/main.out b/tests/specs/npm/invalid_package_name/main.out
new file mode 100644
index 000000000..09c989dea
--- /dev/null
+++ b/tests/specs/npm/invalid_package_name/main.out
@@ -0,0 +1,3 @@
+error: Invalid package specifier 'npm:@foo'
+    0: Did not contain a valid package name
+    at [WILDCARD]/invalid_package_name/main.js:1:22
diff --git a/tests/specs/remove/basic/add_lock.out b/tests/specs/remove/basic/add_lock.out
index 99127b95d..1f6589380 100644
--- a/tests/specs/remove/basic/add_lock.out
+++ b/tests/specs/remove/basic/add_lock.out
@@ -1,8 +1,8 @@
 {
   "version": "4",
   "specifiers": {
-    "jsr:@std/assert@^1.0.0": "jsr:@std/assert@1.0.0",
-    "jsr:@std/http@^1.0.0": "jsr:@std/http@1.0.0"
+    "jsr:@std/assert@1": "1.0.0",
+    "jsr:@std/http@1": "1.0.0"
   },
   "jsr": {
     "@std/assert@1.0.0": {
@@ -14,8 +14,8 @@
   },
   "workspace": {
     "dependencies": [
-      "jsr:@std/assert@^1.0.0",
-      "jsr:@std/http@^1.0.0"
+      "jsr:@std/assert@1",
+      "jsr:@std/http@1"
     ]
   }
 }
diff --git a/tests/specs/run/package_json/invalid_value/__test__.jsonc b/tests/specs/run/package_json/invalid_value/__test__.jsonc
new file mode 100644
index 000000000..c960dd302
--- /dev/null
+++ b/tests/specs/run/package_json/invalid_value/__test__.jsonc
@@ -0,0 +1,21 @@
+{
+  "tempDir": true,
+  "tests": {
+    // should run fine when not referencing a failing dep entry
+    "run_ok": {
+      "args": "run ok.ts",
+      "output": "ok.ts.out"
+    },
+    // should fail when referencing a failing dep entry
+    "run_error": {
+      "args": "run error.ts",
+      "exitCode": 1,
+      "output": "error.ts.out"
+    },
+    // should output a warning about the failing dep entry
+    "task_test": {
+      "args": "task test",
+      "output": "task.out"
+    }
+  }
+}
diff --git a/tests/testdata/package_json/invalid_value/error.ts b/tests/specs/run/package_json/invalid_value/error.ts
index fd75d633c..fd75d633c 100644
--- a/tests/testdata/package_json/invalid_value/error.ts
+++ b/tests/specs/run/package_json/invalid_value/error.ts
diff --git a/tests/specs/run/package_json/invalid_value/error.ts.out b/tests/specs/run/package_json/invalid_value/error.ts.out
new file mode 100644
index 000000000..37796d6da
--- /dev/null
+++ b/tests/specs/run/package_json/invalid_value/error.ts.out
@@ -0,0 +1,5 @@
+error: Invalid version requirement
+    0: Unexpected character.
+         invalid stuff that won't parse
+         ~
+    at file:///[WILDCARD]/error.ts:2:23
diff --git a/tests/testdata/package_json/invalid_value/ok.ts b/tests/specs/run/package_json/invalid_value/ok.ts
index ce517439f..ce517439f 100644
--- a/tests/testdata/package_json/invalid_value/ok.ts
+++ b/tests/specs/run/package_json/invalid_value/ok.ts
diff --git a/tests/testdata/package_json/invalid_value/ok.ts.out b/tests/specs/run/package_json/invalid_value/ok.ts.out
index e8fff7ed7..e8fff7ed7 100644
--- a/tests/testdata/package_json/invalid_value/ok.ts.out
+++ b/tests/specs/run/package_json/invalid_value/ok.ts.out
diff --git a/tests/testdata/package_json/invalid_value/package.json b/tests/specs/run/package_json/invalid_value/package.json
index c8857649e..c8857649e 100644
--- a/tests/testdata/package_json/invalid_value/package.json
+++ b/tests/specs/run/package_json/invalid_value/package.json
diff --git a/tests/specs/run/package_json/invalid_value/task.out b/tests/specs/run/package_json/invalid_value/task.out
new file mode 100644
index 000000000..d0adb0525
--- /dev/null
+++ b/tests/specs/run/package_json/invalid_value/task.out
@@ -0,0 +1,5 @@
+Download http://localhost:4260/@denotest/esm-basic
+Download http://localhost:4260/@denotest/esm-basic/1.0.0.tgz
+Initialize @denotest/esm-basic@1.0.0
+Task test echo 1
+1
diff --git a/tests/specs/workspaces/lockfile/expected-lock.out b/tests/specs/workspaces/lockfile/expected-lock.out
index fc387c760..1559be085 100644
--- a/tests/specs/workspaces/lockfile/expected-lock.out
+++ b/tests/specs/workspaces/lockfile/expected-lock.out
@@ -1,7 +1,7 @@
 {
   "version": "4",
   "specifiers": {
-    "jsr:@denotest/add@1": "jsr:@denotest/add@1.0.0"
+    "jsr:@denotest/add@1": "1.0.0"
   },
   "jsr": {
     "@denotest/add@1.0.0": {
diff --git a/tests/testdata/npm/invalid_package_name/main.out b/tests/testdata/npm/invalid_package_name/main.out
deleted file mode 100644
index b4a421bd7..000000000
--- a/tests/testdata/npm/invalid_package_name/main.out
+++ /dev/null
@@ -1,2 +0,0 @@
-error: Invalid package specifier 'npm:@foo'. Did not contain a valid package name.
-    at [WILDCARD]/invalid_package_name/main.js:1:22
diff --git a/tests/testdata/package_json/invalid_value/error.ts.out b/tests/testdata/package_json/invalid_value/error.ts.out
deleted file mode 100644
index 80893ede0..000000000
--- a/tests/testdata/package_json/invalid_value/error.ts.out
+++ /dev/null
@@ -1,4 +0,0 @@
-error: Invalid npm version requirement. Unexpected character.
-  invalid stuff that won't parse
-  ~
-    at file:///[WILDCARD]/error.ts:2:23
diff --git a/tests/testdata/package_json/invalid_value/task.out b/tests/testdata/package_json/invalid_value/task.out
deleted file mode 100644
index 79249d175..000000000
--- a/tests/testdata/package_json/invalid_value/task.out
+++ /dev/null
@@ -1,2 +0,0 @@
-Task test echo 1
-1