Skip to content

fix: keep nested file: deps and re-resolve changed git refs - #9523

Merged
owlstronaut merged 2 commits into
latestfrom
fix/9433-nested-file-dep-lockfile
Jun 10, 2026
Merged

fix: keep nested file: deps and re-resolve changed git refs#9523
owlstronaut merged 2 commits into
latestfrom
fix/9433-nested-file-dep-lockfile

Conversation

@owlstronaut

@owlstronautowlstronaut commented Jun 9, 2026

Copy link
Copy Markdown

The lockfile pruning added in 11.15.0 dropped every extraneous node outside node_modules to remove stale workspace entries. This also removed legitimate nested entries for a file: dependency that itself has a file: dependency (e.g. lib/b/lib/a), leaving the lockfile incomplete so npm ci failed with "Missing: a@1.0.0 from lock file".

Only prune extraneous nodes that are direct fsChildren of the root or detached link targets (removed workspaces, removed root-level file: deps, orphaned link targets). Extraneous fsChildren nested under another package are kept so npm ci can resolve the parent's dependency.

Fixes: #9433
Fixes: #9486
Supersedes: #9524

@owlstronaut
owlstronaut marked this pull request as ready for review June 9, 2026 17:43
@owlstronaut
owlstronaut requested review from a team as code ownersJune 9, 2026 17:43
Comment on lines +914 to +915
if (node.extraneous && !/(^|\/)node_modules\//.test(loc) && loc !== 'node_modules' &&
(!node.fsParent || node.fsParent.isRoot)) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good one. #9330 missed this.

@owlstronaut
owlstronautforce-pushed the fix/9433-nested-file-dep-lockfile branch from 06cfb41 to d9eeec9CompareJune 9, 2026 18:49
@owlstronaut
owlstronautforce-pushed the fix/9433-nested-file-dep-lockfile branch from d9eeec9 to de72e81CompareJune 9, 2026 18:56
Comment threadworkspaces/arborist/lib/dep-valid.js
@owlstronautowlstronaut changed the title fix: keep nested file: dep entries in package-lock.jsonfix: keep nested file: deps and re-resolve changed git refsJun 10, 2026
@owlstronaut
owlstronaut merged commit fc6268a into latestJun 10, 2026
18 checks passed
@owlstronaut
owlstronaut deleted the fix/9433-nested-file-dep-lockfile branch June 10, 2026 14:30
@github-actions

Copy link
Copy Markdown
Contributor

🎉 Backport to release/v11 created: #9530

@github-actionsgithub-actionsBot mentioned this pull request Jun 9, 2026
owlstronaut pushed a commit that referenced this pull request Jun 10, 2026
Backport of #9523 to `release/v11`.
Co-authored-by: Michael Smith <owlstronaut@github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] npm install ignores tag/branch changes to git dependencies in package.json [BUG] npm ci after npm install fails for file-based dependencies

3 participants

@owlstronaut@manzoorwanijk@nishantms