@npmcli/arborist 2.2.9 → 2.4.2

package/lib/arborist/build-ideal-tree.js

@@ -44,12 +44,15 @@ const _currentDep = Symbol('currentDep')
 const _updateAll = Symbol('updateAll')
 const _mutateTree = Symbol('mutateTree')
 const _flagsSuspect = Symbol.for('flagsSuspect')
+const _workspaces = Symbol.for('workspaces')
 const _prune = Symbol('prune')
 const _preferDedupe = Symbol('preferDedupe')
+const _pruneDedupable = Symbol('pruneDedupable')
 const _legacyBundling = Symbol('legacyBundling')
 const _parseSettings = Symbol('parseSettings')
 const _initTree = Symbol('initTree')
 const _applyUserRequests = Symbol('applyUserRequests')
+const _applyUserRequestsToNode = Symbol('applyUserRequestsToNode')
 const _inflateAncientLockfile = Symbol('inflateAncientLockfile')
 const _buildDeps = Symbol('buildDeps')
 const _buildDepStep = Symbol('buildDepStep')
@@ -109,7 +112,7 @@ const _peerSetSource = Symbol.for('peerSetSource')
 
 // used by Reify mixin
 const _force = Symbol.for('force')
-const _explicitRequests = Symbol.for('explicitRequests')
+const _explicitRequests = Symbol('explicitRequests')
 const _global = Symbol.for('global')
 const _idealTreePrune = Symbol.for('idealTreePrune')
 
@@ -130,8 +133,10 @@ module.exports = cls => class IdealTreeBuilder extends cls {
       force = false,
       packageLock = true,
       strictPeerDeps = false,
+      workspaces = [],
     } = options
 
+    this[_workspaces] = workspaces || []
     this[_force] = !!force
     this[_strictPeerDeps] = !!strictPeerDeps
 
@@ -143,6 +148,9 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     this[_globalStyle] = this[_global] || globalStyle
     this[_follow] = !!follow
 
+    if (this[_workspaces].length && this[_global])
+      throw new Error('Cannot operate on workspaces in global mode')
+
     this[_explicitRequests] = new Set()
     this[_preferDedupe] = false
     this[_legacyBundling] = false
@@ -157,6 +165,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     this[_manifests] = new Map()
     this[_peerConflict] = null
     this[_edgesOverridden] = new Set()
+    this[_resolvedAdd] = []
 
     // a map of each module in a peer set to the thing that depended on
     // that set of peers in the first place.  Use a WeakMap so that we
@@ -204,8 +213,8 @@ module.exports = cls => class IdealTreeBuilder extends cls {
 
     try {
       await this[_initTree]()
-      await this[_applyUserRequests](options)
       await this[_inflateAncientLockfile]()
+      await this[_applyUserRequests](options)
       await this[_buildDeps]()
       await this[_fixDepFlags]()
       await this[_pruneFailedOptional]()
@@ -266,6 +275,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     this[_preferDedupe] = !!options.preferDedupe
     this[_legacyBundling] = !!options.legacyBundling
     this[_updateNames] = update.names
+
     this[_updateAll] = update.all
     // we prune by default unless explicitly set to boolean false
     this[_prune] = options.prune !== false
@@ -387,6 +397,42 @@ module.exports = cls => class IdealTreeBuilder extends cls {
   async [_applyUserRequests] (options) {
     process.emit('time', 'idealTree:userRequests')
     const tree = this.idealTree.target || this.idealTree
+
+    if (!this[_workspaces].length) {
+      return this[_applyUserRequestsToNode](tree, options).then(() =>
+        process.emit('timeEnd', 'idealTree:userRequests'))
+    }
+
+    const wsMap = tree.workspaces
+    if (!wsMap) {
+      this.log.warn('idealTree', 'Workspace filter set, but no workspaces present')
+      return
+    }
+
+    const promises = []
+    for (const name of this[_workspaces]) {
+      const path = wsMap.get(name)
+      if (!path) {
+        this.log.warn('idealTree', `Workspace ${name} in filter set, but not in workspaces`)
+        continue
+      }
+      const loc = relpath(tree.realpath, path)
+      const node = tree.inventory.get(loc)
+
+      /* istanbul ignore if - should be impossible */
+      if (!node) {
+        this.log.warn('idealTree', `Workspace ${name} in filter set, but no workspace folder present`)
+        continue
+      }
+
+      promises.push(this[_applyUserRequestsToNode](node, options))
+    }
+
+    return Promise.all(promises).then(() =>
+      process.emit('timeEnd', 'idealTree:userRequests'))
+  }
+
+  async [_applyUserRequestsToNode] (tree, options) {
     // If we have a list of package names to update, and we know it's
     // going to update them wherever they are, add any paths into those
     // named nodes to the buildIdealTree queue.
@@ -395,38 +441,49 @@ module.exports = cls => class IdealTreeBuilder extends cls {
 
     // global updates only update the globalTop nodes, but we need to know
     // that they're there, and not reinstall the world unnecessarily.
+    const globalExplicitUpdateNames = []
     if (this[_global] && (this[_updateAll] || this[_updateNames].length)) {
       const nm = resolve(this.path, 'node_modules')
       for (const name of await readdir(nm).catch(() => [])) {
-        if (this[_updateNames].includes(name))
-          this[_explicitRequests].add(name)
         tree.package.dependencies = tree.package.dependencies || {}
-        if (this[_updateAll] || this[_updateNames].includes(name))
+        const updateName = this[_updateNames].includes(name)
+        if (this[_updateAll] || updateName) {
+          if (updateName)
+            globalExplicitUpdateNames.push(name)
           tree.package.dependencies[name] = '*'
+        }
       }
     }
 
     if (this.auditReport && this.auditReport.size > 0)
       this[_queueVulnDependents](options)
 
-    if (options.rm && options.rm.length) {
-      addRmPkgDeps.rm(tree.package, options.rm)
-      for (const name of options.rm)
-        this[_explicitRequests].add(name)
+    const { add, rm } = options
+
+    if (rm && rm.length) {
+      addRmPkgDeps.rm(tree.package, rm)
+      for (const name of rm)
+        this[_explicitRequests].add({ from: tree, name, action: 'DELETE' })
     }
 
-    if (options.add)
-      await this[_add](options)
+    if (add && add.length)
+      await this[_add](tree, options)
 
-    // triggers a refresh of all edgesOut
-    if (options.add && options.add.length || options.rm && options.rm.length || this[_global])
+    // triggers a refresh of all edgesOut.  this has to be done BEFORE
+    // adding the edges to explicitRequests, because the package setter
+    // resets all edgesOut.
+    if (add && add.length || rm && rm.length || this[_global])
       tree.package = tree.package
-    process.emit('timeEnd', 'idealTree:userRequests')
+
+    for (const spec of this[_resolvedAdd])
+      this[_explicitRequests].add(tree.edgesOut.get(spec.name))
+    for (const name of globalExplicitUpdateNames)
+      this[_explicitRequests].add(tree.edgesOut.get(name))
   }
 
   // This returns a promise because we might not have the name yet,
   // and need to call pacote.manifest to find the name.
-  [_add] ({add, saveType = null, saveBundle = false}) {
+  [_add] (tree, {add, saveType = null, saveBundle = false}) {
     // get the name for each of the specs in the list.
     // ie, doing `foo@bar` we just return foo
     // but if it's a url or git, we don't know the name until we
@@ -438,19 +495,17 @@ module.exports = cls => class IdealTreeBuilder extends cls {
         .then(add => this[_updateFilePath](add))
         .then(add => this[_followSymlinkPath](add))
     })).then(add => {
-      this[_resolvedAdd] = add
+      this[_resolvedAdd].push(...add)
       // now add is a list of spec objects with names.
       // find a home for each of them!
-      const tree = this.idealTree.target || this.idealTree
       addRmPkgDeps.add({
         pkg: tree.package,
         add,
         saveBundle,
         saveType,
         path: this.path,
+        log: this.log,
       })
-      for (const spec of add)
-        this[_explicitRequests].add(spec.name)
     })
   }
 
@@ -991,7 +1046,7 @@ This is a one-time fix-up, please be patient...
         // if it's peerOptional and not explicitly requested.
         if (!edge.to) {
           return edge.type !== 'peerOptional' ||
-            this[_explicitRequests].has(edge.name)
+            this[_explicitRequests].has(edge)
         }
 
         // If the edge has an error, there's a problem.
@@ -1007,7 +1062,7 @@ This is a one-time fix-up, please be patient...
           return true
 
         // If the user has explicitly asked to install this package, it's a problem.
-        if (node.isProjectRoot && this[_explicitRequests].has(edge.name))
+        if (node.isProjectRoot && this[_explicitRequests].has(edge))
           return true
 
         // No problems!
@@ -1131,10 +1186,20 @@ This is a one-time fix-up, please be patient...
             continue
 
           // problem
-          this[_failPeerConflict](edge)
+          this[_failPeerConflict](edge, parentEdge)
         }
       }
 
+      // There is something present already, and we're not happy about it
+      // See if the thing we WOULD be happy with is also going to satisfy
+      // the other dependents on the current node.
+      const current = edge.to
+      const dep = await this[_nodeFromEdge](edge, null, null, required)
+      if (dep.canReplace(current)) {
+        await this[_nodeFromEdge](edge, node.parent, null, required)
+        continue
+      }
+
       // at this point we know that there is a dep there, and
       // we don't like it.  always fail strictly, always allow forcibly or
       // in non-strict mode if it's not our fault.  don't warn here, because
@@ -1147,17 +1212,17 @@ This is a one-time fix-up, please be patient...
         continue
 
       // ok, it's the root, or we're in unforced strict mode, so this is bad
-      this[_failPeerConflict](edge)
+      this[_failPeerConflict](edge, parentEdge)
     }
     return node
   }
 
-  [_failPeerConflict] (edge) {
-    const expl = this[_explainPeerConflict](edge)
+  [_failPeerConflict] (edge, currentEdge) {
+    const expl = this[_explainPeerConflict](edge, currentEdge)
     throw Object.assign(new Error('unable to resolve dependency tree'), expl)
   }
 
-  [_explainPeerConflict] (edge) {
+  [_explainPeerConflict] (edge, currentEdge) {
     const node = edge.from
     const curNode = node.resolve(edge.name)
     const pc = this[_peerConflict] || { peer: null, current: null }
@@ -1166,6 +1231,10 @@ This is a one-time fix-up, please be patient...
     return {
       code: 'ERESOLVE',
       current,
+      // it SHOULD be impossible to get here without a current node in place,
+      // but this at least gives us something report on when bugs creep into
+      // the tree handling logic.
+      currentEdge: currentEdge ? currentEdge.explain() : null,
       edge: edge.explain(),
       peerConflict,
       strictPeerDeps: this[_strictPeerDeps],
@@ -1190,7 +1259,7 @@ This is a one-time fix-up, please be patient...
   [_placeDep] (dep, node, edge, peerEntryEdge = null, peerPath = []) {
     if (edge.to &&
         !edge.error &&
-        !this[_explicitRequests].has(edge.name) &&
+        !this[_explicitRequests].has(edge) &&
         !this[_updateNames].includes(edge.name) &&
         !this[_isVulnerable](edge.to))
       return []
@@ -1275,6 +1344,21 @@ This is a one-time fix-up, please be patient...
         // this is an overridden peer dep
         this[_warnPeerConflict](edge)
       }
+
+      // if we get a KEEP in a update scenario, then we MAY have something
+      // already duplicating this unnecessarily!  For example:
+      // ```
+      // root
+      // +-- x (dep: y@1.x)
+      // |   +-- y@1.0.0
+      // +-- y@1.1.0
+      // ```
+      // Now say we do `reify({update:['y']})`, and the latest version is
+      // 1.1.0, which we already have in the root.  We'll try to place y@1.1.0
+      // first in x, then in the root, ending with KEEP, because we already
+      // have it.  In that case, we ought to REMOVE the nm/x/nm/y node, because
+      // it is an unnecessary duplicate.
+      this[_pruneDedupable](target, true)
       return []
     }
 
@@ -1330,8 +1414,8 @@ This is a one-time fix-up, please be patient...
     // MAY end up putting a better/identical node further up the tree in
     // a way that causes an unnecessary duplication.  If so, remove the
     // now-unnecessary node.
-    if (edge.valid && edge.to.parent !== target && newDep.canReplace(edge.to))
-      edge.to.parent = null
+    if (edge.valid && edge.to && edge.to !== newDep)
+      this[_pruneDedupable](edge.to, false)
 
     // visit any dependents who are upset by this change
     // if it's an angry overridden peer edge, however, make sure we
@@ -1347,30 +1431,8 @@ This is a one-time fix-up, please be patient...
     // prune anything deeper in the tree that can be replaced by this
     if (this.idealTree) {
       for (const node of this.idealTree.inventory.query('name', newDep.name)) {
-        if (node !== newDep &&
-            node.isDescendantOf(target) &&
-            !node.inShrinkwrap &&
-            !node.inBundle &&
-            node.canReplaceWith(newDep)) {
-          // don't prune if the dupe is necessary!
-          // root (a, d)
-          // +-- a (b, c2)
-          // |   +-- b (c2) <-- place c2 for b, lands at root
-          // +-- d (e)
-          //     +-- e (c1, d)
-          //         +-- c1
-          //         +-- f (c2)
-          //             +-- c2 <-- pruning this would be bad
-
-          const mask = node.parent !== target &&
-            node.parent &&
-            node.parent.parent &&
-            node.parent.parent !== target &&
-            node.parent.parent.resolve(newDep.name)
-
-          if (!mask || mask === newDep || node.canReplaceWith(mask))
-            node.parent = null
-        }
+        if (node.isDescendantOf(target))
+          this[_pruneDedupable](node, false)
       }
     }
 
@@ -1403,6 +1465,21 @@ This is a one-time fix-up, please be patient...
     return placed
   }
 
+  // prune all the nodes in a branch of the tree that can be safely removed
+  // This is only the most basic duplication detection; it finds if there
+  // is another satisfying node further up the tree, and if so, dedupes.
+  // Even in legacyBundling mode, we do this amount of deduplication.
+  [_pruneDedupable] (node, descend = true) {
+    if (node.canDedupe(this[_preferDedupe])) {
+      node.root = null
+      return
+    }
+    if (descend) {
+      for (const child of node.children.values())
+        this[_pruneDedupable](child)
+    }
+  }
+
   [_pruneForReplacement] (node, oldDeps) {
     // gather up all the invalid edgesOut, and any now-extraneous
     // deps that the new node doesn't depend on but the old one did.
@@ -1480,9 +1557,15 @@ This is a one-time fix-up, please be patient...
     if (target.children.has(edge.name)) {
       const current = target.children.get(edge.name)
 
-      // same thing = keep
-      if (dep.matches(current))
-        return KEEP
+      // same thing = keep, UNLESS the current doesn't satisfy and new
+      // one does satisfy.  This can happen if it's a link to a matching target
+      // at a different location, which satisfies a version dep, but not a
+      // file: dep.  If neither of them satisfy, then we can replace it,
+      // because presumably it's better for a peer or something.
+      if (dep.matches(current)) {
+        if (current.satisfies(edge) || !dep.satisfies(edge))
+          return KEEP
+      }
 
       const { version: curVer } = current
       const { version: newVer } = dep
@@ -1549,32 +1632,137 @@ This is a one-time fix-up, please be patient...
         // placed here as well.  the virtualRoot already has the appropriate
         // overrides applied.
         if (peerEntryEdge) {
-          const peerSet = getPeerSet(current)
-          OUTER: for (const p of peerSet) {
-            // if any have a non-peer dep from the target, or a peer dep if
-            // the target is root, then cannot safely replace and dupe deeper.
+          const currentPeerSet = getPeerSet(current)
+
+          // We are effectively replacing currentPeerSet with newPeerSet
+          // If there are any non-peer deps coming into the currentPeerSet,
+          // which are currently valid, and are from the target, then that
+          // means that we have to ensure that they're not going to be made
+          // invalid by putting the newPeerSet in place.
+          // If the edge comes from somewhere deeper than the target, then
+          // that's fine, because we'll create an invalid edge, detect it,
+          // and duplicate the node further into the tree.
+          // loop through the currentPeerSet checking for valid edges on
+          // the members of the peer set which will be made invalid.
+          const targetEdges = new Set()
+          for (const p of currentPeerSet) {
             for (const edge of p.edgesIn) {
-              if (peerSet.has(edge.from))
+              // edge from within the peerSet, ignore
+              if (currentPeerSet.has(edge.from))
+                continue
+              // only care about valid edges from target.
+              // edges from elsewhere can dupe if offended, invalid edges
+              // are already being fixed or will be later.
+              if (edge.from !== target || !edge.valid)
                 continue
+              targetEdges.add(edge)
+            }
+          }
 
-              // only respect valid edges, however, since we're likely trying
-              // to fix the very one that's currently broken!  If the virtual
-              // root's replacement is ok, and doesn't have any invalid edges
-              // indicating that it was an overridden peer, then ignore the
-              // conflict and continue.  If it WAS an override, then we need
-              // to get the conflict here so that we can decide whether to
-              // accept the current dep node, clobber it, or fail the install.
-              if (edge.from === target && edge.valid) {
-                const rep = dep.parent.children.get(edge.name)
-                const override = rep && ([...rep.edgesIn].some(e => !e.valid))
-                if (!rep || !rep.satisfies(edge) || override) {
+          for (const edge of targetEdges) {
+            // see if we intend to replace this one anyway
+            const rep = dep.parent.children.get(edge.name)
+            const current = edge.to
+            if (!rep) {
+              // this isn't one we're replacing.  but it WAS included in the
+              // peerSet for some reason, so make sure that it's still
+              // ok with the replacements in the new peerSet
+              for (const curEdge of current.edgesOut.values()) {
+                const newRepDep = dep.parent.children.get(curEdge.name)
+                if (curEdge.valid && newRepDep && !newRepDep.satisfies(curEdge)) {
                   canReplace = false
-                  break OUTER
+                  break
                 }
               }
+              continue
+            }
+
+            // was this replacement already an override of some sort?
+            const override = [...rep.edgesIn].some(e => !e.valid)
+            // if we have a rep, and it's ok to put in this location, and
+            // it's not already part of an override in the peerSet, then
+            // we can continue with it.
+            if (rep.satisfies(edge) && !override)
+              continue
+            // Otherwise, we cannot replace.
+            canReplace = false
+            break
+          }
+          // if we're going to be replacing the peerSet, we have to remove
+          // and re-resolve any members of the old peerSet that are not
+          // present in the new one, and which will have invalid edges.
+          // We know that they're not depended upon by the target, or else
+          // they would have caused a conflict, so they'll get landed deeper
+          // in the tree, if possible.
+          if (canReplace) {
+            let needNesting = false
+            OUTER: for (const node of currentPeerSet) {
+              const rep = dep.parent.children.get(node.name)
+              // has a replacement, already addressed above
+              if (rep)
+                continue
+
+              // ok, it has been placed here to dedupe, see if it needs to go
+              // back deeper within the tree.
+              for (const edge of node.edgesOut.values()) {
+                const repDep = dep.parent.children.get(edge.name)
+                // not in new peerSet, maybe fine.
+                if (!repDep)
+                  continue
+
+                // new thing will be fine, no worries
+                if (repDep.satisfies(edge))
+                  continue
+
+                // uhoh, we'll have to nest them.
+                needNesting = true
+                break OUTER
+              }
+            }
+
+            // to nest, just delete everything without a target dep
+            // that's in the current peerSet, and add their dependants
+            // to the _depsQueue for evaluation.  Some of these MAY end
+            // up in the same location again, and that's fine.
+            if (needNesting) {
+              // avoid mutating the tree while we're examining it
+              const dependants = new Set()
+              const reresolve = new Set()
+              OUTER: for (const node of currentPeerSet) {
+                const rep = dep.parent.children.get(node.name)
+                if (rep)
+                  continue
+                // create a separate set for each one, so we can skip any
+                // that might somehow have an incoming target edge
+                const deps = new Set()
+                for (const edge of node.edgesIn) {
+                  // a target dep, skip this dep entirely, already addressed
+                  // ignoring for coverage, because it really ought to be
+                  // impossible, but I can't prove it yet, so this is here
+                  // for safety.
+                  /* istanbul ignore if - should be impossible */
+                  if (edge.from === target)
+                    continue OUTER
+                  // ignore this edge, it'll either be replaced or re-resolved
+                  if (currentPeerSet.has(edge.from))
+                    continue
+                  // ok, we care about this one.
+                  deps.add(edge.from)
+                }
+                reresolve.add(node)
+                for (const d of deps)
+                  dependants.add(d)
+              }
+              for (const dependant of dependants) {
+                this[_depsQueue].push(dependant)
+                this[_depsSeen].delete(dependant)
+              }
+              for (const node of reresolve)
+                node.root = null
             }
           }
         }
+
         if (canReplace) {
           const ret = this[_canPlacePeers](dep, target, edge, REPLACE, peerEntryEdge, peerPath, isSource)
           /* istanbul ignore else - extremely rare that the peer set would

package/lib/arborist/index.js

@@ -29,6 +29,7 @@
 const {resolve} = require('path')
 const {homedir} = require('os')
 const procLog = require('../proc-log.js')
+const { saveTypeMap } = require('../add-rm-pkg-deps.js')
 
 const mixins = [
   require('../tracker.js'),
@@ -54,9 +55,11 @@ class Arborist extends Base {
       ...options,
       path: options.path || '.',
       cache: options.cache || `${homedir()}/.npm/_cacache`,
-      packumentCache: new Map(),
+      packumentCache: options.packumentCache || new Map(),
       log: options.log || procLog,
     }
+    if (options.saveType && !saveTypeMap.get(options.saveType))
+      throw new Error(`Invalid saveType ${options.saveType}`)
     this.cache = resolve(this.options.cache)
     this.path = resolve(this.options.path)
     process.emit('timeEnd', 'arborist:ctor')

package/lib/arborist/load-actual.js

@@ -32,6 +32,7 @@ const _loadActual = Symbol('loadActual')
 const _loadActualVirtually = Symbol('loadActualVirtually')
 const _loadActualActually = Symbol('loadActualActually')
 const _loadWorkspaces = Symbol.for('loadWorkspaces')
+const _loadWorkspaceTargets = Symbol('loadWorkspaceTargets')
 const _actualTreePromise = Symbol('actualTreePromise')
 const _actualTree = Symbol('actualTree')
 const _transplant = Symbol('transplant')
@@ -150,18 +151,22 @@ module.exports = cls => class ActualLoader extends cls {
     await new this.constructor({...this.options}).loadVirtual({
       root: this[_actualTree],
     })
+    await this[_loadWorkspaces](this[_actualTree])
+    if (this[_actualTree].workspaces && this[_actualTree].workspaces.size)
+      calcDepFlags(this[_actualTree], !root)
     this[_transplant](root)
     return this[_actualTree]
   }
 
   async [_loadActualActually] ({ root, ignoreMissing, global }) {
     await this[_loadFSTree](this[_actualTree])
+    await this[_loadWorkspaces](this[_actualTree])
+    await this[_loadWorkspaceTargets](this[_actualTree])
     if (!ignoreMissing)
       await this[_findMissingEdges]()
     this[_findFSParents]()
     this[_transplant](root)
 
-    await this[_loadWorkspaces](this[_actualTree])
     if (global) {
       // need to depend on the children, or else all of them
       // will end up being flagged as extraneous, since the
@@ -178,16 +183,37 @@ module.exports = cls => class ActualLoader extends cls {
     return this[_actualTree]
   }
 
+  // if there are workspace targets without Link nodes created, load
+  // the targets, so that we know what they are.
+  async [_loadWorkspaceTargets] (tree) {
+    if (!tree.workspaces || !tree.workspaces.size)
+      return
+
+    const promises = []
+    for (const path of tree.workspaces.values()) {
+      if (!this[_cache].has(path)) {
+        const p = this[_loadFSNode]({ path, root: this[_actualTree] })
+          .then(node => this[_loadFSTree](node))
+        promises.push(p)
+      }
+    }
+    await Promise.all(promises)
+  }
+
   [_transplant] (root) {
     if (!root || root === this[_actualTree])
       return
+
     this[_actualTree][_changePath](root.path)
     for (const node of this[_actualTree].children.values()) {
       if (!this[_transplantFilter](node))
-        node.parent = null
+        node.root = null
     }
 
     root.replace(this[_actualTree])
+    for (const node of this[_actualTree].fsChildren)
+      node.root = this[_transplantFilter](node) ? root : null
+
     this[_actualTree] = root
   }
 

package/lib/arborist/load-virtual.js

@@ -93,7 +93,8 @@ module.exports = cls => class VirtualLoader extends cls {
     this.virtualTree = root
     const {links, nodes} = this[resolveNodes](s, root)
     await this[resolveLinks](links, nodes)
-    this[assignBundles](nodes)
+    if (!(s.originalLockfileVersion >= 2))
+      this[assignBundles](nodes)
     if (this[flagsSuspect])
       this[reCalcDepFlags](nodes.values())
     return root
@@ -220,22 +221,24 @@ module.exports = cls => class VirtualLoader extends cls {
   [assignBundles] (nodes) {
     for (const [location, node] of nodes) {
       // Skip assignment of parentage for the root package
-      if (!location)
+      if (!location || node.target && !node.target.location)
         continue
       const { name, parent, package: { inBundle }} = node
+
       if (!parent)
         continue
 
       // read inBundle from package because 'package' here is
       // actually a v2 lockfile metadata entry.
-      // If the *parent* is also bundled, though, then we assume
-      // that it's being pulled in just by virtue of that.
+      // If the *parent* is also bundled, though, or if the parent has
+      // no dependency on it, then we assume that it's being pulled in
+      // just by virtue of its parent or a transitive dep being bundled.
       const { package: ppkg } = parent
       const { inBundle: parentBundled } = ppkg
-      if (inBundle && !parentBundled) {
+      if (inBundle && !parentBundled && parent.edgesOut.has(node.name)) {
         if (!ppkg.bundleDependencies)
           ppkg.bundleDependencies = [name]
-        else if (!ppkg.bundleDependencies.includes(name))
+        else
           ppkg.bundleDependencies.push(name)
       }
     }