fix!: refuse to pack when overrides apply to bundled packages by owlstronaut · Pull Request #9271 · npm/cli

owlstronaut · 2026-04-22T19:37:42Z

Follow up to #9235.

When a package defines overrides that apply to one or more of its bundledDependencies (or bundleDependencies), the resulting bundled tree is invalid from the perspective of any consumer: consumers do not apply the publishing package's overrides when validating the bundled tree, so npm ls will always show invalid edges for the affected bundled packages.

This PR refuses to pack (and therefore publish) such packages with a clear EBUNDLEOVERRIDE error that lists the offending bundled package names. Defining both overrides and bundledDependencies is still allowed — the error only fires when an override actually targets a package inside the bundled subtree. Cases that are now correctly accepted include:

overrides that target dev dependencies (which are not bundled),
overrides that target packages outside the bundled subtree, and
packages that bundle some deps but override only unrelated ones.

The check uses Arborist's own inBundle / inDepBundle / overridden semantics on the actual on-disk tree (the same tree pacote uses to build the tarball), so it stays consistent with what npm-packlist actually publishes.

The check lives in libnpmpack, so it covers npm pack, npm publish, and any direct consumers of the library.

Closes npm/statusboard#1102.

BREAKING CHANGE: npm pack and npm publish now error when a package's overrides apply to one or more of its bundled packages (bundledDependencies / bundleDependencies). Defining both fields is still allowed as long as no override actually targets a bundled package. To resolve the error, remove the affected entries from either overrides or the bundle.

wraithgar · 2026-04-22T20:57:49Z

What if we have overridden dev dependencies?
What if we only bundle some of our dependencies and none of them are overridden?

owlstronaut · 2026-04-22T20:59:12Z

What if we have overridden dev dependencies? What if we only bundle some of our dependencies and none of them are overridden?

those are good points. I'll need to make this a little more flexible

BREAKING CHANGE: npm pack and npm publish now error when a package's overrides apply to one or more of its bundled packages (bundledDependencies / bundleDependencies). Defining both fields is still allowed as long as no override actually targets a bundled package. To resolve the error, remove the affected entries from either overrides or the bundle.

Remove the project-specific @google registry override before npm ci. With npm 12.0.2, the publishing registry differs from the npmjs.org @google/genai tarball URL in the lockfile, causing EALLOWREMOTE. Use the default registry without changing the lockfile or relaxing allow-remote. Remove root overrides after installation and bundling, before npm pack, to avoid EBUNDLEOVERRIDE for bundled wrap-ansi with npm 12. The installed versions satisfy the bundled dependency ranges; leave the lockfile and resolved dependency tree unchanged. Upstream: npm/cli#9271 Use CI=1 for the check-stage build. npm-run-all 4.1.5 forwards sandboxImageUri as a CLI config flag, which npm 12 rejects with EUNKNOWNCONFIG. Upstream's CI path builds all workspaces sequentially using native npm workspace support. Keep sandbox metadata intact and scope CI to the build command, leaving the test environment unchanged. https://github.com/google-gemini/gemini-cli/blob/v0.50.0/scripts/build.js#L36 Add gemini-cli to the sv39 blacklist because its shell-parser tests initialize web-tree-sitter and the Bash grammar through WebAssembly. Add AUDIT_ARCH_RISCV64 (0xc00000f3) and the RISC-V ptrace syscall number (117) to the Linux seccomp filter. This fixes "Unsupported architecture for seccomp filter: riscv64" without weakening the sandbox's ptrace ban. Load @lydell/node-pty only when the test rig starts an interactive run. Its eager import prevents nine unrelated test suites from collecting because no linux-riscv64 prebuilt binary exists. Keep PTY-required runs explicitly dependent on the module and leave runtime fallback unchanged. Exclude FileCommandLoader and pathReader tests until mock-fs supports Node 26.8. The new native ReadFileJob path bypasses its binding.open interception, so loading mock-fs throws while accessing prototype.read. A null guard alone would still leave reads bypassing the mocked filesystem. tschaub/mock-fs#447 Allow 30 seconds instead of 5 for the 100-character insertion benchmark on a 5,000-line buffer. The latest riscv64 check takes 10.287 seconds (11.423 seconds in the preceding run) and fails only this assertion. Keep the workload and the other benchmark limits unchanged.

owlstronaut requested a review from a team as a code owner April 22, 2026 19:37

owlstronaut force-pushed the fix-bundled-overrides-publish branch from 8cf2689 to 700f297 Compare April 23, 2026 15:21

owlstronaut changed the title ~~fix!: refuse to pack with bundled dependencies AND overrides~~ fix!: refuse to pack when overrides apply to bundled packages Apr 23, 2026

owlstronaut force-pushed the fix-bundled-overrides-publish branch from 700f297 to f6981d5 Compare April 23, 2026 15:31