fix: do not read the project manifest when a dependency is missing

Author: danielroe

packages/nuxt-cli/src/commands/info.ts

@@ -20,6 +20,7 @@ import { formatInfoBox } from '../utils/formatting'
 import{tryResolveNuxt}from'../utils/kit'
 import{logger}from'../utils/logger'
 import{getNuxtConfig}from'../utils/nuxt-config'
+import{readDependencyPackageJson}from'../utils/package-json'
 import{getPackageManagerVersion}from'../utils/packageManagers'
 import{resolveRootDir}from'../utils/paths'
 import{rootDirArgs}from'./_shared'
@@ -52,7 +53,7 @@ export default defineCommand({
 if(!url){
 continue
 }
-constpkg=awaitreadPackageJSON(name,{url}).catch(()=>null)
+constpkg=awaitreadDependencyPackageJson(name,url)
 if(pkg){
 returnpkg.version!
 }

packages/nuxt-cli/src/commands/module/remove.ts

@@ -17,6 +17,7 @@ import { readNuxtConfig, removeNuxtConfigEntries } from '../../utils/config'
 import{CONFIG_KEYS}from'../../utils/config-parse'
 import{logger}from'../../utils/logger'
 import{logNetworkError}from'../../utils/network'
+import{readDependencyPackageJson}from'../../utils/package-json'
 import{relativeToProcess}from'../../utils/paths'
 import{cwdArgs,logLevelArgs}from'../_shared'
 importprepareCommandfrom'../prepare'
@@ -258,7 +259,7 @@ async function findOrphanedPeers(removing: string[], projectPkg: PackageJson, cw
 // peer name -> first removed module that declares it
 constcandidates=newMap<string,string>()
 for(constmofremoving){
-constpkg=awaitreadPackageJSON(m,{from: cwd}).catch(()=>null)
+constpkg=awaitreadDependencyPackageJson(m,cwd)
 if(!pkg?.peerDependencies){
 continue
 }
@@ -280,7 +281,7 @@ async function findOrphanedPeers(removing: string[], projectPkg: PackageJson, cw
 if(removingSet.has(dep)||candidates.has(dep)){
 continue
 }
-constdepPkg=awaitreadPackageJSON(dep,{from: cwd}).catch(()=>null)
+constdepPkg=awaitreadDependencyPackageJson(dep,cwd)
 if(!depPkg){
 continue
 }

packages/nuxt-cli/src/commands/upgrade.ts

@@ -187,7 +187,7 @@ export default defineCommand({
 logger.step(`Package manager: ${colors.cyan(packageManagerName)}${packageManagerVersion}`)
 
 // Check currently installed Nuxt version
-constcurrentVersion=(awaitgetNuxtVersion(cwd,false))||'[unknown]'
+constcurrentVersion=(awaitgetNuxtVersion(cwd))||'[unknown]'
 logger.step(`Current Nuxt version: ${colors.cyan(currentVersion)}`)
 
 constpkg=awaitreadPackageJSON(cwd).catch(()=>null)
@@ -374,7 +374,7 @@ export default defineCommand({
 }
 
 // Check installed Nuxt version again
-constupgradedVersion=(awaitgetNuxtVersion(cwd,false))||'[unknown]'
+constupgradedVersion=(awaitgetNuxtVersion(cwd))||'[unknown]'
 
 if(upgradedVersion==='[unknown]'){
 return

packages/nuxt-cli/src/utils/package-json.ts

@@ -0,0 +1,24 @@
+importtype{PackageJson}from'pkg-types'
+
+import{resolveModulePath}from'exsolve'
+import{join}from'pathe'
+import{readPackageJSON}from'pkg-types'
+
+/**
+ * Read the `package.json` of an installed dependency.
+ *
+ * `readPackageJSON(name, { try: true })` falls back to the nearest `package.json`
+ * above the current working directory when the package cannot be resolved, which
+ * silently returns the consuming project's own manifest in place of the one that
+ * was asked for. Resolution happens here instead so a dependency that is not
+ * installed reports as missing.
+ *
+ * The manifest is asked for directly first, then located from the package's entry
+ * point, because `exports` may withhold either one of the two.
+ */
+exportasyncfunctionreadDependencyPackageJson(name: string,from: string): Promise<PackageJson|undefined>{
+constoptions={from: join(from,'/'),try: true}
+constpath=resolveModulePath(`${name}/package.json`,options)??resolveModulePath(name,options)
+
+returnpath ? awaitreadPackageJSON(path).catch(()=>undefined) : undefined
+}

packages/nuxt-cli/src/utils/versions.ts

@@ -8,23 +8,25 @@ import { resolveCatalogEntry } from './catalog'
 import{fetchJson}from'./fetch'
 import{tryResolveNuxt}from'./kit'
 import{debug}from'./logger'
+import{readDependencyPackageJson}from'./package-json'
 import{detectNpmRegistry}from'./registry'
 
 /** How long to wait on the registry before giving up on a version lookup. */
 constFETCH_TIMEOUT=10_000
 
 /**
  * Names a resolved `nuxt` dependency can legitimately have, so that a
- * `package.json` reached through `pkg-types`' nearest-file fallback (which
- * happens when `nuxt` cannot be resolved at all) is not mistaken for Nuxt's own.
+ * `package.json` reached by walking up from a resolved entry point (which happens
+ * when the package exposes no `./package.json` export) is not mistaken for Nuxt's
+ * own.
  */
 constNUXT_PACKAGE_NAMES=newSet(['nuxt','nuxt-nightly','nuxt3','nuxt-edge'])
 
 /** Assumed Nuxt version when the project declares no resolvable one. */
 exportconstDEFAULT_NUXT_VERSION='3.0.0'
 
-exportasyncfunctiongetNuxtVersion(cwd: string,cache=true){
-constnuxtPkg=awaitreadPackageJSON('nuxt',{url: cwd,try: true, cache }).catch(()=>null)
+exportasyncfunctiongetNuxtVersion(cwd: string){
+constnuxtPkg=awaitreadDependencyPackageJson('nuxt',cwd).catch(()=>null)
 if(nuxtPkg?.version&&NUXT_PACKAGE_NAMES.has(nuxtPkg.name!)){
 returnnuxtPkg.version
 }

packages/nuxt-cli/test/unit/commands/module/remove.spec.ts

@@ -18,7 +18,8 @@ const defaultProjectPkg = {
 dependencies: {'@nuxt/content': '^3.0.0'},
 }
 
-constreadPackageJSON=vi.fn(()=>Promise.resolve(defaultProjectPkg))
+constreadPackageJSON=vi.fn((): Promise<Record<string,unknown>>=>Promise.resolve(defaultProjectPkg))
+constreadDependencyPackageJson=vi.fn((_name?: string): Promise<Record<string,unknown>|undefined>=>Promise.resolve(undefined))
 
 interfaceCommandsType{
 subCommands: {
@@ -29,6 +30,7 @@ interface CommandsType {
 vi.mock('../../../../src/utils/config',()=>({ readNuxtConfig, removeNuxtConfigEntries }))
 vi.mock('nypm',()=>({ removeDependency, detectPackageManager }))
 vi.mock('pkg-types',()=>({ readPackageJSON }))
+vi.mock('../../../../src/utils/package-json',()=>({ readDependencyPackageJson }))
 vi.mock('@clack/prompts',asyncimportOriginal=>({
  ...awaitimportOriginal<typeofimport('@clack/prompts')>(),
 confirm: (...args: unknown[])=>confirm(...(argsas[])),
@@ -71,6 +73,7 @@ describe('module remove', () => {
 confirm.mockReset().mockResolvedValue(false)
 multiselect.mockReset().mockResolvedValue([])
 readPackageJSON.mockReset().mockImplementation(()=>Promise.resolve(defaultProjectPkg))
+readDependencyPackageJson.mockReset().mockImplementation(()=>Promise.resolve(undefined))
 })
 
 it('should remove a Nuxt module by alias',async()=>{
@@ -163,10 +166,10 @@ describe('module remove', () => {
 })
 
 it('should not uninstall a module that is not in dependencies',async()=>{
-readPackageJSON.mockImplementation((()=>Promise.resolve({
+readPackageJSON.mockImplementation(()=>Promise.resolve({
 devDependencies: {nuxt: '3.0.0'},
 dependencies: {},
-}))astypeofreadPackageJSON)
+}))
 
 constremoveCommand=await(commandsasCommandsType).subCommands.remove()
 awaitremoveCommand.setup({
@@ -181,21 +184,16 @@ describe('module remove', () => {
 
 it('should remove orphaned peer dependencies when confirmed',async()=>{
 confirm.mockResolvedValueOnce(true)
-readPackageJSON.mockImplementation(((id?: string)=>{
-if(id==='@vee-validate/nuxt'){
-returnPromise.resolve({peerDependencies: {'vee-validate': '^4.0.0'}})
-}
-if(id==='vee-validate'||id==='nuxt'){
-returnPromise.resolve({})
-}
-returnPromise.resolve({
-devDependencies: {nuxt: '3.0.0'},
-dependencies: {
-'@vee-validate/nuxt': '1.0.0',
-'vee-validate': '4.0.0',
-},
-})
-})astypeofreadPackageJSON)
+readPackageJSON.mockImplementation(()=>Promise.resolve({
+devDependencies: {nuxt: '3.0.0'},
+dependencies: {
+'@vee-validate/nuxt': '1.0.0',
+'vee-validate': '4.0.0',
+},
+}))
+readDependencyPackageJson.mockImplementation((name?: string)=>Promise.resolve(
+name==='@vee-validate/nuxt' ? {peerDependencies: {'vee-validate': '^4.0.0'}} : {},
+))
 
 constremoveCommand=await(commandsasCommandsType).subCommands.remove()
 awaitremoveCommand.setup({
@@ -214,21 +212,16 @@ describe('module remove', () => {
 
 it('should keep orphaned peer dependencies when declined',async()=>{
 confirm.mockResolvedValueOnce(false)
-readPackageJSON.mockImplementation(((id?: string)=>{
-if(id==='@vee-validate/nuxt'){
-returnPromise.resolve({peerDependencies: {'vee-validate': '^4.0.0'}})
-}
-if(id==='vee-validate'||id==='nuxt'){
-returnPromise.resolve({})
-}
-returnPromise.resolve({
-devDependencies: {nuxt: '3.0.0'},
-dependencies: {
-'@vee-validate/nuxt': '1.0.0',
-'vee-validate': '4.0.0',
-},
-})
-})astypeofreadPackageJSON)
+readPackageJSON.mockImplementation(()=>Promise.resolve({
+devDependencies: {nuxt: '3.0.0'},
+dependencies: {
+'@vee-validate/nuxt': '1.0.0',
+'vee-validate': '4.0.0',
+},
+}))
+readDependencyPackageJson.mockImplementation((name?: string)=>Promise.resolve(
+name==='@vee-validate/nuxt' ? {peerDependencies: {'vee-validate': '^4.0.0'}} : {},
+))
 
 constremoveCommand=await(commandsasCommandsType).subCommands.remove()
 awaitremoveCommand.setup({
@@ -246,25 +239,23 @@ describe('module remove', () => {
 })
 
 it('should not treat a peer still required by another dependency as orphaned',async()=>{
-readPackageJSON.mockImplementation(((id?: string)=>{
-if(id==='@vee-validate/nuxt'){
+readPackageJSON.mockImplementation(()=>Promise.resolve({
+devDependencies: {nuxt: '3.0.0'},
+dependencies: {
+'@vee-validate/nuxt': '1.0.0',
+'some-other-dep': '1.0.0',
+'vee-validate': '4.0.0',
+},
+}))
+readDependencyPackageJson.mockImplementation((name?: string)=>{
+if(name==='@vee-validate/nuxt'){
 returnPromise.resolve({peerDependencies: {'vee-validate': '^4.0.0'}})
 }
-if(id==='some-other-dep'){
+if(name==='some-other-dep'){
 returnPromise.resolve({dependencies: {'vee-validate': '^4.0.0'}})
 }
-if(id==='vee-validate'||id==='nuxt'){
-returnPromise.resolve({})
-}
-returnPromise.resolve({
-devDependencies: {nuxt: '3.0.0'},
-dependencies: {
-'@vee-validate/nuxt': '1.0.0',
-'some-other-dep': '1.0.0',
-'vee-validate': '4.0.0',
-},
-})
-})astypeofreadPackageJSON)
+returnPromise.resolve({})
+})
 
 constremoveCommand=await(commandsasCommandsType).subCommands.remove()
 awaitremoveCommand.setup({

packages/nuxt-cli/test/unit/utils/package-json.spec.ts

@@ -0,0 +1,36 @@
+import{mkdtemp,realpath,writeFile}from'node:fs/promises'
+import{tmpdir}from'node:os'
+import{fileURLToPath}from'node:url'
+
+import{join}from'pathe'
+import{describe,expect,it}from'vitest'
+
+import{readDependencyPackageJson}from'../../../src/utils/package-json'
+
+/** This package's own directory, where its dependencies resolve from. */
+constpackageDir=fileURLToPath(newURL('../../../',import.meta.url))
+
+describe('readDependencyPackageJson',()=>{
+it('should read the manifest of an installed dependency',async()=>{
+constpkg=awaitreadDependencyPackageJson('pathe',packageDir)
+
+expect(pkg?.name).toBe('pathe')
+})
+
+it('should read the manifest of a dependency that does not export it',async()=>{
+constpkg=awaitreadDependencyPackageJson('scule',packageDir)
+
+expect(pkg?.name).toBe('scule')
+})
+
+it('should return `undefined` for a package that is not installed',async()=>{
+awaitexpect(readDependencyPackageJson('not-a-real-package-xyz',packageDir)).resolves.toBeUndefined()
+})
+
+it('should not fall back to the manifest of the consuming project',async()=>{
+constcwd=awaitrealpath(awaitmkdtemp(join(tmpdir(),'nuxi-pkg-')))
+awaitwriteFile(join(cwd,'package.json'),'{"name":"my-project","version":"1.2.3"}','utf8')
+
+awaitexpect(readDependencyPackageJson('nuxt',cwd)).resolves.toBeUndefined()
+})
+})

packages/nuxt-cli/test/unit/utils/update.spec.ts

@@ -39,11 +39,17 @@ vi.mock('../../../src/utils/registry', () => ({
 detectNpmRegistry: async()=>registry.current,
 }))
 
-vi.mock('pkg-types',()=>({
-readPackageJSON: async(id?: string)=>{
-if(id==='nuxt'){
+vi.mock('../../../src/utils/package-json',()=>({
+readDependencyPackageJson: async(name?: string)=>{
+if(name==='nuxt'){
 returnproject.nuxtVersion ? {name: 'nuxt',version: project.nuxtVersion} : undefined
 }
+returnundefined
+},
+}))
+
+vi.mock('pkg-types',()=>({
+readPackageJSON: async()=>{
 thrownewError('package.json not found')
 },
 }))

packages/nuxt-cli/test/unit/utils/versions.spec.ts

@@ -25,28 +25,28 @@ describe('getNuxtVersion', () => {
 it('should read the declared version when nuxt is not installed',async()=>{
 awaitwriteFile(join(tempDir,'package.json'),JSON.stringify({devDependencies: {nuxt: '^4.2.0'}}))
 
-expect(awaitgetNuxtVersion(tempDir,false)).toBe('4.2.0')
+expect(awaitgetNuxtVersion(tempDir)).toBe('4.2.0')
 })
 
 it('should resolve a catalog reference through pnpm-workspace.yaml',async()=>{
 awaitwriteFile(join(tempDir,'package.json'),JSON.stringify({devDependencies: {nuxt: 'catalog:'}}))
 awaitwriteFile(join(tempDir,'pnpm-workspace.yaml'),'catalog:\n nuxt: ^4.2.0\n')
 
-expect(awaitgetNuxtVersion(tempDir,false)).toBe('4.2.0')
+expect(awaitgetNuxtVersion(tempDir)).toBe('4.2.0')
 })
 
 it('should resolve a named catalog reference',async()=>{
 awaitwriteFile(join(tempDir,'package.json'),JSON.stringify({dependencies: {nuxt: 'catalog:prod'}}))
 awaitwriteFile(join(tempDir,'pnpm-workspace.yaml'),'catalogs:\n prod:\n nuxt: 4.1.2\n')
 
-expect(awaitgetNuxtVersion(tempDir,false)).toBe('4.1.2')
+expect(awaitgetNuxtVersion(tempDir)).toBe('4.1.2')
 })
 
 it('should fall back when the catalog has no entry for nuxt',async()=>{
 awaitwriteFile(join(tempDir,'package.json'),JSON.stringify({dependencies: {nuxt: 'catalog:'}}))
 awaitwriteFile(join(tempDir,'pnpm-workspace.yaml'),'catalog:\n vue: ^3.6.0\n')
 
-expect(awaitgetNuxtVersion(tempDir,false)).toBe('3.0.0')
+expect(awaitgetNuxtVersion(tempDir)).toBe('3.0.0')
 })
 })