Repository navigation
[BUG] npm install infinite loop with bundledDependency and overrides #9227
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
Create a package that depends on chevrotain ^11 (not the latest v12), bundles dependencies, and overrrides lodash-es.
{
"name": "test",
"dependencies": {
"chevrotain": "^11.2.0"
},
"bundledDependencies": true,
"overrides": {
"lodash-es": "^4.18"
}
}npm install runs indefinitely, printing the same log lines repeatedly.:
$ npm install --loglevel silly
npm silly placeDep ROOT lodash-es@4.18.1 REPLACE for: @chevrotain/cst-dts-gen@11.2.0 want: 4.18
npm silly placeDep ROOT lodash-es@4.18.1 REPLACE for: @chevrotain/gast@11.2.0 want: 4.18
npm silly placeDep ROOT lodash-es@4.18.1 REPLACE for: @chevrotain/cst-dts-gen@11.2.0 want: 4.18
npm silly placeDep ROOT lodash-es@4.18.1 REPLACE for: @chevrotain/gast@11.2.0 want: 4.18
npm silly placeDep ROOT lodash-es@4.18.1 REPLACE for: @chevrotain/cst-dts-gen@11.2.0 want: 4.18
Expected Behavior
I expect npm to override chevrotain's lodash-es depednency, and produce a tarball that bundles the overridden version. The bundled version should satisfy dependency when installed, or this should create an explicit error if overriding bundled dependencies are not allowed (I know that overrides are normally not applied when the package is installed as a dependency, so it seems reasonable that you cannot override bundled dependencies)
Steps To Reproduce
- npm 11.12.1, node 24.14.1, Ubuntu
- package.json depending on chevrotain, bundledDependencies, and an lodash-es override.
- Run 'npm install`
- See infinte loop
Environment
- npm: 11.12.1
- Node.js: 24.14.1
- OS Name: Ubuntu
- System Model Name: Lenovo
- npm config:
; node bin location = ~/.local/share/mise/installs/node/24.14.1/bin/node
; node version = v24.14.1
; npm local prefix =~/github/test
; npm version = 11.12.1
; cwd = ~/github/test
; HOME = ~
; Run `npm config ls -l` to show all defaults.
Activity
everett1992 commentedon Apr 13, 2026
It requires bundledDependencies values of
true,["chevrotain"]or["lodash-es"],["@chevrotain/cst-dts-gen"]will reproduce.I tried reproducing with other dependencies, such as nx -> tar-stream@~2.2.0 override tar-stream to 3, but that didn't cause the same loop.
everett1992 commentedon Apr 13, 2026
Here's a stand alone reproduction:
graph TD Root --> |"bundled"| C["b@1.0.0"] Root --> |"bundled"| C2["c@1.0.0"] C --> L["lodash-es@4.0.0"] C2 --> L Root -->|"override"| L2["lodash-es@4.18.1"]The issue only reproduces when there are multiple paths to the override bundled dependency. Removing b or c, or updating b or c to require lodash-es ^4.18 does not trigger the loop.
everett1992 commentedon Apr 13, 2026
https://github.com/npm/cli/blob/latest/workspaces/arborist/lib/edge.js#L111-L115
https://github.com/npm/cli/blob/latest/workspaces/arborist/lib/can-place-dep.js#L165-L169
This is interesting. I haven't noticed this in public docs, and overrides appear to be applied to bundled dependencies in my reproduction cases (when the infinite loop isn't triggered). The edges are marked
invalidtho so maybe there's a mis match between application and validation?fix(arborist): fix infinite loop with bundledDependencies and overrides
fix(arborist): fix infinite loop with bundledDependencies and overrides
fix(arborist): fix infinite loop with bundledDependencies and overrides
fix(arborist): fix infinite loop with bundledDependencies and overrid…
fix(arborist): fix infinite loop with bundledDependencies and overrid…