chore: assert bundled production deps resolve in the packed npm#9749
Open
reggi wants to merge 1 commit into
Open
chore: assert bundled production deps resolve in the packed npm#9749reggi wants to merge 1 commit into
reggi wants to merge 1 commit into
Conversation
Adds a smoke test that packs npm, installs it globally into an isolated testdir, then walks the installed bundle and require.resolve()s every non-optional production dependency from its owning package. This catches deps that get dropped from the hoisted bundle at pack time (e.g. a dev-only version shadowing the real production copy), which unit tests miss because they run against the source tree where a nested copy still resolves. See #9722/#9740 where sigstore went missing from the packed bundle and shipped a broken `npm publish --provenance`. Runs against the packed/installed bundle (not the dev tree) to avoid dev-only @types/peer noise, and skips optionalDependencies. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 716952b1-3f66-4a3e-a48b-ca9cff285466
reggi
changed the title
martinrrm
approved these changes
Jul 10, 2026
saquibkhan
approved these changes
Jul 10, 2026
nishantms
approved these changes
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a smoke test (
smoke-tests/test/bundled-deps-resolve.js) that packs npm, installs it globally into an isolated testdir, then walks the installed bundle andrequire.resolve()s every non-optional production dependency from its owning package. If any hoisted dependency can't resolve, the test fails and names the culprit (<pkg> -> <dep>).Why
In #9722/#9740,
sigstorewent missing from the packed npm bundle: a stale@npmcli/arborist@^9.1.2pin inmock-registrycouldn't be satisfied by the local v10 workspace, so arborist was pulled from the registry, dragging in a dev-onlysigstore@4that hoisted to the rootnode_modulesand marked itdev. At pack time the dev-only copy was stripped and libnpmpublish's realsigstore@5was nested (not root-bundled), so the published npm shipped with nonode_modules/sigstoreandnpm publish --provenancefailed withCannot find module 'sigstore'.Unit tests didn't catch it because they run against the source tree (where a nested copy still resolves) and mock
sigstoreanyway. Only the packed shape exposes the bug.Approach
@types/*/peer deps.optionalDependencies(legitimately absent sometimes).setup.js/npmLocalTarball()infra; the--globalinstall is fully isolated via testdir-scoped--prefix/--cache/config and redirectedHOME(same pattern asnpm-replace-global.js).Verification
node_modules/sigstoreis removed from the packed bundle (reportslibnpmpublish -> sigstore,pacote -> sigstore).Generic: catches any dropped hoisted production dep, not just sigstore.