pnpm security updates create PR even if update fails for transitive dependency

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

pnpm

Package manager version

11.5.0

Language version

Node 24.13.0

Manifest location and content before the Dependabot update

https://github.com/PrairieLearn/PrairieLearn/blob/master/package.json
https://github.com/PrairieLearn/PrairieLearn/blob/master/apps/prairielearn/package.json

among others (large monorepo)

dependabot.yml content

https://github.com/PrairieLearn/PrairieLearn/blob/master/.github/dependabot.yml

Updated dependency

This was an update to the transitive dependency fast-xml-parser, from 3.21.1 to 5.8.0. Note that our repo has this package as a transitive dependency under two versions: one is already at 5.8.0, the other is at 3.21.1, but with a semver version that does not permit major updates ("^3.12.19"), so updating the latter to 5.8.0 is not permitted.

What you expected to see, versus what you actually saw

Dependabot created a PR (https://github.com/PrairieLearn/PrairieLearn/pull/15189) to update this dependency, but the PR did not update fast-xml-parser. Rather, it updated @csstools/css-syntax-patches-for-csstree, which from what I can tell is the only transitive dependency that can be updated at this stage.

Native package manager behavior

pnpm update fast-xml-parser updates nothing.

Images of the diff or a link to the PR, issue, or logs

https://github.com/PrairieLearn/PrairieLearn/pull/15189

A similar issue happens for other packages with the same problem:
https://github.com/PrairieLearn/PrairieLearn/pull/15188
https://github.com/PrairieLearn/PrairieLearn/pull/15187

Smallest manifest that reproduces the issue

I'm not sure what combination of elements will cause this issue, but depending on a package with outdated major versions of dependencies with security updates, e.g., s3rver@3.7.1, oauth-signature@1.5.0 (depends on crypto-js@3), node-jose@2.2.0 (depends on uuid@9) is likely necessary. I don't know if having other updatable transitive dependencies is a requirement for this to work.