@npmcli/arborist 9.4.1 → 9.4.3

package/lib/arborist/build-ideal-tree.js

@@ -950,7 +950,7 @@ This is a one-time fix-up, please be patient...
         tree: pd,
         getChildren: pd => pd.children,
         visit: pd => {
-          const { placed, edge, canPlace: cpd } = pd
+          const { placed, edge, canPlace: cpd, parent } = pd
           // if we didn't place anything, nothing to do here
           if (!placed) {
             return
@@ -1011,8 +1011,7 @@ This is a one-time fix-up, please be patient...
             return
           }
 
-          // lastly, also check for the missing deps of the node we placed,
-          // and any holes created by pruning out conflicted peer sets.
+          // lastly, also check for the missing deps of the node we placed, and any holes created by pruning out conflicted peer sets.
           this.#depsQueue.push(placed)
           for (const dep of pd.needEvaluation) {
             this.#depsSeen.delete(dep)
@@ -1020,16 +1019,14 @@ This is a one-time fix-up, please be patient...
           }
 
           // pre-fetch any problem edges, since we'll need these soon
-          // if it fails at this point, though, don't worry because it
-          // may well be an optional dep that has gone missing.  it'll
-          // fail later anyway.
+          // if it fails at this point, though, don't worry because it may well be an optional dep that has gone missing
+          // it'll fail later anyway
           for (const e of this.#problemEdges(placed)) {
-            // XXX This is somehow load bearing.  This makes tests that print
-            // the ideal tree of a tree with tarball dependencies fail. This
-            // can't be changed or removed till we figure out why
+            // XXX This is somehow load bearing.  This makes tests that print the ideal tree of a tree with tarball dependencies fail
+            // This can't be changed or removed till we figure out why
             // The test is named "tarball deps with transitive tarball deps"
             promises.push(() =>
-              this.#fetchManifest(npa.resolve(e.name, e.spec, fromPath(placed, e)))
+              this.#fetchManifest(npa.resolve(e.name, e.spec, fromPath(placed, e)), parent)
                 .catch(() => null)
             )
           }
@@ -1047,26 +1044,18 @@ This is a one-time fix-up, please be patient...
     return this.#buildDepStep()
   }
 
-  // loads a node from an edge, and then loads its peer deps (and their
-  // peer deps, on down the line) into a virtual root parent.
+  // loads a node from an edge, and then loads its peer deps (and their peer deps, on down the line) into a virtual root parent.
   async #nodeFromEdge (edge, parent_, secondEdge, required) {
-    // create a virtual root node with the same deps as the node that
-    // is requesting this one, so that we can get all the peer deps in
-    // a context where they're likely to be resolvable.
-    // Note that the virtual root will also have virtual copies of the
-    // targets of any child Links, so that they resolve appropriately.
+    // create a virtual root node with the same deps as the node that is requesting this one, so that we can get all the peer deps in a context where they're likely to be resolvable.
+    // Note that the virtual root will also have virtual copies of the targets of any child Links, so that they resolve appropriately.
     const parent = parent_ || this.#virtualRoot(edge.from)
 
     const spec = npa.resolve(edge.name, edge.spec, edge.from.path)
     const first = await this.#nodeFromSpec(edge.name, spec, parent, edge)
 
-    // we might have a case where the parent has a peer dependency on
-    // `foo@*` which resolves to v2, but another dep in the set has a
-    // peerDependency on `foo@1`.  In that case, if we force it to be v2,
-    // we're unnecessarily triggering an ERESOLVE.
-    // If we have a second edge to worry about, and it's not satisfied
-    // by the first node, try a second and see if that satisfies the
-    // original edge here.
+    // we might have a case where the parent has a peer dependency on `foo@*` which resolves to v2, but another dep in the set has a peerDependency on `foo@1`.
+    // In that case, if we force it to be v2, we're unnecessarily triggering an ERESOLVE.
+    // If we have a second edge to worry about, and it's not satisfied by the first node, try a second and see if that satisfies the original edge here.
     const spec2 = secondEdge && npa.resolve(
       edge.name,
       secondEdge.spec,
@@ -1210,11 +1199,12 @@ This is a one-time fix-up, please be patient...
     return problems
   }
 
-  async #fetchManifest (spec) {
+  async #fetchManifest (spec, parent) {
     const options = {
       ...this.options,
       avoid: this.#avoidRange(spec.name),
       fullMetadata: true,
+      _isRoot: parent?.isProjectRoot || parent?.isWorkspace,
     }
     // get the intended spec and stored metadata from yarn.lock file,
     // if available and valid.
@@ -1231,10 +1221,8 @@ This is a one-time fix-up, please be patient...
   }
 
   async #nodeFromSpec (name, spec, parent, edge) {
-    // pacote will slap integrity on its options, so we have to clone
-    // the object so it doesn't get mutated.
-    // Don't bother to load the manifest for link deps, because the target
-    // might be within another package that doesn't exist yet.
+    // pacote will slap integrity on its options, so we have to clone the object so it doesn't get mutated.
+    // Don't bother to load the manifest for link deps, because the target might be within another package that doesn't exist yet.
     const { installLinks, legacyPeerDeps } = this
     const isWorkspace = this.idealTree.workspaces && this.idealTree.workspaces.has(spec.name)
 
@@ -1287,7 +1275,7 @@ This is a one-time fix-up, please be patient...
 
     // spec isn't a directory, and either isn't a workspace or the workspace we have
     // doesn't satisfy the edge. try to fetch a manifest and build a node from that.
-    return this.#fetchManifest(spec)
+    return this.#fetchManifest(spec, parent)
       .then(pkg => new Node({ name, pkg, parent, installLinks, legacyPeerDeps }), error => {
         error.requiredBy = edge.from.location || '.'
 

package/lib/arborist/isolated-reifier.js

@@ -113,7 +113,11 @@ module.exports = cls => class IsolatedReifier extends cls {
       })
       // local `file:` deps are in fsChildren but are not workspaces.
       // they are already handled as workspace-like proxies above and should not go through the external/store extraction path.
-      if (!next.isProjectRoot && !next.isWorkspace && !next.inert && !idealTree.fsChildren.has(next) && !idealTree.fsChildren.has(next.target)) {
+      // Links with file: resolved paths (from `npm link`) should also be treated as local dependencies and symlinked directly instead of being extracted into the store.
+      const isLocalFileDep = next.isLink && next.resolved?.startsWith('file:')
+      if (isLocalFileDep && !idealTree.fsChildren.has(next) && !idealTree.fsChildren.has(next.target)) {
+        this.idealGraph.workspaces.push(await this.#workspaceProxy(next.target))
+      } else if (!next.isProjectRoot && !next.isWorkspace && !next.inert && !idealTree.fsChildren.has(next) && !idealTree.fsChildren.has(next.target)) {
         this.idealGraph.external.push(await this.#externalProxy(next))
       }
     }
@@ -157,6 +161,7 @@ module.exports = cls => class IsolatedReifier extends cls {
         ...this.options,
         resolved: node.resolved,
         integrity: node.integrity,
+        // TODO _isRoot
       })
       const Arborist = this.constructor
       const arb = new Arborist({ ...this.options, path: dir })

package/lib/arborist/reify.js

@@ -117,9 +117,11 @@ module.exports = cls => class Reifier extends cls {
       // of Node/Link trees
       log.warn('reify', 'The "linked" install strategy is EXPERIMENTAL and may contain bugs.')
       this.idealTree = await this.createIsolatedTree()
-      this.#linkedActualForDiff = this.#buildLinkedActualForDiff(
-        this.idealTree, this.actualTree
-      )
+      if (this.actualTree) {
+        this.#linkedActualForDiff = this.#buildLinkedActualForDiff(
+          this.idealTree, this.actualTree
+        )
+      }
     }
     await this[_diffTrees]()
     await this.#reifyPackages()
@@ -735,6 +737,7 @@ module.exports = cls => class Reifier extends cls {
         ...this.options,
         resolved: node.resolved,
         integrity: node.integrity,
+        _isRoot: node.parent?.isProjectRoot || node.parent?.isWorkspace,
       })
       // store nodes don't use Node class so node.package doesn't get updated
       if (node.isInStore) {
@@ -815,6 +818,10 @@ module.exports = cls => class Reifier extends cls {
       if (combined.has(child.path) || !existsSync(child.path)) {
         continue
       }
+      // Skip store links whose ideal realpath doesn't exist on disk yet — the store hash changed and the symlink needs recreating via ADD.
+      if (child.isLink && child.resolved?.startsWith('file:.store/') && !existsSync(child.realpath)) {
+        continue
+      }
       let entry
       if (child.isLink) {
         entry = new IsolatedLink(child)

package/lib/optional-set.js

@@ -26,7 +26,7 @@ const optionalSet = node => {
 
   // now that we've hit the boundary, gather the rest of the nodes in
   // the optional section that don't have dependents outside the set.
-  return gatherDepSet(set, edge => !set.has(edge.to))
+  return gatherDepSet(set, edge => !set.has(edge.to) && !edge.from?.inert)
 }
 
 module.exports = optionalSet

package/lib/override-set.js

@@ -195,8 +195,29 @@ class OverrideSet {
       }
     }
 
-    // The override sets are incomparable. Neither one contains the other.
-    log.silly('Conflicting override sets', first, second)
+    // The override sets are incomparable (e.g. siblings like the "react" and "react-dom" children of the root override set). Check if they have semantically conflicting rules before treating this as an error.
+    if (this.haveConflictingRules(first, second)) {
+      log.silly('Conflicting override sets', first, second)
+      return undefined
+    }
+
+    // The override sets are structurally incomparable but have compatible rules. Fall back to their nearest common ancestor so the node still has a valid override set.
+    return this.findCommonAncestor(first, second)
+  }
+
+  static findCommonAncestor (first, second) {
+    const firstAncestors = []
+    for (const ancestor of first.ancestry()) {
+      firstAncestors.push(ancestor)
+    }
+    for (const secondAnc of second.ancestry()) {
+      for (const firstAnc of firstAncestors) {
+        if (firstAnc.isEqual(secondAnc)) {
+          return firstAnc
+        }
+      }
+    }
+    return null
   }
 
   static doOverrideSetsConflict (first, second) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "9.4.1",
+  "version": "9.4.3",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",