Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(arborist): check placed node children for missing deps (#7746) #7752

Open
wants to merge 1 commit into
base: latest
Choose a base branch
from

Conversation

TrevorBurnham
Copy link
Contributor

This addresses an edge case where a dep could be placed in the tree with unsatisfied indirect dependencies (see test case), by adding the children of placed deps to the #depsQueue.

See #7746 for details on this bug. As far as I know, this situation only occurs if the lockfile has been manipulated outside of npm; even so, I believe it's worth addressing within npm in order to ensure that the state of the lockfile is consistent (i.e. running npm install more than once does not change the result).

This is my first time working with the npm codebase. I'd welcome any suggestions!

References

Fixes #7746

@TrevorBurnham TrevorBurnham requested a review from a team as a code owner August 25, 2024 22:14
This addresses an edge case where a dep could be placed in the tree
with unsatisfied indirect dependencies (see test case).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[BUG] npm install sometimes removes indirect dependencies if a parent node was deleted from the lockfile
2 participants