Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

8.15.5

Which area(s) of pnpm are affected? (leave empty if unsure)

Package manager compatibility, Operating System (Windows, MacOS, Linux)

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

package.json

{
  "name": "cmd-shim-repro",
  "private": true,
  "version": "1.0.0",
  "dependencies": {
    "eslint": "~8.7.0",
    "eslint-newest": "npm:eslint@~8.23.1",
    "eslint-oldest": "npm:eslint@8.6.0"
  }
}

The above package.json occasionally produces corrupted files such as node_modules/.bin/eslint, node_modules/.bin/eslint.CMD, etc. The race condition is easiest to encounter on Windows OS.

Describe the Bug

The problem occurs when multiple packages define a "bin" script with the same name. Usually this is a somewhat rare case of two different packages using the same name, but in our case the person was using an NPM alias "eslint-newest": "npm:eslint@~8.23.1" to install two versions side-by-side, which is a fairly common practice.

The data corruption occurs because PNPM attempts to write all files simultaneously:
cmd-shim/src/index.ts

  return Promise.all(
    generatorAndExts.map((generatorAndExt) => writeShim(src, to + generatorAndExt.extension, srcRuntimeInfo, generatorAndExt.generator, opts_))
  )

Maybe the upstream NPM implementation does not have this problem, because it seems to only parallelize file extensions for one filename:
cmd-shim/lib/index.js

  return Promise.all([
    writeFile(to + '.ps1', pwsh, 'utf8'),
    writeFile(to + '.cmd', cmd, 'utf8'),
    writeFile(to, sh, 'utf8'),
  ]).then(() => chmodShim(to))

Expected Behavior

It's unclear which .bin script should win. NPM 10 seems to choose the unaliased package, but I didn't have time to study it closely.

However it's certainly expected that PNPM's installation should be:

• deterministic; AND
• not corrupted

Which Node.js version are you using?

v18.19.1

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response