[rush] `rush update` never stabilizes when `globalOverrides` uses a versioned selector

[bmiddha]

Summary

When a globalOverrides entry in pnpm-config.json uses a versioned package selector (e.g. "webpack@5": "5.103.0"), rush update never reaches a stable state when a package is requesting another version.

Repro steps

Minimal repro: https://github.com/bmiddha/rushstack-demo-pnpm-global-overrides-rush-update-bug

Details

When a globalOverrides entry in pnpm-config.json uses a versioned package selector (e.g. "webpack@5": "5.103.0"), rush update never reaches a stable state when a package is requesting another version. Every invocation reports that dependencies do not match the current shrinkwrap, re-runs pnpm install, and rewrites the lockfile — even though nothing has changed.

Changing the override key to an unversioned selector (e.g. "webpack": "5.103.0") works; rush update stabilizes after the first run.

Standard questions

Please answer these questions to help us investigate your issue more quickly:

Question	Answer
@microsoft/rush globally installed version?	5.163.0
rushVersion from rush.json?	5.163.0
pnpmVersion, npmVersion, or yarnVersion from rush.json?	pnpm@8.14.0
(if pnpm) useWorkspaces from pnpm-config.json?	true
Operating system?	Mac
Would you consider contributing a PR?	Yes
Node.js version (node -v)?	22.19.0

[dmichon-msft]

Most likely also doesn't handle selectors of the form foo>bar where foo matches the name of an in-workspace package.