@npmcli/arborist 5.0.2 → 5.0.3

package/lib/arborist/load-actual.js

@@ -435,7 +435,7 @@ module.exports = cls => class ActualLoader extends cls {
           if (d.dummy) {
             // it's a placeholder, so likely would not have loaded this dep,
             // unless another dep in the tree also needs it.
-            const depPath = `${p}/node_modules/${name}`
+            const depPath = normalize(`${p}/node_modules/${name}`)
             const cached = this[_cache].get(depPath)
             if (!cached || cached.dummy) {
               depPromises.push(this[_loadFSNode]({

package/lib/arborist/reify.js

@@ -1225,14 +1225,23 @@ module.exports = cls => class Reifier extends cls {
             newSpec = h.shortcut(opt)
           }
         } else if (isLocalDep) {
-          // save the relative path in package.json
-          // Normally saveSpec is updated with the proper relative
-          // path already, but it's possible to specify a full absolute
-          // path initially, in which case we can end up with the wrong
-          // thing, so just get the ultimate fetchSpec and relativize it.
-          const p = req.fetchSpec.replace(/^file:/, '')
-          const rel = relpath(addTree.realpath, p)
-          newSpec = `file:${rel}`
+          // when finding workspace nodes, make sure that
+          // we save them using their version instead of
+          // using their relative path
+          if (edge.type === 'workspace') {
+            const { version } = edge.to.target
+            const prefixRange = version ? this[_savePrefix] + version : '*'
+            newSpec = prefixRange
+          } else {
+            // save the relative path in package.json
+            // Normally saveSpec is updated with the proper relative
+            // path already, but it's possible to specify a full absolute
+            // path initially, in which case we can end up with the wrong
+            // thing, so just get the ultimate fetchSpec and relativize it.
+            const p = req.fetchSpec.replace(/^file:/, '')
+            const rel = relpath(addTree.realpath, p)
+            newSpec = `file:${rel}`
+          }
         } else {
           newSpec = req.saveSpec
         }

package/package.json

@@ -1,19 +1,19 @@
 {
   "name": "@npmcli/arborist",
-  "version": "5.0.2",
+  "version": "5.0.3",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
     "@npmcli/installed-package-contents": "^1.0.7",
     "@npmcli/map-workspaces": "^2.0.0",
-    "@npmcli/metavuln-calculator": "^3.0.0",
+    "@npmcli/metavuln-calculator": "^3.0.1",
     "@npmcli/move-file": "^1.1.0",
     "@npmcli/name-from-folder": "^1.0.1",
     "@npmcli/node-gyp": "^1.0.3",
     "@npmcli/package-json": "^1.0.1",
     "@npmcli/run-script": "^3.0.0",
     "bin-links": "^3.0.0",
-    "cacache": "^15.0.3",
+    "cacache": "^16.0.0",
     "common-ancestor-path": "^1.0.1",
     "json-parse-even-better-errors": "^2.3.1",
     "json-stringify-nice": "^1.1.4",
@@ -25,7 +25,7 @@
     "npm-pick-manifest": "^7.0.0",
     "npm-registry-fetch": "^13.0.0",
     "npmlog": "^6.0.1",
-    "pacote": "^13.0.2",
+    "pacote": "^13.0.5",
     "parse-conflict-json": "^2.0.1",
     "proc-log": "^2.0.0",
     "promise-all-reject-late": "^1.0.0",