fix(arborist): apply overrides across a file:/workspace link boundary by manzoorwanijk · Pull Request #9671 · npm/cli

manzoorwanijk · 2026-06-26T05:55:38Z

A root overrides entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a file:/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the hoisted and linked install strategies, while the same override applied correctly when the dependency was reached without crossing a link.

Override rules propagate through dependency edges, but a Link and its target are not edge-connected, so they are bridged by forwarding the Link's OverrideSet to its target. That forwarding ran while the target's subtree was still unbuilt, so its guard found no matching rule and never forwarded, leaving the target and its descendant edges without the rule.

buildIdealTree now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's OverrideSet. loadActual now repropagates overrides through links once all edges are resolved, so a transitive override reached through a file: link is reported as overridden rather than invalid by npm ls.

References

Fixes#9659

…IdealTree A root override for a transitive dep was dropped when the path to that dep crossed a file:/workspace link boundary, so the dep resolved to its un-overridden version. The link target's overrides were never forwarded before its subtree resolved. Forward them in #resolveLinks so descendant edges inherit the rule.

…Actual A file: link target's subtree resolves late, so repropagating overrides before edges were resolved missed the transitive match and npm ls reported the overridden edge as invalid. Run repropagation once all edges are resolved.

github-actions · 2026-06-26T13:31:07Z

⚠️ Backport to release/v11 failed.

This usually means the cherry-pick had conflicts. Please create a manual backport:

git fetch origin release/v11
git checkout -b backport/v11/9671 origin/release/v11
git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
# resolve any conflicts, then:
git push origin backport/v11/9671

Error details

Command failed: git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
error: could not apply 968e42fbd... fix(arborist): apply overrides across a file:/workspace link boundary (#9671)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

manzoorwanijk · 2026-06-26T13:35:26Z

Creating a manual backport...

manzoorwanijk · 2026-06-26T13:41:42Z

Here you go #9673

…v11) (#9673) Backport of #9671 to `release/v11`. A root `overrides` entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a `file:`/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the `hoisted` and `linked` install strategies, while the same override applied correctly when the dependency was reached without crossing a link. `buildIdealTree` now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's `OverrideSet`. `loadActual` now repropagates overrides through links once all edges are resolved, so a transitive override reached through a `file:` link is reported as `overridden` rather than `invalid` by `npm ls`. Backport notes: clean cherry-pick except for the `#repropagateOverrides` comment, which conflicted only because `release/v11` does not have the adjacent `#applyPackageExtensions` method; resolved by keeping the v11 structure and applying the comment update. ## References Fixes#9659 Backport of #9671

manzoorwanijk · 2026-06-26T05:55:38Z

A root overrides entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a file:/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the hoisted and linked install strategies, while the same override applied correctly when the dependency was reached without crossing a link.

Override rules propagate through dependency edges, but a Link and its target are not edge-connected, so they are bridged by forwarding the Link's OverrideSet to its target. That forwarding ran while the target's subtree was still unbuilt, so its guard found no matching rule and never forwarded, leaving the target and its descendant edges without the rule.

buildIdealTree now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's OverrideSet. loadActual now repropagates overrides through links once all edges are resolved, so a transitive override reached through a file: link is reported as overridden rather than invalid by npm ls.

References

Fixes#9659

…IdealTree A root override for a transitive dep was dropped when the path to that dep crossed a file:/workspace link boundary, so the dep resolved to its un-overridden version. The link target's overrides were never forwarded before its subtree resolved. Forward them in #resolveLinks so descendant edges inherit the rule.

…Actual A file: link target's subtree resolves late, so repropagating overrides before edges were resolved missed the transitive match and npm ls reported the overridden edge as invalid. Run repropagation once all edges are resolved.

github-actions · 2026-06-26T13:31:07Z

⚠️ Backport to release/v11 failed.

This usually means the cherry-pick had conflicts. Please create a manual backport:

git fetch origin release/v11
git checkout -b backport/v11/9671 origin/release/v11
git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
# resolve any conflicts, then:
git push origin backport/v11/9671

Error details

Command failed: git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
error: could not apply 968e42fbd... fix(arborist): apply overrides across a file:/workspace link boundary (#9671)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

manzoorwanijk · 2026-06-26T13:35:26Z

Creating a manual backport...

manzoorwanijk · 2026-06-26T13:41:42Z

Here you go #9673

…v11) (#9673) Backport of #9671 to `release/v11`. A root `overrides` entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a `file:`/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the `hoisted` and `linked` install strategies, while the same override applied correctly when the dependency was reached without crossing a link. `buildIdealTree` now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's `OverrideSet`. `loadActual` now repropagates overrides through links once all edges are resolved, so a transitive override reached through a `file:` link is reported as `overridden` rather than `invalid` by `npm ls`. Backport notes: clean cherry-pick except for the `#repropagateOverrides` comment, which conflicted only because `release/v11` does not have the adjacent `#applyPackageExtensions` method; resolved by keeping the v11 structure and applying the comment update. ## References Fixes#9659 Backport of #9671

manzoorwanijk · 2026-06-26T05:55:38Z

A root overrides entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a file:/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the hoisted and linked install strategies, while the same override applied correctly when the dependency was reached without crossing a link.

Override rules propagate through dependency edges, but a Link and its target are not edge-connected, so they are bridged by forwarding the Link's OverrideSet to its target. That forwarding ran while the target's subtree was still unbuilt, so its guard found no matching rule and never forwarded, leaving the target and its descendant edges without the rule.

buildIdealTree now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's OverrideSet. loadActual now repropagates overrides through links once all edges are resolved, so a transitive override reached through a file: link is reported as overridden rather than invalid by npm ls.

References

Fixes#9659

…IdealTree A root override for a transitive dep was dropped when the path to that dep crossed a file:/workspace link boundary, so the dep resolved to its un-overridden version. The link target's overrides were never forwarded before its subtree resolved. Forward them in #resolveLinks so descendant edges inherit the rule.

…Actual A file: link target's subtree resolves late, so repropagating overrides before edges were resolved missed the transitive match and npm ls reported the overridden edge as invalid. Run repropagation once all edges are resolved.

github-actions · 2026-06-26T13:31:07Z

⚠️ Backport to release/v11 failed.

This usually means the cherry-pick had conflicts. Please create a manual backport:

git fetch origin release/v11
git checkout -b backport/v11/9671 origin/release/v11
git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
# resolve any conflicts, then:
git push origin backport/v11/9671

Error details

Command failed: git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
error: could not apply 968e42fbd... fix(arborist): apply overrides across a file:/workspace link boundary (#9671)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

manzoorwanijk · 2026-06-26T13:35:26Z

Creating a manual backport...

manzoorwanijk · 2026-06-26T13:41:42Z

Here you go #9673

…v11) (#9673) Backport of #9671 to `release/v11`. A root `overrides` entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a `file:`/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the `hoisted` and `linked` install strategies, while the same override applied correctly when the dependency was reached without crossing a link. `buildIdealTree` now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's `OverrideSet`. `loadActual` now repropagates overrides through links once all edges are resolved, so a transitive override reached through a `file:` link is reported as `overridden` rather than `invalid` by `npm ls`. Backport notes: clean cherry-pick except for the `#repropagateOverrides` comment, which conflicted only because `release/v11` does not have the adjacent `#applyPackageExtensions` method; resolved by keeping the v11 structure and applying the comment update. ## References Fixes#9659 Backport of #9671

manzoorwanijk · 2026-06-26T05:55:38Z

A root overrides entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a file:/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the hoisted and linked install strategies, while the same override applied correctly when the dependency was reached without crossing a link.

Override rules propagate through dependency edges, but a Link and its target are not edge-connected, so they are bridged by forwarding the Link's OverrideSet to its target. That forwarding ran while the target's subtree was still unbuilt, so its guard found no matching rule and never forwarded, leaving the target and its descendant edges without the rule.

buildIdealTree now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's OverrideSet. loadActual now repropagates overrides through links once all edges are resolved, so a transitive override reached through a file: link is reported as overridden rather than invalid by npm ls.

References

Fixes#9659

…IdealTree A root override for a transitive dep was dropped when the path to that dep crossed a file:/workspace link boundary, so the dep resolved to its un-overridden version. The link target's overrides were never forwarded before its subtree resolved. Forward them in #resolveLinks so descendant edges inherit the rule.

…Actual A file: link target's subtree resolves late, so repropagating overrides before edges were resolved missed the transitive match and npm ls reported the overridden edge as invalid. Run repropagation once all edges are resolved.

github-actions · 2026-06-26T13:31:07Z

⚠️ Backport to release/v11 failed.

This usually means the cherry-pick had conflicts. Please create a manual backport:

git fetch origin release/v11
git checkout -b backport/v11/9671 origin/release/v11
git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
# resolve any conflicts, then:
git push origin backport/v11/9671

Error details

Command failed: git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
error: could not apply 968e42fbd... fix(arborist): apply overrides across a file:/workspace link boundary (#9671)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

manzoorwanijk · 2026-06-26T13:35:26Z

Creating a manual backport...

manzoorwanijk · 2026-06-26T13:41:42Z

Here you go #9673

…v11) (#9673) Backport of #9671 to `release/v11`. A root `overrides` entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a `file:`/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the `hoisted` and `linked` install strategies, while the same override applied correctly when the dependency was reached without crossing a link. `buildIdealTree` now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's `OverrideSet`. `loadActual` now repropagates overrides through links once all edges are resolved, so a transitive override reached through a `file:` link is reported as `overridden` rather than `invalid` by `npm ls`. Backport notes: clean cherry-pick except for the `#repropagateOverrides` comment, which conflicted only because `release/v11` does not have the adjacent `#applyPackageExtensions` method; resolved by keeping the v11 structure and applying the comment update. ## References Fixes#9659 Backport of #9671

manzoorwanijk · 2026-06-26T05:55:38Z

A root overrides entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a file:/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the hoisted and linked install strategies, while the same override applied correctly when the dependency was reached without crossing a link.

Override rules propagate through dependency edges, but a Link and its target are not edge-connected, so they are bridged by forwarding the Link's OverrideSet to its target. That forwarding ran while the target's subtree was still unbuilt, so its guard found no matching rule and never forwarded, leaving the target and its descendant edges without the rule.

buildIdealTree now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's OverrideSet. loadActual now repropagates overrides through links once all edges are resolved, so a transitive override reached through a file: link is reported as overridden rather than invalid by npm ls.

References

Fixes#9659

…IdealTree A root override for a transitive dep was dropped when the path to that dep crossed a file:/workspace link boundary, so the dep resolved to its un-overridden version. The link target's overrides were never forwarded before its subtree resolved. Forward them in #resolveLinks so descendant edges inherit the rule.

…Actual A file: link target's subtree resolves late, so repropagating overrides before edges were resolved missed the transitive match and npm ls reported the overridden edge as invalid. Run repropagation once all edges are resolved.

github-actions · 2026-06-26T13:31:07Z

⚠️ Backport to release/v11 failed.

This usually means the cherry-pick had conflicts. Please create a manual backport:

git fetch origin release/v11
git checkout -b backport/v11/9671 origin/release/v11
git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
# resolve any conflicts, then:
git push origin backport/v11/9671

Error details

Command failed: git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
error: could not apply 968e42fbd... fix(arborist): apply overrides across a file:/workspace link boundary (#9671)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

manzoorwanijk · 2026-06-26T13:35:26Z

Creating a manual backport...

manzoorwanijk · 2026-06-26T13:41:42Z

Here you go #9673

…v11) (#9673) Backport of #9671 to `release/v11`. A root `overrides` entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a `file:`/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the `hoisted` and `linked` install strategies, while the same override applied correctly when the dependency was reached without crossing a link. `buildIdealTree` now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's `OverrideSet`. `loadActual` now repropagates overrides through links once all edges are resolved, so a transitive override reached through a `file:` link is reported as `overridden` rather than `invalid` by `npm ls`. Backport notes: clean cherry-pick except for the `#repropagateOverrides` comment, which conflicted only because `release/v11` does not have the adjacent `#applyPackageExtensions` method; resolved by keeping the v11 structure and applying the comment update. ## References Fixes#9659 Backport of #9671

manzoorwanijk · 2026-06-26T05:55:38Z

A root overrides entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a file:/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the hoisted and linked install strategies, while the same override applied correctly when the dependency was reached without crossing a link.

Override rules propagate through dependency edges, but a Link and its target are not edge-connected, so they are bridged by forwarding the Link's OverrideSet to its target. That forwarding ran while the target's subtree was still unbuilt, so its guard found no matching rule and never forwarded, leaving the target and its descendant edges without the rule.

buildIdealTree now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's OverrideSet. loadActual now repropagates overrides through links once all edges are resolved, so a transitive override reached through a file: link is reported as overridden rather than invalid by npm ls.

References

Fixes#9659

…IdealTree A root override for a transitive dep was dropped when the path to that dep crossed a file:/workspace link boundary, so the dep resolved to its un-overridden version. The link target's overrides were never forwarded before its subtree resolved. Forward them in #resolveLinks so descendant edges inherit the rule.

…Actual A file: link target's subtree resolves late, so repropagating overrides before edges were resolved missed the transitive match and npm ls reported the overridden edge as invalid. Run repropagation once all edges are resolved.

github-actions · 2026-06-26T13:31:07Z

⚠️ Backport to release/v11 failed.

This usually means the cherry-pick had conflicts. Please create a manual backport:

git fetch origin release/v11
git checkout -b backport/v11/9671 origin/release/v11
git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
# resolve any conflicts, then:
git push origin backport/v11/9671

Error details

Command failed: git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
error: could not apply 968e42fbd... fix(arborist): apply overrides across a file:/workspace link boundary (#9671)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

manzoorwanijk · 2026-06-26T13:35:26Z

Creating a manual backport...

manzoorwanijk · 2026-06-26T13:41:42Z

Here you go #9673

…v11) (#9673) Backport of #9671 to `release/v11`. A root `overrides` entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a `file:`/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the `hoisted` and `linked` install strategies, while the same override applied correctly when the dependency was reached without crossing a link. `buildIdealTree` now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's `OverrideSet`. `loadActual` now repropagates overrides through links once all edges are resolved, so a transitive override reached through a `file:` link is reported as `overridden` rather than `invalid` by `npm ls`. Backport notes: clean cherry-pick except for the `#repropagateOverrides` comment, which conflicted only because `release/v11` does not have the adjacent `#applyPackageExtensions` method; resolved by keeping the v11 structure and applying the comment update. ## References Fixes#9659 Backport of #9671

manzoorwanijk · 2026-06-26T05:55:38Z

A root overrides entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a file:/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the hoisted and linked install strategies, while the same override applied correctly when the dependency was reached without crossing a link.

Override rules propagate through dependency edges, but a Link and its target are not edge-connected, so they are bridged by forwarding the Link's OverrideSet to its target. That forwarding ran while the target's subtree was still unbuilt, so its guard found no matching rule and never forwarded, leaving the target and its descendant edges without the rule.

buildIdealTree now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's OverrideSet. loadActual now repropagates overrides through links once all edges are resolved, so a transitive override reached through a file: link is reported as overridden rather than invalid by npm ls.

References

Fixes#9659

…IdealTree A root override for a transitive dep was dropped when the path to that dep crossed a file:/workspace link boundary, so the dep resolved to its un-overridden version. The link target's overrides were never forwarded before its subtree resolved. Forward them in #resolveLinks so descendant edges inherit the rule.

…Actual A file: link target's subtree resolves late, so repropagating overrides before edges were resolved missed the transitive match and npm ls reported the overridden edge as invalid. Run repropagation once all edges are resolved.

github-actions · 2026-06-26T13:31:07Z

⚠️ Backport to release/v11 failed.

This usually means the cherry-pick had conflicts. Please create a manual backport:

git fetch origin release/v11
git checkout -b backport/v11/9671 origin/release/v11
git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
# resolve any conflicts, then:
git push origin backport/v11/9671

Error details

Command failed: git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
error: could not apply 968e42fbd... fix(arborist): apply overrides across a file:/workspace link boundary (#9671)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

manzoorwanijk · 2026-06-26T13:35:26Z

Creating a manual backport...

manzoorwanijk · 2026-06-26T13:41:42Z

Here you go #9673

…v11) (#9673) Backport of #9671 to `release/v11`. A root `overrides` entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a `file:`/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the `hoisted` and `linked` install strategies, while the same override applied correctly when the dependency was reached without crossing a link. `buildIdealTree` now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's `OverrideSet`. `loadActual` now repropagates overrides through links once all edges are resolved, so a transitive override reached through a `file:` link is reported as `overridden` rather than `invalid` by `npm ls`. Backport notes: clean cherry-pick except for the `#repropagateOverrides` comment, which conflicted only because `release/v11` does not have the adjacent `#applyPackageExtensions` method; resolved by keeping the v11 structure and applying the comment update. ## References Fixes#9659 Backport of #9671

manzoorwanijk · 2026-06-26T05:55:38Z

A root overrides entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a file:/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the hoisted and linked install strategies, while the same override applied correctly when the dependency was reached without crossing a link.

Override rules propagate through dependency edges, but a Link and its target are not edge-connected, so they are bridged by forwarding the Link's OverrideSet to its target. That forwarding ran while the target's subtree was still unbuilt, so its guard found no matching rule and never forwarded, leaving the target and its descendant edges without the rule.

buildIdealTree now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's OverrideSet. loadActual now repropagates overrides through links once all edges are resolved, so a transitive override reached through a file: link is reported as overridden rather than invalid by npm ls.

References

Fixes#9659

…IdealTree A root override for a transitive dep was dropped when the path to that dep crossed a file:/workspace link boundary, so the dep resolved to its un-overridden version. The link target's overrides were never forwarded before its subtree resolved. Forward them in #resolveLinks so descendant edges inherit the rule.

…Actual A file: link target's subtree resolves late, so repropagating overrides before edges were resolved missed the transitive match and npm ls reported the overridden edge as invalid. Run repropagation once all edges are resolved.

github-actions · 2026-06-26T13:31:07Z

⚠️ Backport to release/v11 failed.

This usually means the cherry-pick had conflicts. Please create a manual backport:

git fetch origin release/v11
git checkout -b backport/v11/9671 origin/release/v11
git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
# resolve any conflicts, then:
git push origin backport/v11/9671

Error details

Command failed: git cherry-pick -x 968e42fbd62eb3a6f446466359c9431f41d76b2b
error: could not apply 968e42fbd... fix(arborist): apply overrides across a file:/workspace link boundary (#9671)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

manzoorwanijk · 2026-06-26T13:35:26Z

Creating a manual backport...

manzoorwanijk · 2026-06-26T13:41:42Z

Here you go #9673

…v11) (#9673) Backport of #9671 to `release/v11`. A root `overrides` entry targeting a transitive dependency was silently dropped when the path to that dependency crossed a `file:`/workspace link, so the dependency resolved to its un-overridden version and the lockfile pinned the wrong version. It reproduced under both the `hoisted` and `linked` install strategies, while the same override applied correctly when the dependency was reached without crossing a link. `buildIdealTree` now forwards a link's overrides to its target before the target's subtree is resolved, so descendant edges inherit the rule as they are added, matching how a registry node always inherits its ancestor's `OverrideSet`. `loadActual` now repropagates overrides through links once all edges are resolved, so a transitive override reached through a `file:` link is reported as `overridden` rather than `invalid` by `npm ls`. Backport notes: clean cherry-pick except for the `#repropagateOverrides` comment, which conflicted only because `release/v11` does not have the adjacent `#applyPackageExtensions` method; resolved by keeping the v11 structure and applying the comment update. ## References Fixes#9659 Backport of #9671

manzoorwanijk added 2 commits June 26, 2026 11:25

manzoorwanijk marked this pull request as ready for review June 26, 2026 05:58

manzoorwanijk requested review from a team as code owners June 26, 2026 05:58

owlstronaut added the backport:v11 label Jun 26, 2026

owlstronaut approved these changes Jun 26, 2026
View reviewed changes

owlstronaut merged commit 968e42f into npm:latestJun 26, 2026
24 checks passed

manzoorwanijk deleted the fix/override-across-file-link branch June 26, 2026 13:30

github-actionsBot mentioned this pull request Jun 25, 2026
chore: release 12.0.0-pre.2 #9594
Merged

manzoorwanijk mentioned this pull request Jun 26, 2026
fix(arborist): apply overrides across a file: link (backport release/v11) #9673
Merged

manzoorwanijk added 2 commits June 26, 2026 11:25

manzoorwanijk marked this pull request as ready for review June 26, 2026 05:58

manzoorwanijk requested review from a team as code owners June 26, 2026 05:58

owlstronaut added the backport:v11 label Jun 26, 2026

owlstronaut approved these changes Jun 26, 2026
View reviewed changes

owlstronaut merged commit 968e42f into npm:latestJun 26, 2026
24 checks passed

manzoorwanijk deleted the fix/override-across-file-link branch June 26, 2026 13:30

github-actionsBot mentioned this pull request Jun 25, 2026
chore: release 12.0.0-pre.2 #9594
Merged

manzoorwanijk mentioned this pull request Jun 26, 2026
fix(arborist): apply overrides across a file: link (backport release/v11) #9673
Merged

manzoorwanijk added 2 commits June 26, 2026 11:25

manzoorwanijk marked this pull request as ready for review June 26, 2026 05:58

manzoorwanijk requested review from a team as code owners June 26, 2026 05:58

owlstronaut added the backport:v11 label Jun 26, 2026

owlstronaut approved these changes Jun 26, 2026
View reviewed changes

owlstronaut merged commit 968e42f into npm:latestJun 26, 2026
24 checks passed

manzoorwanijk deleted the fix/override-across-file-link branch June 26, 2026 13:30

github-actionsBot mentioned this pull request Jun 25, 2026
chore: release 12.0.0-pre.2 #9594
Merged

manzoorwanijk mentioned this pull request Jun 26, 2026
fix(arborist): apply overrides across a file: link (backport release/v11) #9673
Merged

manzoorwanijk added 2 commits June 26, 2026 11:25

manzoorwanijk marked this pull request as ready for review June 26, 2026 05:58

manzoorwanijk requested review from a team as code owners June 26, 2026 05:58

owlstronaut added the backport:v11 label Jun 26, 2026

owlstronaut approved these changes Jun 26, 2026
View reviewed changes

owlstronaut merged commit 968e42f into npm:latestJun 26, 2026
24 checks passed

manzoorwanijk deleted the fix/override-across-file-link branch June 26, 2026 13:30

github-actionsBot mentioned this pull request Jun 25, 2026
chore: release 12.0.0-pre.2 #9594
Merged

manzoorwanijk mentioned this pull request Jun 26, 2026
fix(arborist): apply overrides across a file: link (backport release/v11) #9673
Merged

manzoorwanijk added 2 commits June 26, 2026 11:25

manzoorwanijk marked this pull request as ready for review June 26, 2026 05:58

manzoorwanijk requested review from a team as code owners June 26, 2026 05:58

owlstronaut added the backport:v11 label Jun 26, 2026

owlstronaut approved these changes Jun 26, 2026
View reviewed changes

owlstronaut merged commit 968e42f into npm:latestJun 26, 2026
24 checks passed

manzoorwanijk deleted the fix/override-across-file-link branch June 26, 2026 13:30

github-actionsBot mentioned this pull request Jun 25, 2026
chore: release 12.0.0-pre.2 #9594
Merged

manzoorwanijk mentioned this pull request Jun 26, 2026
fix(arborist): apply overrides across a file: link (backport release/v11) #9673
Merged

manzoorwanijk added 2 commits June 26, 2026 11:25

manzoorwanijk marked this pull request as ready for review June 26, 2026 05:58

manzoorwanijk requested review from a team as code owners June 26, 2026 05:58

owlstronaut added the backport:v11 label Jun 26, 2026

owlstronaut approved these changes Jun 26, 2026
View reviewed changes

owlstronaut merged commit 968e42f into npm:latestJun 26, 2026
24 checks passed

manzoorwanijk deleted the fix/override-across-file-link branch June 26, 2026 13:30

github-actionsBot mentioned this pull request Jun 25, 2026
chore: release 12.0.0-pre.2 #9594
Merged

manzoorwanijk mentioned this pull request Jun 26, 2026
fix(arborist): apply overrides across a file: link (backport release/v11) #9673
Merged

manzoorwanijk added 2 commits June 26, 2026 11:25

manzoorwanijk marked this pull request as ready for review June 26, 2026 05:58

manzoorwanijk requested review from a team as code owners June 26, 2026 05:58

owlstronaut added the backport:v11 label Jun 26, 2026

owlstronaut approved these changes Jun 26, 2026
View reviewed changes

owlstronaut merged commit 968e42f into npm:latestJun 26, 2026
24 checks passed

manzoorwanijk deleted the fix/override-across-file-link branch June 26, 2026 13:30

github-actionsBot mentioned this pull request Jun 25, 2026
chore: release 12.0.0-pre.2 #9594
Merged

manzoorwanijk mentioned this pull request Jun 26, 2026
fix(arborist): apply overrides across a file: link (backport release/v11) #9673
Merged

manzoorwanijk added 2 commits June 26, 2026 11:25

manzoorwanijk marked this pull request as ready for review June 26, 2026 05:58

manzoorwanijk requested review from a team as code owners June 26, 2026 05:58

owlstronaut added the backport:v11 label Jun 26, 2026

owlstronaut approved these changes Jun 26, 2026
View reviewed changes

owlstronaut merged commit 968e42f into npm:latestJun 26, 2026
24 checks passed

manzoorwanijk deleted the fix/override-across-file-link branch June 26, 2026 13:30

github-actionsBot mentioned this pull request Jun 25, 2026
chore: release 12.0.0-pre.2 #9594
Merged

manzoorwanijk mentioned this pull request Jun 26, 2026
fix(arborist): apply overrides across a file: link (backport release/v11) #9673
Merged

Uh oh!

Conversation

manzoorwanijk commented Jun 26, 2026

References

Uh oh!

Uh oh!

github-actionsBot commented Jun 26, 2026

Uh oh!

manzoorwanijk commented Jun 26, 2026

Uh oh!

manzoorwanijk commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

manzoorwanijk commented Jun 26, 2026

References

Uh oh!

Uh oh!

github-actionsBot commented Jun 26, 2026

Uh oh!

manzoorwanijk commented Jun 26, 2026

Uh oh!

manzoorwanijk commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

manzoorwanijk commented Jun 26, 2026

References

Uh oh!

Uh oh!

github-actionsBot commented Jun 26, 2026

Uh oh!

manzoorwanijk commented Jun 26, 2026

Uh oh!

manzoorwanijk commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

manzoorwanijk commented Jun 26, 2026

References

Uh oh!

Uh oh!

github-actionsBot commented Jun 26, 2026

Uh oh!

manzoorwanijk commented Jun 26, 2026

Uh oh!

manzoorwanijk commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants