[BUG] `npm install` infinite loop with bundledDependency and overrides

[everett1992]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Create a package that depends on chevrotain ^11 (not the latest v12), bundles dependencies, and overrrides lodash-es.

{
  "name": "test",
  "dependencies": {
    "chevrotain": "^11.2.0"
  },
  "bundledDependencies": true,
  "overrides": {
    "lodash-es": "^4.18"
  }
}

npm install runs indefinitely, printing the same log lines repeatedly.:

$ npm install --loglevel silly
npm silly placeDep ROOT lodash-es@4.18.1 REPLACE for: @chevrotain/cst-dts-gen@11.2.0 want: 4.18
npm silly placeDep ROOT lodash-es@4.18.1 REPLACE for: @chevrotain/gast@11.2.0 want: 4.18
npm silly placeDep ROOT lodash-es@4.18.1 REPLACE for: @chevrotain/cst-dts-gen@11.2.0 want: 4.18
npm silly placeDep ROOT lodash-es@4.18.1 REPLACE for: @chevrotain/gast@11.2.0 want: 4.18
npm silly placeDep ROOT lodash-es@4.18.1 REPLACE for: @chevrotain/cst-dts-gen@11.2.0 want: 4.18

Expected Behavior

I expect npm to override chevrotain's lodash-es depednency, and produce a tarball that bundles the overridden version. The bundled version should satisfy dependency when installed, or this should create an explicit error if overriding bundled dependencies are not allowed (I know that overrides are normally not applied when the package is installed as a dependency, so it seems reasonable that you cannot override bundled dependencies)

Steps To Reproduce

1. npm 11.12.1, node 24.14.1, Ubuntu
2. package.json depending on chevrotain, bundledDependencies, and an lodash-es override.
3. Run 'npm install`
4. See infinte loop

Environment

• npm: 11.12.1
• Node.js: 24.14.1
• OS Name: Ubuntu
• System Model Name: Lenovo
• npm config:

; node bin location = ~/.local/share/mise/installs/node/24.14.1/bin/node
; node version = v24.14.1
; npm local prefix =~/github/test
; npm version = 11.12.1
; cwd = ~/github/test
; HOME = ~
; Run `npm config ls -l` to show all defaults.

[everett1992]

It requires bundledDependencies values of true, ["chevrotain"] or ["lodash-es"], ["@chevrotain/cst-dts-gen"] will reproduce.

I tried reproducing with other dependencies, such as nx -> tar-stream@~2.2.0 override tar-stream to 3, but that didn't cause the same loop.

[everett1992]

Here's a stand alone reproduction:

  graph TD                                                                                                 
      Root --> |"bundled"| C["b@1.0.0"]                                                           
      Root --> |"bundled"| C2["c@1.0.0"]                                                         
      C --> L["lodash-es@4.0.0"]                                                                       
      C2 --> L                
      Root -->|"override"| L2["lodash-es@4.18.1"]          

Loading

The issue only reproduces when there are multiple paths to the override bundled dependency. Removing b or c, or updating b or c to require lodash-es ^4.18 does not trigger the loop.

  `package.json`                                                                                          
                                                                                                          
  {                                                                                                       
    "name": "repro-9227",                                                                                 
    "version": "1.0.0",                                                                                   
    "dependencies": {                                                                                     
      "b": "file:./b/b-1.0.0.tgz",                                                                        
      "c": "file:./c/c-1.0.0.tgz"                                                                         
    },                                                                                                    
    "bundledDependencies": true,                                                                          
    "overrides": {                                                                                        
      "lodash-es": "^4.18"                                                                                
    }                                                                                                     
  }                                                                                                       
                                                                                                          
  `b/package.json`                                                                                        
                                                                                                          
  {                                                                                                       
    "name": "b",                                                                                          
    "version": "1.0.0",                                                                                   
    "dependencies": {                                                                                     
      "lodash-es": "4.0.0"                                                                                
    }                                                                                                     
  }                                                                                                       
                                                                                                          
  `c/package.json`                                                                                        
                                                                                                          
  {                                                                                                       
    "name": "c",                                                                                          
    "version": "1.0.0",                                                                                   
    "dependencies": {                                                                                     
      "lodash-es": "4.0.0"                                                                                
    }                                                                                                     
  }                                                                                                       
    

[everett1992]

https://github.com/npm/cli/blob/latest/workspaces/arborist/lib/edge.js#L111-L115
https://github.com/npm/cli/blob/latest/workspaces/arborist/lib/can-place-dep.js#L165-L169

    // NOTE: this condition means we explicitly do not support overriding
    // bundled or shrinkwrapped dependencies
    if (node.hasShrinkwrap || node.inShrinkwrap || node.inBundle) {
      return depValid(node, this.rawSpec, this.#accept, this.#from)
    }

This is interesting. I haven't noticed this in public docs, and overrides appear to be applied to bundled dependencies in my reproduction cases (when the infinite loop isn't triggered). The edges are marked invalid tho so maybe there's a mis match between application and validation?