Skip to content

fix: keep nested file: deps and re-resolve changed git refs#9523

Merged
owlstronaut merged 2 commits into
latestfrom
fix/9433-nested-file-dep-lockfile
Jun 10, 2026
Merged

fix: keep nested file: deps and re-resolve changed git refs#9523
owlstronaut merged 2 commits into
latestfrom
fix/9433-nested-file-dep-lockfile

Conversation

@owlstronaut

@owlstronaut owlstronaut commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

The lockfile pruning added in 11.15.0 dropped every extraneous node outside node_modules to remove stale workspace entries. This also removed legitimate nested entries for a file: dependency that itself has a file: dependency (e.g. lib/b/lib/a), leaving the lockfile incomplete so npm ci failed with "Missing: a@1.0.0 from lock file".

Only prune extraneous nodes that are direct fsChildren of the root or detached link targets (removed workspaces, removed root-level file: deps, orphaned link targets). Extraneous fsChildren nested under another package are kept so npm ci can resolve the parent's dependency.

Fixes: #9433
Fixes: #9486
Supersedes: #9524

@owlstronaut owlstronaut marked this pull request as ready for review June 9, 2026 17:43
@owlstronaut owlstronaut requested review from a team as code owners June 9, 2026 17:43
Comment on lines +914 to +915
if (node.extraneous && !/(^|\/)node_modules\//.test(loc) && loc !== 'node_modules' &&
(!node.fsParent || node.fsParent.isRoot)) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good one. #9330 missed this.

@owlstronaut owlstronaut force-pushed the fix/9433-nested-file-dep-lockfile branch from 06cfb41 to d9eeec9 Compare June 9, 2026 18:49
@owlstronaut owlstronaut force-pushed the fix/9433-nested-file-dep-lockfile branch from d9eeec9 to de72e81 Compare June 9, 2026 18:56
Comment thread workspaces/arborist/lib/dep-valid.js
@owlstronaut owlstronaut changed the title fix: keep nested file: dep entries in package-lock.json fix: keep nested file: deps and re-resolve changed git refs Jun 10, 2026
@owlstronaut owlstronaut merged commit fc6268a into latest Jun 10, 2026
18 checks passed
@owlstronaut owlstronaut deleted the fix/9433-nested-file-dep-lockfile branch June 10, 2026 14:30
@github-actions

Copy link
Copy Markdown
Contributor

🎉 Backport to release/v11 created: #9530

owlstronaut added a commit that referenced this pull request Jun 10, 2026
Backport of #9523 to `release/v11`.

Co-authored-by: Michael Smith <owlstronaut@github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] npm install ignores tag/branch changes to git dependencies in package.json [BUG] npm ci after npm install fails for file-based dependencies

3 participants